Bump the service-runtime group across 1 directory with 10 updates

[dependabot]

Bumps the service-runtime group with 10 updates in the /install directory:

Package	From	To
openai	3.3.1	3.19.2
anyio	4.14.2	4.15.1
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
idna	3.19	3.20
jiter	0.16.0	0.17.0
markdownify	1.1.0	1.2.3
pydantic	2.13.4	2.13.5
pydantic-core	2.46.4	2.49.0
soupsieve	2.9.2	2.10

Updates openai from 3.3.1 to 3.19.2

Release notes

Sourced from openai's releases.

v3.19.2

3.19.2 (2026-09-23)

Bug Fixes

• preserve single files for fallback extraction paths (#3875) (bfd3680)

Chores

• api: clarify approximate web search location defaults (#3953) (a95c95e)
• api: clarify Realtime modality array definitions (#3954) (e79cf53)
• api: correct fine-tuning bounds and Realtime response reference (#3949) (325a948)

v3.19.1

3.19.1 (2026-09-23)

Bug Fixes

• chat: preserve single-pass tool iterables (#3770) (33ffa1f)
• client: merge HTTP headers case-insensitively (#3486) (5e39766)

Chores

• api: clarify Chat Completions seed limits (#3945) (be9d666)

Documentation

• clarify collaborator-only pull request policy (#3948) (ead1fa2)

v3.19.0

3.19.0 (2026-09-22)

Features

• api: add GCP external storage support (#3943) (d12d60f)
• api: add GPT-Rosalind research model (#3940) (d041d73)

Bug Fixes

• _utils/_transform: propagate api_exclude in _async_transform_recursive (#3324) (161ae65)
• api: handle omission markers in queued WebSocket events (#3944) (63e4616)
• client: retry only replayable request content (#3771) (6e0c2be)
• client: tolerate older optional aiohttp installations (#3941) (0d91efb)

... (truncated)

Changelog

Sourced from openai's changelog.

3.19.2 (2026-09-23)

Bug Fixes

• preserve single files for fallback extraction paths (#3875) (bfd3680)

Chores

• api: clarify approximate web search location defaults (#3953) (a95c95e)
• api: clarify Realtime modality array definitions (#3954) (e79cf53)
• api: correct fine-tuning bounds and Realtime response reference (#3949) (325a948)

3.19.1 (2026-09-23)

Bug Fixes

• chat: preserve single-pass tool iterables (#3770) (33ffa1f)
• client: merge HTTP headers case-insensitively (#3486) (5e39766)

Chores

• api: clarify Chat Completions seed limits (#3945) (be9d666)

Documentation

• clarify collaborator-only pull request policy (#3948) (ead1fa2)

3.19.0 (2026-09-22)

Features

• api: add GCP external storage support (#3943) (d12d60f)
• api: add GPT-Rosalind research model (#3940) (d041d73)

Bug Fixes

• _utils/_transform: propagate api_exclude in _async_transform_recursive (#3324) (161ae65)
• api: handle omission markers in queued WebSocket events (#3944) (63e4616)
• client: retry only replayable request content (#3771) (6e0c2be)
• client: tolerate older optional aiohttp installations (#3941) (0d91efb)
• helpers: use asyncio.get_running_loop() inside async methods (#3289) (bac3545)

3.18.0 (2026-09-22)

... (truncated)

Commits

• d9f7b7a release: 3.19.2 (#3951)
• e79cf53 chore(api): clarify Realtime modality array definitions (#3954)
• a95c95e chore(api): clarify approximate web search location defaults (#3953)
• 325a948 chore(api): correct fine-tuning bounds and Realtime response reference (#3949)
• bfd3680 fix: preserve single files for fallback extraction paths (#3875)
• 4d12746 release: 3.19.1 (#3946)
• 33ffa1f fix(chat): preserve single-pass tool iterables (#3770)
• 5e39766 fix(client): merge HTTP headers case-insensitively (#3486)
• ead1fa2 docs: clarify collaborator-only pull request policy (#3948)
• be9d666 chore(api): clarify Chat Completions seed limits (#3945)
• Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates httpcore2 from 2.12.0 to 2.13.1

Release notes

Sourced from httpcore2's releases.

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

• Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
• Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: pydantic/httpx2@v2.13.0...v2.13.1

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

... (truncated)

Commits

• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• 392bbed Honor the TLS hostname override in proxy tunnels (#1223)
• df9783d Respect file cursor positions when calculating raw content length (#1214)
• 36c4009 httpcore2: prefer h2 for ALPN protocol if requesting HTTP/2 (#1155)
• 04d152b docs: correct stale URL.query example (#1222)
• f295185 Prepare version 2.13.0 (#1208)
• c518f71 Avoid nested async generator finalization errors (#1204)
• 8f215b5 Use portable links in API docstrings (#1202)
• 81c523f Revert "Maintain connection reservations incrementally in the pool" (#1197)
• Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.1

Release notes

Sourced from httpx2's releases.

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

• Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
• Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: pydantic/httpx2@v2.13.0...v2.13.1

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.13.1 (September 23rd, 2026)

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position. (#1214)
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown. (#1228)

2.13.0 (September 14th, 2026)

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
• Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Commits

• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• df9783d Respect file cursor positions when calculating raw content length (#1214)
• 04d152b docs: correct stale URL.query example (#1222)
• f295185 Prepare version 2.13.0 (#1208)
• 8f215b5 Use portable links in API docstrings (#1202)
• 36d636a Group httpx2.__all__ exports by source module (#1188)
• f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
• bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
• 62e0827 Restore --no-verify CLI flag (#1186)
• Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates jiter from 0.16.0 to 0.17.0

Commits

• 2b5ec63 release: 0.17.0 (#294)
• 6881310 Return CPython's singletons for empty and single-character strings (#293)
• 819dc92 Lock the Python string cache once per parse (#289)
• e9c1cab Add JsonValueScratch, reusable stacks for parsing values (#292)
• 01f5c8e drop Python 3.9, update PGO workflows (#288)
• 9c6d8e9 use digit run to determine float or integer decode (#286)
• 9e7d52f x86_64 SIMD string scanning and int decoding (#279)
• 1da1e5c Build containers on shared stacks, allocate them exactly once (#269)
• b0a501e Disable ASLR for the CodSpeed bench run (#284)
• e8e4297 Benchmark script summary and validation, LTO for release builds (#282)
• Additional commits viewable in compare view

Updates markdownify from 1.1.0 to 1.2.3

Release notes

Sourced from markdownify's releases.

1.2.3

What's Changed

• fix: allow None to be used for strip_pre and warp_width params in types by @​G-Rath in matthewwithanm/python-markdownify#257
• fix: preserve text nested inside <br> by html.parser (#244) by @​gaoflow in matthewwithanm/python-markdownify#264

New Contributors

• @​gaoflow made their first contribution in matthewwithanm/python-markdownify#264

Full Changelog: matthewwithanm/python-markdownify@1.2.2...1.2.3

1.2.2

fix: include py.typed file by @​G-Rath in matthewwithanm/python-markdownify#235

Full Changelog: matthewwithanm/python-markdownify@1.2.0...1.2.2

1.2.0

What's Changed

• Add beautiful_soup_parser option by @​vincentkelleher in matthewwithanm/python-markdownify#206
• make convert_hn() public instead of internal by @​chrispy-snps in matthewwithanm/python-markdownify#213
• Add conversion support for <q> tags by @​colinrobinsonuib in matthewwithanm/python-markdownify#217
• Ensure that explicitly provided heading conversion functions are used (#212) by @​chrispy-snps in matthewwithanm/python-markdownify#214
• allow BeautifulSoup configuration kwargs to be specified by @​chrispy-snps in matthewwithanm/python-markdownify#224
• implement a strip_pre configuration option (#218) by @​chrispy-snps in matthewwithanm/python-markdownify#222
• Support backticks in <code> spans (#226) by @​chrispy-snps in matthewwithanm/python-markdownify#230
• limit colspan values to range [1, 1000] by @​alheiveea in matthewwithanm/python-markdownify#232
• ci: update actions/checkout to v4 by @​G-Rath in matthewwithanm/python-markdownify#233
• docs: fix typo by @​G-Rath in matthewwithanm/python-markdownify#234
• feat: add basic type stubs by @​G-Rath in matthewwithanm/python-markdownify#221

New Contributors

• @​vincentkelleher made their first contribution in matthewwithanm/python-markdownify#206
• @​colinrobinsonuib made their first contribution in matthewwithanm/python-markdownify#217
• @​alheiveea made their first contribution in matthewwithanm/python-markdownify#232
• @​G-Rath made their first contribution in matthewwithanm/python-markdownify#233

Full Changelog: matthewwithanm/python-markdownify@1.1.0...1.2.0

Commits

• 9341855 Merge branch 'develop'
• bc98c9e bump to version v1.2.3
• dd5728e fix: preserve text nested inside <br> by html.parser (#264)
• 0b359c0 fix: allow None to be used for strip_pre and warp_width params in types...
• 241ed02 Merge branch 'develop'
• add391a bump to version v1.2.2
• e89cc2a Merge branch 'develop'
• aafa4c3 fix: include py.typed file (#235)
• c47709c Merge branch 'develop'
• fbc1353 bump to version v1.2.0
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pydantic-core from 2.46.4 to 2.49.0

Commits

• See full diff in compare view

Updates soupsieve from 2.9.2 to 2.10

Release notes

Sourced from soupsieve's releases.

2.10

• NEW: Support Python 3.15.
• NEW: Add new ignore option to API methods that allows the specification of specific pseudo-classes to be ignored.
• NEW: Tighten restrictions such that namespaces and custom objects must always be a Mapping, previously lists of tuples were also allowed.
• NEW: Use a singleton for null selectors internally via called Null of type SelectorNull.
• NEW: For performance, Soup Sieve will no longer try and coerce bad attribute values to useable strings.
• NEW: Add NOCACHE flag that can be used to disable caching optimizations selectors and possibly other future caching optimizations. Provided for disabling and also disabling if issues are found with the new caching approach.
• FIX: Improve performance of ~ for various cases by employing caching.
• FIX: Improve performance of nth-* family of selectors in certain scenarios by employing caching.
• FIX: Ensure custom is properly passed down from API functions to compilation.

Commits

• fc195cd Add official support for Python 3.15 (#305)
• 04af8c7 Update changelog
• edf9a5e Include tools in sdist
• 71c662b Fix example and update doc configuration
• 0928124 Rework patterns
• 56c9655 Update documentation
• ffb88cc Employ caching to speed up various cases of general sibling combinator (#304)
• 537d072 Use caching to increase performance of nth-* family of selectors (#301)
• 8df4abf Don't coerce bad attributes to strings
• 7975507 Improve performance for tag and namespace checking
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml