Skip to content

Bump the python-minor-patch group across 1 directory with 9 updates - #647

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-c92082088d
Open

Bump the python-minor-patch group across 1 directory with 9 updates#647
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-c92082088d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 9 updates in the / directory:

Package From To
python-dotenv 1.2.2 1.2.3
anthropic 0.119.0 0.122.0
langchain-core 1.5.1 1.5.6
langchain-openai 1.4.1 1.5.1
nltk 3.10.0 3.10.3
sentry-sdk 2.66.1 2.68.0
langfuse 4.14.1 4.14.4
opentelemetry-instrumentation-anthropic 0.62.1 0.62.3
ruff 0.16.0 0.16.3

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates anthropic from 0.119.0 to 0.122.0

Release notes

Sourced from anthropic's releases.

v0.122.0

0.122.0 (2026-08-13)

Full Changelog: v0.121.0...v0.122.0

Features

  • api: add output_behavior to dream creation (create a new memory store or update the input store in place) (852c4bb)

Bug Fixes

  • bedrock,aws: run SigV4 signing off the event loop in async clients (#334) (2bae6c8)
  • bedrock: expose beta.messages.parse, stream and tool_runner (#366) (6eca7bb)
  • client: add models (52e9d94)
  • client: keep token exchange bound per client across copy() (#388) (c13e6e3)
  • client: read PathLike contents passed inside a file tuple (070f953)
  • client: treat empty ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN as unset (#341) (76a2e68)
  • streaming: add context to malformed tool input JSON errors in the non-beta accumulator (#339) (a343e17)
  • streaming: apply all message_delta fields when accumulating streamed messages (#380) (fc1599b)
  • streaming: emit input_json events for server tool use blocks (#336) (ccfc8e1)
  • streaming: keep omitted content block fields unset in accumulated messages (#346) (cd40aab)
  • streaming: run the request transform once in messages.stream() (#347) (81a92da)
  • streaming: silence pydantic serializer warnings on message_stop events (#338) (41f9cdc)
  • tools: reject symlink loops in tool paths and skip special skill-archive members (#322) (43e8669)
  • vertex: expose beta.messages.parse and tool_runner (#367) (96723a0)

Chores

  • ci: run breaking-change detection as a ci.yml job on every push (6dfd16e)
  • examples: update messages_stream.py shebang from rye to uv (#1519) (7d72364)
  • internal: codegen related update (21a0e3d)
  • internal: drop remaining references to black (13df390)
  • internal: remove misc things (d6ee99e)
  • tests: use pytest monkeypatch and fakes instead of unittest.mock (55d246f)
  • tests: use pytest monkeypatch instead of unittest.mock (e0c6488)

Documentation

  • api: clarify that user profile name is optional for resold profiles (b8f9f61)
  • fix fulfillment typos in session runner (#1795) (009b035)
  • fix incorrect docstring in AsyncAnthropicFoundry.models (#1592) (f1f5e9b)

Refactors

  • use the not_given singleton instead of the legacy NOT_GIVEN alias (eeb4d74)

... (truncated)

Changelog

Sourced from anthropic's changelog.

0.122.0 (2026-08-13)

Full Changelog: v0.121.0...v0.122.0

Features

  • api: add output_behavior to dream creation (create a new memory store or update the input store in place) (852c4bb)

Bug Fixes

  • bedrock,aws: run SigV4 signing off the event loop in async clients (#334) (2bae6c8)
  • bedrock: expose beta.messages.parse, stream and tool_runner (#366) (6eca7bb)
  • client: add models (52e9d94)
  • client: keep token exchange bound per client across copy() (#388) (c13e6e3)
  • client: read PathLike contents passed inside a file tuple (070f953)
  • client: treat empty ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN as unset (#341) (76a2e68)
  • streaming: add context to malformed tool input JSON errors in the non-beta accumulator (#339) (a343e17)
  • streaming: apply all message_delta fields when accumulating streamed messages (#380) (fc1599b)
  • streaming: emit input_json events for server tool use blocks (#336) (ccfc8e1)
  • streaming: keep omitted content block fields unset in accumulated messages (#346) (cd40aab)
  • streaming: run the request transform once in messages.stream() (#347) (81a92da)
  • streaming: silence pydantic serializer warnings on message_stop events (#338) (41f9cdc)
  • tools: reject symlink loops in tool paths and skip special skill-archive members (#322) (43e8669)
  • vertex: expose beta.messages.parse and tool_runner (#367) (96723a0)

Chores

  • ci: run breaking-change detection as a ci.yml job on every push (6dfd16e)
  • examples: update messages_stream.py shebang from rye to uv (#1519) (7d72364)
  • internal: codegen related update (21a0e3d)
  • internal: drop remaining references to black (13df390)
  • internal: remove misc things (d6ee99e)
  • tests: use pytest monkeypatch and fakes instead of unittest.mock (55d246f)
  • tests: use pytest monkeypatch instead of unittest.mock (e0c6488)

Documentation

  • api: clarify that user profile name is optional for resold profiles (b8f9f61)
  • fix fulfillment typos in session runner (#1795) (009b035)
  • fix incorrect docstring in AsyncAnthropicFoundry.models (#1592) (f1f5e9b)

Refactors

  • use the not_given singleton instead of the legacy NOT_GIVEN alias (eeb4d74)

0.121.0 (2026-08-07)

... (truncated)

Commits
  • ad53cac release: 0.122.0
  • c71b2f5 chore(tests): use pytest monkeypatch instead of unittest.mock
  • 932488d chore(internal): drop remaining references to black
  • de9fe77 docs(api): clarify that user profile name is optional for resold profiles
  • db4581d refactor: use the not_given singleton instead of the legacy NOT_GIVEN alias
  • 36cbc3a chore(tests): use pytest monkeypatch and fakes instead of unittest.mock
  • 05cdf07 chore(ci): run breaking-change detection as a ci.yml job on every push
  • fd3eaa6 fix(client): keep token exchange bound per client across copy() (#388)
  • c18fcbf chore(internal): codegen related update
  • 57bc2ce fix(streaming): keep omitted content block fields unset in accumulated messag...
  • Additional commits viewable in compare view

Updates langchain-core from 1.5.1 to 1.5.6

Release notes

Sourced from langchain-core's releases.

langchain-core==1.5.6

Changes since langchain-core==1.5.5

chore(core): release 1.5.6 (#39704) feat(core): incorporate gateway metadata to traces (#39703)

langchain-core==1.5.5

Changes since langchain-core==1.5.4

release(core): 1.5.5 (#39655) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (#39367) fix(core): respect pydantic aliases when validating tool inputs (#39572) fix(core): issues in merging chunks (#39535) fix(core): handle v1 base model validation in async path (#39576) fix(core): handle tool descriptions for infer_schema=False (#39573) fix(core): clear usage metadata callback on exceptions in context manager (#39616) fix(core): handle falsy LLM and chat model caches (#39283) chore(core): add httpx as an explicit dep (#39612) fix(core): preserve non-str/non-dict items in DictPromptTemplate list values (#39588) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (#39142) fix(core): guard malformed Anthropic content blocks (#38670)

langchain-core==1.5.4

Changes since langchain-core==1.5.3

release(core): 1.5.4 (#39592) fix(core): compat with pydantic 2.14 (#39328) fix(core): stop StructuredPrompt from mutating caller kwargs (#39174) fix(core): preserve flat tool args schema for RootModel runnables (#39307) fix(core): close internally created event loops in streaming tracers (#39222) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(core): preserve OpenAI file blocks (#39205) fix(core): document reserved argument names for tools (#39207) fix(core): handle injected args for subclasses of BaseTool (#39202) fix(core): respect include_injected=False with filter_args (#39200) fix(core): redact streaming callback options (#39179) fix(core): type text stream projections (#39170) chore(infra): add missing LICENSE files to publishable packages (#39146)

langchain-core==1.5.3

Changes since langchain-core==1.5.2

release(core): 1.5.3 (#39145) fix(core): fall back to LANGSMITH_API_KEY for gateway (#39115)

langchain-core==1.5.2

Changes since langchain-core==1.5.1

release(core): 1.5.2 (#39108) fix(core): handle empty string in gateway env vars (#39107)

... (truncated)

Commits

Updates langchain-openai from 1.4.1 to 1.5.1

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.5.1

Changes since langchain-openai==1.5.0

release(openai): 1.5.1 (#39653) fix(openai): preserve streamed encrypted reasoning (#39635) chore(infra): support langsmith gateway in CI (#39651)

langchain-openai==1.5.0

Changes since langchain-openai==1.4.3

release(openai): 1.5.0 (#39629) feat(openai): support openai 3.0 SDK (#39613) chore(partners): bump langgraph floor in openai and huggingface lockfiles (#39617)

langchain-openai==1.4.3

Changes since langchain-openai==1.4.2

release(openai): 1.4.3 (#39485) fix(openai): filter invalid tool calls from content (#39366) chore(openai): update guidance for responses API for OpenAI-compatible providers (#39327) chore(openai): update docstring for include_response_headers (#39326)

langchain-openai==1.4.2

Changes since langchain-openai==1.4.1

release(openai): 1.4.2 (#39322) fix(openai): handle ContextWindowExceededError (#39300) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(openai): filter langchain-generated content block IDs (#39209) fix(openai): preserve Responses text options (#39204) fix(openai): redact MCP authorization (#39155) chore(model-profiles): refresh model profile data (#39050)

Commits

Updates nltk from 3.10.0 to 3.10.3

Release notes

Sourced from nltk's releases.

v3.10.3

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

New Contributors

Full Changelog: nltk/nltk@v3.10.2...v3.10.3

v3.10.3-rc1

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • 303f6e2 Prepare release 3.10.3 (#3745)
  • cf2aaac Merge pull request #3744 from alvations/ci-guard-open
  • 6cd8320 test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)
  • e965330 fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...
  • df1bb4c test: make pathsec security tests platform-independent (fix Linux/Windows CI)
  • 0e5c7be ci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)
  • 5017826 Merge commit from fork
  • 40d0f06 Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...
  • 483c5fe Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...
  • 722778f Merge commit from fork
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.66.1 to 2.68.0

Release notes

Sourced from sentry-sdk's releases.

2.68.0

Important

  • We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

    Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

    Action Needed

    If you had enable_logs set to True:

    • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
    • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=True),
],
)

    If you had enable_logs set to False:

    • If you were using it to gate usages of the sentry_sdk.logger.X API, you'll need to remove the calls entirely or define a before_send_log callback to filter out unwanted logs.

    If you has enable_metrics set to False:

    • Any metrics emitted using the metrics API will be emitted. You'll need to drop them in a before_send_metric or remove the calls to the API.

    Why We're Doing This

    We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.

New Features ✨

Other

Bug Fixes 🐛

Internal Changes 🔧

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.68.0

Important

  • We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

    Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

    Action Needed

    If you had enable_logs set to True:

    • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
    • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=True),
],
)

    If you had enable_logs set to False:

    • If you were using it to gate usages of the sentry_sdk.logger.X API, you'll need to remove the calls entirely or define a before_send_log callback to filter out unwanted logs.

    If you has enable_metrics set to False:

    • Any metrics emitted using the metrics API will be emitted. You'll need to drop them in a before_send_metric or remove the calls to the API.

    Why We're Doing This

    We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.

New Features ✨

Other

Bug Fixes 🐛

... (truncated)

Commits
  • c819e66 Update README
  • 90446df Update CHANGELOG.md
  • cb2499c release: 2.68.0
  • 1c3b50d ref: Flush trace buckets when segment spans finish (#7170)
  • c200bdf test(django): Remove dead code and stale markers from the Django test suite (...
  • 4e4ea83 ref(boto3): Move crumbs to integration (#7165)
  • 0f0cd1f ref(stdlib): Move crumbs to integration (#7161)
  • 2fef9bc chore: Make enable_logs, enable_metrics no-op (#7177)
  • 8177739 ref(httpx,httpx2): Move crumbs to integrations (#7149)
  • e4d7398 ref(pyreqwest): Move crumbs to integration (#7148)
  • Additional commits viewable in compare view

Updates langfuse from 4.14.1 to 4.14.4

Commits

Updates opentelemetry-instrumentation-anthropic from 0.62.1 to 0.62.3

Release notes

Sourced from opentelemetry-instrumentation-anthropic's releases.

0.62.3

v0.62.3 (2026-08-10)

Fix

  • litellm: register instrumentation in commitizen version files (#4408)

[main 62e24c2ff] bump: version 0.62.2 → 0.62.3 66 files changed, 71 insertions(+), 65 deletions(-)

0.62.2

v0.62.2 (2026-08-09)

Fix

  • sdk,openai-agents: stop entity names leaking onto sibling and parent spans (#4405)

[main c2f3f45e2] bump: version 0.62.1 → 0.62.2 64 files changed, 69 insertions(+), 63 deletions(-)

Changelog

Sourced from opentelemetry-instrumentation-anthropic's changelog.

v0.62.3 (2026-08-10)

Fix

  • litellm: register instrumentation in commitizen version files (#4408)

v0.62.2 (2026-08-09)

Fix

  • sdk,openai-agents: stop entity names leaking onto sibling and parent spans (#4405)
Commits
  • 62e24c2 bump: version 0.62.2 → 0.62.3
  • 9965d24 fix(litellm): register instrumentation in commitizen version files (#4408)
  • c2f3f45 bump: version 0.62.1 → 0.62.2
  • e561195 fix(sdk,openai-agents): stop entity names leaking onto sibling and parent spa...
  • See full diff in compare view

Updates ruff from 0.16.0 to 0.16.3

Release notes

Sourced from ruff's releases.

0.16.3

Release Notes

Released on 2026-08-13.

Preview features

  • [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
  • [pylint] Allow continue in finally on Python 3.8 (#27626)
  • [pylint] Fix PLE1307 false positive with bools (#27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

  • Enable PGO for Linux x86-64 Ruff releases (#27570)
  • Enable PGO for Linux ARM64 Ruff releases (#27574)
  • Enable PGO for Windows x86-64 Ruff releases (#27573)
  • Enable PGO for macOS ARM64 Ruff releases (#27572)
  • Reduce Expr size to 64 bytes (#27591)

CLI

  • Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.3

Released on 2026-08-13.

Preview features

  • [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
  • [pylint] Allow continue in finally on Python 3.8 (#27626)
  • [pylint] Fix PLE1307 false positive with bools (

@dependabot
Bump the python-minor-patch group across 1 directory with 9 updates
4f2ad2c 
Bumps the python-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.119.0` | `0.122.0` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.1` | `1.5.6` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.4.1` | `1.5.1` |
| [nltk](https://github.com/nltk/nltk) | `3.10.0` | `3.10.3` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.66.1` | `2.68.0` |
| [langfuse](https://github.com/langfuse/langfuse) | `4.14.1` | `4.14.4` |
| [opentelemetry-instrumentation-anthropic](https://github.com/traceloop/openllmetry) | `0.62.1` | `0.62.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.3` |



Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `anthropic` from 0.119.0 to 0.122.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v0.119.0...v0.122.0)

Updates `langchain-core` from 1.5.1 to 1.5.6
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.5.1...langchain-core==1.5.6)

Updates `langchain-openai` from 1.4.1 to 1.5.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.4.1...langchain-openai==1.5.1)

Updates `nltk` from 3.10.0 to 3.10.3
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@v3.10.0...v3.10.3)

Updates `sentry-sdk` from 2.66.1 to 2.68.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.66.1...2.68.0)

Updates `langfuse` from 4.14.1 to 4.14.4
- [Release notes](https://github.com/langfuse/langfuse/releases)
- [Commits](https://github.com/langfuse/langfuse/commits)

Updates `opentelemetry-instrumentation-anthropic` from 0.62.1 to 0.62.3
- [Release notes](https://github.com/traceloop/openllmetry/releases)
- [Changelog](https://github.com/traceloop/openllmetry/blob/main/CHANGELOG.md)
- [Commits](traceloop/openllmetry@0.62.1...0.62.3)

Updates `ruff` from 0.16.0 to 0.16.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.3)

---
updated-dependencies:
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: anthropic
  dependency-version: 0.122.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: nltk
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: sentry-sdk
  dependency-version: 2.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langfuse
  dependency-version: 4.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: opentelemetry-instrumentation-anthropic
  dependency-version: 0.62.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python An issue related to python/ML services labels Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python An issue related to python/ML services

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants