Bump the patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #6381 · mozilla/bugbug

dependabot · 2026-07-25T00:23:13Z

Bumps the patch group with 6 updates in the / directory:

Package	From	To
boto3	`1.43.47`	`1.43.53`
claude-agent-sdk	`0.2.116`	`0.2.125`
libmozdata	`0.2.12`	`0.2.14`
matplotlib	`3.11.0`	`3.11.1`
weave	`0.53.1`	`0.53.2`
pre-commit	`4.6.0`	`4.6.1`

Updates boto3 from 1.43.47 to 1.43.53

Commits

d554104 Merge branch 'release-1.43.53'
7b9ccc7 Bumping version to 1.43.53
7a84fca Add changelog entries from botocore
50ab61c Merge branch 'release-1.43.52'
c6313f3 Merge branch 'release-1.43.52' into develop
e75330d Bumping version to 1.43.52
f07275a Add changelog entries from botocore
7ac5bf2 fix: upgrade http:// to https:// in README.rst (#4818)
2be6659 Bump the github-actions group with 3 updates (#4815)
09cf399 Merge branch 'release-1.43.51'
Additional commits viewable in compare view

Updates claude-agent-sdk from 0.2.116 to 0.2.125

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.125

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.217

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.125/
pip install claude-agent-sdk==0.2.125
v0.2.124

Bug Fixes

Refused batch script CLI spawning on Windows: Blocked spawning .bat/.cmd CLI scripts (including npm's claude.cmd shim) on Windows to prevent command injection via cmd.exe metacharacter re-parsing (BatBadBut / CVE-2024-27980 class). Windows users relying on the npm shim should switch to the native installer, an explicit claude.exe path, or a platform wheel that bundles the CLI (#1127)

Windows cmd.exe metacharacter rejection: resume and session_id values containing cmd.exe metacharacters (& | < > ^ % ! ") or newlines now raise ValueError on Windows, preventing injection even if a cmd.exe hop is reintroduced. POSIX behavior is unchanged (#1127)

Dash-prefixed extra_args value binding: extra_args now uses --flag=value form when the value starts with -, preventing a dash-leading value from being misinterpreted as a separate CLI flag (#1127)

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.216

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.124/
pip install claude-agent-sdk==0.2.124
v0.2.123

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.215

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.123/
pip install claude-agent-sdk==0.2.123

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.125

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.217

0.2.124

Bug Fixes

Refused batch script CLI spawning on Windows: Blocked spawning .bat/.cmd CLI scripts (including npm's claude.cmd shim) on Windows to prevent command injection via cmd.exe metacharacter re-parsing (BatBadBut / CVE-2024-27980 class). Windows users relying on the npm shim should switch to the native installer, an explicit claude.exe path, or a platform wheel that bundles the CLI (#1127)

Windows cmd.exe metacharacter rejection: resume and session_id values containing cmd.exe metacharacters (& | < > ^ % ! ") or newlines now raise ValueError on Windows, preventing injection even if a cmd.exe hop is reintroduced. POSIX behavior is unchanged (#1127)

Dash-prefixed extra_args value binding: extra_args now uses --flag=value form when the value starts with -, preventing a dash-leading value from being misinterpreted as a separate CLI flag (#1127)

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.216

0.2.123

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.215

0.2.122

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.214

0.2.121

Bug Fixes

Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)

CI now lints and typechecks scripts/ alongside src/ and tests/

CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)

Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

Updated bundled Claude CLI to version 2.1.211

0.2.119

... (truncated)

Commits

ab3b09c docs: update changelog for v0.2.125
e74b021 chore: release v0.2.125
1314e18 chore: bump bundled CLI version to 2.1.217
4dedce6 docs: update changelog for v0.2.124
fddf27f chore: release v0.2.124
8860ce3 chore: bump bundled CLI version to 2.1.216
879e920 Refuse to spawn .bat/.cmd CLI scripts on Windows to prevent command injection...
2d4ef94 docs: update changelog for v0.2.123
d65bf4a chore: release v0.2.123
4fa1389 chore: bump bundled CLI version to 2.1.215
Additional commits viewable in compare view

Updates libmozdata from 0.2.12 to 0.2.14

Release notes

Sourced from libmozdata's releases.

v0.2.14

set User-Agent for connections (#265)

Bump pre-commit hook versions (#286)

Bind response body to a local before indexing JSON keys (#285)

Fix CI by running on Python 3.13 (#288)

Retry all Phabricator API calls upon 50x HTTP error codes (#293)

Remove release_owners module (#294)

Update icalendar requirement from >=3.10 to >=7.2.0 (#291)

Update six requirement from >=1.10.0 to >=1.17.0 (#272)

Released with mozilla/task-boot

Commits

fa9c39b Version 0.2.14
982e919 Update six requirement from >=1.10.0 to >=1.17.0 (#272)
2833632 Update icalendar requirement from >=3.10 to >=7.2.0 (#291)
2d9661d Remove release_owners module (#294)
464909c Retry all Phabricator API calls upon 50x HTTP error codes (#293)
5bdc34b Fix CI by running on Python 3.13 (#288)
07b739f Version 0.2.13
a8614d3 Bind response body to a local before indexing JSON keys (#285)
4ab2909 Bump pre-commit hook versions (#286)
6a77742 set User-Agent for connections (#265)
See full diff in compare view

Updates matplotlib from 3.11.0 to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

Fix tight layout of multiple subplots with sharey=True

Fix NoNorm cursor formatting for uint8 images

Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)

Fix clipped Axis labels on 3D plots with tight layout

Fix inverted Axis on 3D plots

Fix restoring 'auto' aspect in 3D axes after switching from 'equal'

Fix missing glyphs when subsetting Type 1 fonts in PDF

Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits

3c1757a REL: v3.11.1
792c6b5 DOC: Prepare for 3.11.1
aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
Additional commits viewable in compare view

Updates weave from 0.53.1 to 0.53.2

Release notes

Sourced from weave's releases.

v0.53.2

What's Changed

perf(weave): per-source union-all for custom-attrs schema query by @gtarpenning in wandb/weave#7502

perf(weave): compute numeric-histogram bounds once (3 map scans -> 2) by @gtarpenning in wandb/weave#7504

perf(weave): page-prefetch two-pass for agents list-view attribution by @gtarpenning in wandb/weave#7449

perf(weave): prune the agents cost list-read via the two-pass by @gtarpenning in wandb/weave#7453

chore(inference): fix 500 in catalog API by @jamie-rasmussen in wandb/weave#7515

fix(weave_ts): re-route agent spans to the active project on weave.init() by @fixit-agent[bot] in wandb/weave#7512

chore(weave_ts): Bump version, update changelog. by @drtangible in wandb/weave#7520

perf(weave): two-pass filter CTE for calls_complete heavy reads by @gtarpenning in wandb/weave#7486

chore(weave): add column_visibility to ComparisonViewDefinition by @gtarpenning in wandb/weave#7519

perf(weave): add tuned skip indexes on calls_complete (trace_id + attributes_dump) by @gtarpenning in wandb/weave#7510

fix(weave): soft-delete calls_complete via lightweight UPDATE, reclaim async by @gtarpenning in wandb/weave#7509

feat(weave): Base64 and Data URL content ref conversion by @zbirenbaum in wandb/weave#7489

chore(weave_ts): Move type to keep typedoc on Turn by @drtangible in wandb/weave#7521

feat(weave_ts): nest LLM/Tool/SubAgent under a SubAgent by @rgao-coreweave in wandb/weave#7077

chore(weave): require the (weave_ts) PR-title scope for TS SDK changes by @fixit-agent[bot] in wandb/weave#7522

perf(weave): cache published content refs to dedupe repeat base64 blobs on ingest by @gtarpenning in wandb/weave#7527

feat(weave): first-class sdk feedback for agent spans + turns by @gtarpenning in wandb/weave#7524

fix(weave): capture Bedrock cache tokens in streaming converse by @fixit-agent[bot] in wandb/weave#7525

fix(weave): pass through external refs embedded in JSON strings on read by @gtarpenning in wandb/weave#7530

chore(weave): rename Turn/SubAgent factory methods to start_*() by @rgao-coreweave in wandb/weave#7526

chore(weave): update costs by @jwlee64 in wandb/weave#7533

perf(weave): batch content object inserts in calls_complete by @gtarpenning in wandb/weave#7528

perf(weave): negative-cache mimetype-rejected base64 blobs on ingest by @gtarpenning in wandb/weave#7529

fix(weave): map request-input validation failures to 400 not 500 by @gtarpenning in wandb/weave#7409

perf(weave): narrow eval cost pricing to predict calls by @ro31337 in wandb/weave#7536

fix(weave): idempotent migrations, additive 029, and partial-migration auto-recovery by @gtarpenning in wandb/weave#7496

fix(weave): use real Bedrock cache token field names by @ro31337 in wandb/weave#7540

fix(weave): drop stalling calls_complete reclaim DELETE by @gtarpenning in wandb/weave#7542

feat(weave): report deleted versions in ObjDeleteRes by @ruhiparvatam in wandb/weave#7544

perf(weave): skip latest alias write for content objects in calls_complete by @gtarpenning in wandb/weave#7537

fix(weave): stabilize client-side digests across non-string dict keys by @gtarpenning in wandb/weave#7539

chore(weave): cap openai below 2.45.0 for openai_agents shard by @gtarpenning in wandb/weave#7546

feat(weave): nest LLM/Tool/SubAgent under Turn & SubAgent, add SubAgent.start_subagent() by @rgao-coreweave in wandb/weave#7133

chore(weave): add gpt-5.6 by @jwlee64 in wandb/weave#7550

fix(weave): agents-view conversation label uses opening user turn by @gtarpenning in wandb/weave#7545

feat(weave): add agent eval span fields by @bcsherma in wandb/weave#7469

feat(weave): filter agent conversations by signals (tags + ratings) - backend by @jtschoonhoven in wandb/weave#7477

feat(weave): server-side ingest sampling for the spans model by @ro31337 in wandb/weave#7531

fix(weave): fix duplicate migration numbers by @jtschoonhoven in wandb/weave#7553

fix(weave): price W&B Inference models under the id usage records by @gtarpenning in wandb/weave#7549

feat(weave): stamp eval metadata on agent spans by @bcsherma in wandb/weave#7476

fix(weave): support google-adk 2.3.0+ trace_inference_result signature by @fixit-agent[bot] in wandb/weave#7560

chore(weave): Update Remote Scoring samples with info about MT-Saas by @mscavezze-cw in wandb/weave#7563

chore(weave): Remote Scoring docs and sample use released Weave by @mscavezze-cw in wandb/weave#7565

perf(weave): flush file chunks and content objects concurrently in calls_complete by @gtarpenning in wandb/weave#7538

fix(weave): include Anthropic prompt cache tokens in summary input_tokens by @ro31337 in wandb/weave#7561

fix(weave): relax agent-search matched-message role to str by @gtarpenning in wandb/weave#7568

feat(weave): denormalize scorer_trace_id onto feedback by @gtarpenning in wandb/weave#7555

... (truncated)

Commits

59a9d18 Release version: 0.53.2-dev0 → 0.53.2
a91b60c feat(weave): export api contract (#7571)
b2685a7 feat(weave_ts): default JS client to calls_complete ingest path (#7386)
d160a7f add docstring to StringPrompt Python Class (#7583)
b49d5b6 chore(weave_ts): bump TS SDK version to 0.16.3 (#7582)
9175d5b fix(weave_ts): propagate conversation attributes across runIsolated frames (#...
90abcef fix(weave): normalize Claude Code chat projection (#7579)
6c241d3 fix(weave): allow span_name in agent-spans group_by/filter (#7581)
813b21b fix(weave): trace direct openai calls under otel_v2 (#7570)
c3064a9 fix(weave): guard ref converter recursion against deeply-nested payloads (#7578)
Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Commits

242ce8a v4.6.1
766e550 Merge pull request #3727 from pre-commit/dedupe
1558d06 Merge pull request #3726 from pre-commit/exists-faster
8a1c47a avoid duplicate files in --all-files during conflict
2e01c99 faster check of rev existing locally as a commit
3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
1d811d9 Return an error for invalid --repo
374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
1e7994f set JULIA_DEPOT_PATH
b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.47` | `1.43.53` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.116` | `0.2.125` | | [libmozdata](https://github.com/mozilla/libmozdata) | `0.2.12` | `0.2.14` | | [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` | | [weave](https://github.com/wandb/weave) | `0.53.1` | `0.53.2` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` | Updates `boto3` from 1.43.47 to 1.43.53 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.47...1.43.53) Updates `claude-agent-sdk` from 0.2.116 to 0.2.125 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.116...v0.2.125) Updates `libmozdata` from 0.2.12 to 0.2.14 - [Release notes](https://github.com/mozilla/libmozdata/releases) - [Commits](mozilla/libmozdata@v0.2.12...v0.2.14) Updates `matplotlib` from 3.11.0 to 3.11.1 - [Release notes](https://github.com/matplotlib/matplotlib/releases) - [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1) Updates `weave` from 0.53.1 to 0.53.2 - [Release notes](https://github.com/wandb/weave/releases) - [Changelog](https://github.com/wandb/weave/blob/master/dev_docs/RELEASE.md) - [Commits](wandb/weave@v0.53.1...v0.53.2) Updates `pre-commit` from 4.6.0 to 4.6.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.53 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: claude-agent-sdk dependency-version: 0.2.125 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: libmozdata dependency-version: 0.2.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: matplotlib dependency-version: 3.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: weave dependency-version: 0.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: pre-commit dependency-version: 4.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 25, 2026

dependabot Bot requested a review from a team as a code owner July 25, 2026 00:23

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the patch group across 1 directory with 6 updates#6381

Bump the patch group across 1 directory with 6 updates#6381
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/patch-7eb2768fb0

dependabot Bot commented on behalf of github Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 25, 2026

v0.2.125

Internal/Other Changes

v0.2.124

Bug Fixes

Internal/Other Changes

v0.2.123

Internal/Other Changes

0.2.125

Internal/Other Changes

0.2.124

Bug Fixes

Internal/Other Changes

0.2.123

Internal/Other Changes

0.2.122

Internal/Other Changes

0.2.121

Bug Fixes

Internal/Other Changes

0.2.120

Internal/Other Changes

0.2.119

v0.2.14

REL: v3.11.1

v0.53.2

What's Changed

pre-commit v4.6.1

Fixes

4.6.1 - 2026-07-21

Fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants