Skip to content

chore(deps): update python dependencies#36

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/python-dependencies
Open

chore(deps): update python dependencies#36
renovate[bot] wants to merge 1 commit intomainfrom
renovate/python-dependencies

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 9, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
PyGithub 2.8.12.9.0 age confidence dependencies minor
PyJWT 2.11.02.12.1 age confidence dependencies minor
cosmic-ray 8.4.38.4.4 age confidence dev patch
dynaconf 3.2.123.2.13 age confidence dependencies patch
fastapi (changelog) 0.128.00.135.2 age confidence dependencies minor
opentelemetry-api 1.39.11.40.0 age confidence dependencies minor
opentelemetry-exporter-otlp 1.39.11.40.0 age confidence dependencies minor
opentelemetry-sdk 1.39.11.40.0 age confidence dependencies minor
pydantic-settings (changelog) 2.12.02.13.1 age confidence dependencies minor
pytest-cov (changelog) 7.0.07.1.0 age confidence dev minor
python >=3.11==3.14.3 age confidence dependencies pin
ruff (source, changelog) 0.14.140.15.8 age confidence dev minor
uvicorn (changelog) 0.40.00.42.0 age confidence dependencies minor

Release Notes

pygithub/pygithub (PyGithub)

v2.9.0

Compare Source

Notable changes
Lazy PyGithub objects

The notion of lazy objects has been added to some PyGithub classes in version 2.6.0. This release now makes all CompletableGithubObjects optionally lazy (if useful). See PyGithub/PyGithub#3403 for a complete list.

In lazy mode, getting a PyGithub object does not send a request to the GitHub API. Only accessing methods and properties sends the necessary requests to the GitHub API:

# Use lazy mode
g = Github(auth=auth, lazy=True)

# these method calls do not send requests to the GitHub API
user = g.get_user("PyGithub")    # get the user
repo = user.get_repo("PyGithub") # get the user's repo
pull = repo.get_pull(3403)       # get a known pull request
issue = pull.as_issue()          # turn the pull request into an issue

# these method and property calls send requests to Github API
issue.create_reaction("rocket")  # create a reaction
created = repo.created_at        # get property of lazy object repo

# once a lazy object has been fetched, all properties are available (no more requests)
licence = repo.license

All PyGithub classes that implement CompletableGithubObject support lazy mode (if useful). This is only useful for classes that have methods creating, changing, or getting objects.

By default, PyGithub objects are not lazy.

PyGithub objects with a paginated property

The GitHub API has the "feature" of paginated properties. Some objects returned by the API have a property that allows for pagination. Fetching subsequent pages of that property means fetching the entire object (with all other properties) and the specified page of the paginated property. Iterating over the paginated property means fetching all other properties multiple times. Fortunately, the allowed size of each page (per_page is usually 300, in contrast to the "usual" per_page maximum of 100).

Objects with paginated properties:

  • Commit.files
  • Comparison.commits
  • EnterpriseConsumedLicenses.users

This PR makes iterating those paginated properties use the configured per_page setting.

It further allows to specify an individual per_page when either retrieving such objects, or fetching paginated properties.

See Classes with paginated properties for details.

Drop Python 3.8 support due to End-of-Life

Python 3.8 reached its end-of-life September 6, 2024. Support has been removed with this release.

Deprecations
  • Method delete of Reaction is deprecated, use IssueComment.delete_reaction,
    PullRequestComment.delete_reaction, CommitComment.delete_reaction or Issue.delete_reaction instead.
  • Method Issue.assignee and parameter Issue.edit(assignee=…) are deprecated,
    use Issue.assignees and Issue.edit(assignees=…) instead.
  • Method Organization.edit_hook is deprecated, use Organization.get_hook(id).edit(…) instead.
    If you need to avoid Organization.get_hook(id) to fetch the Hook object from Github API,
    use a lazy Github instance:
Github(…, lazy=True).get_organization(…).get_hook(id).edit(…)
  • Methods Team.add_to_members and Team.remove_from_members are deprecated,
    use Team.add_membership or Team.remove_membership instead.
New Features
Improvements
Bug Fixes
Maintenance

New Contributors

Full Changelog: PyGithub/PyGithub@v2.8.0...v2.9.0

jpadilla/pyjwt (PyJWT)

v2.12.1

Compare Source

Changed


- Migrate the ``dev``, ``docs``, and ``tests`` package extras to dependency groups by @&#8203;kurtmckee in `#&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>`__

`v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>`__
------------------------------------------------------------------------

Fixed
~~~~~

- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Annotate PyJWKSet.keys for pyright by @&#8203;tamird in `#&#8203;1134 <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @&#8203;veeceey in `#&#8203;1133 <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @&#8203;akx in `#&#8203;1143 <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @&#8203;dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `#&#8203;1148 <https://github.com/jpadilla/pyjwt/pull/1148>`__

Added
~~~~~

- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @&#8203;kurtmckee in `#&#8203;1105 <https://github.com/jpadilla/pyjwt/pull/1105>`__
- Validate key against allowed types for Algorithm family in `#&#8203;964 <https://github.com/jpadilla/pyjwt/pull/964>`__
- Add iterator for JWKSet in `#&#8203;1041 <https://github.com/jpadilla/pyjwt/pull/1041>`__
- Validate `iss` claim is a string during encoding and decoding by @&#8203;pachewise in `#&#8203;1040 <https://github.com/jpadilla/pyjwt/pull/1040>`__
- Improve typing/logic for `options` in decode, decode_complete by @&#8203;pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Declare float supported type for lifespan and timeout by @&#8203;nikitagashkov in `#&#8203;1068 <https://github.com/jpadilla/pyjwt/pull/1068>`__
- Fix ``SyntaxWarning``\s/``DeprecationWarning``\s caused by invalid escape sequences by @&#8203;kurtmckee in `#&#8203;1103 <https://github.com/jpadilla/pyjwt/pull/1103>`__
- Development: Build a shared wheel once to speed up test suite setup times by @&#8203;kurtmckee in `#&#8203;1114 <https://github.com/jpadilla/pyjwt/pull/1114>`__
- Development: Test type annotations across all supported Python versions,
  increase the strictness of the type checking, and remove the mypy pre-commit hook
  by @&#8203;kurtmckee in `#&#8203;1112 <https://github.com/jpadilla/pyjwt/pull/1112>`__

Added
~~~~~

- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @&#8203;kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @&#8203;kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @&#8203;kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @&#8203;kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @&#8203;kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @&#8203;djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @&#8203;pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @&#8203;cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @&#8203;kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Prevent partial matching of `iss` claim by @&#8203;fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__
-----------------------------------------------------------------------

Changed
  • Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @​luhn in #&#8203;975 <https://github.com/jpadilla/pyjwt/pull/975>__

  • Use Sequence for parameter types rather than List where applicable by @​imnotjames in #&#8203;970 <https://github.com/jpadilla/pyjwt/pull/970>__

  • Add JWK support to JWT encode by @​luhn in #&#8203;979 <https://github.com/jpadilla/pyjwt/pull/979>__

  • Encoding and decoding payloads using the none algorithm by @​jpadilla in #c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>__

    Before:

    .. code-block:: pycon

    import jwt
    jwt.encode({"payload": "abc"}, key=None, algorithm=None)

    After:

    .. code-block:: pycon

    import jwt
    jwt.encode({"payload": "abc"}, key=None, algorithm="none")

  • Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @​Divan009 in #&#8203;1005 <https://github.com/jpadilla/pyjwt/pull/1005>__

  • Refactor project configuration files from setup.cfg to pyproject.toml by @​cleder in #&#8203;995 <https://github.com/jpadilla/pyjwt/pull/995>__

  • Ruff linter and formatter changes by @​gagandeepp in #&#8203;1001 <https://github.com/jpadilla/pyjwt/pull/1001>__

  • Drop support for Python 3.8 (EOL) by @​kkirsche in #&#8203;1007 <https://github.com/jpadilla/pyjwt/pull/1007>__

Fixed


- Encode EC keys with a fixed bit length by @&#8203;etianen in `#&#8203;990 <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @&#8203;kurtmckee in `#&#8203;977 <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @&#8203;pachewise in `#&#8203;974 <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @&#8203;RbnRncn in `#&#8203;982 <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @&#8203;pachewise in `#&#8203;986 <https://github.com/jpadilla/pyjwt/pull/986>`__
- Fix ``test_utils.py`` not to xfail by @&#8203;pachewise in `#&#8203;987 <https://github.com/jpadilla/pyjwt/pull/987>`__
- Docs: Correct `jwt.decode` audience param doc expression by @&#8203;peter279k in `#&#8203;994 <https://github.com/jpadilla/pyjwt/pull/994>`__

Added
  • Add support for python 3.13 by @​hugovk in #&#8203;972 <https://github.com/jpadilla/pyjwt/pull/972>__
  • Create SECURITY.md by @​auvipy and @​jpadilla in #&#8203;973 <https://github.com/jpadilla/pyjwt/pull/973>__
  • Docs: Add PS256 encoding and decoding usage by @​peter279k in #&#8203;992 <https://github.com/jpadilla/pyjwt/pull/992>__
  • Docs: Add API docs for PyJWK by @​luhn in #&#8203;980 <https://github.com/jpadilla/pyjwt/pull/980>__
  • Docs: Add EdDSA algorithm encoding/decoding usage by @​peter279k in #&#8203;993 <https://github.com/jpadilla/pyjwt/pull/993>__
  • Include checkers and linters for pyproject.toml in pre-commit by @​cleder in #&#8203;1002 <https://github.com/jpadilla/pyjwt/pull/1002>__
  • Docs: Add ES256 decoding usage by @​Gautam-Hegde in #&#8203;1003 <https://github.com/jpadilla/pyjwt/pull/1003>__

v2.12.0

Compare Source

Security

What's Changed

New Contributors

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

dynaconf/dynaconf (dynaconf)

v3.2.13

Compare Source

What's Changed

Bug Fixes

Full Changelog: dynaconf/dynaconf@3.2.12...3.2.13

fastapi/fastapi (fastapi)

v0.135.2

Compare Source

Upgrades
Docs
Translations
Internal

v0.135.1

Compare Source

Fixes
  • 🐛 Fix, avoid yield from a TaskGroup, only as an async context manager, closed in the request async exit stack. PR #​15038 by @​tiangolo.
Docs
Internal

v0.135.0

Compare Source

Features

v0.134.0

Compare Source

Features
  • ✨ Add support for streaming JSON Lines and binary data with yield. PR #​15022 by @​tiangolo.
    • This also upgrades Starlette from >=0.40.0 to >=0.46.0, as it's needed to properly unrwap and re-raise exceptions from exception groups.
    • New docs: Stream JSON Lines.
    • And new docs: Stream Data.
Docs
Internal

v0.133.1

Compare Source

Features
Internal

v0.133.0

Compare Source

v0.132.1

Compare Source

Refactors
Internal

v0.132.0

Compare Source

Breaking Changes
  • 🔒️ Add strict_content_type checking for JSON requests. PR #​14978 by @​tiangolo.
    • Now FastAPI checks, by default, that JSON requests have a Content-Type header with a valid JSON value, like application/json, and rejects requests that don't.
    • If the clients for your app don't send a valid Content-Type header you can disable this with strict_content_type=False.
    • Check the new docs: Strict Content-Type Checking.
Internal

v0.131.0

Compare Source

Breaking Changes

v0.130.0

Compare Source

Features

v0.129.2

Compare Source

Internal

v0.129.1

Compare Source

Fixes
  • ♻️ Fix JSON Schema for bytes, use "contentMediaType": "application/octet-stream" instead of "format": "binary". PR #​14953 by @​tiangolo.
Docs
Translations
Internal

v0.129.0

Compare Source

Breaking Changes
Refactors
Docs
Internal

v0.128.8

Compare Source

Docs
Internal

v0.128.7

Compare Source

Features
Refactors
  • ♻️ Simplify reading files in memory, do it sequentially instead of (fake) parallel. PR #​14884 by @​tiangolo.
Docs
Internal

[


Configuration

📅 Schedule: Branch creation - "before 6am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from dannysauer as a code owner February 9, 2026 05:58
@renovate renovate bot added the dependencies label Feb 9, 2026
@renovate renovate bot enabled auto-merge (squash) February 9, 2026 05:58
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 9, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (931443b) to head (4a876db).

Additional details and impacted files
@@            Coverage Diff            @@
##              main       #36   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          982       982           
  Branches       113       113           
=========================================
  Hits           982       982           
Flag Coverage Δ
unittests 100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 9, 2026

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.128.5 chore(deps): update dependency fastapi to v0.128.6 Feb 9, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from f6772f0 to 9fe3fd1 Compare February 9, 2026 18:47
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 9, 2026

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.128.6 chore(deps): update dependency fastapi to v0.128.7 Feb 10, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from 9fe3fd1 to b688577 Compare February 10, 2026 14:38
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.128.7 chore(deps): update python dependencies Feb 10, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from b688577 to e64ba08 Compare February 10, 2026 21:01
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update python dependencies chore(deps): update dependency fastapi to v0.128.7 Feb 11, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from e64ba08 to 1e682c1 Compare February 11, 2026 02:58
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.128.7 chore(deps): update dependency fastapi to v0.128.8 Feb 11, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from 1e682c1 to 027980d Compare February 11, 2026 17:39
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.128.8 chore(deps): update dependency fastapi to v0.129.0 Feb 12, 2026
@renovate renovate bot force-pushed the renovate/python-dependencies branch from 027980d to b48fc4c Compare February 12, 2026 14:37
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot force-pushed the renovate/python-dependencies branch from b48fc4c to d5d2716 Compare February 15, 2026 13:59
@renovate renovate bot changed the title chore(deps): update dependency fastapi to v0.129.0 chore(deps): update python dependencies Feb 15, 2026
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot force-pushed the renovate/python-dependencies branch from d5d2716 to 9a859db Compare February 17, 2026 01:42
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot force-pushed the renovate/python-dependencies branch from 9a859db to d796be5 Compare February 17, 2026 17:05
@github-actions
Copy link
Copy Markdown
Contributor

🐳 Docker image built and pushed: ghcr.io/dannysauer/stampbot:pr-36

@renovate renovate bot force-pushed the renovate/python-dependencies branch 17 times, most recently from 4a876db to b27e114 Compare March 4, 2026 15:05
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Mar 4, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock
Updating dependencies
Resolving dependencies...


Because opentelemetry-sdk (1.40.0) depends on opentelemetry-semantic-conventions (0.61b0)
 and opentelemetry-instrumentation-fastapi (0.60b1) depends on opentelemetry-semantic-conventions (0.60b1), opentelemetry-sdk (1.40.0) is incompatible with opentelemetry-instrumentation-fastapi (0.60b1).
And because no versions of opentelemetry-instrumentation-fastapi match >0.60b1,<0.61, opentelemetry-sdk (1.40.0) is incompatible with opentelemetry-instrumentation-fastapi (>=0.60b1,<0.61).
So, because stampbot depends on both opentelemetry-sdk (1.40.0) and opentelemetry-instrumentation-fastapi (^0.60b1), version solving failed.

@renovate renovate bot force-pushed the renovate/python-dependencies branch 2 times, most recently from c3f3efa to 5eaeed3 Compare March 12, 2026 18:39
@renovate renovate bot force-pushed the renovate/python-dependencies branch 9 times, most recently from 79281e8 to 1be6286 Compare March 19, 2026 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants