Skip to content

deps(python): bump the python-minor group with 5 updates - #9958

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-212fbadcdd
Open

deps(python): bump the python-minor group with 5 updates#9958
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-212fbadcdd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor group with 5 updates:

Package From To
fastapi 0.139.2 0.140.7
fastmcp 3.4.4 3.4.5
anthropic 0.119.0 0.120.0
cachetools 7.1.5 7.1.6
bokeh 3.9.1 3.9.2

Updates fastapi from 0.139.2 to 0.140.7

Release notes

Sourced from fastapi's releases.

0.140.6

Refactors

  • ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #16073 by @​tiangolo.

0.140.5

Refactors

0.140.4

Refactors

0.140.3

Refactors

0.140.2

Refactors

Internal

0.140.1

Refactors

  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #16062 by @​tiangolo.

0.140.0

Refactors

Docs

Internal

... (truncated)

Commits

Updates fastmcp from 3.4.4 to 3.4.5

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line, led by JWTVerifier no longer rejecting every token when an authorization server publishes an unrecognized key type such as Ed25519.

Fixes 🐞

New Contributors

Full Changelog: v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

... (truncated)

Commits

Updates anthropic from 0.119.0 to 0.120.0

Release notes

Sourced from anthropic's releases.

v0.120.0

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

  • api: add claude-opus-5 model (bf4e31c)
  • api: add tool addition/removal blocks and tool_change events (bf4e31c)
  • api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)
Changelog

Sourced from anthropic's changelog.

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

  • api: add claude-opus-5 model (bf4e31c)
  • api: add tool addition/removal blocks and tool_change events (bf4e31c)
  • api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)
Commits

Updates cachetools from 7.1.5 to 7.1.6

Changelog

Sourced from cachetools's changelog.

v7.1.6 (2026-07-24)

  • Minor style improvements to keep ruff happy.
Commits

Updates bokeh from 3.9.1 to 3.9.2

Changelog

Sourced from bokeh's changelog.

2026-07-25 3.9.2:

  • bugfixes:

    • #11991 [component: server] Authentication doesn't work with prefix? [BUG]
    • #12160 [BUG] theme is not applied to json_item plot
    • #14439 [component: bokehjs] Hiding map tiles attribution when multiple tiles renderer are added to the plot
    • #15006 [component: bokehjs] Python callback updates min interval of y range but fails to update the plot
    • #15026 [component: bokehjs] JS callback does not change the color of arrow head
    • #15031 [component: bokehjs] Cannot recover the original state of the plot after toggling scientific notation
    • #15063 [component: bokehjs] Scientific precision not updating when zooming in
    • #15034 [component: bokehjs] Bokeh Button is still resizable after setting resizable to false with CustomJS
    • #15122 [component: bokehjs] DataRange1d.max_interval runtime update does not recompute the visible range
    • #15135 [component: bokehjs] Primary group labels of a nested categorical axis are not centered
    • #15151 CI failing due to pytest 9.1.0 deprecations
    • #15212 [component: bokehjs] on_transitive_change has a resource leak
    • #15218 [component: tests] Handle precision issue in flaky mercator tick test
    • #15251 [component: bokehjs] bokeh init uses npm incompabible bokehjs version

  • tasks:

    • #10067 [BUG] _line_stack() doesn't accept np.ndarray in stackers argument
    • #13177 Remove message "User authentication hooks NOT provided (default user enabled)"
    • #14026 [component: docs] Update environment variables section in dev docs
    • #14689 [component: docs] Document caveats of visual integration tests in bokehjs
    • #15120 [component: bokehjs] Axis.fixed_location string value on numeric range can throw UnreachableError during initial render
    • #15125 [component: server] Verify WebSocket token signatures before payload parsing
    • #15234 [component: tests] Fix flaky macos BokehJS Pantool test
    • #15260 [component: examples] Fix/improve faces example
    • #15189 [component: docs] Fix parameter name mismatches in docstrings
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(python): bump the python-minor group with 5 updates
e83f32e 
Bumps the python-minor group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.2` | `0.140.7` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.4` | `3.4.5` |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.119.0` | `0.120.0` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.5` | `7.1.6` |
| [bokeh](https://github.com/bokeh/bokeh) | `3.9.1` | `3.9.2` |


Updates `fastapi` from 0.139.2 to 0.140.7
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.2...0.140.7)

Updates `fastmcp` from 3.4.4 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.4...v3.4.5)

Updates `anthropic` from 0.119.0 to 0.120.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v0.119.0...v0.120.0)

Updates `cachetools` from 7.1.5 to 7.1.6
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.1.5...v7.1.6)

Updates `bokeh` from 3.9.1 to 3.9.2
- [Changelog](https://github.com/bokeh/bokeh/blob/3.9.2/docs/CHANGELOG)
- [Commits](bokeh/bokeh@3.9.1...3.9.2)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.140.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: fastmcp
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: anthropic
  dependency-version: 0.120.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: cachetools
  dependency-version: 7.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: bokeh
  dependency-version: 3.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python labels Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants