Skip to content

build(deps): bump the semgrep group in /.github with 21 updates - #184

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/semgrep-d607049954
Closed

build(deps): bump the semgrep group in /.github with 21 updates#184
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/semgrep-d607049954

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the semgrep group in /.github with 21 updates:

Package From To
boltons 21.0.0 26.2.0
click 8.4.2 8.5.0
exceptiongroup 1.2.2 1.3.1
importlib-metadata 8.7.1 9.0.1
jsonschema 4.25.1 4.26.0
mcp 1.29.0 2.3.0
opentelemetry-api 1.37.0 1.45.1
opentelemetry-exporter-otlp-proto-common 1.37.0 1.45.1
opentelemetry-exporter-otlp-proto-http 1.37.0 1.45.1
opentelemetry-instrumentation 0.58b0 0.66b1
opentelemetry-instrumentation-requests 0.58b0 0.66b1
opentelemetry-instrumentation-threading 0.58b0 0.66b1
opentelemetry-proto 1.37.0 1.45.1
opentelemetry-sdk 1.37.0 1.45.1
opentelemetry-semantic-conventions 0.58b0 0.66b1
opentelemetry-util-http 0.58b0 0.66b1
peewee 3.19.0 4.5.3
protobuf 6.33.6 7.36.2
tomli 2.4.1 2.5.0
wcmatch 8.5.2 11.0.1
wrapt 1.17.3 2.5.0

Updates boltons from 21.0.0 to 26.2.0

Release notes

Sourced from boltons's releases.

26.2.0

Full Changelog: mahmoud/boltons@26.1.0...26.2.0

26.1.0

  • Fixed strutils.singularize mangling words ending in 'ss'

... (truncated)

Changelog

Sourced from boltons's changelog.

26.2.0

(September 7, 2026)

  • Added [statsutils.mode][statsutils.mode] to return the most common value, breaking ties by first appearance (#453)
  • Fixed [setutils.IndexedSet.update][setutils.IndexedSet.update] adding the iterables themselves instead of their elements when given multiple inputs (#474)
  • Fixed [strutils.iter_splitlines][strutils.iter_splitlines] and [strutils.indent][strutils.indent] splitting dates containing 28 or 29 instead of recognizing Unicode line separators (#475)
  • Added [strutils.ellipsize][strutils.ellipsize] for word-boundary-aware text truncation with an ellipsis
  • Fixed [funcutils.wraps][funcutils.wraps] passing arguments positionally to wrappers that only accept them as keywords (#261)
  • Fixed [tableutils.Table.to_text][tableutils.Table] crashes on empty tables, None headers, and short header rows; empty headers now render no header row, matching to_html
  • Fixed [timeutils.isoparse][timeutils.isoparse] misreading fractional seconds (.851 parsed as 851µs instead of 851000µs); >6-digit fractions now truncate instead of raising
  • Fixed [timeutils.daterange][timeutils.daterange] looping forever on non-advancing steps: zero and self-cancelling month/day steps now raise ValueError, wrong-direction steps yield nothing like range()
  • Fixed [strutils.MultiReplace][strutils.MultiReplace] raising KeyError on empty substitution maps (now a no-op)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] hanging when a seek lands past the last newline, and negative rel_seek values seeking past EOF (sign bug)
  • Fixed [iterutils.xfrange][iterutils.xfrange] yielding nothing for descending ranges; now shares [frange][iterutils.frange]'s count-based semantics, so both agree at inexact float boundaries
  • Fixed [urlutils.parse_qsl][urlutils.parse_qsl] ignoring its encoding argument when decoding keys and values (#455)
  • Fixed [dictutils.OrderedMultiDict.addlist][dictutils.OrderedMultiDict.addlist] dropping values from one-shot iterables, including the vendored copy in urlutils (#458)
  • Fixed [ecoutils.get_profile][ecoutils.get_profile] looking up identifying host, username, and working-directory information when scrub=True (#461)
  • Fixed [namedutils.namedtuple][namedutils.namedtuple] and [namedutils.namedlist][namedutils.namedlist] raising IndexError instead of ValueError for empty type and field names (#462)
  • Fixed [iterutils.GUIDerator][iterutils.GUIDerator] error text to reflect the inclusive minimum size of 20 (#451)
  • Fixed [timeutils.decimal_relative_time][timeutils.decimal_relative_time] and relative_time rejecting aware datetimes when the comparison time is omitted (#469)
  • Fixed [timeutils.USTimeZone][timeutils.USTimeZone] handling of repeated and missing DST hours, including fold on UTC conversion (#441)
  • Fixed [mathutils.Bits][mathutils.Bits] negative indexing (#450)
  • Fixed [mathutils.Bits][mathutils.Bits] empty binary, hexadecimal, and byte round trips (#468)
  • Sped up [setutils.IndexedSet][setutils.IndexedSet] bulk difference and intersection updates with a single-pass rebuild (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] out-of-range indexing returning unrelated values (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] insertion clamping across multiple internal lists (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] popping after an internal list was emptied by indexed removals (#440)
  • Fixed [listutils.BarrelList.iter_slice][listutils.BarrelList.iter_slice] slice normalization and reverse steps (#471)
  • Fixed [listutils.BarrelList.del_slice][listutils.BarrelList.del_slice] deletion across internal lists and through the end of the list (#472)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] rejecting the documented rel_seek=1.0 endpoint (#465)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] relative seeking in binary streams (#464)
  • Fixed [statsutils.Stats.get_histogram_counts][statsutils.Stats.get_histogram_counts] division by zero for data with no interquartile spread (#467)
  • Fixed [jsonutils.reverse_iter_lines][jsonutils.reverse_iter_lines] ignoring explicit and stream encodings (#463)
  • Fixed [jsonutils.reverse_iter_lines][jsonutils.reverse_iter_lines] detaching the caller's text stream, preventing later reads and context-manager cleanup (#466)
  • Fixed [cacheutils.ThresholdCounter.update][cacheutils.ThresholdCounter.update] ignoring mapping and keyword counts (#476)
  • Fixed [cacheutils.LRI.update][cacheutils.LRI.update] and [cacheutils.LRU.update][cacheutils.LRU.update] rejecting empty and keyword-only updates, and ignoring keywords when the source is the cache itself (#478)
  • Fixed [cacheutils.ThresholdCounter.most_common][cacheutils.ThresholdCounter.most_common] returning no pairs when the limit is omitted (#460)
  • Fixed [strutils.bytes2human][strutils.bytes2human] failing to use the Y suffix for yottabyte-sized values (#459)
  • Fixed [urlutils.URL.get_authority][urlutils.URL.get_authority] dropping passwords when the username is empty (#477)
  • Fixed [strutils.args2sh][strutils.args2sh] and [strutils.args2cmd][strutils.args2cmd] ignoring the sep argument (#454)
  • Fixed [statsutils.Stats.pearson_type][statsutils.Stats.pearson_type] raising RuntimeError instead of classifying Pearson types IV, V, and VI (#434)
  • Fixed [statsutils.Stats.pearson_type][statsutils.Stats.pearson_type] division by zero at the exact coefficient boundary, preserving the existing Normal and Gamma cases (#434)
  • Fixed [setutils.complement][setutils.complement] subset and superset comparisons raising AttributeError (#438)
  • Fixed [mathutils.Bits][mathutils.Bits] accepting values too large for the requested bit length
  • Fixed [tbutils.ParsedException][tbutils.ParsedException] dropping Python 3.11+ traceback anchor lines during round trips (#333)
  • Fixed [strutils.pluralize][strutils.pluralize] handling of words ending in x, such as box
  • Fixed [iterutils.backoff_iter][iterutils.backoff_iter] division by zero with factor=1.0 and no count; equal bounds yield once, and unequal bounds raise ValueError

26.1.0

... (truncated)

Commits
  • 4332b35 boltons version 26.2.0
  • 1216b46 Complete September PR sweep for 26.2.0 (#481)
  • 8bb31ba statsutils: complete Pearson classification and maintainer review (#434)
  • 73e22c9 statsutils: finish Pearson zero-denominator review and regression coverage
  • 3913220 Merge current master into Pearson classification branch
  • 45a2511 strutils: recognize Unicode line separators without splitting dates (#475)
  • 1cdc0e9 statsutils: handle zero interquartile range in histograms (#467)
  • 805c803 jsonutils: align binary streams to binary newlines (#464)
  • 5150802 jsonutils: accept explicit end-of-file relative seek (#465)
  • 574393a listutils: preserve barrel endpoints during slice deletion (#472)
  • Additional commits viewable in compare view

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits
  • 8b19813 Release version 8.5.0
  • 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
  • 131c86a Add FAQ entry about UnicodeEncodeError on Windows
  • e1fd594 Add support of pathlib.Path to edit (#3781)
  • a1d8785 Add support of pathlib.Path to edit
  • 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
  • a6256bf Forwards all user's parameters set in PAGER
  • 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
  • 9835b0f Resolve the pager command once, in _pager_contextmanager
  • f36d58b Refactor pager stream handling (#3767)
  • Additional commits viewable in compare view

Updates exceptiongroup from 1.2.2 to 1.3.1

Release notes

Sourced from exceptiongroup's releases.

1.3.1

  • Fixed AttributeError: 'TracebackException' object has no attribute 'exceptions' when formatting unpickled TBEs from another Python process which did not apply the exceptiongroup patches (#144)

1.3.0

  • Added **kwargs to function and method signatures as appropriate to match the signatures in the standard library
  • In line with the stdlib typings in typeshed, updated (Base)ExceptionGroup generic types to define defaults for their generic arguments (defaulting to BaseExceptionGroup[BaseException] and ExceptionGroup[Exception]) (PR by @​mikenerone)
  • Changed BaseExceptionGroup.__init__() to directly call BaseException.__init__() instead of the superclass __init__() in order to emulate the CPython behavior (broken or not) (PR by @​cfbolz)
  • Changed the exceptions attribute to always return the same tuple of exceptions, created from the original exceptions sequence passed to BaseExceptionGroup to match CPython behavior (#143)
Changelog

Sourced from exceptiongroup's changelog.

Version history

This library adheres to Semantic Versioning 2.0 <http://semver.org/>_.

UNRELEASED

  • Fixed the repr() of exception groups being affected by mutation of the original exception sequence after construction ([#154](https://github.com/agronholm/exceptiongroup/issues/154) <https://github.com/agronholm/exceptiongroup/issues/154>_)

1.3.1

  • Fixed AttributeError: 'TracebackException' object has no attribute 'exceptions' when formatting unpickled TBEs from another Python process which did not apply the exceptiongroup patches ([#144](https://github.com/agronholm/exceptiongroup/issues/144) <https://github.com/agronholm/exceptiongroup/issues/144>_)

1.3.0

  • Added **kwargs to function and method signatures as appropriate to match the signatures in the standard library
  • In line with the stdlib typings in typeshed, updated (Base)ExceptionGroup generic types to define defaults for their generic arguments (defaulting to BaseExceptionGroup[BaseException] and ExceptionGroup[Exception]) (PR by @​mikenerone)
  • Changed BaseExceptionGroup.__init__() to directly call BaseException.__init__() instead of the superclass __init__() in order to emulate the CPython behavior (broken or not) (PR by @​cfbolz)
  • Changed the exceptions attribute to always return the same tuple of exceptions, created from the original exceptions sequence passed to BaseExceptionGroup to match CPython behavior ([#143](https://github.com/agronholm/exceptiongroup/issues/143) <https://github.com/agronholm/exceptiongroup/issues/143>_)

1.2.2

  • Removed an assert in exceptiongroup._formatting that caused compatibility issues with Sentry ([#123](https://github.com/agronholm/exceptiongroup/issues/123) <https://github.com/agronholm/exceptiongroup/issues/123>_)

1.2.1

  • Updated the copying of __notes__ to match CPython behavior (PR by CF Bolz-Tereick)
  • Corrected the type annotation of the exception handler callback to accept a BaseExceptionGroup instead of BaseException
  • Fixed type errors on Python < 3.10 and the type annotation of suppress() (PR by John Litborn)

1.2.0

  • Added special monkeypatching if Apport <https://github.com/canonical/apport>_ has

... (truncated)

Commits
  • ddddb6f Added the release version
  • 49c5e60 Fixed AttributeError when formatting unpickled TBEs from an unpatched process
  • 1be517f [pre-commit.ci] pre-commit autoupdate (#152)
  • af0ea2f [pre-commit.ci] pre-commit autoupdate (#149)
  • 7c980a8 Removed pin on pyright version
  • ef85336 Fixed typing job not finding Python 3.14
  • 080b3f4 Pinned pyright version to fix typeshed related failure
  • ac66090 Added Python 3.14 to the test matrix
  • a0da94d Fixed test failures on Python 3.14
  • 77fba8a Added the release version
  • Additional commits viewable in compare view

Updates importlib-metadata from 8.7.1 to 9.0.1

Changelog

Sourced from importlib-metadata's changelog.

v9.0.1

Bugfixes

  • Marked the other parameter of SimplePath.joinpath and SimplePath.__truediv__ positional-only, so pathlib.Path satisfies the protocol under type checkers that compare parameter names. (#542)

v9.0.0

Deprecations and Removals

  • Added MetadataNotFound (subclass of FileNotFoundError) and updated Distribution.metadata/metadata() to raise it when the metadata files are missing instead of returning Nonepython/cpython#143387#532)

v8.9.0

Features

v8.8.0

Features

  • Removed Python 3.9 compatibility.
Commits

Updates jsonschema from 4.25.1 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

New Contributors

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

Changelog

Sourced from jsonschema's changelog.

v4.26.0

  • Decrease import time by delaying importing of urllib.request (#1416).
Commits
  • a727743 Add a changelog entry for 4.26.
  • 6d28c13 Update the lockfile.
  • 739499e Update pre-commit hooks.
  • cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
  • e6bbbb7 [pre-commit.ci] pre-commit autoupdate
  • d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
  • e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
  • 1f7c9fb Partially update docs requirements.
  • 241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
  • 2818efb Apache-2.0 -> nongpl
  • Additional commits viewable in compare view

Updates mcp from 1.29.0 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connecti...

    Description has been truncated

@dependabot
build(deps): bump the semgrep group in /.github with 21 updates
acc02f7 
Bumps the semgrep group in /.github with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [boltons](https://github.com/mahmoud/boltons) | `21.0.0` | `26.2.0` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [exceptiongroup](https://github.com/agronholm/exceptiongroup) | `1.2.2` | `1.3.1` |
| [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `9.0.1` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.25.1` | `4.26.0` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.29.0` | `2.3.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` |
| [opentelemetry-exporter-otlp-proto-common](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` |
| [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` |
| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.58b0` | `0.66b1` |
| [opentelemetry-instrumentation-requests](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.58b0` | `0.66b1` |
| [opentelemetry-instrumentation-threading](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.58b0` | `0.66b1` |
| [opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` |
| [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` |
| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.58b0` | `0.66b1` |
| [opentelemetry-util-http](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.58b0` | `0.66b1` |
| [peewee](https://github.com/coleifer/peewee) | `3.19.0` | `4.5.3` |
| [protobuf](https://developers.google.com/protocol-buffers/) | `6.33.6` | `7.36.2` |
| [tomli](https://github.com/hukkin/tomli) | `2.4.1` | `2.5.0` |
| [wcmatch](https://github.com/facelessuser/wcmatch) | `8.5.2` | `11.0.1` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.3` | `2.5.0` |


Updates `boltons` from 21.0.0 to 26.2.0
- [Release notes](https://github.com/mahmoud/boltons/releases)
- [Changelog](https://github.com/mahmoud/boltons/blob/master/CHANGELOG.md)
- [Commits](mahmoud/boltons@21.0.0...26.2.0)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `exceptiongroup` from 1.2.2 to 1.3.1
- [Release notes](https://github.com/agronholm/exceptiongroup/releases)
- [Changelog](https://github.com/agronholm/exceptiongroup/blob/main/CHANGES.rst)
- [Commits](agronholm/exceptiongroup@1.2.2...1.3.1)

Updates `importlib-metadata` from 8.7.1 to 9.0.1
- [Release notes](https://github.com/python/importlib_metadata/releases)
- [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst)
- [Commits](python/importlib_metadata@v8.7.1...v9.0.1)

Updates `jsonschema` from 4.25.1 to 4.26.0
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.25.1...v4.26.0)

Updates `mcp` from 1.29.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.29.0...v2.3.0)

Updates `opentelemetry-api` from 1.37.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1)

Updates `opentelemetry-exporter-otlp-proto-common` from 1.37.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1)

Updates `opentelemetry-exporter-otlp-proto-http` from 1.37.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1)

Updates `opentelemetry-instrumentation` from 0.58b0 to 0.66b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-requests` from 0.58b0 to 0.66b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-threading` from 0.58b0 to 0.66b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-proto` from 1.37.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1)

Updates `opentelemetry-sdk` from 1.37.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1)

Updates `opentelemetry-semantic-conventions` from 0.58b0 to 0.66b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/commits)

Updates `opentelemetry-util-http` from 0.58b0 to 0.66b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `peewee` from 3.19.0 to 4.5.3
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](coleifer/peewee@3.19.0...4.5.3)

Updates `protobuf` from 6.33.6 to 7.36.2

Updates `tomli` from 2.4.1 to 2.5.0
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](hukkin/tomli@2.4.1...2.5.0)

Updates `wcmatch` from 8.5.2 to 11.0.1
- [Release notes](https://github.com/facelessuser/wcmatch/releases)
- [Commits](facelessuser/wcmatch@8.5.2...11.0.1)

Updates `wrapt` from 1.17.3 to 2.5.0
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@1.17.3...2.5.0)

---
updated-dependencies:
- dependency-name: boltons
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: exceptiongroup
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: importlib-metadata
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: opentelemetry-exporter-otlp-proto-common
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: opentelemetry-instrumentation
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: semgrep
- dependency-name: opentelemetry-instrumentation-requests
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: semgrep
- dependency-name: opentelemetry-instrumentation-threading
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: semgrep
- dependency-name: opentelemetry-proto
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: semgrep
- dependency-name: opentelemetry-util-http
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: semgrep
- dependency-name: peewee
  dependency-version: 4.5.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: tomli
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: semgrep
- dependency-name: wcmatch
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
- dependency-name: wrapt
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: semgrep
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from donislawdev as a code owner October 14, 2026 19:00
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@donislawdev donislawdev mentioned this pull request Oct 15, 2026
Merged
@donislawdev

donislawdev commented Oct 15, 2026

Copy link
Copy Markdown
Owner

Closed in favour of #188. Every one of the 21 versions here is outside what semgrep 1.180.0 allows (boltons 26.2.0 against its boltons~=21.0 is the one pip names), so pip refuses the set. Compiled with pip-compile, the semgrep closure today is the 66 versions main already pins. #188 makes the list a pip-compile file, so the next update arrives as a set pip resolved.

@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/dot-github/semgrep-d607049954 branch October 15, 2026 11:47
donislawdev added a commit that referenced this pull request Oct 15, 2026
@donislawdev @claude
ci: compile the semgrep requirements, so Dependabot proposes sets pip…
0a3fe12 
… can install (#188)

Dependabot raised every line of .github/requirements-semgrep.txt on its own,
past what semgrep allows: #184 moved 21 packages, boltons to 26.2.0 among
them, while semgrep 1.180.0 asks for boltons~=21.0, and pip refused the
whole set. Grouping kept them in one pull request but did not make them
agree.

semgrep is now pinned in requirements-semgrep.in, the one line a person
writes, and the list beside it is compiled from it by pip-compile. An .in
file in the directory makes Dependabot run pip-compile itself, so what it
proposes is a set pip resolved. Compiled today with Python 3.14, pip 26.1.1
and pip-tools 7.5.3, the versions Dependabot runs, the list is the same 66
versions the freeze had - none of the 21 in #184 is inside what semgrep
allows. Only the spelling of two names moves (ruamel.yaml as ruamel-yaml).

The reasons that stood at the top of the list moved to the .in file, with
the command that compiles it by hand.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@donislawdev donislawdev Awaiting requested review from donislawdev donislawdev is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@donislawdev