chore(deps): bump the python group across 1 directory with 17 updates

[dependabot]

Updates the requirements on starlette, gitpython, uvicorn, sqlalchemy, alembic, psycopg, pydantic, pyjwt, anthropic, ansible-core, cryptography, authlib, idna, ruff, mypy, hypothesis and mutmut to permit the latest version.
Updates starlette to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

1.6.0 (August 8, 2026)

Added

• Add max_body_size to Starlette and route classes #3431.
• Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

... (truncated)

Commits

• 2269e9a Version 1.7.0 (#3575)
• 4fe55eb Preserve FileResponse status for range requests (#3568)
• 1f08daf Mark OpenTelemetryMiddleware as experimental (#3574)
• 57de5fa Support HTTP response trailers in TestClient (#3563)
• 03f12b7 Allow HTTPException to use non-standard status codes (#3545)
• 76fd00f Reject WebSocket requests to StaticFiles (#3532)
• f03f65c docs: fix 'its not available' and 'This ensure' wording (#3526)
• 485aca4 docs: the test client is built on httpx2, not httpx (#3525)
• fd662b1 Implement identity on SimpleUser and UnauthenticatedUser (#3271)
• 41db6a7 Stabilize CodSpeed upload buffer allocations (#3524)
• Additional commits viewable in compare view

Updates gitpython to 3.1.62

Release notes

Sourced from gitpython's releases.

3.1.62

What's Changed

• prepare next release by @​Byron in gitpython-developers/GitPython#2222
• Keep bare-repository worktrees non-bare by @​Byron in gitpython-developers/GitPython#2224
• Reject unsafe submodule checkout paths by @​Byron in gitpython-developers/GitPython#2225
• build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group by @​dependabot[bot] in gitpython-developers/GitPython#2226
• fix: join backslash line continuations when reading config values by @​nkbeast in gitpython-developers/GitPython#2227

New Contributors

• @​nkbeast made their first contribution in gitpython-developers/GitPython#2227

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

Commits

• db47516 prepare new release
• 10ec385 get better commit messages from agents
• b754897 test: cover subdirectory discovery and pathspec commands in bare-repo worktre...
• 9ebf8b6 Merge pull request #2227 from nkbeast/fix-config-backslash-continuation
• a15f791 fix: parse joined config values as a whole
• 60dd946 fix: ignore continuation markers in config comments
• 075a664 fix: join backslash line continuations when reading config values
• 62d1e2f Merge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...
• 23d0e92 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
• 8a14adc Merge pull request #2225 from gitpython-developers/submodule-path-hardening
• Additional commits viewable in compare view

Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.1.0

Release notes

Sourced from sqlalchemy's releases.

2.1.0

Released: September 24, 2026

orm

• [orm] [feature] Added _orm.composite.column_template parameter to _orm.composite(). When the composite class is a dataclass, this parameter accepts a string template such as "person_%s", containing exactly one %s placeholder, that's used to generate column names for dataclass fields that don't otherwise have an explicit name, rather than using the bare field name. This removes the need to hand-write a _orm.mapped_column() for each field when the same composite dataclass is mapped multiple times on the same class with different column-name prefixes. Pull request courtesy Leonardo Rosa.

  References: #12575

• [orm] [bug] Fixed issue where pickling an ORM object that had an instance level lazy loader established, such as when the _orm.raiseload() option is used, would emit a spurious warning regarding the loader containing additional criteria, if the object had itself been unpickled from a previous serialization. This would occur for objects that cross more than one serialization boundary, such as when using multiprocessing.

  This change is also backported to: 2.0.53

  References: #13574

• [orm] [bug] Fixed issue where calling _orm.aliased() against an existing _orm.aliased() construct, without passing an explicit selectable, would disregard the selectable of the existing construct and produce an alias of the mapped table instead, if that selectable were anything other than a table or a plain subquery, leading to incorrect results and/or non-working queries.

  This includes _orm.aliased() against a _orm.with_polymorphic() construct, which would previously produce an alias of the base mapped class only, discarding the polymorphic selectable and additional mappers. The new construct now retains these, so that criteria against subclass attributes and the innerjoin and selectable parameters of _orm.with_polymorphic() take effect, and subclass columns are loaded up front. The SQL rendered for these constructs now includes the polymorphic selectable.

  This change is also backported to: 2.0.53

  References: #13583, #13584

... (truncated)

Commits

• See full diff in compare view

Updates alembic to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

• [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

  References: #1846

• [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

  References: #916

bug

• [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

  References: #1768

• [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

• See full diff in compare view

Updates psycopg to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
• Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
• Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
• Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
• Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
• Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
• Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
• Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
• Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
• Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
• Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
• Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
• Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

• a67654d chore: bump psycopg package version to 3.3.6
• 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
• 42966e9 test: add helpful comments to some tests
• 5e8797f test: add reasonable connect_timeout to most tests
• c81ba62 perf: reduce the overhead of wait_async()
• d2bbfe4 refactor: use get_running_loop() in the async wait functions
• 2b1484a test: add a script to measure the async wait functions
• 573cf4a test: fix incorrect wait timing test
• 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
• 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
• Additional commits viewable in compare view

Updates pydantic to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pyjwt to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security

- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.
Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed



JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
</tr></table> 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates anthropic to 1.8.0

Release notes
Sourced from anthropic's releases.

v1.8.0
1.8.0 (2026-09-22)
Full Changelog: v1.7.0...v1.8.0
Features

api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
tools: add_tools() takes effect straight away (#874) (06d0a6b)
tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

docs: add descriptions to the Dreams API reference (5574c63)
docs: add descriptions to the User Profiles API reference (5574c63)
docs: add memory store descriptions to the Managed Agents API reference (5574c63)
docs: improve descriptions in the Dreams API reference (1f5e477)
docs: simplify the session thread agent type description (a45b7ec)
docs: update diagnostics field descriptions on beta messages (367750c)
internal: fix tests (70c8cbd)
internal: remove mypy (be01ed6)
tests: update fixtures (77f6df8)

Documentation

add path and header parameter descriptions (f429a30)

Refactors

client: remove the request param transform in favour of the JSON encoder (539422c)




Changelog
Sourced from anthropic's changelog.

1.8.0 (2026-09-22)
Full Changelog: v1.7.0...v1.8.0
Features

api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
tools: add_tools() takes effect straight away (#874) (06d0a6b)
tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

docs: add descriptions to the Dreams API reference (5574c63)
docs: add descriptions to the User Profiles API reference (5574c63)
docs: add memory store descriptions to the Managed Agents API reference (5574c63)
docs: improve descriptions in the Dreams API reference (1f5e477)
docs: simplify the session thread agent type description (a45b7ec)
docs: update diagnostics field descriptions on beta messages (367750c)
internal: fix tests (70c8cbd)
internal: remove mypy (be01ed6)
tests: update fixtures (77f6df8)

Documentation

add path and header parameter descriptions (f429a30)

Refactors

client: remove the request param transform in favour of the JSON encoder (539422c)

1.7.0 (2026-09-18)
Full Changelog: v1.6.0...v1.7.0
Features

api: add group with display_name to rate limits, deprecate group_type (28f0a83)
tools: add compact_before_next_turn() to the tool runner (#641) (8b23fb3)

Bug Fixes


... (truncated)


Commits

4421d56 Merge pull request #1946 from anthropics/release-please--branches--main--chan...
d0247c2 release: 1.8.0
be01ed6 chore(internal): remove mypy
06d0a6b fix(tools): add_tools() takes effect straight away (#874)
af029bd fix(streaming): avoid a Python 3.13 crash at exit when a stream is left open
4687310 fix(tools): leave reply-only params off the tool runner's compaction request ...
b5cc700 feat(api): add support for claude-opus-5-5, inline tool definitions and MCP t...
70c8cbd chore(internal): fix tests
539422c refactor(client): remove the request param transform in favour of the JSON en...
10a4c07 codegen metadata
Additional commits viewable in compare view




Updates ansible-core to 2.21.4

Release notes
Sourced from ansible-core's releases.

v2.21.4
Changelog
See the full changelog for the changes included in this release.
Release Artifacts

Built Distribution: ansible_core-2.21.4-py3-none-any.whl - ‌2457154 bytes

ebe74d9c8fadcb41ad2151e031bf1e785e3098aaa015019b4e19a0a96f0dcc4f (SHA256)


Source Distribution: ansible_core-2.21.4.tar.gz - ‌3394492 bytes

81a9329f4f12cfa5008dcab5d1bf23ae69b7effc08c0f00048ab2461147ae95a (SHA256)






Commits

997ad6b New release v2.21.4 (#87502)
689832e Update Ansible release version to v2.21.4rc1.post0. (#87473)
9627c06 New release v2.21.4rc1 (#87470)
40bfd1d [stable-2.21] tempfile: sanitize prefix/suffix to prevent path traversal (#87...