Skip to content

Build(deps): Bump the python-runtime group across 2 directories with 6 updates - #599

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/backend/python-runtime-040e6f3392
Closed

Build(deps): Bump the python-runtime group across 2 directories with 6 updates#599
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/backend/python-runtime-040e6f3392

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-runtime group with 5 updates in the /backend directory:

Package From To
langgraph 1.2.17 1.2.19
langsmith 0.14.12 0.14.17
openai 3.37.0 3.42.1
pydantic 2.14.1 2.14.2
transformers 5.20.2 5.22.1

Bumps the python-runtime group with 1 update in the /frontend directory: pytz.

Updates langgraph from 1.2.17 to 1.2.19

Release notes

Sourced from langgraph's releases.

langgraph==1.2.19

Changes since 1.2.18

  • release(langgraph): 1.2.19 (#9504)
  • release(checkpoint-sqlite): 3.1.3 (#9505)
  • fix(langgraph): keep trace_policy from rewriting streamed node payloads (#9486)
  • fix(langgraph): give messages and tools events the namespace of their graph (#9458)
  • chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph (#9433)
  • fix(langgraph): emit node-output messages from a graph streamed inside a node (#9463)
  • fix(langgraph): respect subgraphs=False in RemoteGraph.stream under a streaming parent (#9453)
  • fix(langgraph): don't report a paused tool as failed on the tools stream (#9406)
  • fix(langgraph): return an awaited @​task's value while streaming (#9407)
  • feat(langgraph): list ToolNode tool names in graph node metadata (#9449)

langgraph==1.2.18

Changes since 1.2.17

  • release(checkpoint): 4.3.1 (#9447)
  • release(langgraph): 1.2.18 (#9445)
  • fix(langgraph): let error_handler recover on every path and stream failed task results (#9408)
  • feat(langgraph): default delta snapshots to 100 updates (#9420). DeltaChannel now takes a full snapshot every 100 updates instead of 1000: faster reads on long threads, more storage. Pass snapshot_frequency=1000 to keep the old behavior.
  • fix(langgraph): stream the last checkpoint of a run stopped by interrupt_after or the recursion limit (#9409)
  • fix(langgraph): stop duplicating tags at every subgraph level (#9400)
  • chore(deps): bump opentelemetry-api from 1.39.1 to 1.45.1 in /libs/langgraph (#9424)
  • chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/langgraph (#9426)
Commits
  • 5bd231c release(langgraph): 1.2.19 (#9504)
  • 3eaf06c release(checkpoint-sqlite): 3.1.3 (#9505)
  • 6fab323 release(sdk-py): 0.4.11 (#9503)
  • 8d5637b fix(langgraph): keep trace_policy from rewriting streamed node payloads (#9486)
  • 1f0cf81 fix(langgraph): give messages and tools events the namespace of their graph (...
  • 6f2df05 test(sdk-py): check that a reconnect loop resumes after the newest event (#9483)
  • ffc3336 fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects with back...
  • 5f4b28a fix(sdk-py): warn when a stream reconnects without a Last-Event-ID (#9482)
  • 5c96bce chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph (#9433)
  • 2f46bb3 fix(sdk-py): preserve SSE data and cursor state across chunks (#9477)
  • Additional commits viewable in compare view

Updates langsmith from 0.14.12 to 0.14.17

Release notes

Sourced from langsmith's releases.

v0.14.17

0.14.17 (2026-11-02)

Features

  • cli: add langsmith evaluators create-decision-model (534a040)
  • sandboxes: AWS session tags on proxy role rules (bc15831)
  • sdk: read profile api_key_env in Python, JS and Java SDKs (ce4946f)

Bug Fixes

  • evaluators: show the effective spend limit in the evaluator tables (b00e161)
  • expose v1 session creation and updates in Python and TypeScript SDKs (LSO-4121, LSO-4130) (de2293b)
  • restore disposable Engine sandboxes with released SDK (6529456)
  • sdks: unify shared-profile OAuth refresh locking (d9c5731)

Chores

  • deps-dev: bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 in /sdks/python (6c9be7b)

Documentation

  • sandboxes: document match_paths on proxy rules (b764565)

Build System

  • refresh CA bundles for dev ops (b202202)

v0.14.16

0.14.16 (2026-10-29)

Features

  • py: trace OpenAI Agents API sessions in wrap_openai (dac7037)
  • sdks: add create_decision_model to the generated SDKs (61afde1)

Bug Fixes

  • sdk: drop the base workspace for write replicas on another instance (1a255bb)

Reverts

... (truncated)

Changelog

Sourced from langsmith's changelog.

0.14.17 (2026-11-02)

Features

  • cli: add langsmith evaluators create-decision-model (534a040)
  • sandboxes: AWS session tags on proxy role rules (bc15831)
  • sdk: read profile api_key_env in Python, JS and Java SDKs (ce4946f)

Bug Fixes

  • evaluators: show the effective spend limit in the evaluator tables (b00e161)
  • expose v1 session creation and updates in Python and TypeScript SDKs (LSO-4121, LSO-4130) (de2293b)
  • restore disposable Engine sandboxes with released SDK (6529456)
  • sdks: unify shared-profile OAuth refresh locking (d9c5731)

Chores

  • deps-dev: bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 in /sdks/python (6c9be7b)

Documentation

  • sandboxes: document match_paths on proxy rules (b764565)

Build System

  • refresh CA bundles for dev ops (b202202)

0.14.16 (2026-10-29)

Features

  • py: trace OpenAI Agents API sessions in wrap_openai (dac7037)
  • sdks: add create_decision_model to the generated SDKs (61afde1)

Bug Fixes

  • sdk: drop the base workspace for write replicas on another instance (1a255bb)

Reverts

  • provision disposable Engine sandboxes (d3a4a2c)

... (truncated)

Commits
  • 15dd2a7 Merge pull request #85 from langchain-ai/release-please--branches--main
  • 00ee905 release: 0.14.17
  • 6c9be7b chore(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 ...
  • d9c5731 fix(sdks): unify shared-profile OAuth refresh locking
  • de2293b fix: expose v1 session creation and updates in Python and TypeScript SDKs (LS...
  • b00e161 fix(evaluators): show the effective spend limit in the evaluator tables
  • bc15831 feat(sandboxes): AWS session tags on proxy role rules
  • b202202 build: refresh CA bundles for dev ops
  • 5b1280f test: gate sparse example tests on supporting server versions
  • b764565 docs(sandboxes): document match_paths on proxy rules
  • Additional commits viewable in compare view

Updates openai from 3.37.0 to 3.42.1

Release notes

Sourced from openai's releases.

v3.42.1

3.42.1 (2026-11-01)

Bug Fixes

  • api: preserve Responses WebSocket connection behavior (#4221) (38075d8)
  • realtime: validate beta WebSocket authentication profiles (#4218) (3622a97)

Refactors

  • websocket: add SDK-owned Responses policy helpers (#4219) (83ed269)

v3.42.0

3.42.0 (2026-10-31)

Features

  • api: add agent context compaction settings (#4209) (f552fcf)
  • api: add agent session review and tool settings (#4217) (a63c4cd)
  • api: add experimental agent time awareness (#4211) (10f9dd0)
  • api: add image edit markup overlays (#4210) (72c656d)
  • api: add organization external key management (#4205) (3ee373e)
  • api: add SIP DTMF commands and delivery events (#4208) (f9f3f76)
  • api: improve WebSocket recovery and delivery reporting (#4213) (68b962c)
  • api: keep callable API keys scoped to each request (#4216) (85bb536)
  • api: support response format updates and local output types (#4212) (bd61e84)
  • api: support WebSocket warmup and preserve cleanup cancellation (#4215) (9abd656)

Bug Fixes

  • preserve refusal output and authentication in WebSocket helpers (#4214) (0599203)

v3.41.0

3.41.0 (2026-10-28)

Features

  • api: accept typed references in Realtime response inputs (#4189) (8ecb487)
  • api: add response tool usage models (#4201) (55fc500)
  • api: filter agent sessions by metadata (#4200) (77fd116)
  • websocket: recover queued binary frames after reconnect (#4191) (f079868)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

3.42.1 (2026-11-01)

Bug Fixes

  • api: preserve Responses WebSocket connection behavior (#4221) (38075d8)
  • realtime: validate beta WebSocket authentication profiles (#4218) (3622a97)

Refactors

  • websocket: add SDK-owned Responses policy helpers (#4219) (83ed269)

3.42.0 (2026-10-31)

Features

  • api: add agent context compaction settings (#4209) (f552fcf)
  • api: add agent session review and tool settings (#4217) (a63c4cd)
  • api: add experimental agent time awareness (#4211) (10f9dd0)
  • api: add image edit markup overlays (#4210) (72c656d)
  • api: add organization external key management (#4205) (3ee373e)
  • api: add SIP DTMF commands and delivery events (#4208) (f9f3f76)
  • api: improve WebSocket recovery and delivery reporting (#4213) (68b962c)
  • api: keep callable API keys scoped to each request (#4216) (85bb536)
  • api: support response format updates and local output types (#4212) (bd61e84)
  • api: support WebSocket warmup and preserve cleanup cancellation (#4215) (9abd656)

Bug Fixes

  • preserve refusal output and authentication in WebSocket helpers (#4214) (0599203)

3.41.0 (2026-10-28)

Features

  • api: accept typed references in Realtime response inputs (#4189) (8ecb487)
  • api: add response tool usage models (#4201) (55fc500)
  • api: filter agent sessions by metadata (#4200) (77fd116)
  • websocket: recover queued binary frames after reconnect (#4191) (f079868)

Bug Fixes

  • examples: detect incomplete WebSocket responses (#4187) (8559299)
  • examples: handle interruptions and disconnects in push-to-talk (#4192) (35fc9f3)
  • keep consumer fixtures clean under strict Pyright (#4204) (5012565)

... (truncated)

Commits
  • 190dd5a release: 3.42.1 (#4220)
  • 38075d8 fix(api): preserve Responses WebSocket connection behavior (#4221)
  • 3622a97 fix(realtime): validate beta WebSocket authentication profiles (#4218)
  • 83ed269 refactor(websocket): add SDK-owned Responses policy helpers (#4219)
  • 0dcd904 release: 3.42.0 (#4206)
  • a63c4cd feat(api): add agent session review and tool settings (#4217)
  • 9abd656 feat(api): support WebSocket warmup and preserve cleanup cancellation (#4215)
  • 85bb536 feat(api): keep callable API keys scoped to each request (#4216)
  • bd61e84 feat(api): support response format updates and local output types (#4212)
  • 68b962c feat(api): improve WebSocket recovery and delivery reporting (#4213)
  • Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

  • Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

  • Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits
  • aa540ac Update changelog for v2.14.2
  • 6cde12f Update changelog for v2.14.2
  • 2db7c25 Fix deep copy of self-referential models
  • d783154 Update changelog for v2.14.2
  • df49b6c Avoid heap allocation for small JSON model field buffers
  • cd93e69 Skip decorator field checks when no field decorators exist
  • 2771e57 Make JSON validation by iteration consistent with Python approach
  • 8102e3f Avoid Python tuple allocation during model fields validation
  • dd139b5 Bump pydantic.v1 namespace to v1.10.27
  • 66155f9 Prepare release v2.14.2
  • Additional commits viewable in compare view

Updates transformers from 5.20.2 to 5.22.1

Release notes

Sourced from transformers's releases.

Patch release v5.22.1

We just had to fix the documentation!

** [Fix] Remove WIP doc for Ml4 (huggingface/transformers#50124) from @​remi-or

v5.22.0: Mistral Large 4 (Le Chonk)

New Models

Mistral Large 4 (Le Chonk)

Mistral Large 4 is Mistral's largest and most capable model to date: a 1 trillion-parameter natively multimodal Mixture-of-Experts model with 49 billion active parameters per token (52 billion including embeddings and output layers), trained from scratch on 3,800 NVIDIA Grace Blackwell GPUs in Mistral's own datacenters in Europe.

Mistral Large 4 unifies instruction following, reasoning, coding, and agentic workflows in a single set of weights. While a generalist model, it shows especially good performance on workloads such as cybersecurity, finance, and law, and it surpasses frontier closed models on visual grounding. It is natively fluent in 160+ languages, including every official language of the European Union.

Key Features

Mistral Large 4 includes the following architectural choices:

  • ~1T total / ~52B active parameters: granular Mixture-of-Experts with 128 routed experts (4 active per token) and 1 shared expert.
  • 1M context length, for long-context workloads.
  • Multimodal input: accepts text and image input, with text output. Pixtral-style vision encoder trained to handle variable image sizes and aspect ratios.
  • Instruct and Reasoning functionalities with function calls, reasoning effort configurable per request.

Mistral Large 4 offers the following capabilities:

  • Reasoning Mode: three reasoning efforts — low, medium, high (default) — so the same model can answer a quick chat reply or work through a complex agentic run.
  • Vision: analyzes images, charts, technical drawings, and documents, with state-of-the-art visual grounding among open weights.
  • Multilingual: natively fluent in 160+ languages, including all official languages of the European Union.
  • System Prompt: strong adherence and support for system prompts.
  • Agentic: native function calling, JSON output, and strict JSON schema enforcement.
  • Cybersecurity: state of the art among open-weight models for security work, while refusing malicious requests.
  • Large Context Window: supports a 1M context window.

The model is released under the Mistral Ecosystem Open-Weight License: a modified version of the MIT license, for both commercial and non-commercial use — operating a Model-as-a-Service business requires a separate commercial license with Mistral.

Recommended Settings

  • Reasoning Effort:
    • 'low' / 'medium' / 'high' — default is 'high'.
    • Use reasoning_effort="high" for complex prompts and agentic usage, 'low' for fast chat replies and 'medium' for day to day usage.
  • Sampling: for all reasoning efforts, we recommend the following sampling parameters:
    • temperature=1.0
    • top_p=0.95
  • System Prompt: define a clear environment and use case, including guidance on how to effectively leverage tools in agentic systems.
  • Tools: keep the set of tools well-defined and limit their number to the minimum required for the use case.
  • Context: the checkpoint supports a 1M context window.

... (truncated)

Commits

Updates pytz from 2026.5 to 2026.6

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Build(deps): Bump the python-runtime group across 2 directories with …
d166391 
…6 updates

Bumps the python-runtime group with 5 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.17` | `1.2.19` |
| [langsmith](https://github.com/langchain-ai/langsmith-python) | `0.14.12` | `0.14.17` |
| [openai](https://github.com/openai/openai-python) | `3.37.0` | `3.42.1` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.14.1` | `2.14.2` |
| [transformers](https://github.com/huggingface/transformers) | `5.20.2` | `5.22.1` |

Bumps the python-runtime group with 1 update in the /frontend directory: [pytz](https://github.com/stub42/pytz).


Updates `langgraph` from 1.2.17 to 1.2.19
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@1.2.17...1.2.19)

Updates `langsmith` from 0.14.12 to 0.14.17
- [Release notes](https://github.com/langchain-ai/langsmith-python/releases)
- [Changelog](https://github.com/langchain-ai/langsmith-python/blob/main/CHANGELOG.md)
- [Commits](langchain-ai/langsmith-python@v0.14.12...v0.14.17)

Updates `openai` from 3.37.0 to 3.42.1
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v3.37.0...v3.42.1)

Updates `pydantic` from 2.14.1 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.14.2/HISTORY.md)
- [Commits](pydantic/pydantic@v2.14.1...v2.14.2)

Updates `transformers` from 5.20.2 to 5.22.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.20.2...v5.22.1)

Updates `pytz` from 2026.5 to 2026.6
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2026.5...release_2026.6)

---
updated-dependencies:
- dependency-name: langgraph
  dependency-version: 1.2.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: langsmith
  dependency-version: 0.14.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: openai
  dependency-version: 3.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pydantic
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: transformers
  dependency-version: 5.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pytz
  dependency-version: '2026.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 9, 2026
@vvbandeira vvbandeira mentioned this pull request Nov 9, 2026
Merged
@vvbandeira

vvbandeira commented Nov 9, 2026

Copy link
Copy Markdown
Member

Superseded by #600, which carries these updates.

@vvbandeira vvbandeira closed this Nov 9, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/backend/python-runtime-040e6f3392 branch November 9, 2026 17:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vvbandeira