Skip to content
This repository was archived by the owner on Sep 2, 2026. It is now read-only.

build(deps): bump the minor-updates group across 1 directory with 33 updates - #127

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-updates-e69543a91c
Open

build(deps): bump the minor-updates group across 1 directory with 33 updates#127
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-updates-e69543a91c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-updates group with 33 updates in the / directory:

Package From To
boto3 1.42.85 1.43.34
mcp 1.27.0 1.28.0
strands-agents 1.35.0 1.44.0
compliance-trestle 4.0.1 4.0.3
regex 2026.4.4 2026.5.9
anyio 4.13.0 4.14.0
botocore 1.42.85 1.43.34
certifi 2026.2.25 2026.6.17
click 8.3.2 8.4.1
cryptography 46.0.5 46.0.7
docstring-parser 0.17.0 0.18.0
idna 3.11 3.18
importlib-metadata 8.7.1 8.9.0
opentelemetry-api 1.40.0 1.42.1
opentelemetry-instrumentation 0.61b0 0.63b1
opentelemetry-instrumentation-threading 0.61b0 0.63b1
opentelemetry-sdk 1.40.0 1.42.1
opentelemetry-semantic-conventions 0.61b0 0.63b1
orjson 3.11.8 3.11.9
packaging 26.0 26.2
pydantic 2.12.5 2.13.4
pydantic-core 2.41.5 2.47.0
pydantic-settings 2.13.1 2.14.2
pyjwt 2.12.1 2.13.0
python-frontmatter 1.1.0 1.3.0
python-multipart 0.0.24 0.0.32
requests 2.33.1 2.34.2
s3transfer 0.16.0 0.19.0
sse-starlette 3.3.4 3.4.4
starlette 1.0.0 1.3.1
urllib3 2.6.3 2.7.0
uvicorn 0.44.0 0.49.0
zipp 3.23.0 3.23.1

Updates boto3 from 1.42.85 to 1.43.34

Commits

Updates mcp from 1.27.0 to 1.28.0

Release notes

Sourced from mcp's releases.

v1.28.0

Deprecations

Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is called - importing the modules stays silent.

  • WebSocket transport - mcp.client.websocket.websocket_client and mcp.server.websocket.websocket_servermodelcontextprotocol/typescript-sdk#1783
  • Experimental tasks API - ClientSession.experimental, Server.experimental, ServerSession.experimental, and the experimental_task_handlers= kwarg on ClientSession. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.

If your test suite runs with filterwarnings = ["error"] and exercises these paths, add a scoped ignore such as ignore:The experimental tasks API is deprecated:DeprecationWarning or ignore:The WebSocket .* transport is deprecated:DeprecationWarning.

See #2828 for full details.

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/python-sdk@v1.27.2...v1.28.0

v1.27.2

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

v1.27.1

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

Commits
  • 32d3290 [v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...
  • 0dca751 [v1.x] Deflake the child process cleanup tests (#2839)
  • 52258a9 [v1.x] Add a v2 status banner to the README (#2835)
  • b8f4917 [v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...
  • 2309e5e fix: omit null optional fields from task result payloads (#2809)
  • 494eb11 [v1.x] Support Python 3.14 (#2769)
  • 6213787 [v1.x] Scope experimental tasks to the session that created them (#2720)
  • ce267b6 [v1.x] Bind transport sessions to the authenticated principal (#2719)
  • 1abcca2 [v1.x] Add subject and claims to AccessToken (#2690)
  • 9773a3f [v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact (...
  • Additional commits viewable in compare view

Updates strands-agents from 1.35.0 to 1.44.0

Release notes

Sourced from strands-agents's releases.

python/v1.44.0

What's Changed (Python SDK)

✨ Features

🐛 Fixes

♻️ Refactors

  • refactor(memory): represent passed-in config types as TypedDicts by @​pgrayy in #2824
  • refactor(memory): represent ExtractionConfig as a TypedDict by @​pgrayy in #2827
  • refactor(memory): drop redundant | None from optional config fields by @​pgrayy in #2832

🧪 Tests & Chores

  • test: suppress verbose logging in tests with large text payloads by @​zastrowm in #2773
  • test(memory): assert S3 sidecar metadata and scope round-trip (shared with TS) by @​pgrayy in #2840
  • chore: apply ruff format to fix pre-existing drift in strands-py by @​pgrayy in #2799

Full Changelog: strands-agents/harness-sdk@python/v1.43.0...python/v1.44.0

python/v1.43.0

What's Changed

... (truncated)

Commits
  • 7170a70 test(memory): assert S3 sidecar metadata and scope round-trip (#2840)
  • 12c2200 chore: bump hono to 4.12.25 to fix high-severity audit failure (#2843)
  • a5f6522 ci: remove lockfile drift check to unblock Dependabot and audit fixes (#2841)
  • 1b8cd9f feat(python): vended tools/plugins for sandbox (#2835)
  • ac7aab3 feat(memory): port BedrockKnowledgeBaseStore to strands-py (#2834)
  • 3534e54 feat(site): add For humans / For agents toggle to homepage hero (#2778)
  • 56b8dc9 fix(site): send analytics events in the WebSDK's XDM shape (#2815)
  • 47645db fix(site): inject sitemap lastmod by matching git path prefix (#2814)
  • 97b5206 docs(cedar-authorization): add Python examples to Cedar docs page (#2828)
  • 5486b23 refactor(memory): drop redundant | None from optional config fields (#2832)
  • Additional commits viewable in compare view

Updates compliance-trestle from 4.0.1 to 4.0.3

Release notes

Sourced from compliance-trestle's releases.

v4.0.3 (2026-05-20)

This release is published under the Apache-2.0 License.

Bug Fixes

  • Add cross-platform install docs and conventional-pr make target (#2202, cc76c3a)

  • Address PR review comments on multi-train release support (#2201, a013ac8)

  • Apply mdformat to maintenance_releases.md (#2201, a013ac8)

  • Codeql issue Bad HTML filtering regexp (#2226, 7e39242)

  • Cognitive complexity (53de5e7)

  • Convert negative security checks to positive allowlists (#2201, a013ac8)

  • Correct act install SHA to commit SHA (not tag object SHA) (#2201, a013ac8)

  • Correct path security validator behaviour on mac os (34ca6ad)

  • Correct path security validator behaviour on mac os (140acb2)

  • Handle dotted dir in to_trash_path (#2209, 7244d97)

  • Handle dotted directory paths in trash resolution (#2209, 7244d97)

  • Handle dotted trash path edge cases (#2209, 7244d97)

  • Handle missing metadata in version (#2186, 4f6c77c)

  • Improve test coverage (53de5e7)

  • Improve test coverage to 100% for security.py (89f4e53)

  • Improve validation (2dd1cce)

  • Jinja write (2dd1cce)

  • Pin act install to v0.2.87 and fix mdformat table padding (#2202, cc76c3a)

  • Pre-configure act image to avoid interactive prompt in CI (#2201, a013ac8)

  • Preserve dotted catalog names in validate -a (#2146, bc638c0)

  • The HTTPSFetcher (53de5e7)

  • Update stale OSCAL reference links (#2209, 7244d97)

... (truncated)

Changelog

Sourced from compliance-trestle's changelog.

v4.0.3 (2026-05-20)

Bug Fixes

  • Add cross-platform install docs and conventional-pr make target (#2202, cc76c3a)

  • Address PR review comments on multi-train release support (#2201, a013ac8)

  • Apply mdformat to maintenance_releases.md (#2201, a013ac8)

  • Codeql issue Bad HTML filtering regexp (#2226, 7e39242)

  • Cognitive complexity (53de5e7)

  • Convert negative security checks to positive allowlists (#2201, a013ac8)

  • Correct act install SHA to commit SHA (not tag object SHA) (#2201, a013ac8)

  • Correct path security validator behaviour on mac os (34ca6ad)

  • Correct path security validator behaviour on mac os (140acb2)

  • Handle dotted dir in to_trash_path (#2209, 7244d97)

  • Handle dotted directory paths in trash resolution (#2209, 7244d97)

  • Handle dotted trash path edge cases (#2209, 7244d97)

  • Handle missing metadata in version

... (truncated)

Commits
  • c797d96 4.0.3
  • f5ea128 Merge pull request #2237 from oscal-compass/develop
  • 7f42431 fix(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 (#2229)
  • da6598f fix(deps): bump github/codeql-action from 4.35.2 to 4.35.5 (#2230)
  • 247fcce Merge commit from fork
  • 2dd1cce Merge commit from fork
  • 53de5e7 Merge commit from fork
  • 34ca6ad fix: correct path security validator behaviour on mac os
  • 0299136 Revert "test fix"
  • 070b3a1 Revert "Merge branch 'develop' of"
  • Additional commits viewable in compare view

Updates regex from 2026.4.4 to 2026.5.9

Changelog

Sourced from regex's changelog.

Version: 2026.5.9

Reverse matching with full unicode casefolding could lead to out-of-range string indexes.

Version: 2026.4.4

A fix for older Python versions before free-threading was  supported.

Version: 2026.4.3

More fixes for free-threading.

Version: 2026.3.32

Fixed segfault.

Version: 2026.3.31

Fixed bug again.

Version: 2026.3.30

Fixed bug.

Version: 2026.3.28

Fixed version.

Version: 2026.3.27

Various fixes, including ones to improve free-threading support.

Version: 2026.2.28

Replaced atomic operations with mutex on pattern object for free-threaded Python.

Version: 2026.2.26

PR [#598](https://github.com/mrabarnett/mrab-regex/issues/598): Fix race condition in storage caching with atomic operations.

Replaced use of PyUnicode_GET_LENGTH with PyUnicode_GetLength.

Version: 2026.2.19

Added \z as alias of \Z, like in re module.

Added prefixmatch as alias of match, like in re module.

Version: 2026.1.15

... (truncated)

Commits
  • e57d185 Reverse matching with full unicode casefolding lead to out-of-range string in...
  • See full diff in compare view

Updates anyio from 4.13.0 to 4.14.0

Release notes

Sourced from anyio's releases.

4.14.0

  • Added support for Python 3.15

  • Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

  • Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

  • Added support for custom capacity limiters in async path and file I/O functions and classes

  • Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

  • Changed TaskGroup.start_soon() to return a TaskHandle

  • Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

  • Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

  • Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

  • Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

  • Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

  • Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

    • TaskGroup.start_soon()
    • TaskGroup.start()
    • anyio.from_thread.run()

    This reverts an earlier change from v3.7.0 which was made in error. (#1153)

  • Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

  • Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

    • anyio.CancelScope
    • anyio.CapacityLimiter
    • anyio.Condition
    • anyio.Event
    • anyio.Lock
    • anyio.ResourceGuard
    • anyio.Semaphore

  • Fixed cancellation exception escaping a cancel scope when triggered via check_cancelled() in a worker thread (#1113)

  • Fixed TaskGroup raising AttributeError instead of a clear error when entered more than once (#1109; PR by @​bahtya)

  • Fixed lost type information when passing arguments to lru_cache (#1104; PR by @​Graeme22)

  • Fixed test resumption after KeyboardInterrupt in async generator fixtures on the asyncio backend (#1060; PR by @​EmmanuelNiyonshuti)

... (truncated)

Commits
  • ffe9133 Bumped up the version
  • f8b9f01 Fixed asyncio lock waiter deadlocks after cancellation (#1145)
  • d517ee1 [pre-commit.ci] pre-commit autoupdate (#1176)
  • 550b68e Make anyio.run support Awaitable at runtime on all backends (#1171)
  • 29a5e04 Fixed FastAPI test run
  • 4d752ac Updated downstream test setups for FastAPI and Anthropic MCP
  • ebdc950 Added task handle support to start() and start_soon() (#1153)
  • f32bfb8 Fixed test suite compatibility issues with Pytest 9.1.0
  • 85f7e8e Added __slots__ to several classes
  • b7ea84c [pre-commit.ci] pre-commit autoupdate (#1165)
  • Additional commits viewable in compare view

Updates botocore from 1.42.85 to 1.43.34

Commits

Updates certifi from 2026.2.25 to 2026.6.17

Commits

Updates click from 8.3.2 to 8.4.1

Release notes

Sourced from click's releases.

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32?closed=1

  • get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484
  • Zsh completion scripts parse correctly on Windows. #3277 # 3466
  • Shell completion of Choice Enum values produces a valid completion result. #3015
  • Fix empty byte-string handling in echo. #3487
  • Fix closed file error with echo_via_pager. #3449

8.4.0

This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.4.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-0 Milestone https://github.com/pallets/click/milestone/30

  • ParamType typing improvements. #3371

    • :class:ParamType is now a generic abstract base class, parameterized by its converted value type.
    • :meth:~ParamType.convert return types are narrowed on all concrete types (str for :class:STRING, int for :class:INT, etc.).
    • :meth:~ParamType.to_info_dict returns specific :class:~typing.TypedDict subclasses instead of dict[str, Any].
    • :class:CompositeParamType and the number-range base are now generic with abstract methods.

  • Refactor convert_type to extract type inference into a private _guess_type helper, and add :func:typing.overload signatures. #3372

  • Parameter typing improvements. #2805

    • :class:Parameter is now an abstract base class, making explicit that it cannot be instantiated directly.
    • :attr:Parameter.name is now str instead of str | None. When expose_value=False, the name is set to "" instead of None.
    • The ctx parameter of :meth:Parameter.get_error_hint is now typed as Context | None, matching the runtime behavior.

  • Split string values from default_map for parameters with nargs > 1 or :class:Tuple type, matching environment variable behavior.

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.4.1

Released 2026-05-21

  • get_parameter_source() is available during eager callbacks and type conversion again. {issue}3458 {pr}3484
  • Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
  • Shell completion of Enum values used as Choice options produces a valid completion result. {issue}3015 {pr}3471
  • Fix empty byte-string handling in echo. {issue}3487 {pr}3493
  • Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
  • Fix open_url on Windows when the file path contains spaces. {issue}2994 {pr}3478

Version 8.4.0

Released 2026-05-17

  • {class}ParamType typing improvements. {pr}3371

    • {class}ParamType is now a generic abstract base class, parameterized by its converted value type.
    • {meth}~ParamType.convert return types are narrowed on all concrete types (str for {class}STRING, int for {class}INT, etc.).
    • {meth}~ParamType.to_info_dict returns specific {class}~typing.TypedDict subclasses instead of dict[str, Any].
    • {class}CompositeParamType and the number-range base are now generic with abstract methods.

  • Refactor convert_type to extract type inference into a private _guess_type helper, and add {func}typing.overload signatures. {pr}3372

  • {class}Parameter typing improvements. {pr}2805

    • {class}Parameter is now an abstract base class, making explicit that it cannot be instantiated directly.
    • {attr}Parameter.name is now str instead of str | None. When expose_value=False, the name is set to "" instead of None.
    • The ctx parameter of {meth}Parameter.get_error_hint is now typed as Context | None, matching the runtime behavior.

  • Split string values from default_map for parameters with nargs > 1 or {class}Tuple type, matching environment variable behavior. {issue}2745 {pr}3364

  • Auto-detect type=UNPROCESSED for flag_value of non-basic types

... (truncated)

Commits
  • 6eeb50e release version 8.4.1
  • 67921d5 change log and doc fixes (#3495)
  • 9c41f46 Fix changelog and version admonitions
  • 6cb3477 fix skip condition
  • 5ee8e31 fix I/O operation on closed file error with CliRunner and echo_via_pager (#3482)
  • becbde5 pager doesn't close std streams
  • a5f5aa6 Handle empty bytes in echo (#3493)
  • 4d3db84 handle empty bytes in echo
  • d42f15b Fix get_parameter_source() during type conversion and eager callbacks (#3484)
  • 0baa8db Document ctx.params bypass with test and doc
  • Additional commits viewable in compare view

Updates cryptography from 46.0.5 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07


* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.

.. _v46-0-6:


46.0.6 - 2026-03-25

  • SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

Commits

Updates docstring-parser from 0.17.0 to 0.18.0

Changelog

Sourced from docstring-parser's changelog.

0.18 (2026-04-14)

  • General: Allow parse() to work with missing __doc__ (thanks to @​jamesbraza)
  • General: Officially support Python 3.14 (thanks to @​mauvilsa)
  • General: Exclude docstring_parser.tests from built wheels (thanks to @​gvalkov)
  • Epydoc: Add missing attribute parsing, which includes the "@​ivar", "@​cvar" and "@​var" syntax (thanks to @​Masara)
  • Numpydoc: Add support for defaults in type declarations and improve compose behavior (thanks to @​jwlodek)

0.17 (2025-07-21)

  • General: Replace poetry with hatchling (thanks to @​LecrisUT)
  • General: Drop support for Python 3.6 and 3.7 (thanks to @​LecrisUT)
  • General: Officially support Python 3.13 (thanks to @​mauvilsa)
  • General: Publish packages to PyPI with digital attestations (thanks to @​mauvilsa)
  • Google: Fix multi-line parameter definitions (thanks to @​coolbeevip)
  • Attrdoc: Remove use of deprecated ast classes (thanks to @​fedepell)

0.16 (2024-03-15)

  • Parser: add a new property, description, that combines short and long de...

    Description has been truncated

@dependabot
build(deps): bump the minor-updates group across 1 directory with 33 …
7c550ab 
…updates

Bumps the minor-updates group with 33 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.42.85` | `1.43.34` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.27.0` | `1.28.0` |
| [strands-agents](https://github.com/strands-agents/harness-sdk) | `1.35.0` | `1.44.0` |
| [compliance-trestle](https://github.com/oscal-compass/compliance-trestle) | `4.0.1` | `4.0.3` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.4.4` | `2026.5.9` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.0` |
| [botocore](https://github.com/boto/botocore) | `1.42.85` | `1.43.34` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.6.17` |
| [click](https://github.com/pallets/click) | `8.3.2` | `8.4.1` |
| [cryptography](https://github.com/pyca/cryptography) | `46.0.5` | `46.0.7` |
| [docstring-parser](https://github.com/rr-/docstring_parser) | `0.17.0` | `0.18.0` |
| [idna](https://github.com/kjd/idna) | `3.11` | `3.18` |
| [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `8.9.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.42.1` |
| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.63b1` |
| [opentelemetry-instrumentation-threading](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.63b1` |
| [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.42.1` |
| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.61b0` | `0.63b1` |
| [orjson](https://github.com/ijl/orjson) | `3.11.8` | `3.11.9` |
| [packaging](https://github.com/pypa/packaging) | `26.0` | `26.2` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.13.4` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.41.5` | `2.47.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.2` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` |
| [python-frontmatter](https://github.com/eyeseast/python-frontmatter) | `1.1.0` | `1.3.0` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.24` | `0.0.32` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [s3transfer](https://github.com/boto/s3transfer) | `0.16.0` | `0.19.0` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.3.4` | `3.4.4` |
| [starlette](https://github.com/Kludex/starlette) | `1.0.0` | `1.3.1` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.44.0` | `0.49.0` |
| [zipp](https://github.com/jaraco/zipp) | `3.23.0` | `3.23.1` |



Updates `boto3` from 1.42.85 to 1.43.34
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.42.85...1.43.34)

Updates `mcp` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.27.0...v1.28.0)

Updates `strands-agents` from 1.35.0 to 1.44.0
- [Release notes](https://github.com/strands-agents/harness-sdk/releases)
- [Commits](strands-agents/harness-sdk@v1.35.0...python/v1.44.0)

Updates `compliance-trestle` from 4.0.1 to 4.0.3
- [Release notes](https://github.com/oscal-compass/compliance-trestle/releases)
- [Changelog](https://github.com/oscal-compass/compliance-trestle/blob/develop/CHANGELOG.md)
- [Commits](oscal-compass/compliance-trestle@v4.0.1...v4.0.3)

Updates `regex` from 2026.4.4 to 2026.5.9
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.4.4...2026.5.9)

Updates `anyio` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.14.0)

Updates `botocore` from 1.42.85 to 1.43.34
- [Commits](boto/botocore@1.42.85...1.43.34)

Updates `certifi` from 2026.2.25 to 2026.6.17
- [Commits](certifi/python-certifi@2026.02.25...2026.06.17)

Updates `click` from 8.3.2 to 8.4.1
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.3.2...8.4.1)

Updates `cryptography` from 46.0.5 to 46.0.7
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.5...46.0.7)

Updates `docstring-parser` from 0.17.0 to 0.18.0
- [Changelog](https://github.com/rr-/docstring_parser/blob/master/CHANGELOG.md)
- [Commits](rr-/docstring_parser@0.17.0...0.18.0)

Updates `idna` from 3.11 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.11...v3.18)

Updates `importlib-metadata` from 8.7.1 to 8.9.0
- [Release notes](https://github.com/python/importlib_metadata/releases)
- [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst)
- [Commits](python/importlib_metadata@v8.7.1...v8.9.0)

Updates `opentelemetry-api` from 1.40.0 to 1.42.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.42.1)

Updates `opentelemetry-instrumentation` from 0.61b0 to 0.63b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-threading` from 0.61b0 to 0.63b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-sdk` from 1.40.0 to 1.42.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.42.1)

Updates `opentelemetry-semantic-conventions` from 0.61b0 to 0.63b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/commits)

Updates `orjson` from 3.11.8 to 3.11.9
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.11.8...3.11.9)

Updates `packaging` from 26.0 to 26.2
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.0...26.2)

Updates `pydantic` from 2.12.5 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.5...v2.13.4)

Updates `pydantic-core` from 2.41.5 to 2.47.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `pydantic-settings` from 2.13.1 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.13.1...v2.14.2)

Updates `pyjwt` from 2.12.1 to 2.13.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.12.1...2.13.0)

Updates `python-frontmatter` from 1.1.0 to 1.3.0
- [Release notes](https://github.com/eyeseast/python-frontmatter/releases)
- [Commits](eyeseast/python-frontmatter@v1.1.0...v1.3.0)

Updates `python-multipart` from 0.0.24 to 0.0.32
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.24...0.0.32)

Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)

Updates `s3transfer` from 0.16.0 to 0.19.0
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](boto/s3transfer@0.16.0...0.19.0)

Updates `sse-starlette` from 3.3.4 to 3.4.4
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.3.4...v3.4.4)

Updates `starlette` from 1.0.0 to 1.3.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.0.0...1.3.1)

Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

Updates `uvicorn` from 0.44.0 to 0.49.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.44.0...0.49.0)

Updates `zipp` from 3.23.0 to 3.23.1
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst)
- [Commits](jaraco/zipp@v3.23.0...v3.23.1)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.34
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: mcp
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: strands-agents
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: compliance-trestle
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: regex
  dependency-version: 2026.5.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: anyio
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: botocore
  dependency-version: 1.43.34
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: certifi
  dependency-version: 2026.6.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: click
  dependency-version: 8.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: cryptography
  dependency-version: 46.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: docstring-parser
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: importlib-metadata
  dependency-version: 8.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: opentelemetry-api
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: opentelemetry-instrumentation
  dependency-version: 0.63b1
  dependency-type: direct:production
  dependency-group: minor-updates
- dependency-name: opentelemetry-instrumentation-threading
  dependency-version: 0.63b1
  dependency-type: direct:production
  dependency-group: minor-updates
- dependency-name: opentelemetry-sdk
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.63b1
  dependency-type: direct:production
  dependency-group: minor-updates
- dependency-name: orjson
  dependency-version: 3.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: packaging
  dependency-version: '26.2'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: pydantic-core
  dependency-version: 2.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: pyjwt
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: python-frontmatter
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: s3transfer
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: sse-starlette
  dependency-version: 3.4.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: uvicorn
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: zipp
  dependency-version: 3.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 22, 2026
@dependabot
dependabot Bot requested a review from a team June 22, 2026 23:28
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 22, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants