Skip to content

chore(deps): Bump the python group with 17 updates - #256

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/python-4818ebc322
Open

chore(deps): Bump the python group with 17 updates#256
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/python-4818ebc322

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 17 updates:

Package From To
agent-manifest 0.12.0 0.15.0
a2a-sdk 1.2.1 1.2.2
aiohttp 3.14.3 3.14.5
ruff 0.16.10 0.17.0
mypy 2.3.1 2.4.0
agentrust-trace-tests 0.5.1 0.6.2
uvicorn 0.53.0 0.54.0
mkdocs-llmstxt 0.5.0 0.5.1
mkdocstrings 1.0.6 1.0.7
griffe 2.3.0 2.3.2
platformdirs 4.12.2 4.13.0
setuptools 84.0.0 ``
backrefs 8.0 8.1
griffecli 2.3.0 2.3.2
griffelib 2.3.0 2.3.2
markupsafe 3.0.3 3.0.4
wcwidth 0.9.1 0.9.2

Updates agent-manifest from 0.12.0 to 0.15.0

Release notes

Sourced from agent-manifest's releases.

python-v0.15.0

What's Changed

Full Changelog: agentrust-io/agent-manifest@python-v0.14.0...python-v0.15.0

python-v0.14.0

What's Changed

Full Changelog: agentrust-io/agent-manifest@python-v0.13.1...python-v0.14.0

python-v0.13.1

agent-manifest 0.13.1

pip install agent-manifest==0.13.1

Behaviour change

verify_evidence_pack() now reads the verdict inside the pack. A pack whose embedded section 5.2 verification_result says REVOKED, EXPIRED, MISMATCH or anything other than VALID returns FAILED. Under 0.13.0 the same pack returned VERIFIED. If you accepted those packs, they will now be rejected.

Fixed

  • [SDK] verify_evidence_pack() only checked that the embedded verification_result carried a known enum value, and never read its verification_signature. Now a non-VALID result fails the pack, a manifest_id that differs from the pack's manifest fails it, and a result with no manifest_id is MALFORMED. New keyword arguments result_key_id and result_algorithm check verification_signature over the new verification_result_pre_image(). Leave out result_key_id and the result reports verification_result_signature_verified=False with a verification_result_signature_not_appraised warning. signature_verified still covers the outer pack_signature only. (#463)
  • [SDK] verify_evidence_pack() and verify_trace_envelope() raised TypeError or ValueError on some untrusted input: a non-string verification_result.result or pack_signature.key_id, or a value RFC 8785 cannot represent (NaN, Infinity, a lone surrogate, an integer beyond 2^53, nesting deeper than 64). They now return MALFORMED. (#463)

Changed

  • [CI] CodeQL runs on every pull request and every push to main, with the python/** path filter and the Dependabot skip removed (#463). Write permissions in codeql.yml and docs.yml moved from workflow level to the job that needs them (#464). New ClusterFuzzLite target fuzz_trace.py covers both verifiers (#463).

Full changelog: agentrust-io/agent-manifest@python-v0.13.0...python-v0.13.1

agent-manifest 0.13.0 is on PyPI: pip install agent-manifest==0.13.0.

Compatibility: canonicalize() now follows RFC 8785 exactly (#404, closes #322). It no longer NFC-normalizes strings, no longer escapes U+2028, U+2029 or U+007F to U+009F, and refuses integers above 2**53 - 1. A signature that 0.12.0 made over a document containing any of those will not verify. Every other document canonicalizes to the same bytes as before.

Security fixes

  • #404: two distinct strings could share one signature, and two keys that normalized alike produced invalid JSON that silently dropped a signed field.
  • #450: verify_revocation_signature() compares signer_key_id in constant time.

... (truncated)

Changelog

Sourced from agent-manifest's changelog.

[0.15.0] - 2026-09-30

Security

  • [SDK] verify_attestation_chain() refuses debug guests. The SEV-SNP path never read the signed guest policy and the TDX path never parsed TDATTRIBUTES, so a debug-enabled guest with an allow-listed measurement returned passed=True. A debug guest's memory is readable and writable by the host, so its REPORT_DATA and the code that chose it are the host's to set. The verdict now fails when SNP guest policy DEBUG (bit 19, AMD 56860) or TDX TDATTRIBUTES.DEBUG (bit 0, TD report body offset 120) is set, read from the signed bytes after the signature verifies. SNP reports must also carry VMPL 0, the level both of this package's SNP producers request at (SEVSNPProvider through configfs-TSM, and the Azure paravisor). verify_runtime_report() and verify_runtime_freshness() apply the same checks with no opt-in. ChainVerificationResult gains debug and vmpl, read from the signed report (None without a verified signature, and for platforms with no such field). verify_attestation_chain(allow_debug=True) accepts a debug guest for development and records it in reasons; it does not relax VMPL. SnpReport.debug, TdxQuote.td_attributes and TdxQuote.debug expose the parsed state. Behaviour change: a debug guest, or an SNP report at VMPL 1 to 3, that previously verified now fails.

Added

  • [SDK] Experimental, opt-in evidence-requirements-experimental-v1 profile. A v0.2 manifest that declares it may carry a signed evidence_requirements block (components, required relationships, combination policy reference), and agent_manifest.evidence_requirements.verify_evidence_manifest() returns it only after verify_manifest() is VALID. Without the profile the block is still rejected as an unknown field, so existing manifests verify as before. Under the profile every 0.14.0 check still applies, including the signed audit_key_sealed rule under enforce_attestation. Not part of the specification; see docs/evidence-requirements-experimental.md. Consumer: agentrust-io/trace-spec#439.

Fixed

  • [SDK] attach_receipt() corrupted or crashed when the envelope's receipts header (label 394) wasn't already an array - a map became its keys, a string its characters, and null/0/false/"" were silently replaced with []. attach_approvals() was already fixed for the same issue in 0.13.0; attach_receipt() now works the same way: a non-array existing value raises CoseStructureError instead of being coerced or overwritten, and receipt itself must be bytes or bytearray. To replace the array, use attach_unprotected(envelope, HDR_RECEIPTS, receipts). Behaviour change: a bad receipt, or a non-array receipts value, now raises instead of being silently coerced.

... (truncated)

Commits
  • 2f1b9f5 fix(attestation): refuse debug guests and non-VMPL0 SNP reports, release 0.15...
  • 7466b3d feat(sdk): add opt-in experimental evidence-requirements profile (#479)
  • 7a28a4b docs(changelog): file the attach_receipt fix under Unreleased (#478)
  • d3ed22e fix attach receipt (#469)
  • 3c3f5a5 fix(attestation): read verdicts from signed evidence, pin the AMD root (0.14....
  • d991472 bump-urllib3-2.8.0 (#475)
  • 025247a docs(spec): correct identity framing, container-digest binding and Blackwell ...
  • 539c24c docs(spec): publish the two-tool catalog_hash vector in Appendix D (#470)
  • 2f54af9 chore(deps): bump the codeql-action group with 4 updates (#467)
  • 3c12491 docs(api): mark signing_pre_image() as v0.1-only (#460)
  • Additional commits viewable in compare view

Updates a2a-sdk from 1.2.1 to 1.2.2

Release notes

Sourced from a2a-sdk's releases.

v1.2.2

1.2.2 (2026-10-03)

Features

  • allow configuring SSE shutdown grace periods (#1222) (6ff0a82)

Bug Fixes

  • client: handle REST error bodies that are not a google.rpc.Status (#1300) (ee61dc1)
  • compat: keep timestamp and three other fields in v0.3 gRPC conversion (#1277) (fad0482), closes #1276
  • compat: treat an unset v0.3 history_length as unlimited (#1306) (21fe836), closes #1305
  • server: name the task state in terminal-state errors (#1302) (fdca1d0)
  • server: return the stored id when creating a push notification config (#1236) (dac7d9d), closes #1237
  • server: stop printing a traceback to stderr for malformed JSON-RPC bodies (#1301) (5a1a004)
Changelog

Sourced from a2a-sdk's changelog.

1.2.2 (2026-10-03)

Features

  • allow configuring SSE shutdown grace periods (#1222) (6ff0a82)

Bug Fixes

  • client: handle REST error bodies that are not a google.rpc.Status (#1300) (ee61dc1)
  • compat: keep timestamp and three other fields in v0.3 gRPC conversion (#1277) (fad0482), closes #1276
  • compat: treat an unset v0.3 history_length as unlimited (#1306) (21fe836), closes #1305
  • server: name the task state in terminal-state errors (#1302) (fdca1d0)
  • server: return the stored id when creating a push notification config (#1236) (dac7d9d), closes #1237
  • server: stop printing a traceback to stderr for malformed JSON-RPC bodies (#1301) (5a1a004)
Commits
  • 2f9e44a chore(main): release 1.2.2 (#1284)
  • e649325 chore(deps-dev): bump pyjwt from 2.13.0 to 2.15.0 (#1292)
  • 37b6646 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 (#1291)
  • e72db26 chore(deps): bump virtualenv from 21.2.0 to 21.7.13 (#1293)
  • fdca1d0 fix(server): name the task state in terminal-state errors (#1302)
  • 21fe836 fix(compat): treat an unset v0.3 history_length as unlimited (#1306)
  • 6ff0a82 feat: allow configuring SSE shutdown grace periods (#1222)
  • 52030cf test(cluster): only require accepted follow-ups to survive the replica race (...
  • ee61dc1 fix(client): handle REST error bodies that are not a google.rpc.Status (#1300)
  • 5a1a004 fix(server): stop printing a traceback to stderr for malformed JSON-RPC bodie...
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Updates agentrust-trace-tests from 0.5.1 to 0.6.2

Release notes

Sourced from agentrust-trace-tests's releases.

agentrust-trace-tests 0.6.2

Conformance package release from the consolidated trace-spec repository.

  • Adds dinakarjs's portable anchor inclusion vectors: nine positive and eighteen negative cases, with a Python harness and independent JavaScript cross-check (#463; original trace-tests #137).
  • Moves package source and maintenance to trace-spec/conformance. Package name, trace_tests import and trace-tests CLI are unchanged.
  • Documentation: https://trace.agentrust-io.com/conformance/

Reviewed cutover: #465. This release covers agentrust-trace-tests; the root agentrust-trace library is unchanged.

TRACE SDK 0.6.0

Fixed

  • __version__ reported the wrong number for four releases. It was a literal that drifted from pyproject.toml at #36 and was never corrected, so v0.3.0, v0.4.0, v0.5.0 and v0.5.1 each shipped a wheel reporting 0.2.0 at runtime. Anyone pinning or logging on agentrust_trace.__version__ got the wrong answer, and nothing failed. It now derives from installed package metadata, which makes the two unable to disagree, and tests/test_version.py pins the source tree against pyproject.toml and requires the changelog to carry a section for the declared version before a tag is cut.

  • The package description advertised TRACE v0.1. The PyPI summary still named the superseded profile.

Added

  • TraceSandboxAdapter: Trust Records from a sandboxed agent runtime. A kernel sandbox confines one agent on one machine. It does not answer, on its own, which agent on which of two hundred machines took an action, what actually ran rather than what the policy said, or how to say either on a host with no secure hardware. The adapter builds a record from what such a runtime already has at session close: sandbox identity, image digest, the effective policy bundle bytes, and the decision log. No change to the runtime is required.

    Unlike TraceAGTAdapter, one code path spans Level 0 and Level 1. Passing a SandboxAttestation moves the record from software-only to the attested platform and nothing else about the call changes, because a sandbox runs wherever the customer runs it and the deployments that most need evidence often have the least hardware.

    A caller cannot claim hardware it does not have: platform is only ever set from a supplied attestation, an attestation may not name software-only, the platform is validated against the enum on RuntimeInfo rather than a copy of it, and the measurement must be a sha256:/sha384: digest. Sandbox identity and image ride the existing subject and build_provenance.digest, so no schema change was needed.

    Two defaults differ from the AGT adapter, deliberately. appraisal.status is "none", because building a record does not appraise it and affirming would put a verdict in the field a consumer reads to find out whether anybody checked. transparency is None and omitted, which is what an unanchored record should say.

    tool_transcript.hash is taken over the RFC 8785 canonical form of the decision log rather than json.dumps(sort_keys=True). The two agree on ASCII and diverge on non-ASCII strings and number formatting; a decision log carries paths and hostnames, and the signature pre-image already uses JCS. See docs/integration/sandbox-runtime.md and examples/sandbox-runtime.json.

  • verify_record(..., revocation=...) enforces key revocation at verification time (#76). §3.2.1 has always required that "Verifiers MUST consult current revocation status at verification time", but verify_record() checked only signature and freshness, so a record signed by a revoked or compromised key kept verifying. The new revocation parameter accepts either a container of revoked key identifiers or a callable performing a live CRL, status-endpoint, or SCITT lookup. A listed key is rejected, and a store that cannot answer is also rejected: an unavailable revocation source is not evidence that a key is unrevoked.

    Keys are identified by RFC 7638 JWK Thumbprint or kid. The check reads the trusted key rather than record["cnf"]["jwk"], which is attacker-controlled until the signature verifies.

    Additive and backward compatible: revocation defaults to None, which leaves verification purely offline and unchanged. That mode cannot prove non-revocation, now stated in LIMITATIONS.md and docs/verification.md. No normative text, schema, or record field changed.

  • jwk_thumbprint(jwk): RFC 7638 JWK Thumbprint (RFC 8037 §2 for OKP), exported so callers can key a revocation list on the same identifier the verifier derives.

Changelog

Sourced from agentrust-trace-tests's changelog.

Changelog

All notable changes to the TRACE specification will be documented here.

Format: Semantic Versioning. Spec versions follow MAJOR.MINOR.PATCH:

  • MAJOR: breaking changes to wire format or required Trust Record fields
  • MINOR: new optional fields, new platform profiles, new conformance levels
  • PATCH: editorial fixes, clarifications, non-normative additions

[Unreleased]

  • Revocation store and allow_embedded_key are type-checked. verify_record accepted a dict or a string as revocation: a dict was searched by its field names, so a revoked key verified, and a string was searched by substring. Both now raise ValueError, as does a non-bool allow_embedded_key, which was read for truthiness (#511, by @​drk-ram).
  • verify_bridge reports the real reason. A key-id mismatch or an unusable trusted JWK is now reported as itself rather than as an invalid signature; verify_successor_artifact gets the same JWK check. Nothing that was rejected now passes (#510, by @​drk-ram).
  • Example: a valid signature is not verified execution. examples/signature-execution-boundary/ shows a record of invented execution claims, signed by the trusted issuer, passing verify_record, with 49 tests (#509, by @​drk-ram).
  • A second verifier, in TypeScript. trust-record-verify/ verifies TRACE v0.2 records independently of the Python implementation, and a differential harness scores the two against each other on 1644 cases: 1643 agree, and the remaining one is listed in the harness's divergence ledger (#376, by @​chernistry).
  • v0.3 draft fixtures for the manifest reference. Six conformance fixtures under conformance/tests/vectors/manifest-ref-v0.3-draft/ exercise the manifest object proposed in #483: a digest match, a mismatch, a mismatch beside an asserted verified, an unresolvable manifest, a manifest added after signing, and a control without one. Draft only; no spec text or schema changes (#487, by @​babyblueviper1).
  • Accuracy pass on non-normative text. Examples, schema descriptions, adapter docstrings and unsigned test records use vendor-neutral placeholders (example-provider, example-model), the Section 6.2 list keeps confidential-computing and standards organizations, and the Appendix B reference titles use each project's own name. The Acta crosswalk now cites v0.2 sections. Platform pages no longer name a cMCP provider value. The package description, spec abstract, charter, schema descriptions and conformance messages no longer say "hardware-attested": a record is a signed governance record that can carry hardware attestation evidence, and verify_record() performs no attestation verification. Signed and digest-pinned vectors are unchanged. No normative text changes.
  • Conformance site links point at trace.agentrust-io.com/conformance/, where the combined docs build publishes it; the stale conformance/CNAME is removed.
  • Generators write LF on every platform. gen_number_spelling.py and the anchor-inclusion generator opened their output in text mode, so a Windows run wrote CRLF and the byte-for-byte regeneration check failed.
  • License and trademark text names the LF series. LICENSE, NOTICE and both site footers read "The TRACE Specification Authors" as the copyright line. The separate patent promise section is removed from LICENSE; the patent grants in the Community

... (truncated)

Commits
  • aa5c350 Prepare conformance 0.6.2 and combine documentation deployment (#465)
  • 7703a0b ci: re-render the maintainer gate for bases that predate the policy file (#466)
  • 0d97997 tools: report what a library fix's tests can see, on each pull request (#454)
  • 99b7693 Preserve portable anchor inclusion vectors from trace-tests #137 (#463)
  • 1b8ef83 governance: align TRACE ownership and prepare conformance publisher (#462)
  • c5cfa00 docs: review a pull request once CI is green, and a code fix with its tests (...
  • 633ebdc Consolidate TRACE conformance suite into trace-spec (#455)
  • 5991999 docs: a producer-signed re-execution result is the producer's report (#450)
  • 4d60e4a fix(intent-bridge): bind the successor observer's name to the observer key (#...
  • 7d1289a examples: bind MCP retries to retained declaration snapshots (#423)
  • Additional commits viewable in compare view

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates mkdocs-llmstxt from 0.5.0 to 0.5.1

Release notes

Sourced from mkdocs-llmstxt's releases.

0.5.1

0.5.1 - 2026-10-06

Compare with 0.5.0

Build

  • Drop support for Python 3.10 (53623ce by Timothée Mazzucotelli).
Changelog

Sourced from mkdocs-llmstxt's changelog.

0.5.1 - 2026-10-06

Compare with 0.5.0

Build

  • Drop support for Python 3.10 (53623ce by Timothée Mazzucotelli).
Commits

Updates mkdocstrings from 1.0.6 to 1.0.7

Release notes

Sourced from mkdocstrings's releases.

1.0.7

1.0.7 - 2026-10-10

Compare with 1.0.6

Build

  • Drop support for Python 3.10 (2c2cbb1 by Timothée Mazzucotelli).

Bug Fixes

Changelog

Sourced from mkdocstrings's changelog.

1.0.7 - 2026-10-10

Compare with 1.0.6

Build

  • Drop support for Python 3.10 (2c2cbb1 by Timothée Mazzucotelli).

Bug Fixes

Commits

@dependabot
chore(deps): Bump the python group with 17 updates
e538e24 
---
updated-dependencies:
- dependency-name: agent-manifest
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: a2a-sdk
  dependency-version: 1.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: agentrust-trace-tests
  dependency-version: 0.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mkdocs-llmstxt
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocstrings
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffe
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: platformdirs
  dependency-version: 4.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: setuptools
  dependency-version:
  dependency-type: direct:development
  dependency-group: python
- dependency-name: backrefs
  dependency-version: '8.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: griffecli
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffelib
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: wcwidth
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from carloshvp as a code owner October 15, 2026 16:26
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 15, 2026
@dependabot
dependabot Bot requested review from a team and zohebk8s as code owners October 15, 2026 16:26
@dependabot dependabot Bot added the python Pull requests that update python code label Oct 15, 2026
This was referenced Oct 15, 2026
Closed
Closed
Closed
Closed
Closed
@imran-siddique @claude
ci: regenerate the python group locks with uv --universal from main
5de138c 
Dependabot's recompile dropped setuptools and the win32/PyPy markers and
moved agt.txt cryptography back to 48.0.1; pip-audit then flagged the
runner's setuptools 79.0.1. Same package moves as the group, nothing else.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codecov-commenter

codecov-commenter commented Oct 16, 2026

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

imran-siddique
imran-siddique approved these changes Oct 16, 2026
View reviewed changes

@imran-siddique imran-siddique left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency update and lock fix reviewed; CI green.

@imran-siddique

imran-siddique commented Oct 16, 2026

Copy link
Copy Markdown
Member

@rajnisht7 could you review and approve this? Dependabot's lock regeneration dropped setuptools and pip and the win32/PyPy markers, so pip-audit failed; 5de138c regenerates the four locks from main, moving only this group's packages. That makes me the last pusher, so the ruleset needs an approval from another maintainer. CI is green at 5de138c.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imran-siddique imran-siddique imran-siddique approved these changes
@carloshvp carloshvp Awaiting requested review from carloshvp carloshvp is a code owner
@zohebk8s zohebk8s Awaiting requested review from zohebk8s zohebk8s is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @imran-siddique