[dependabot]

Bumps the locks group with 71 updates in the /requirements directory:

Package	From	To
anyio	4.15.1	4.16.0
ast-serialize	0.11.2	0.13.1
certifi	2026.7.22	2026.10.23
charset-normalizer	3.5.1	3.5.2
coverage	7.16.1	7.17.0
cryptography	50.0.1	50.0.2
googleapis-common-protos	1.75.3	1.76.0
griffelib	2.3.0	2.4.1
httpcore2	2.13.0	2.16.0
httpx2	2.13.0	2.16.0
hypothesis	6.168.0	6.170.14
idna	3.19	3.20
iniconfig	2.3.0	2.3.1
jiter	0.17.0	0.18.0
jsonpatch	1.33	1.39
jsonpointer	3.1.1	3.7
langchain	1.4.0	1.4.8
langchain-core	1.6.3	1.7.4
langchain-openai	1.6.2	1.7.3
langchain-protocol	0.0.19	0.0.20
langgraph	1.2.11	1.2.19
langgraph-checkpoint	4.2.0	4.3.1
langgraph-prebuilt	1.1.0	1.1.1
langgraph-sdk	0.4.4	0.4.11
langsmith	0.12.4	0.14.17
librt	0.15.0	0.16.0
mcp	2.2.0	2.3.0
mcp-types	2.2.0	2.3.0
mypy	2.3.1	2.4.1
openai	3.13.0	3.42.1
openai-agents	0.22.2	0.24.0
opentelemetry-api	1.44.0	1.45.2
opentelemetry-exporter-otlp-proto-common	1.44.0	1.45.2
opentelemetry-exporter-otlp-proto-http	1.44.0	1.45.2
opentelemetry-proto	1.44.0	1.45.2
opentelemetry-sdk	1.44.0	1.45.2
opentelemetry-semantic-conventions	0.65b0	0.66b2
orjson	3.12.0	3.13.0
ormsgpack	1.12.2	1.13.0
pluggy	1.6.0	1.7.0
protobuf	7.36.1	7.36.2
pycparser	3.0	3.12
pydantic	2.13.5	2.14.2
pydantic-core	2.46.5	2.50.2
pyjwt	2.14.0	2.15.1
pyproject-hooks	1.2.0	1.3.3
pytest	9.1.1	9.2.0
python-multipart	0.0.32	0.0.33
regex	2026.9.10	2026.9.29
rpds-py	2026.6.3	2026.9.1
ruff	0.16.7	0.17.3
setuptools	84.0.0	84.2.1
sse-starlette	3.4.11	3.6.0
starlette	1.6.0	1.10.0
tenacity	9.1.4	9.2.1
truststore	0.10.4	0.10.5
urllib3	2.7.0	2.8.0
uuid-utils	0.17.1	1.2.0
uvicorn	0.53.0	0.54.0
websockets	16.1.1	17.4
xxhash	4.0.1	4.0.2
more-itertools	11.1.0	11.2.1
chardet	5.2.0	7.7.0
cyclonedx-bom	7.3.1	7.6.0
fqdn	1.5.1	1.6.0
pyparsing	3.3.2	3.3.3
python-dateutil	2.9.0.post0	4.0.0
tzdata	2026.4	2026.6
psycopg	3.3.5	3.3.6
griffe	2.3.0	2.4.1
griffecli	2.3.0	2.4.1

Updates anyio from 4.15.1 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
• Additional commits viewable in compare view

Updates ast-serialize from 0.11.2 to 0.13.1

Commits

• e83de7d Bump version to 0.13.1
• 4b10d47 Make file-level type: ignore consistent with mypy: ignore (#97)
• 42628bd Bump version to 0.13.0
• 67659a0 Straighten type comment parsing (#95)
• 8d0a5c6 Bump version to 0.12.1
• a7f11b1 Fix parsing plain None type in a string (#96)
• bcf707f Bump version to 0.12.0
• 89b6e83 Allow colon in error codes (#94)
• See full diff in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates coverage from 7.16.1 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

• Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

• Fixes for obscure but legal file names:

  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

• 393ac71 docs: prep for 7.17.0
• 14257d3 test: check that 100% files haven't lost coverage
• db056ac docs: keep the ukraine banner #2344
• 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
• 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
• ff62a02 refactor: remove unused caching branches
• 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
• 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
• f95c980 fix: triply nested with statements don't cause false branch misses #1987
• 6aaa858 docs: more changelog gardening
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates googleapis-common-protos from 1.75.3 to 1.76.0

Release notes

Sourced from googleapis-common-protos's releases.

googleapis-common-protos: v1.76.0

1.76.0 (2026-10-22)

Features

• declare support for Python 3.15 (#18737) (65c8767)
• update API sources and regenerate (#18797) (be4d954)

Commits

• 82b0565 chore: release main (#18711)
• ab29d5f chore(main): release google-cloud-bigtable 2.50.2 (#18817)
• 157efe4 feat(bigquery): add column data policies to SchemaField (#18710)
• ea7299f fix: validate Host header in graph_server request handlers (#17932)
• b14c2e5 docs(bigquery-storage): mark ReadRows arrow serialization as beta (#18802)
• 3ccf5ac fix(bigquery): keep the Arrow schema for empty results (#18655)
• 8ac01b9 feat(bigquery): read Arrow results from explicit destinations (#18654)
• 6eab34e feat(bigquery-storage): add context manager to ReadRowsStream (#18781)
• 31d9365 feat(bigquery-storage): send gRPC keepalive pings by default (#18792)
• 89cbc50 feat(bigquery): share one BigQuery Storage client per Client (#18652)
• Additional commits viewable in compare view

Updates griffelib from 2.3.0 to 2.4.1

Release notes

Sourced from griffelib's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

• Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

• Stop checking attribute values (0670d03 by Timothée Mazzucotelli). Issue-506

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

• Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

• Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli dev@pawamoy.fr
• Propagate public value to inherited members (aliases) (8b94205 by Timothée Mazzucotelli). Issue-495, PR-503, Co-authored-by: Sydney Duckworth sydduckworth@users.noreply.github.com

Performance Improvements

• Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

  This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

2.3.2

2.3.2 - 2026-10-06

Compare with 2.3.1

Build

• Drop support for Python 3.10 in griffelib and griffecli packages (7c45a8f by Timothée Mazzucotelli).

2.3.1

2.3.1 - 2026-10-06

Compare with 2.3.0

Build

• Drop support for Python 3.10 (686993d by Timothée Mazzucotelli).

... (truncated)

Changelog

Sourced from griffelib's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

• Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

• Stop checking attribute values (0670d03 by Timothée Mazzucotelli). Issue-506

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

• Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

• Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli dev@pawamoy.fr
• Propagate public value to inherited members (aliases) (8b94205 by Timothée Mazzucotelli). Issue-495, PR-503, Co-authored-by: Sydney Duckworth sydduckworth@users.noreply.github.com

Performance Improvements

• Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

  This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

2.3.2 - 2026-10-06

Compare with 2.3.1

Build

• Drop support for Python 3.10 in griffelib and griffecli packages (7c45a8f by Timothée Mazzucotelli).

2.3.1 - 2026-10-06

Compare with 2.3.0

Enum values now inherit from StrEnum, so str(member) returns its value.

Build

• Drop support for Python 3.10 (686993d by Timothée Mazzucotelli).

Bug Fixes

... (truncated)

Commits

• a74c9d0 chore: Prepare release 2.4.1
• 0670d03 refactor: Stop checking attribute values
• f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
• da6f966 docs: Add periods to docstrings
• 9d51e51 docs: Single block license headers
• 5b833a9 docs: Fix code tree with annotations
• 731b3c5 docs: Various improvements
• 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
• ca60582 chore: Prepare release 2.4.0
• 07bd484 Merge branch 'issue448'
• Additional commits viewable in compare view

Updates httpcore2 from 2.13.0 to 2.16.0

Release notes

Sourced from httpcore2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• 6dd59b9 Prepare version 2.15.1 (#1279)
• 7715bf0 Configure the default Linux SSL context once instead of per handshake (#1253)
• 6078596 Prepare version 2.15.0 (#1278)
• 5b26c25 Drop support for Python 3.10 (#1274)
• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• Additional commits viewable in compare view

Updates httpx2 from 2.13.0 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2d872a0e-e2b0-4674-bd97-d82b4312e1a4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn