Skip to content

chore(deps): bump the python group with 4 updates - #222

Merged
krisztianfekete merged 1 commit into
mainfrom
dependabot/uv/python-07f158fce1
Sep 15, 2026
Merged

chore(deps): bump the python group with 4 updates#222
krisztianfekete merged 1 commit into
mainfrom
dependabot/uv/python-07f158fce1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 4 updates: mcp, ruff, langchain and langchain-openai.

Updates mcp from 1.29.0 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • See full diff in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates langchain from 1.3.18 to 1.4.0

Release notes

Sourced from langchain's releases.

langchain-perplexity==1.4.0

Changes since langchain-perplexity==1.3.2

release(perplexity): 1.4.0 (#37993) feat(perplexity): bind_tools and Responses-API tool round-trip (#37934) hotfix(openai): min core dep (#37990)

langchain-openai==1.4.0

Changes since langchain-openai==1.3.5

release(openai): 1.4.0 (#38983) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/openai (#38999) feat(core): add reasoning_effort as a standard chat model parameter (#38887) chore(model-profiles): refresh model profile data (#38797)

langchain==1.4.0

Changes since langchain==1.3.18

docs(langchain): runnable langchain.mcp examples (#39976) feat(langchain): langchain.mcp namespace, MCPAdapter (#39939) perf(anthropic,langchain): omit middleware trace inputs (#40098) fix(langchain): include model destination in agent tool routing (#38355) chore(langchain): bump vcrpy test dependency minimum to >=8.2.0 (#39942)

langchain==1.4.0a4

Initial release

release(langchain): 1.4.0a4 test(langchain): cover mixed-era ClientGroup and group elicitation Update libs/langchain_v1/langchain/mcp/adapter.py fix(langchain): drive MCP elicitation via member session for fastmcp 4.0.1 fix(sdk): use latest fastmcp and rm reentrant impl cr cr refactor(langchain): inline MCP client arming into __init__ refactor(langchain): stamp an arm marker instead of introspecting the handler closure fix(langchain): gate MCP interrupt routing on the negotiated protocol era refactor(langchain): drop MCP elicitation flag, derive interrupt routing from the client fix(sdk): add _ReentrantClientGroup fix(langchain): narrow MCPAdapter.client union in mcp tests for mypy chore(langchain): format mcp/adapter.py release(langchain): 1.4.0a3 feat(langchain): group MCP tool metadata under an mcp namespace refactor(langchain): stop exporting MCPAdapterTarget from langchain.mcp refactor(langchain): rename convert_mcp_tool_to_langchain_tool to as_langchain_tool refactor(langchain): rename MCPAdapter.get_tools to list_tools feat(langchain): expose cache_mode on MCPAdapter.get_tools chore(langchain): require fastmcp 4.0.0 feat(langchain): accept a ClientGroup as an MCPAdapter target feat(langchain): mark the langchain.mcp namespace as beta

... (truncated)

Commits
  • 79cab2d release(anthropic): 1.7.1 (#40181)
  • 1e6a4f0 chore(model-profiles): refresh model profile data (#40171)
  • 8330dfe docs(langchain): runnable langchain.mcp examples (#39976)
  • 280442b feat(langchain): langchain.mcp namespace, MCPAdapter (#39939)
  • f5ee2b6 chore(chroma): bump Pygments security constraint (#40162)
  • 234255c chore(model-profiles): refresh model profile data (#40009)
  • 79e0e4a chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/langchain (#40149)
  • e90201b chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (#40150)
  • 4240248 chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/text-splitters (#40148)
  • 530290a chore(deps): bump uv to 0.12.8 (#40092)
  • Additional commits viewable in compare view

Updates langchain-openai from 1.6.0 to 1.6.2

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.6.2

Changes since langchain-openai==1.6.1

release(openai): 1.6.2 (#40339) fix(openai): add GPT-6 Astra reasoning efforts (#40330) chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/partners/openai (#40309)

langchain-openai==1.6.1

Changes since langchain-openai==1.6.0

fix(openai): bump max_completion_tokens in cache breakpoint integration test (#40284) release(openai): 1.6.1 (#40268) chore(model-profiles): refresh model profile data (#40217) fix(openai): support Azure AD auth with OpenAI 3.8 (#40190) feat(openai): support async tools (#40208) feat(openai): support configuration_update (#40201) chore(model-profiles): refresh model profile data (#40171) fix(openai): route gpt-5.6-sol to responses API (#40133) chore(openai): fix tests (#39972) fix(openai): correct reasoning_effort_levels for gpt-5 and gpt-5.1 profiles (#39936) chore(model-profiles): refresh model profile data (#39954)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python group with 4 updates
143d646 
Bumps the python group with 4 updates: [mcp](https://github.com/modelcontextprotocol/python-sdk), [ruff](https://github.com/astral-sh/ruff), [langchain](https://github.com/langchain-ai/langchain) and [langchain-openai](https://github.com/langchain-ai/langchain).


Updates `mcp` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.29.0...v1.30.0)

Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `langchain` from 1.3.18 to 1.4.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==1.3.18...langchain==1.4.0)

Updates `langchain-openai` from 1.6.0 to 1.6.2
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.6.0...langchain-openai==1.6.2)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: langchain
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain-openai
  dependency-version: 1.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added CLI dependencies Dependency updates labels Sep 15, 2026
@krisztianfekete
krisztianfekete merged commit b1450cf into main Sep 15, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-07f158fce1 branch September 15, 2026 10:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@krisztianfekete krisztianfekete krisztianfekete approved these changes

Assignees

No one assigned

Labels

CLI dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@krisztianfekete