Skip to content

chore(deps): bump the python-minor-patch group with 6 updates - #57

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-f0cdc54be4
Closed

chore(deps): bump the python-minor-patch group with 6 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-f0cdc54be4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 6 updates:

Package From To
boto3 1.43.106 1.43.108
pytz 2026.4 2026.5
commitizen 4.19.0 4.19.1
litellm 1.103.2 1.104.0
hypothesis 6.168.3 6.168.4
lefthook 2.1.16 2.1.17

Updates boto3 from 1.43.106 to 1.43.108

Commits

Updates pytz from 2026.4 to 2026.5

Commits

Updates commitizen from 4.19.0 to 4.19.1

Release notes

Sourced from commitizen's releases.

v4.19.1 (2026-10-03)

Refactor

  • bump: use VersionIncrement ordering for bump detection (#2097)
Changelog

Sourced from commitizen's changelog.

v4.19.1 (2026-10-03)

Refactor

  • bump: use VersionIncrement ordering for bump detection (#2097)
Commits
  • b2eb0cb bump: version 4.19.0 → 4.19.1
  • 667de74 refactor(bump): use VersionIncrement ordering for bump detection (#2097)
  • 642b8be docs: add galaxy provider plugin docs (#2096)
  • cc2f522 docs: document additional_dependencies for pre-commit plugin hooks
  • 6eec06e docs(cli/screenshots): update CLI screenshots
  • See full diff in compare view

Updates litellm from 1.103.2 to 1.104.0

Release notes

Sourced from litellm's releases.

v1.104.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 7964577 Merge pull request #44397 from BerriAI/litellm_fix_d03a47
  • 5bb3b88 fix(proxy-extras): keep the post-migration sanity check from building the han...
  • 5aa0cd0 chore(release): backport part of #43902 and #43983 to rc/1.104.0 (#44332)
  • 31d6c60 chore(release): backport #44283 and part of #44229 to rc/1.104.0 (#44312)
  • 656daa0 chore(release): backport #44277 to rc/1.104.0 and bump oauthlib (#44304)
  • a1f27fc test: fix three order-dependent and timing-flaky tests (#44271) (#44280)
  • 6e747b0 test(integration): opt the config pass-through spend-log case into auth (#44267)
  • 2e5981c Merge pull request #44224 from BerriAI/litellm_rc_1_104_0_extras_post1
  • 13d3ba8 chore: bump litellm-proxy-extras to 0.4.102.post1
  • e012755 Merge pull request #44206 from BerriAI/litellm_rc_1_104_0_enforce_migration_c...
  • Additional commits viewable in compare view

Updates hypothesis from 6.168.3 to 6.168.4

Commits
  • d862501 Bump hypothesis version to 6.168.4 and update changelog
  • de4ec1c Merge pull request #4887 from HypothesisWorks/create-pull-request/patch
  • 8a80889 add pypy312 support
  • 9ee265d Update pinned dependencies
  • See full diff in compare view

Updates lefthook from 2.1.16 to 2.1.17

Release notes

Sourced from lefthook's releases.

v2.1.17

Changelog

  • 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
  • c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
  • 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
  • 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)
Changelog

Sourced from lefthook's changelog.

Change log

2.2.1

2.2.0

2.1.7

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-minor-patch group with 6 updates
1c63a57 
Bumps the python-minor-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.106` | `1.43.108` |
| [pytz](https://github.com/stub42/pytz) | `2026.4` | `2026.5` |
| [commitizen](https://github.com/commitizen-tools/commitizen) | `4.19.0` | `4.19.1` |
| [litellm](https://github.com/BerriAI/litellm) | `1.103.2` | `1.104.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.168.3` | `6.168.4` |
| [lefthook](https://github.com/evilmartians/lefthook) | `2.1.16` | `2.1.17` |


Updates `boto3` from 1.43.106 to 1.43.108
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.106...1.43.108)

Updates `pytz` from 2026.4 to 2026.5
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2026.4...release_2026.5)

Updates `commitizen` from 4.19.0 to 4.19.1
- [Release notes](https://github.com/commitizen-tools/commitizen/releases)
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md)
- [Commits](commitizen-tools/commitizen@v4.19.0...v4.19.1)

Updates `litellm` from 1.103.2 to 1.104.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.103.2...v1.104.0)

Updates `hypothesis` from 6.168.3 to 6.168.4
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.3...v6.168.4)

Updates `lefthook` from 2.1.16 to 2.1.17
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](evilmartians/lefthook@v2.1.16...v2.1.17)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.108
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pytz
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: commitizen
  dependency-version: 4.19.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: litellm
  dependency-version: 1.104.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: hypothesis
  dependency-version: 6.168.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: lefthook
  dependency-version: 2.1.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from laithalsaadoon as a code owner October 12, 2026 21:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 12, 2026
@laithalsaadoon laithalsaadoon mentioned this pull request Oct 15, 2026
Merged
laithalsaadoon added a commit that referenced this pull request Oct 15, 2026
@laithalsaadoon @claude
chore(deps): upgrade every uv package but ty, litellm v1.104.2 prices
1d0e2df 
`uv lock --upgrade` inside the 7-day cooldown, with ty held at 0.0.84: 0.0.85
adds truthiness-test-of-none-union, which reports 55 sites across six members,
and each needs its own None-versus-empty decision. Moves polars 2.0.0,
pydantic 2.14.0, cyclopts 5.2.0, tenacity 9.2.1, litellm 1.104.2, boto3
1.43.109, commitizen 4.19.2, hypothesis 6.168.5 and lefthook 2.2.1, plus their
transitives. filelock moves back to 3.32.7 because litellm 1.104.2 caps it
below 4; litellm is dev-only. Supersedes Dependabot #57.

The published `polars>=1.40.0` already resolves polars 2.0.0 on a fresh
install, so the suite now runs against what users get; it passes unchanged.
tenacity 9.2.1 types `.retry` on a decorated function, so the retry tests drop
their ty and pyright ignores. The harbor and transformers exclude-newer-package
exemptions are deleted now that the global window admits both releases.

litellm 1.104.2's data is what turned #57 red: 90 of 257 vendored entries still
matched the installed table. `scripts/update_prices.py --ref v1.104.2`
regenerates it. Upstream prices claude-opus-5-5 at the rates its override
carried, so the override retires and the override tests pin a synthetic entry.
Upstream dropped six gpt-5.x priority rates, so the two gpt-5.1-codex priority
frozen prices are re-captured, and deleted 32 models past their deprecation
date, whose sessions are now unpriced. The arithmetic is unchanged: the
identity grid passes bit for bit against litellm 1.104.2.

CONVERTER_SCHEMA_VERSION 9 -> 10: cost labels and totals change, so a corpus
re-converts on its next materialize. `mise run docs:citations:fix` rewrote the
citations the pyproject.toml and test-file line moves shifted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@laithalsaadoon

laithalsaadoon commented Oct 15, 2026

Copy link
Copy Markdown
Owner

Superseded by #58.

@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-patch-f0cdc54be4 branch October 15, 2026 19:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@laithalsaadoon laithalsaadoon Awaiting requested review from laithalsaadoon laithalsaadoon is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@laithalsaadoon