Skip to content

Bump the uv group across 1 directory with 15 updates - #199

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-78bec24eb8
Open

Bump the uv group across 1 directory with 15 updates#199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-78bec24eb8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 8 updates in the / directory:

Package From To
langchain 1.2.0 1.3.9
aiohttp 3.13.5 3.14.3
dulwich 0.25.0 1.2.5
pillow 12.1.1 12.3.0
pydantic-settings 2.12.0 2.14.2
python-dotenv 1.2.1 1.2.2
ujson 5.12.0 5.13.0
urllib3 2.6.3 2.7.0

Updates langchain from 1.2.0 to 1.3.9

Release notes

Sourced from langchain's releases.

langchain==1.3.9

Changes since langchain==1.3.8

release(anthropic): 1.4.6 (#38105) release(langchain): 1.3.9 (#38104) fix(langchain,anthropic): confine file-search results and tighten anthropic allowed_prefixes (#38106)

langchain==1.3.8

Changes since langchain==1.3.7

release(langchain): 1.3.8 (#38096) style(core,langchain,langchain-classic,partners): replace double backticks in docstrings (#38095) release(core): 1.4.6 (#38061) chore(langchain): add overloads to create_agent (#34309) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470) fix(langchain): support async middleware decorator typing (#34584) fix(langchain): tighten structured output model fallbacks (#38042) release(anthropic): 1.4.5 (#38036) hotfix(core): bump lockfile(s) (#38032) refactor(langchain): refactor test_create_agent_tool_validation (#34443)

langchain==1.3.7

Changes since langchain==1.3.6

release(langchain): 1.3.7 (#38024) style(langchain): add ruff rules ARG (#34435) feat(langchain): add ProviderToolSearchMiddleware (#37969) chore(langchain): activate mypy warn_return_any (#34249) test(langchain): mark legacy trigger view for 2.0 removal (#38002)

langchain==1.3.6

Changes since langchain==1.3.5

release(langchain): 1.3.6 (#38001) fix(langchain): preserve summarization trigger compatibility (#38000)

langchain==1.3.5

Changes since langchain==1.3.4

release(langchain): 1.3.5 (#37998) feat(langchain): port AND-capable trigger conditions to SummarizationMiddleware (#34576) hotfix(openai): min core dep (#37990) feat(openai): support apply_patch built-in tool (#37157) chore: bump pyarrow from 21.0.0 to 23.0.1 in /libs/langchain_v1 (#37930) chore: bump dependencies (#37892) chore: bump aiohttp from 3.13.4 to 3.14.0 in /libs/langchain_v1 (#37888)

langchain-openai==1.3.5

Changes since langchain-openai==1.3.4

... (truncated)

Commits
  • 3bfb6a3 release(langchain): 1.3.9 (#38104)
  • dcaf779 fix(langchain,anthropic): confine file-search results and tighten anthropic `...
  • 0392b6b fix(core): fix Pydantic v1 support in tools/runnable (#33698)
  • f6d63bc release(langchain): 1.3.8 (#38096)
  • 5d20596 style(core,langchain,langchain-classic,partners): replace double backticks in...
  • fb55c66 chore: bump langsmith from 0.8.9 to 0.8.14 in /libs/partners/huggingface (#38...
  • 51daae5 chore: bump langsmith from 0.8.9 to 0.8.14 in /libs/partners/chroma (#38092)
  • 70e9579 chore: bump langsmith from 0.8.9 to 0.8.14 in /libs/partners/fireworks (#38093)
  • 6c0e9af chore: bump langsmith from 0.8.9 to 0.8.14 in /libs/partners/xai (#38094)
  • 222dc84 ci(infra): clarify early PR auto-close guidance (#38090)
  • Additional commits viewable in compare view

Updates langchain-openai from 1.1.6 to 1.5.0

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.5.0

Changes since langchain-openai==1.4.3

release(openai): 1.5.0 (#39629) feat(openai): support openai 3.0 SDK (#39613) chore(partners): bump langgraph floor in openai and huggingface lockfiles (#39617)

langchain-openai==1.4.3

Changes since langchain-openai==1.4.2

release(openai): 1.4.3 (#39485) fix(openai): filter invalid tool calls from content (#39366) chore(openai): update guidance for responses API for OpenAI-compatible providers (#39327) chore(openai): update docstring for include_response_headers (#39326)

langchain-openai==1.4.2

Changes since langchain-openai==1.4.1

release(openai): 1.4.2 (#39322) fix(openai): handle ContextWindowExceededError (#39300) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(openai): filter langchain-generated content block IDs (#39209) fix(openai): preserve Responses text options (#39204) fix(openai): redact MCP authorization (#39155) chore(model-profiles): refresh model profile data (#39050)

langchain-openai==1.4.1

Changes since langchain-openai==1.4.0

release(openai): 1.4.1 (#39045) feat(anthropic,fireworks,openai): support langsmith gateway through env var (#38742) fix(openai): correct gpt-5.3-chat-latest profile (#39009)

langchain-openai==1.4.0

Changes since langchain-openai==1.3.5

release(openai): 1.4.0 (#38983) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/openai (#38999) feat(core): add reasoning_effort as a standard chat model parameter (#38887) chore(model-profiles): refresh model profile data (#38797)

langchain-openai==1.3.5

Changes since langchain-openai==1.3.4

release(openai): 1.3.5 (#38785) feat(openai): support explicit prompt caching (#38762) chore(model-profiles): refresh model profile data (#38774)

langchain-openai==1.3.4

Changes since langchain-openai==1.3.3

... (truncated)

Commits

Updates gitpython from 3.1.45 to 3.1.59

Release notes

Sourced from gitpython's releases.

3.1.59 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

... (truncated)

Commits
  • 66340d7 prepare changelog prior to release
  • a5e047d Merge pull request #2211 from gitpython-developers/config-sanitize-more
  • ef7568e fix: ignore includes in submodule configuration
  • 4b4e47f fix: preserve multiline config values when writing
  • b473abb Merge pull request #2210 from gitpython-developers/fix-clone-unsafe-option
  • 5ff52cc Merge pull request #2209 from caroescm/fix-index-add-chmod
  • b68afff Block separate git directories during clone
  • 93677a0 fix: index.add() now supports filters (#2021)
  • 9729ed3 Merge pull request #2208 from gitpython-developers/security-fixes
  • ce9d8e8 prepare next release
  • Additional commits viewable in compare view

Updates aiohttp from 3.13.5 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates dulwich from 0.25.0 to 1.2.5

Release notes

Sourced from dulwich's releases.

1.2.5

This is a security release. All users are encouraged to upgrade.

Security fixes

  • GHSA-gfhv-vqv2-4544 -- Validate submodule paths in porcelain.submodule_update (and thus porcelain.clone(recurse_submodules=True)). A crafted upstream repository could carry a submodule whose path was .git/hooks (or any other path inside .git or above the work tree), causing the submodule's tree contents to be written there with their executable bits intact. The dulwich analogue of git's CVE-2024-32002 / CVE-2024-32004. (Reported by tonghuaroot)

  • CVE-2026-42305 -- Harden tree path validation against entry names that are harmless on POSIX but dangerous when checked out on Windows. validate_path_element_ntfs now also rejects Windows path separators, the alternate data stream marker :, NTFS 8.3 short-name aliases of .git, and reserved Windows device names. core.protectNTFS now defaults to true on every platform, and both core.protectNTFS and core.protectHFS are now read under their correct option names. (Reported by Christopher Toth)

  • CVE-2026-42563 -- Shell-quote values substituted into ProcessMergeDriver commands. A malicious branch could inject shell commands when a merge driver referencing %P was configured. (Reported by Ravishanker Kusuma (hayageek))

  • CVE-2026-47712 -- Sanitize commit subjects used in porcelain.format_patch filenames so a malicious subject (e.g. x/../../x) cannot direct the generated patch outside outdir. (Reported by Christopher Toth)

  • receive.maxInputSize -- Honour receive.maxInputSize in ReceivePackHandler. Previously a remote unauthenticated client could send a tiny crafted pack that declared a huge dest_size and trigger hundreds of MB of allocation over git-receive-pack. (Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @ University of Sydney)

1.2.4

What's Changed

Full Changelog: jelmer/dulwich@dulwich-1.2.3...dulwich-1.2.4

1.2.1

Changes since 1.2.0

  • Derive the LFS endpoint as the remote's on-disk LFS store (<remote>/.git/lfs for worktrees, <remote>/lfs for bare repos) when remote.origin.url points at a local filesystem path or file:// URL, matching git-lfs behaviour. Previously the built-in smudge filter constructed an HTTP-style <remote>.git/info/lfs path that did not exist on disk, leaving LFS-tracked files as pointers when cloning from a local repo.

  • Deduplicate objects when writing a multi-pack-index. Objects present in multiple packs (e.g. after git gc creates a cruft pack) would otherwise produce an OIDL chunk with repeated SHAs, causing git multi-pack-index verify to fail with "oid lookup out of order". (#2152)

  • Extend ignorecase and precomposeunicode support to index lookups. (#1807)

1.2.0

Notable changes since 1.1.0

New features

  • Add am command and porcelain.am() for applying mailbox-style email patches (git am), with state persistence for --continue, --skip, --abort, and --quit recovery (#1692).
  • Add apply command and porcelain.apply_patch() for applying unified diffs, including rename/copy detection, binary patches with Git's base85 encoding, and --3way merge fallback (#1784).

... (truncated)

Changelog

Sourced from dulwich's changelog.

1.2.5 2026-05-28

  • SECURITY(GHSA-gfhv-vqv2-4544): Validate submodule paths in porcelain.submodule_update (and thus porcelain.clone(recurse_submodules=True)). A crafted upstream repository could carry a submodule whose path was .git/hooks (or any other path inside .git or above the work tree), causing the submodule's tree contents to be written there with their executable bits intact -- dropping a hook that later commands would run. Submodule paths are now rejected if they are absolute or carry a component that the configured path validator refuses, and the submodule's own tree is materialized with the same validator. This is the dulwich analogue of git's CVE-2024-32002 / CVE-2024-32004. (Jelmer Vernooij; reported by tonghuaroot)

  • SECURITY(CVE-2026-42305): Harden tree path validation against entry names that are harmless on POSIX but dangerous when checked out on Windows. A crafted tree could previously carry such names through to the work tree. validate_path_element_ntfs now also rejects:

    • Windows path separators, so an entry named .git\hooks\pre-commit.exe can no longer materialize a file inside .git that Git for Windows would execute.
    • The alternate data stream marker : (e.g. .git::$INDEX_ALLOCATION, which writes into .git directly).
    • NTFS 8.3 short-name aliases of .git (git~<digits>); only git~1 was rejected before.
    • Reserved Windows device names (CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9), including with an extension or trailing dots/spaces such as NUL.txt or COM1 .bar.

    In addition, core.protectNTFS now defaults to true on every platform (matching git after CVE-2019-1353), so a POSIX clone no longer accepts paths that would be unsafe on a later Windows clone, and both core.protectNTFS and core.protectHFS are now read under their correct option names, having previously been silently ignored. POSIX users who need literal NTFS-unsafe filenames can opt out with core.protectNTFS=false. (Jelmer Vernooij; reported by Christopher Toth)

  • SECURITY (CVE-2026-42563): Shell-quote values substituted into ProcessMergeDriver commands. %P is a path from the git tree, so a malicious branch could inject shell commands when the user had a merge driver configured that referenced %P. (Jelmer Vernooij; reported by Ravishanker Kusuma (hayageek))

  • SECURITY(CVE-2026-47712): Sanitize commit subjects used in porcelain.format_patch filenames so a malicious subject (e.g. x/../../x) cannot direct the generated patch outside outdir. get_summary now matches git's format_sanitized_subject.

... (truncated)

Commits
  • 073f4df Release 1.2.5
  • 5f85d3e tests: fix Windows-only failures in NTFS and merge-driver tests
  • 25313ad Merge branch 'advisory-5'
  • 1ca1814 submodule: Reject unsafe submodule paths in submodule_update
  • 3559ef1 Merge branch 'advisory-4'
  • f860ca4 server: Honour receive.maxInputSize to bound received packs
  • 0fd6e6b Merge branch 'advisory-3'
  • 0110b88 Merge branch 'advisory-2'
  • 49eb56e Add NEWS entry for CVE-2026-42305
  • 57efc4a Merge branch 'advisory-1'
  • Additional commits viewable in compare view

Updates idna from 3.11 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

  • When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

  • Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
  • Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

  • Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.
  • Raise the minimum supported Python version to 3.9
  • Various code quality improvements

3.15 (2026-05-12)

  • Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

  • Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass

... (truncated)

Commits
  • f39ea90 Release 3.18
  • 40f4e40 Pre-release 3.18rc0
  • 1a5bf80 Merge pull request #253 from kjd/lenient-decode
  • 5bbb26f Merge branch 'master' into lenient-decode
  • c532bae Rename decode() lenient= option to display= (issue #248)
  • 0b1758b Merge pull request #252 from kjd/release-3.17
  • f48619c Release 3.17
  • 7421ba8 Pre-release 3.17rc0
  • 22ebb73 Merge pull request #251 from kjd/structure-optimizations
  • 2a7ac0a Drop redundant parallel-arrays comment from uts46data
  • Additional commits viewable in compare view

Updates langchain-core from 1.2.28 to 1.5.4

Release notes

Sourced from langchain-core's releases.

langchain-core==1.5.4

Changes since langchain-core==1.5.3

release(core): 1.5.4 (#39592) fix(core): compat with pydantic 2.14 (#39328) fix(core): stop StructuredPrompt from mutating caller kwargs (#39174) fix(core): preserve flat tool args schema for RootModel runnables (#39307) fix(core): close internally created event loops in streaming tracers (#39222) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(core): preserve OpenAI file blocks (#39205) fix(core): document reserved argument names for tools (#39207) fix(core): handle injected args for subclasses of BaseTool (#39202) fix(core): respect include_injected=False with filter_args (#39200) fix(core): redact streaming callback options (#39179) fix(core): type text stream projections (#39170) chore(infra): add missing LICENSE files to publishable packages (#39146)

langchain-core==1.5.3

Changes since langchain-core==1.5.2

release(core): 1.5.3 (#39145) fix(core): fall back to LANGSMITH_API_KEY for gateway (#39115)

langchain-core==1.5.2

Changes since langchain-core==1.5.1

release(core): 1.5.2 (#39108) fix(core): handle empty string in gateway env vars (#39107) chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (#39032) chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (#39033) chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (#39029)

langchain-core==1.5.1

Changes since langchain-core==1.5.0

release(core): 1.5.1 (#39042) feat(anthropic,fireworks,openai): support langsmith gateway through env var (#38742) fix(core): use tool_call_schema cache for BaseTool token counting in count_tokens_approximately (#39020)

langchain-core==1.5.0

Changes since langchain-core==1.4.9

release(core): 1.5.0 (#38978) feat(core): add reasoning_effort as a standard chat model parameter (#38887) chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (#38750) chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (#38783)

langchain-core==1.4.9

Changes since langchain-core==1.4.8

... (truncated)

Commits

Updates langchain-text-splitters from 1.1.0 to 1.1.2

Commits
  • 58c4e5b release(text-splitters): 1.1.2 (#36822)
  • c289bf1 fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...
  • b7447c6 fix(infra): skip serdes tests in min-version release step (#36818)
  • 41c0cc5 release(openai): 1.1.14 (#36820)
  • 0516156 fix(openai): use SSRF-safe transport for image token counting (#36819)
  • 338aa81 fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#3...
  • 51e9548 chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (#36797)
  • e85c418 chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (#36798)
  • 789126e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (#36799)
  • 937b3eb chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (#36800)
  • Additional commits viewable in compare view

Updates langgraph-checkpoint from 4.0.0 to 4.2.0

Release notes

Sourced from langgraph-checkpoint's releases.

langgraph-checkpoint==4.2.0

Changes since checkpoint==4.1.1

  • release(checkpoint): 4.2.0 (#8563)
  • fix(checkpoint): collect writes at plain-value seed in delta channel history (#8526)
  • chore: enforce PLC0415 in tests for the remaining packages (#8547)
  • chore: enable RUF100 and clear unused noqa directives (#8546)
  • chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 updates (#8490)
  • feat(checkpoint,checkpoint-postgres): add opt-in omit_expired to skip expired rows on read (#8354)
  • chore(deps): bump the minor-and-patch group in /libs/checkpoint with 5 updates (#8248)
  • chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/checkpoint (#8173)
  • docs: standardize package README.md structure (#8064)
  • chore: migrate Python type checking to ty (#8002)
  • chore(deps-dev): bump the major group in /libs/checkpoint with 2 updates (#7967)
  • chore(deps): bump the minor-and-patch group in /libs/checkpoint with 3 updates (#7960)

langgraph-checkpoint==4.1.1

Changes since checkpoint==4.1.0

  • release(checkpoint): 4.1.1 (#7890)
  • fix(checkpoint): restrict lc:2 envelope revival to default constructor (#7892)
  • chore(deps): bump idna from 3.11 to 3.15 in /libs/checkpoint (#7860)
  • chore(deps): bump langsmith from 0.7.31 to 0.8.0 in /libs/checkpoint (#7784)

langgraph-checkpoint==4.1.0

Changes since checkpoint==4.1.0a4

  • release: bump alpha packages to official versions (#7775)
  • chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /libs/checkpoint (#7762)
  • chore(deps): bump langchain-core from 1.3.2 to 1.3.3 in /libs/checkpoint (#7752)
  • feat(checkpoint): force delta channel snapshot after max supersteps since last snapshot (#7746)
  • fix(checkpoint): specify allowed_objects in Reviver (#7743)
  • chore: remove keepset helper (#7745)
  • chore(langgraph): add guide/conformance for delta channel checkpointer (#7736)
  • docs(checkpoint): mark DeltaChannel and delta-history APIs as beta (#7732)
  • chore(deps): bump the minor-and-patch group across 1 directory with 3 updates (#7670)
  • chore: "chore: minor clean up around checkpoint and delta channel" (#7706)
  • chore: minor clean up around checkpoint and delta channel (#7705)

langgraph-checkpoint==4.1.0a4

Changes since checkpoint==4.1.0a3

  • release: alpha bump (a4) for langgraph, checkpoint, checkpoint-postgres (#7701)
  • feat: public get_writes_history saver API + delta cadence rework (#7699)

langgraph-checkpoint==4.1.0a3

Changes since checkpoint==4.1.0a2

  • release: alpha bump (a3) for langgraph, checkpoint, checkpoint-postgres (#7678)
  • chore(langgraph): use two phase read to avoid unnecessary data transport (#7660)

... (truncated)

Commits
  • f55e772 release(checkpoint): 4.2.0 (#8563)
  • a90ab44 fix(checkpoint): collect writes at plain-value seed in delta channel history ...
  • ea5f9cc chore: enforce PLC0415 in tests for the remaining packages (#8547)
  • 36a505a test(checkpoint-postgres,checkpoint-sqlite): run the conformance suite (#8537)
  • d569e18 fix(checkpoint-postgres): find plain-value seeds when walking delta history (...
  • f22af62 chore: enable RUF100 and clear unused noqa directives (#8546)
  • 658541c chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint rule (#8540)
  • fb3d5f0 chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 8 u...
  • 01521c1 chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example ...
  • cd62feb chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 update...
  • Additional commits viewable in compare view

Updates langgraph-sdk from 0.3.1 to 0.4.2

Release notes

Sourced from langgraph-sdk's releases.

langgraph-sdk==0.4.2

Changes since sdk==0.4.1

  • release(sdk-py): 0.4.2 (#7955)
  • fix(sdk-py): percent-encode thread_id in v3 stream transport default paths (#7954)

langgraph-sdk==0.4.1

Changes since sdk==0.4.0

  • release(sdk-py): 0.4.1 (#7944)
  • feat(sdk-py): extract stream decoders and add interleave_projections (

@dependabot
Bump the uv group across 1 directory with 15 updates
8049927 
Bumps the uv group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.2.0` | `1.3.9` |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.5` | `3.14.3` |
| [dulwich](https://github.com/dulwich/dulwich) | `0.25.0` | `1.2.5` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.3.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.12.0` | `2.14.2` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.1` | `1.2.2` |
| [ujson](https://github.com/ultrajson/ultrajson) | `5.12.0` | `5.13.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |



Updates `langchain` from 1.2.0 to 1.3.9
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==1.2.0...langchain==1.3.9)

Updates `langchain-openai` from 1.1.6 to 1.5.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.1.6...langchain-openai==1.5.0)

Updates `gitpython` from 3.1.45 to 3.1.59
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.45...3.1.59)

Updates `aiohttp` from 3.13.5 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.13.5...v3.14.3)

Updates `dulwich` from 0.25.0 to 1.2.5
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-0.25.0...dulwich-1.2.5)

Updates `idna` from 3.11 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.11...v3.18)

Updates `langchain-core` from 1.2.28 to 1.5.4
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.2.28...langchain-core==1.5.4)

Updates `langchain-text-splitters` from 1.1.0 to 1.1.2
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-text-splitters==1.1.0...langchain-text-splitters==1.1.2)

Updates `langgraph-checkpoint` from 4.0.0 to 4.2.0
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@checkpoint==4.0.0...checkpoint==4.2.0)

Updates `langgraph-sdk` from 0.3.1 to 0.4.2
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@0.3.1...0.4.2)

Updates `pillow` from 12.1.1 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.1.1...12.3.0)

Updates `pydantic-settings` from 2.12.0 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.12.0...v2.14.2)

Updates `python-dotenv` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.1...v1.2.2)

Updates `ujson` from 5.12.0 to 5.13.0
- [Release notes](https://github.com/ultrajson/ultrajson/releases)
- [Commits](ultrajson/ultrajson@5.12.0...5.13.0)

Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.3.9
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: langchain-openai
  dependency-version: 1.5.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: gitpython
  dependency-version: 3.1.59
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: dulwich
  dependency-version: 1.2.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: indirect
  dependency-group: uv
- dependency-name: langchain-core
  dependency-version: 1.5.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: langchain-text-splitters
  dependency-version: 1.1.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: langgraph-checkpoint
  dependency-version: 4.2.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: langgraph-sdk
  dependency-version: 0.4.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-dotenv
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: ujson
  dependency-version: 5.13.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner August 14, 2026 15:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 14, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying emma with  Cloudflare Pages  Cloudflare Pages

Latest commit: 8049927
Status: ✅  Deploy successful!
Preview URL: https://d2e35f86.emma-anv.pages.dev
Branch Preview URL: https://dependabot-uv-uv-78bec24eb8.emma-anv.pages.dev

View logs

@dependabot dependabot Bot mentioned this pull request Aug 14, 2026
Closed
@petercrocker petercrocker mentioned this pull request Aug 14, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants