build(deps): bump the ci-python group across 1 directory with 99 updates

[dependabot]

Bumps the ci-python group with 99 updates in the / directory:

Package	From	To
strix-agent	1.0.4	1.6.2
google-cloud-aiplatform	1.160.0	2.1.0
cryptography	50.0.0	50.0.1
protobuf	6.33.6	7.36.1
pygments	2.20.0	2.21.0
setuptools	83.0.0	84.0.0
stevedore	5.9.0	5.9.1
aiohttp	3.14.1	3.14.3
annotated-types	0.7.0	0.8.0
anyio	4.14.2	4.15.1
caido-sdk-client	0.2.0	0.3.1
certifi	2026.6.17	2026.7.22
cffi	2.1.0	2.1.1
charset-normalizer	3.4.9	3.5.1
click	8.4.2	8.5.0
filelock	3.29.7	3.32.6
fsspec	2026.6.0	2026.7.0
google-api-core	2.31.0	2.36.0
google-auth	2.55.2	2.58.0
google-cloud-bigquery	3.42.2	3.45.0
google-cloud-core	2.6.0	2.7.0
google-cloud-storage	3.12.1	3.14.1
google-genai	2.11.0	2.23.0
google-resumable-media	2.10.0	2.10.2
googleapis-common-protos	1.75.0	1.75.3
graphql-core	3.2.11	3.2.12
griffelib	2.1.0	2.3.0
grpc-google-iam-v1	0.14.4	0.14.5
grpcio	1.82.1	1.83.1
grpcio-status	1.81.1	1.83.1
hf-xet	1.5.1	1.6.0
huggingface-hub	1.23.0	1.31.0
idna	3.18	3.19
importlib-metadata	8.9.0	9.0.1
linkify-it-py	2.1.0	2.2.0
litellm	1.89.2	1.100.1
mcp	1.28.1	2.2.0
multidict	6.7.1	6.8.0
openai	2.45.0	3.13.0
openai-agents	0.14.6	0.22.2
packaging	26.2	26.3
platformdirs	4.10.0	4.11.8
proto-plus	1.28.1	1.28.4
pydantic	2.13.4	2.13.5
pydantic-core	2.46.4	2.49.0
pydantic-settings	2.14.2	2.15.0
python-dotenv	1.2.2	1.2.3
regex	2026.7.10	2026.9.10
sse-starlette	3.4.5	3.4.11
starlette	1.3.1	1.6.0
tiktoken	0.13.0	0.14.0
tokenizers	0.23.1	0.23.2
tqdm	4.68.4	4.70.0
types-requests	2.33.0.20260712	2.33.0.20260906
typing-inspection	0.4.2	0.4.4
uvicorn	0.51.0	0.52.4
websockets	15.0.1	17.1
yarl	1.24.2	1.24.5
aiosmtplib	5.1.2	5.1.3
alembic	1.18.5	1.19.2
annotated-doc	0.0.4	0.0.5
asgiref	3.11.1	3.12.1
fastapi	0.139.0	0.141.1
google-api-python-client	2.198.0	2.200.0
google-auth-httplib2	0.4.0	0.4.2
google-auth-oauthlib	1.4.0	1.4.1
greenlet	3.5.3	3.5.5
icalendar	7.2.0	7.3.0
langchain-core	1.4.9	1.6.2
langchain-protocol	0.0.18	0.0.19
langsmith	0.10.2	0.12.4
mako	1.3.12	1.4.1
opentelemetry-api	1.43.0	1.44.0
opentelemetry-exporter-otlp	1.43.0	1.44.0
opentelemetry-exporter-otlp-proto-common	1.43.0	1.44.0
opentelemetry-exporter-otlp-proto-grpc	1.43.0	1.44.0
opentelemetry-exporter-otlp-proto-http	1.43.0	1.44.0
opentelemetry-instrumentation	0.64b0	0.65b0
opentelemetry-instrumentation-asgi	0.64b0	0.65b0
opentelemetry-instrumentation-fastapi	0.64b0	0.65b0
opentelemetry-proto	1.43.0	1.44.0
opentelemetry-sdk	1.43.0	1.44.0
opentelemetry-semantic-conventions	0.64b0	0.65b0
opentelemetry-util-http	0.64b0	0.65b0
orjson	3.11.9	3.12.0
prometheus-client	0.25.0	0.26.0
prometheus-fastapi-instrumentator	8.0.2	8.1.0
ruff	0.15.21	0.16.7
sqlalchemy	2.0.51	2.0.52
uuid-utils	0.17.0	1.0.0
wheel	0.47.0	0.48.0
wrapt	2.2.2	2.4.1
xxhash	3.8.1	4.0.1
pydantic-ai-slim	2.9.0	2.42.0
genai-prices	0.0.71	0.1.6
httpcore2	2.5.0	2.12.0
httpx2	2.5.0	2.12.0
logfire-api	4.37.0	5.0.0
pydantic-graph	2.9.0	2.42.0

Updates strix-agent from 1.0.4 to 1.6.2

Release notes

Sourced from strix-agent's releases.

v1.6.2

What's Changed

• fix(agents): stop parents waiting on finished non-interactive children by @​devin-ai-integration[bot] in usestrix/strix#1241
• fix(cloud): print top-up instructions on 402 and guide oversize or ar… by @​bearsyankees in usestrix/strix#1242
• fix(viewer): show stopped run status by @​kusonooyasumi in usestrix/strix#1249
• feat(web_search): add Exa as a web search provider alongside Perplexity by @​devin-ai-integration[bot] in usestrix/strix#1270
• fix(cli): join the import warm-up before the engine imports, drop the orphan purge by @​devin-ai-integration[bot] in usestrix/strix#1273
• chore(telemetry): drop per-load skill_loaded beacons, send anonymous events by @​devin-ai-integration[bot] in usestrix/strix#1275
• docs: update README and CLI links by @​devin-ai-integration[bot] in usestrix/strix#1272
• feat(telemetry): classify error beacons by phase and exception class by @​devin-ai-integration[bot] in usestrix/strix#1276
• chore: release v1.6.2 by @​devin-ai-integration[bot] in usestrix/strix#1277

Full Changelog: usestrix/strix@v1.6.1...v1.6.2

v1.6.1

What's Changed

• skills: reference new cloud cli by @​bearsyankees in usestrix/strix#1227
• MCP call errors no longer quarantine the connection by @​yoni-at-strix in usestrix/strix#1228
• fix(tui): run environment and model checks on the no-target start screen by @​devin-ai-integration[bot] in usestrix/strix#1232
• fix(ci): make the pre-commit mypy hook and the test suite pass on a fresh checkout by @​devin-ai-integration[bot] in usestrix/strix#1234
• fix(config): merge env into cli-config.json and invalidate the linked LLM connection on change by @​devin-ai-integration[bot] in usestrix/strix#1236
• feat(models): add GLM-5.3, Fable 5.1, Gemini 3.7 Flash to the recommended list and make openrouter/z-ai/glm-5.3 the top pick by @​devin-ai-integration[bot] in usestrix/strix#1235
• docs(readme): trim the strix cloud section to the essentials by @​devin-ai-integration[bot] in usestrix/strix#1237
• docs: trim crammed README sections and add cloud CLI and viewer docs pages by @​devin-ai-integration[bot] in usestrix/strix#1238
• docs(readme): shorten the coding-agent skills paragraph by @​devin-ai-integration[bot] in usestrix/strix#1239
• chore: release v1.6.1 by @​devin-ai-integration[bot] in usestrix/strix#1240

Full Changelog: usestrix/strix@v1.6.0...v1.6.1

v1.6.0

What's Changed

• Fix LiteLLM cost model resolution by @​bearsyankees in usestrix/strix#1069
• feat: place caller-provided files into the sandbox workspace (extra_files, --workspace-file) by @​yoni-at-strix in usestrix/strix#1085
• feat(reporting): contextual CVSS breakdown on dependency reports by @​devin-ai-integration[bot] in usestrix/strix#1091
• feat(reporting): require contextual CVSS and usage evidence on dependency reports by @​devin-ai-integration[bot] in usestrix/strix#1092
• handle resume tokens gracefully by @​bearsyankees in usestrix/strix#1097
• Add OWASP LLM Top 10 2026 skill coverage by @​bearsyankees in usestrix/strix#1115
• Add Azure and Entra security skill by @​bearsyankees in usestrix/strix#1119
• Add argument injection security skill by @​bearsyankees in usestrix/strix#1120
• Add ecosystem supply-chain security skills by @​bearsyankees in usestrix/strix#1121
• Add Hurl and Hypothesis security playbooks by @​bearsyankees in usestrix/strix#1122
• Add semantic browser and Electron security skills by @​bearsyankees in usestrix/strix#1123
• Expose viewer host option by @​kusonooyasumi in usestrix/strix#1127
• Drop strict tool schemas on Claude routes by @​devin-ai-integration[bot] in usestrix/strix#1136
• fix(tui): preserve cost when state is truncated by @​kusonooyasumi in usestrix/strix#1086
• fix(tui): use single space after ordered-list marker by @​OpenPay-App in usestrix/strix#1043
• fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @​vardhans07 in usestrix/strix#1116
• better skills by @​bearsyankees in usestrix/strix#1139

... (truncated)

Commits

• ff5c8cc chore: release v1.6.2
• afce7d9 fix(telemetry): classify setup-mode TUI preflight and preparation failures
• 2e1db25 feat(telemetry): classify error beacons by phase and exception class
• f4b0416 docs: update README and CLI links (#1272)
• c2c84f1 chore(telemetry): drop unnecessary lock around loaded-skills set
• bb7e82b chore(telemetry): drop per-load skill_loaded beacons, send anonymous events
• 9cc9de8 fix(warmup): drop docker from WARMUP_MODULES
• a3bf864 test(warmup): assert wait_for_import_warmup blocks until the thread finishes
• e60fd83 refactor(warmup): drop the orphan purge and join the warm-up once before the ...
• 7f46dd1 fix(cli): wait for the import warm-up before importing the agents SDK on the ...
• Additional commits viewable in compare view

Updates google-cloud-aiplatform from 1.160.0 to 2.1.0

Release notes

Sourced from google-cloud-aiplatform's releases.

v2.1.0

2.1.0 (2026-09-01)

Features

• Add execute_bash to the Agent Engine sandbox SDK. (505bd42)
• Allow setting ingress_control_config when creating a SandboxEnvironmentTemplate via the SDK (Python, Java, JS). (2dccde8)
• Expose SandboxEnvironmentTemplateState as a standalone enum class in the Python, Java, and JS SDKs. (a31d2ba)
• Expose STATE_PAUSED, STATE_PAUSING, and STATE_RESUMING values in the SandboxState enum for SandboxEnvironment across Python, Java, and JS SDKs. (ec342d9)

Bug Fixes

• Guard the post-LRO refresh in sandboxes.pause() and sandboxes.resume() on the presence of a resource name in the LRO response. (2c60077)
• Preserve rrf_ranking_alpha=0.0 in MatchingEngineIndexEndpoint hybrid queries (7e1c95a)

Documentation

• Update CHANGELOG.md to mark version 2.0.0 as yanked (75f9361)

v2.0.1

2.0.1 (2026-08-28)

Note: This release contains all updates originally intended for v2.0.0. The version was bumped to 2.0.1 due to a PyPI registry conflict with a previously yanked 2.0.0 package.

⚠ BREAKING CHANGES

• agentplatform: agent_engines module renamed to runtimes.
• agentplatform: a2a tasks module is removed.
• agentplatform: sessions and sandboxes moved to top-level modules.
• agentplatform: Removed global initializer dependency. Agent frameworks now read project and location from environment variables.
• agentplatform: runtime templates import changed from agentplatform.agent_engines.templates to agentplatform.frameworks.
• agentplatform: evals.run_inference(agent=...) now accepts types.Runtime instead of types.AgentEngine.
• agentplatform: Migrate Memory Bank methods to client.memory_banks sub-module.

Features

• Add sandboxes.pause() and sandboxes.resume() methods to the Agent Engine sandbox SDK across Python, Java, and JS SDKs. (9b92c88)
• Add Shell Sandbox environment support to the Agent Engine sandbox SDK (8f87082)
• agentplatform: Support client.memory_banks.get (6dfe678)
• agentplatform: Support client.memory_banks.list (6dfe678)
• agentplatform: Support ExampleStores module for few-shot example management (5248240)
• agentplatform: Support Memory Bank configs. (6dfe678)
• Decouple agentplatform from google-cloud-aiplatform and package it as a standalone PyPI package google-cloud-agentplatform. (e0e32c2)
• Expose ingress_control_config field on SandboxEnvironmentTemplate across Python, Java, and JS SDKs. (c08ed98)
• Expose service_attachment field on SandboxEnvironmentConnectionInfo across Python, Java, JS, and Go SDKs. (b781b0e)

... (truncated)

Changelog

Sourced from google-cloud-aiplatform's changelog.

2.1.0 (2026-09-01)

Features

• Add execute_bash to the Agent Engine sandbox SDK. (505bd42)
• Allow setting ingress_control_config when creating a SandboxEnvironmentTemplate via the SDK (Python, Java, JS). (2dccde8)
• Expose SandboxEnvironmentTemplateState as a standalone enum class in the Python, Java, and JS SDKs. (a31d2ba)
• Expose STATE_PAUSED, STATE_PAUSING, and STATE_RESUMING values in the SandboxState enum for SandboxEnvironment across Python, Java, and JS SDKs. (ec342d9)

Bug Fixes

• Guard the post-LRO refresh in sandboxes.pause() and sandboxes.resume() on the presence of a resource name in the LRO response. (2c60077)
• Preserve rrf_ranking_alpha=0.0 in MatchingEngineIndexEndpoint hybrid queries (7e1c95a)

Documentation

• Update CHANGELOG.md to mark version 2.0.0 as yanked (75f9361)

2.0.1 (2026-08-28)

⚠ BREAKING CHANGES

• agentplatform: agent_engines module renamed to runtimes.
• agentplatform: a2a tasks module is removed.
• agentplatform: sessions and sandboxes moved to top-level modules.
• agentplatform: Removed global initializer dependency. Agent frameworks now read project and location from environment variables.
• agentplatform: runtime templates import changed from agentplatform.agent_engines.templates to agentplatform.frameworks.
• agentplatform: evals.run_inference(agent=...) now accepts types.Runtime instead of types.AgentEngine.
• agentplatform: Migrate Memory Bank methods to client.memory_banks sub-module.

Features

• Add sandboxes.pause() and sandboxes.resume() methods to the Agent Engine sandbox SDK across Python, Java, and JS SDKs. (9b92c88)
• Add Shell Sandbox environment support to the Agent Engine sandbox SDK (8f87082)
• agentplatform: Support client.memory_banks.get (6dfe678)
• agentplatform: Support client.memory_banks.list (6dfe678)
• agentplatform: Support ExampleStores module for few-shot example management (5248240)
• agentplatform: Support Memory Bank configs. (6dfe678)
• Decouple agentplatform from google-cloud-aiplatform and package it as a standalone PyPI package google-cloud-agentplatform. (e0e32c2)
• Expose ingress_control_config field on SandboxEnvironmentTemplate across Python, Java, and JS SDKs. (c08ed98)
• Expose service_attachment field on SandboxEnvironmentConnectionInfo across Python, Java, JS, and Go SDKs. (b781b0e)

Bug Fixes

... (truncated)

Commits

• 5631755 chore(main): release 2.1.0 (#7116)
• 505bd42 feat: Add execute_bash to the Agent Engine sandbox SDK.
• e14d6fe chore: Correct stale Python support and maturity metadata on google-cloud-age...
• ec342d9 feat: Expose STATE_PAUSED, STATE_PAUSING, and STATE_RESUMING values in the Sa...
• a31d2ba feat: Expose SandboxEnvironmentTemplateState as a standalone enum class in th...
• 2dccde8 feat: Allow setting ingress_control_config when creating a `SandboxEnvironm...
• 2c60077 fix: Guard the post-LRO refresh in sandboxes.pause() and sandboxes.resume() o...
• 5e9823f chore: Update agentplatform version to 2.0.1 and fix release-please path.
• 75f9361 Copybara import of the project:
• 7e1c95a fix: Preserve rrf_ranking_alpha=0.0 in MatchingEngineIndexEndpoint hybrid que...
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates protobuf from 6.33.6 to 7.36.1

Commits

• See full diff in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
  • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

• a43b45d Get ready for the 2.21.0 release.
• d8f14cb Fix version_added for Purescript.
• 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
• 9992e09 Merge pull request #3191 from jvoisin/dupes
• bd22577 Fix regexlint warnings after latest update.
• 6a62df1 Release preparation: Update the changelog.
• aabba32 Merge pull request #3221 from jvoisin/alter
• d3441d0 Merge pull request #3225 from jvoisin/caddy
• c593f3f Add a lexer for Caddy
• 0644b53 Simplify single-character regex alternations to character classes
• Additional commits viewable in compare view

Updates setuptools from 83.0.0 to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

• Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
• Extensionpypa/distutils#373#5022)
• The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
• The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
• The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
• The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

• The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
• The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
• copy_filepypa/distutils#379#5079)
• Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
• build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

• Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
• Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

• Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
• Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
• The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
• customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363

Commits

• 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
• 1b29701 Select the top-level pyproject.toml when reading build requirements
• bb1b381 Bump version: 83.0.0 → 84.0.0
• ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
• 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
• cbd1195 Merge https://github.com/jaraco/skeleton
• bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
• f02e90a Configure C408 to allow dict(a=1) rather than disabling it
• c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
• e9904b0 Match the distutils sdist base type for the user_options override
• Additional commits viewable in compare view

Updates stevedore from 5.9.0 to 5.9.1

Updates aiohttp from 3.14.1 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

• Rename DocInfo to Doc by @​zen-xu in annotated-types/annotated-types#80
• Add support for Python 3.13 by @​hugovk in annotated-types/annotated-types#83
• Fix docstring of Timezone by @​Viicos in annotated-types/annotated-types#84
• Update license-files to be PEP-639 compliant (#85) by @​shoeffner in annotated-types/annotated-types#86Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: bcfb7e2f-0f1f-4191-be9a-1e5874e50dd9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack repair: this CI dependency lane also rewrites backend dependency manifests that are concurrently owned by #1685, so it is now based on #1685 (dependabot/pip/backend/backend-python-d80bac61f6@d096a5c235d2c1d8b5a5751cdd4e2c8cbba17c21) rather than develop. GitHub's refreshed mergeability calculation is currently mergeable=true; that does not make the overlapping backend rewrites independent authority. Keep Draft/open and reconcile non-force. After #1685 is repaired on #1565, this lane should retain only the still-valid CI/connector deltas and regenerate their exact hash contracts. In particular, do not let the CI lane overwrite the backend httpx2 TestClient dependency contract or treat its duplicate backend requirement rewrites as an independent source of truth.