Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 6 updates - #823

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/git_issue_agent/minor-and-patch-1fbe0b30c0
Open

chore(deps): Bump the minor-and-patch group across 1 directory with 6 updates#823
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/git_issue_agent/minor-and-patch-1fbe0b30c0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the /a2a/git_issue_agent directory:

Package From To
python-dotenv 1.2.2 1.2.3
a2a-sdk 1.1.0 1.1.2
litellm 1.91.1 1.98.0
starlette 1.3.1 1.6.0
lxml 6.1.1 6.1.2
orjson 3.11.9 3.12.0

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates a2a-sdk from 1.1.0 to 1.1.2

Release notes

Sourced from a2a-sdk's releases.

v1.1.2

1.1.2 (2026-07-20)

Features

  • server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

  • agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
  • persist early producer failure as FAILED with originating message (#1106) (4e3d724)

v1.1.1

1.1.1 (2026-07-15)

Bug Fixes

  • server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

  • grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
  • http: eliminate httpx-sse dependency (#1132) (0d82ab9)
Changelog

Sourced from a2a-sdk's changelog.

1.1.2 (2026-07-20)

Features

  • server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

  • agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
  • persist early producer failure as FAILED with originating message (#1106) (4e3d724)

1.1.1 (2026-07-15)

Bug Fixes

  • server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

  • grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
  • http: eliminate httpx-sse dependency (#1132) (0d82ab9)
Commits
  • 3e6fa6a chore(main): release 1.1.2 (#1139)
  • 9801f46 feat(server): add aclose() to drain ActiveTask background tasks (#1101) (#1105)
  • d19c4d2 fix(agent_execution): resolve ActiveTask 'destroyed but pending' warning duri...
  • 4e3d724 fix: persist early producer failure as FAILED with originating message (#1106)
  • 86c6b0d chore(main): release 1.1.1 (#1103)
  • 0d82ab9 refactor(http): eliminate third-party httpx-sse dependency (#1132)
  • 723880e refactor(grpc): remove grpcio-status dependency (#1130)
  • 343373b test: expand itk scenarios with ts java and rust agents (#1129)
  • e7eafe3 chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#1109)
  • 46b292b fix(server): improve Swagger /docs example annotations for A2A routes (#1092)
  • Additional commits viewable in compare view

Updates litellm from 1.91.1 to 1.98.0

Release notes

Sourced from litellm's releases.

v1.98.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.98.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.98.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.98.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • d8f71d7 fix(ui): keep completion-mode models in the playground chat dropdown (backpor...
  • bc6e7df Merge pull request #37042 from BerriAI/litellm_internal_staging
  • 973329e Merge pull request #37069 from BerriAI/litellm_/frosty-goldwasser-93a2a1
  • de2b220 test(e2e/ui): assert the log drawer chevrons by their lucide classes
  • ae8afec Merge pull request #37066 from BerriAI/litellm_/release-ui-build-1e15d9
  • b3077c9 chore: update Next.js build artifacts (2026-08-16 00:22 UTC, node v24.19.0)
  • 992a812 Merge pull request #37010 from BerriAI/litellm_shadcn_next_0814
  • 91aee78 Merge pull request #37065 from BerriAI/litellm_/nice-wilson-9fbed6
  • dddee7d Merge pull request #37063 from BerriAI/litellm_pr_template_proof_format
  • 1968562 Merge pull request #37059 from BerriAI/litellm_/circleci-pipeline-triage-9b92e5
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Version 1.4.1

What's Changed

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

  • Reject inverted single-byte ranges in FileResponse #3389.
  • Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

  • Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

  • Expand default excluded content types in GZipMiddleware #3421.

Fixed

  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware #3420.

1.4.1 (August 5, 2026)

Fixed

  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

  • GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

  • Some minor corrections for error handling cases.

Other changes

  • Built with Cython 3.2.9.
Commits
  • f2874e9 Update release date.
  • 687a295 Build: Exclude Py3.8 from windows-arm builds.
  • acadc56 Build: Remove outdated build target.
  • 59f93eb Build: Split old-Linux and other-Py3.8 builds.
  • 923df83 Build: Fix manylinux2014 build.
  • 975cc83 Build: Fix Px3.8 build setup.
  • 09e5d3e Build: Fix cibuildwheel version.
  • 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
  • 5567037 Build: Exclude Py3.15 from 32bit builds.
  • 904db40 Build: Update cibuildwheel to include Py3.15.
  • Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

  • Serialization implementation substantially rewritten.
  • Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
  • No longer publish PyPI wheels for ppc64le and s390x.
Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

  • Serialization implementation substantially rewritten.
  • Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
  • No longer publish PyPI wheels for ppc64le and s390x.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 6…
2428ef2 
… updates

Bumps the minor-and-patch group with 6 updates in the /a2a/git_issue_agent directory:

| Package | From | To |
| --- | --- | --- |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [a2a-sdk](https://github.com/a2aproject/a2a-python) | `1.1.0` | `1.1.2` |
| [litellm](https://github.com/BerriAI/litellm) | `1.91.1` | `1.98.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.2` |
| [orjson](https://github.com/ijl/orjson) | `3.11.9` | `3.12.0` |



Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `a2a-sdk` from 1.1.0 to 1.1.2
- [Release notes](https://github.com/a2aproject/a2a-python/releases)
- [Changelog](https://github.com/a2aproject/a2a-python/blob/main/CHANGELOG.md)
- [Commits](a2aproject/a2a-python@v1.1.0...v1.1.2)

Updates `litellm` from 1.91.1 to 1.98.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.91.1...v1.98.0)

Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)

Updates `lxml` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.1...lxml-6.1.2)

Updates `orjson` from 3.11.9 to 3.12.0
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.11.9...3.12.0)

---
updated-dependencies:
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: a2a-sdk
  dependency-version: 1.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.98.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lxml
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: orjson
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Rossoctl Issue Prioritization
Status: New/ToDo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubambiza