Skip to content

build(deps): bump the root-backend-runtime group with 17 updates - #3634

Merged
PetrefiedThunder merged 4 commits into
mainfrom
dependabot/pip/root-backend-runtime-04093d9940
Oct 28, 2026
Merged

build(deps): bump the root-backend-runtime group with 17 updates#3634
PetrefiedThunder merged 4 commits into
mainfrom
dependabot/pip/root-backend-runtime-04093d9940

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on pydantic-settings, neo4j, boto3, supabase, resend, authlib, joserfc, sentry-sdk, cachetools, langchain, langchain-core, langgraph-sdk, langsmith, openai, typesafe-sdk, pytest-mock and hypothesis to permit the latest version.
Updates pydantic-settings to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
  • CliSubCommand aliases keep their case with case_sensitive=False (#989).
  • Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
  • CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

  • Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
  • Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
  • A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
  • collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
  • A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
  • Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

  • With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
  • secrets_case_sensitive=True is now honored on Windows (#1001).
  • An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
  • TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

  • Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
  • Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
  • NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • 6ea85e6 Decode optional Annotated named union aliases (#1041)
  • ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
  • b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
  • bedb60e Honor explicit empty TOML table header overrides (#1027)
  • Additional commits viewable in compare view

Updates neo4j to 6.4.1

Release notes

Sourced from neo4j's releases.

Neo4j Python Driver 6.4.1

https://github.com/neo4j/neo4j-python-driver/wiki/6.x-changelog#641

Changelog

Sourced from neo4j's changelog.

Neo4j Driver Change Log (breaking/major changes only)

See also https://github.com/neo4j/neo4j-python-driver/wiki for a full changelog.

NEXT RELEASE

  • No breaking or major changes.

Version 6.4

  • Python 3.15 support added.
  • Deprecate configuring drivers with URIs containing a path (e.g. neo4://example.com/some/path) or fragment (e.g. neo4://example.com#some-fragment).
    This information is currently being ignored anyway. This deprecation will be turned into an exception in a future version.

Version 6.2 - 6.3

  • No breaking or major changes.

Version 6.1

  • Python 3.14 support added.

Version 6.0

  • Python 3.7, 3.8, and 3.9 support has been dropped.
  • Remove deprecated package alias neo4j-driver. Use pip install neo4j instead.
  • Remove setup.py. Please use a recent enough packaging/build tool that supports pyproject.toml
  • Remove deprecated modules:
    • neo4j.conf
    • neo4j.data
    • neo4j.meta
    • neo4j.packstream
    • neo4j.routing
    • neo4j.time.arithmetic
    • neo4j.time.clock_implementation
    • neo4j.time.hydration
    • neo4j.time.metaclasses
    • neo4j.work
    • neo4j.work.query
    • neo4j.work.summary
  • Remove deprecated exports from neo4j:
    • log, Config, PoolConfig, SessionConfig, WorkspaceConfig (internal - no replacement)
    • SummaryNotificationPosition (use SummaryInputPosition instead)
  • api.Version has been removed as it's unused now.
    ServerInfo.protocol_version now is a tuple[int, int] insteadof a api.Version. This should be drop-in replacement is most cases:
    • Version was a sup-type of tuple[int, int]
    • ServerInfo.protocol_version was already documented and typed as tuple[int, int]
    • Version's additional methods were undocumented and shouldn't have been used

... (truncated)

Commits

Updates boto3 to 1.43.114

Commits
  • 432fa17 Merge branch 'release-1.43.114'
  • bf4aed7 Bumping version to 1.43.114
  • fa3e3f2 Add changelog entries from botocore
  • 69ed308 Merge branch 'release-1.43.113'
  • 3abaa49 Merge branch 'release-1.43.113' into develop
  • 741f8d9 Bumping version to 1.43.113
  • ad1c6b5 Add changelog entries from botocore
  • 9ca5e36 Merge branch 'release-1.43.112'
  • f5581ba Merge branch 'release-1.43.112' into develop
  • 6f065c3 Bumping version to 1.43.112
  • Additional commits viewable in compare view

Updates supabase to 2.33.0

Release notes

Sourced from supabase's releases.

v2.33.0

2.33.0 (2026-10-15)

Features

  • postgrest: return a select builder from insert, upsert, update and delete (#1558) (04baf59)

Bug Fixes

  • auth: allow listeners to unsubscribe during notification (#1643) (29ff4ff)
  • auth: avoid mutating OAuth query params (#1660) (553cb47)
  • auth: keep the session after refreshing it on initialize (#1647) (2658d8b)
  • auth: stop putting the raw JWT in UserDoesntExist (#1602) (aa73211)
  • functions: copy headers in invoke() to avoid leaking them across calls (#1536) (655d4c2)
  • functions: do not overwrite content-type when it is passed in (#1746) (94748bb)
  • functions: do not parse relay error as json, save it as text instead (#1714) (dfae141)
  • functions: handle case insensitive headers with httpx.Headers (#1747) (2de8af0)
  • functions: pass verify as keyword argument in create_client (#1705) (#1706) (42549e4)
  • functions: raise FunctionsRelayError for x-relay-error responses (#1638) (f294058)
  • postgrest: escape quoted values in in filters (#1703) (710042f)
  • postgrest: serialize neq/gt/gte/lt/lte filter values like eq (#1723) (d0e1f34)
  • realtime: include connection params in WebSocket URL (#1652) (954403b)
  • realtime: return the existing channel for a topic from channel() (#1673) (df4ed51)
  • realtime: update channel join payloads in set_auth (#1656) (a2a142e)
  • storage: make vector object metadata JSON (#1717) (05c03dc)
  • storage: preserve vector index creation time (#1701) (c5e345d)
Changelog

Sourced from supabase's changelog.

2.33.0 (2026-10-15)

Features

  • postgrest: return a select builder from insert, upsert, update and delete (#1558) (04baf59)

Bug Fixes

  • auth: allow listeners to unsubscribe during notification (#1643) (29ff4ff)
  • auth: avoid mutating OAuth query params (#1660) (553cb47)
  • auth: keep the session after refreshing it on initialize (#1647) (2658d8b)
  • auth: stop putting the raw JWT in UserDoesntExist (#1602) (aa73211)
  • functions: copy headers in invoke() to avoid leaking them across calls (#1536) (655d4c2)
  • functions: do not overwrite content-type when it is passed in (#1746) (94748bb)
  • functions: do not parse relay error as json, save it as text instead (#1714) (dfae141)
  • functions: handle case insensitive headers with httpx.Headers (#1747) (2de8af0)
  • functions: pass verify as keyword argument in create_client (#1705) (#1706) (42549e4)
  • functions: raise FunctionsRelayError for x-relay-error responses (#1638) (f294058)
  • postgrest: escape quoted values in in filters (#1703) (710042f)
  • postgrest: serialize neq/gt/gte/lt/lte filter values like eq (#1723) (d0e1f34)
  • realtime: include connection params in WebSocket URL (#1652) (954403b)
  • realtime: return the existing channel for a topic from channel() (#1673) (df4ed51)
  • realtime: update channel join payloads in set_auth (#1656) (a2a142e)
  • storage: make vector object metadata JSON (#1717) (05c03dc)
  • storage: preserve vector index creation time (#1701) (c5e345d)

2.32.0 (2026-10-02)

Features

  • functions: fix invoke option leakage, add method and bytes body support (#1600) (9dcbc5f)
  • support new realtime features (#1524) (80688d1)

Bug Fixes

  • auth: raise AuthInvalidJwtError when get_claims JWT has no exp (#1603) (899302e)
  • auth: raise AuthWeakPasswordError for responses without an error code (#1629) (1f74409)
  • ci: point SDK compliance workflow at the python reusable workflow (#1540) (b16b16a)
  • ci: unbreak storage tests (service_role for bucket empty) and stop fail-fast cancelling sibling jobs (#1601) (2f9ca44)
  • client_options: honor False for boolean options in replace() (#1516) (10fb8f9)
  • correct invalid feature IDs in sdk-compliance.yaml (#1578) (2a795a7)
  • handle non-standard and non-JSON error responses without AttributeError (#1577) (5b8080a)
  • postgrest: align rpc maybe_single with select (#1555) (0490201)
  • postgrest: coerce non-string values in array filters (#1530) (3433b0d)
  • postgrest: escape array-literal elements in cs/cd/contains/contained_by/overlaps (#1593) (f140cd6)
  • postgrest: normalize boolean values in is_() to lowercase literals (#1535) (21ccd63)

... (truncated)

Commits
  • 2a291e3 chore(main): release 2.33.0 (#1704)
  • 10d5dbe chore(deps): bump supabase/sdk/.github/workflows/validate-sdk-compliance-pyth...
  • ed93913 chore(deps): bump the uv group across 1 directory with 2 updates (#1744)
  • 5e55db5 chore(deps): bump astral-sh/setup-uv from 8.3.2 to 10.3.0 (#1745)
  • a2a142e fix(realtime): update channel join payloads in set_auth (#1656)
  • df4ed51 fix(realtime): return the existing channel for a topic from channel() (#1673)
  • 2de8af0 fix(functions): handle case insensitive headers with httpx.Headers (#1747)
  • 94748bb fix(functions): do not overwrite content-type when it is passed in (#1746)
  • 710042f fix(postgrest): escape quoted values in in filters (#1703)
  • d0e1f34 fix(postgrest): serialize neq/gt/gte/lt/lte filter values like eq (#1723)
  • Additional commits viewable in compare view

Updates resend to 2.50.0

Release notes

Sourced from resend's releases.

v2.50.0

What's Changed

Full Changelog: resend/resend-python@v2.49.1...v2.50.0

Commits
  • b64da65 feat(inboxes): add support for the Inboxes API (#298)
  • 063f797 fix(broadcasts): add topic_id to the Broadcast response type (#299)
  • ac6aae5 fix(broadcasts): accept preview_text and topic_id in create and update params...
  • 486a69d fix: honor legacy custom async HTTP clients (#294)
  • 6b7d105 chore(deps): update dependency python to v3.15.0 (#292)
  • See full diff in compare view

Updates authlib to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates joserfc to 1.7.7

Release notes

Sourced from joserfc's releases.

1.7.7

   🐞 Bug Fixes

    View changes on GitHub
Changelog

Sourced from joserfc's changelog.

1.7.7

Released on October 19, 2026

  • JWK: Reject recognized DER, PEM, and SSH asymmetric public keys when importing oct keys, including public key bytes embedded in an oct JWK. Preserve warnings for input that only resembles an asymmetric key.
  • Replace legacy union type hints with | syntax.

1.7.6

Released on October 19, 2026

  • JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
  • JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
  • JWT: Report the correct claim name for invalid iss values.
  • JWS & JWE: Validate compact token size before splitting it into segments.
  • JWK: Handle key set equality comparisons with unrelated types.

1.7.5

Released on August 29, 2026

  • JWK: Ignore keys with unknown kty values when importing a key set.
  • JWE: Add max_recipients to JWERegistry.

1.7.4

Released on July 13, 2026

  • Reject JWS general JSON serialization when signatures is empty.
  • Raises DecodeError when encrypted_key is None in JWE.

1.7.3

Released on July 8, 2026

  • Add default claims validation for iss, sub and aud.
  • Add size validation even for self-provided payload.

1.7.2

... (truncated)

Commits
  • 43af5af chore: release 1.7.7
  • 0bd4c41 fix: improve typing use | as union
  • 4fb465e fix(jwk): reject asymmetric public keys in oct imports
  • c54d9cc chore: release 1.7.6
  • d060c2e fix(ci): restrict default workflow token permissions
  • e93fd2b fix(jwt): require string values for jti claims
  • 25e9526 fix(jwe): limit additional authenticated data size
  • 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
  • 397e04f fix: validate compact value size before split
  • 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
  • Additional commits viewable in compare view

Updates sentry-sdk to 2.72.0

Release notes

Sourced from sentry-sdk's releases.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Commits
  • 9d24514 release: 2.72.0
  • 4dc1d72 fix: Fix span, metrics, log client reports (#7933)
  • 5780399 feat(types): Export DataCollectionUserOptions from sentry_sdk.types (#7957)
  • 1ca0326 chore(deps): lock file maintenance (#7848)
  • f5bf69b ci(mypy): Bump version to 2.4.0 (#7937)
  • 02210fa ci(openai-agents): Bump version for type checking to 0.23.1 (#7935)
  • fcccb7b ci(strawberry-graphql): Bump version for type checking to 0.332.0 (#7936)
  • 7cb8094 chore: Deprecate ai.monitoring.record_token_usage() (#7918)
  • 1f4ba26 chore: Deprecate send_default_pii (#7694)
  • 4b9d329 refactor: move FastAPI active thread tracking into Starlette (#7825)
  • Additional commits viewable in compare view

Updates cachetools to 7.2.3

Changelog

Sourced from cachetools's changelog.

v7.2.3 (2026-10-17)

  • Fix @cached decorator stacking behavior.

  • Minor type stub improvements.

v7.2.2 (2026-10-15)

  • Fix @cachedmethod for subclasses that override a decorated method and call the base class implementation via super().

  • Restore class access to instance methods decorated with @cachedmethod.

  • Improve TTLCache robustness when calculating expiration time fails.

  • Various unit test improvements.

v7.2.1 (2026-10-05)

  • Improve error handling for RRCache.popitem() when the cache is empty.

  • Minor style and documentation improvements.

  • Update CI environment.

v7.2.0 (2026-09-16)

  • Deprecate use of cache=None to suppress caching with the @cached decorator.

  • Add support for Python 3.15.

  • Minor test improvements.

  • Minor documentation updates.

v7.1.8 (2026-08-31)

... (truncated)

Commits

@dependabot
build(deps): bump the root-backend-runtime group with 17 updates
610b7c0 
Updates the requirements on [pydantic-settings](https://github.com/pydantic/pydantic-settings), [neo4j](https://github.com/neo4j/neo4j-python-driver), [boto3](https://github.com/boto/boto3), [supabase](https://github.com/supabase/supabase-py), [resend](https://github.com/resendlabs/resend-python), [authlib](https://github.com/authlib/authlib), [joserfc](https://github.com/authlib/joserfc), [sentry-sdk](https://github.com/getsentry/sentry-python), [cachetools](https://github.com/tkem/cachetools), [langchain](https://github.com/langchain-ai/langchain), [langchain-core](https://github.com/langchain-ai/langchain), [langgraph-sdk](https://github.com/langchain-ai/langgraph), [langsmith](https://github.com/langchain-ai/langsmith-python), [openai](https://github.com/openai/openai-python), [typesafe-sdk](https://github.com/typesafe-ai/typesafe-sdk-python), [pytest-mock](https://github.com/pytest-dev/pytest-mock) and [hypothesis](https://github.com/HypothesisWorks/hypothesis) to permit the latest version.

Updates `pydantic-settings` to 2.16.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.0)

Updates `neo4j` to 6.4.1
- [Release notes](https://github.com/neo4j/neo4j-python-driver/releases)
- [Changelog](https://github.com/neo4j/neo4j-python-driver/blob/6.x/CHANGELOG.md)
- [Commits](neo4j/neo4j-python-driver@6.4.0...6.4.1)

Updates `boto3` to 1.43.114
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.111...1.43.114)

Updates `supabase` to 2.33.0
- [Release notes](https://github.com/supabase/supabase-py/releases)
- [Changelog](https://github.com/supabase/supabase-py/blob/main/CHANGELOG.md)
- [Commits](supabase/supabase-py@v2.32.0...v2.33.0)

Updates `resend` to 2.50.0
- [Release notes](https://github.com/resendlabs/resend-python/releases)
- [Commits](resend/resend-python@v2.49.1...v2.50.0)

Updates `authlib` to 1.9.1
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.8.0...v1.9.1)

Updates `joserfc` to 1.7.7
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.5...1.7.7)

Updates `sentry-sdk` to 2.72.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.71.0...2.72.0)

Updates `cachetools` to 7.2.3
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.2.1...v7.2.3)

Updates `langchain` to 1.4.6
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==1.4.4...langchain==1.4.6)

Updates `langchain-core` to 1.6.12
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.6.9...langchain-core==1.6.12)

Updates `langgraph-sdk` to 0.4.8
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@0.4.6...0.4.8)

Updates `langsmith` to 0.14.11
- [Release notes](https://github.com/langchain-ai/langsmith-python/releases)
- [Changelog](https://github.com/langchain-ai/langsmith-python/blob/main/CHANGELOG.md)
- [Commits](langchain-ai/langsmith-python@v0.14.9-rc.1...v0.14.11)

Updates `openai` to 3.35.1
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v3.29.0...v3.35.1)

Updates `typesafe-sdk` to 0.7.5
- [Release notes](https://github.com/typesafe-ai/typesafe-sdk-python/releases)
- [Changelog](https://github.com/typesafe-ai/typesafe-sdk-python/blob/main/docs/changelog.md)
- [Commits](typesafe-ai/typesafe-sdk-python@v0.7.4...v0.7.5)

Updates `pytest-mock` to 3.17.0
- [Release notes](https://github.com/pytest-dev/pytest-mock/releases)
- [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-mock@v3.16.0...v3.17.0)

Updates `hypothesis` to 6.170.2
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.169.0...v6.170.2)

---
updated-dependencies:
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: neo4j
  dependency-version: 6.4.1
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: boto3
  dependency-version: 1.43.114
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: supabase
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: resend
  dependency-version: 2.50.0
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: joserfc
  dependency-version: 1.7.7
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: sentry-sdk
  dependency-version: 2.72.0
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: cachetools
  dependency-version: 7.2.3
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: langchain
  dependency-version: 1.4.6
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: langchain-core
  dependency-version: 1.6.12
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: langgraph-sdk
  dependency-version: 0.4.8
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: langsmith
  dependency-version: 0.14.11
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: openai
  dependency-version: 3.35.1
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: typesafe-sdk
  dependency-version: 0.7.5
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: pytest-mock
  dependency-version: 3.17.0
  dependency-type: direct:production
  dependency-group: root-backend-runtime
- dependency-name: hypothesis
  dependency-version: 6.170.2
  dependency-type: direct:production
  dependency-group: root-backend-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
regengine Ignored Ignored Preview Oct 28, 2026 4:29am UTC

Request Review

@dependabot dependabot Bot added backend dependencies Pull requests that update a dependency file labels Oct 26, 2026
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Regenerated requirements.lock with CI's toolchain (pip 24.3.1, pip-tools 7.5.2, Python 3.11), pinned to the versions this PR proposes. Backend CI and security were re-dispatched on the new head — wait for them to go green before merging.

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR Blocker Checklist

Head SHA: 080d9d306d418df18534a3558c6570e0432e31e6

Status: Ready

  • All review threads resolved
  • No reviews requesting changes
  • No blocked review engines

@PetrefiedThunder
merge: bring main into dependabot root-backend-runtime (#3634)
2429b99
@PetrefiedThunder
fix: bump dnspython to >=2.9.0 for CVE-2026-114605
080d9d3 
Security/Dependency Audit fails after merging main: pip-audit
flags dnspython 2.8.0. Floor dnspython>=2.9.0 in requirements.in
and regenerate the hashed lock with the CI pip-tools toolchain.
authlib was already at 1.9.1 on this branch.

Signed-off-by: Christopher Sellers <1@christophersellers.com>
@PetrefiedThunder PetrefiedThunder mentioned this pull request Oct 28, 2026
Closed
@PetrefiedThunder

PetrefiedThunder commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@PetrefiedThunder

PetrefiedThunder commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

Different-engine review (Codex CLI, read-only sandbox, fresh clone of main with this PR merged in, so it covers exactly what lands on main at 70e7e8e).

  • pydantic-settings 2.16.0: no validate_by_alias, validation_alias or AliasChoices in any settings class (8 classes, 1,416 Python files under services/, packages/, scripts/). Python 3.11 and python-dotenv 1.2.4 meet its new floors.
  • LangChain/core, OpenAI, Supabase, Neo4j, TypeSafe, Resend and Boto3 call sites checked against the changelogs: no removed API or changed signature in use.
  • sentry-sdk 2.72: profiles_sample_rate and send_default_pii=False in services/shared/error_handling.py are deprecated but still work.
  • Lock: every requirements.in floor is met by its pin, 200 unique pins with no duplicates, all 23 changed pins carry SHA-256 hashes. authlib stays 1.9.1 and dnspython 2.9.0 after the merge.
  • Security: all 23 changed pins go up, all 16 changed floors go up, no CVE floor dropped.
  • Not run: runtime tests (CI's backend matrix passed on this head).

@dependabot rebase was not acted on, because this branch has non-Dependabot commits. The branch merges into main cleanly and branch protection is not strict.

REVIEW: PASS codex 080d9d3

@PetrefiedThunder
PetrefiedThunder merged commit fad75d3 into main Oct 28, 2026
92 of 96 checks passed
@PetrefiedThunder
PetrefiedThunder deleted the dependabot/pip/root-backend-runtime-04093d9940 branch October 28, 2026 07:27
PetrefiedThunder
PetrefiedThunder approved these changes Oct 28, 2026
View reviewed changes

@PetrefiedThunder PetrefiedThunder left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PASS at 080d9d3. Dependabot authlib 1.9.1 / dnspython 2.9.0; no direct app use, audits pass; Engine Review red only because Dependabot author isn't allowed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PetrefiedThunder PetrefiedThunder PetrefiedThunder approved these changes

Assignees

No one assigned

Labels

backend dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PetrefiedThunder