chore(deps): bump the python-compatible group across 1 directory with 6 updates by dependabot[bot] · Pull Request #187 · huggingface/Repo2RLEnv

dependabot · 2026-10-05T09:57:34Z

Bumps the python-compatible group with 6 updates in the / directory:

Package	From	To
anyio	`4.14.2`	`4.15.1`
litellm	`1.100.0`	`1.103.0`
langgraph	`1.2.11`	`1.2.12`
daytona	`0.211.2`	`0.218.0`
harbor	`0.22.0`	`0.23.0`
ruff	`0.16.6`	`0.16.9`

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

follow_symlinks on exists() (Python 3.12+)

follow_symlinks on is_dir() (Python 3.13+)

follow_symlinks on is_file() (Python 3.13+)

follow_symlinks on owner() (Python 3.13+)

follow_symlinks on group() (Python 3.13+)

newline on read_text() (Python 3.13+)

(#1286, #1293; PR by @jaideeppyne)

Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @Graeme22)

Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @EmmanuelNiyonshuti)

Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @Vizonex)

Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @nightcityblade)

Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @davidbrochart)

Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @gschaffner)

Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @EmmanuelNiyonshuti)

Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @c-tonneslan)

Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @Graeme22)

Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @gschaffner)

Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @tapetersen)

Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @Sanjays2402)

Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @alloutflo)

Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @matthewfeickert)

Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @hansu650)

Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @zelinewang)

... (truncated)

Commits

ffcd154 Bumped up the version
0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
9283662 Bumped up the version
d137692 Improved the instructions for AI agents
033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
b825c3b Fixed pyproject.toml changes not triggering the test suite
9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
b05fe6d Fixed wrong type in move_on_after (#1297)
44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
Additional commits viewable in compare view

Updates litellm from 1.100.0 to 1.103.0

Release notes

Sourced from litellm's releases.

v1.103.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.0
Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.103.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.0
Expected output:
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
What's Changed

fix(responses): translate the reasoning object into a chat-completion reasoning effort by @joshgarnett in BerriAI/litellm#36363

fix(proxy): bound tool and guardrail index create_many by the spend-log statement budgets by @devin-ai-integration[bot] in BerriAI/litellm#40561

fix(mcp): require admission for delegated OAuth by @joshua-berri in BerriAI/litellm#40923

fix(logging): log one bounded summary for a burst of timed-out LoggingWorker callbacks by @devin-ai-integration[bot] in BerriAI/litellm#40912

fix(fireworks): resolve short model names to long cost map keys by @devin-ai-integration[bot] in BerriAI/litellm#40929

ci: remove main branch source guard by @yuneng-berri in BerriAI/litellm#40172

chore(ci): promote internal staging to main by @yuneng-berri in BerriAI/litellm#40942

fix(spend_logs): store litellm_call_id and match it in request_id lookups by @mateo-berri in BerriAI/litellm#39068

fix(auth): refresh lite login session token grants from the live user and team rows by @ryan-crabbe-berri in BerriAI/litellm#40657

feat(bedrock): support file delete and list for S3-backed managed files by @mateo-berri in BerriAI/litellm#39836

fix(proxy): gate the webhook test alert on proxy admins by @ryan-crabbe-berri in BerriAI/litellm#40814

fix(ui): hide admin write-form tabs on the models page from view-only admins by @mateo-berri in BerriAI/litellm#38867

fix(anthropic-adapter): surface mid-stream provider errors as Anthropic error events by @devin-ai-integration[bot] in BerriAI/litellm#33352

docs(github): add an Affected release section to the PR template by @mateo-berri in BerriAI/litellm#40618

docs(e2e): ban unit tests under tests/e2e by @yassin-berriai in BerriAI/litellm#33852

... (truncated)

Commits

c991f4b fix(proxy): unregister logging callbacks removed from the stored config (#43429)
cc111d1 fix(streaming): backport text-completion usage fix and e2e provider-flake tol...
4dbbe6e test(ci): fix the e2e and integration reds left on rc/1.103.0 after #43382 an...
8aca86a test(e2e): clear the two rc/1.103.0 e2e reds owned by upstream providers (#43...
e640c0e test(integration): make rc/1.103.0 integration groups collect and pass again ...
10e77ce fix(caching): stand default cache points down when extra_body hides a direct ...
6076c0a fix(jwt,otel): backport session conversation id and JWT team header selection...
6bfc987 chore: update Next.js build artifacts (2026-09-26 18:18 UTC, node v24.19.0) (...
6397b36 fix: backport five regression fixes to rc/1.103.0 (#43331)
4d08789 fix(proxy): pass team member spend rows as jsonb so a $0 flush cannot poison ...
Additional commits viewable in compare view

Updates langgraph from 1.2.11 to 1.2.12

Release notes

Sourced from langgraph's releases.

langgraph==1.2.12

Changes since 1.2.11

release(langgraph): 1.2.12 (#8987)

chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (#8958)

feat(langgraph): add response_schema to interrupt() (#8886)

fix(langgraph): type undeclared v3 stream projections (#8596)

chore(langgraph): bump mistune to 3.3.4 (#8804)

chore(deps): bump the minor-and-patch group across 1 directory with 7 updates (#8779)

chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (#8782)

chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (#8792)

chore(deps): bump the major group in /libs/langgraph with 2 updates (#8783)

fix(langgraph): detect subgraphs from bytecode instead of source (#8569)

Commits

49cce0c release(sdk-py): 0.4.5 (#8988)
19273fa release(langgraph): 1.2.12 (#8987)
ed384f3 fix(cli): remediate AnyIO vulnerabilities in example lockfiles (#9022)
aa742fb chore(deps): bump anyio from 4.14.2 to 4.15.1 in /libs/sdk-py (#8997)
b58044a chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/cli (#8998)
daa514a chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/checkpoint-conformance...
022043a chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint (#8995)
d7b99cc chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/sdk-py (#8994)
b19edd7 chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint-sqlite (#8993)
c81c135 chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (#8958)
Additional commits viewable in compare view

Updates daytona from 0.211.2 to 0.218.0

Updates harbor from 0.22.0 to 0.23.0

Commits

See full diff in compare view

Updates ruff from 0.16.6 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)

[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)

[flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

0be08a2 Bump version to 0.16.9 (#28882)
b4920b7 Rename ruff_cli to ruff_command_line (#28881)
47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
5edf5a1 Use target form in rooster.version_files (#28876)
915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
4710e1a ci(github): update version number in placeholder of issue template (#28871)
eedfc62 [ty] Propagate outer type context through cast calls (#28855)
ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 6 updates Bumps the python-compatible group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` | | [litellm](https://github.com/BerriAI/litellm) | `1.100.0` | `1.103.0` | | [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.11` | `1.2.12` | | daytona | `0.211.2` | `0.218.0` | | [harbor](https://github.com/harbor-framework/harbor-cookbook) | `0.22.0` | `0.23.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.9` | Updates `anyio` from 4.14.2 to 4.15.1 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.15.1) Updates `litellm` from 1.100.0 to 1.103.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](BerriAI/litellm@v1.100.0...v1.103.0) Updates `langgraph` from 1.2.11 to 1.2.12 - [Release notes](https://github.com/langchain-ai/langgraph/releases) - [Commits](langchain-ai/langgraph@1.2.11...1.2.12) Updates `daytona` from 0.211.2 to 0.218.0 Updates `harbor` from 0.22.0 to 0.23.0 - [Commits](https://github.com/harbor-framework/harbor-cookbook/commits) Updates `ruff` from 0.16.6 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.6...0.16.9) --- updated-dependencies: - dependency-name: anyio dependency-version: 4.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: litellm dependency-version: 1.103.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: langgraph dependency-version: 1.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-compatible - dependency-name: daytona dependency-version: 0.218.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: harbor dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-compatible ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 5, 2026

Navigation Menu

Repository navigation

chore(deps): bump the python-compatible group across 1 directory with 6 updates - #187

chore(deps): bump the python-compatible group across 1 directory with 6 updates#187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-compatible-4d8ab0f7d5

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026

4.15.1

4.15.0

v1.103.0

Verify Docker Image Signature

What's Changed

langgraph==1.2.12

0.16.9

Release Notes

Preview features

Bug fixes

Rule changes

Documentation

Contributors

Install ruff 0.16.9

Install prebuilt binaries via shell script

0.16.9

Preview features

Bug fixes

Rule changes

Documentation

Contributors

0.16.8

Bug fixes

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants