Bump the minor group across 1 directory with 6 updates

[dependabot]

Bumps the minor group with 6 updates in the / directory:

Package	From	To
django-ninja	1.7.0	1.7.1
mcp	2.1.1	2.3.0
newrelic	13.5.0	13.6.1
servestatic	4.3.4	4.4.0
uvicorn	0.52.4	0.54.0
uvloop	0.22.1	0.23.0

Updates django-ninja from 1.7.0 to 1.7.1

Release notes

Sourced from django-ninja's releases.

1.7.1

What's Changed

• fix(auth): preserve percent sequences in HTTP Basic credentials by @​Aryan-coder-student in vitalik/django-ninja#1780

• fix: avoid duplicate async authentication calls by @​tunglambk in vitalik/django-ninja#1755

• Migrate from flit to uv for CI/CD, contributing and publishing by @​vitalik in vitalik/django-ninja#1770

• docs: add authorization and permissions section by @​namelessweakl1ng in vitalik/django-ninja#1744

• docs: add decorator example to permissions section by @​vitalik in vitalik/django-ninja#1776

New Contributors

• @​namelessweakl1ng made their first contribution in vitalik/django-ninja#1744
• @​Aryan-coder-student made their first contribution in vitalik/django-ninja#1780

Full Changelog: vitalik/django-ninja@v1.7.0...v1.7.1

1.7.1a2

Pre-release exercising PyPI Trusted Publishing (OIDC) via uv (#1771). No functional changes since 1.7.1a1.

1.7.1a1

Pre-release exercising the new uv-based CI/CD and publishing pipeline (#1770).

No functional changes since 1.7.0 — tooling migration only: flit → uv for contributing, CI, and publishing (build backend remains flit_core).

Commits

• 1cb8426 Update version to 1.7.1
• 1685055 fix(auth): preserve percent sequences in HTTP Basic credentials (#1780)
• d1a5d88 Merge pull request #1776 from vitalik/docs-permissions-decorator-example
• b570ded docs: add decorator example to permissions section
• acd6da0 Merge pull request #1744 from namelessweakl1ng/docs-permissions-section
• 0fcad9f Document why _await_coroutine exists in sync auth path
• 7d2a27a Merge pull request #1755 from tunglambk/agent/fix-async-auth-double-call
• e82e575 Merge pull request #1771 from vitalik/trusted-publishing
• 276c251 Publish to PyPI via Trusted Publishing (OIDC)
• 1d66bd3 Merge pull request #1770 from vitalik/uv-migration
• Additional commits viewable in compare view

Updates mcp from 2.1.1 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

• It was >=2.5.0. The new max_sse_event_size option needs it.
• Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

• @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
• Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
• Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
• For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

• On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
• ping and list requests without a cursor go out with no params member.
• On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
• 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

• It used to send "experimental": {}. server/discover already left it out.
• Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

• MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
• The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

• The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
• This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
• A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

• max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
• MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
• Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
• Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

• ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
• An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
• A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
• Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
• stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits

• 2118f14 docs: refresh translations for recent English changes (#3636)
• ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
• d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
• c15566c Link What's new to the Header parameters page (#3632)
• 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
• 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
• c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
• 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
• cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
• 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
• Additional commits viewable in compare view

Updates newrelic from 13.5.0 to 13.6.1

Release notes

Sourced from newrelic's releases.

v13.6.1

Notes

This release of the Python agent fixes issues with signed headers in botocore (SigV4).

Install the agent using easy_install/pip/distribute via the Python Package Index, using conda via the Conda-Forge Package Index, or download it directly from the New Relic download site.

Bugs

• Fix issues with signed headers in botocore (SigV4)

  • The previous change to botocore distributed tracing headers has been reverted to avoid duplicate headers being sent.
  • Previously any distributed tracing headers that were generated by other tracing libraries could cause issues with instrumentation in botocore due to header signing. This has been fixed by disabling signing for these headers within botocore.

Support statement

We recommend updating to the latest agent version as soon as it's available. If you can't upgrade to the latest version, update your agents to a version no more than 90 days old. Read more about keeping agents up to date.

See the New Relic Python agent EOL policy for information about agent releases and support dates.

v13.6.0

Notes

This release of the Python agent adds support for OpenSearch, Microsoft Azure SQL, new Kinesis methods, and a new browser_monitoring.version setting. Additionally, improvements have been made to Anthropic, MCP, and Google ADK instrumentation. Issues with signed headers in botocore (SigV4) and Gemini tools parsing have also been fixed for this release.

Install the agent using easy_install/pip/distribute via the Python Package Index, using conda via the Conda-Forge Package Index, or download it directly from the New Relic download site.

New Features

• New instrumentation for opensearch-py

  • Instrumentation was added for the official OpenSearch database connector.

• New instrumentation for mssql-python

  • Instrumentation was added for Microsoft Azure SQL.

• New instrumentation for new Kinesis methods

  • The following methods are now supported in Kinesis:
    • create_channel
    • delete_channel
    • describe_channel
    • list_channels
    • update_channel

• New setting for browser_monitoring.version

  • The new setting browser_monitoring.version enables users to specify specific versions of our Browser Monitoring Agent to be injected.
  • See the list of Supported Browser Agent Versions to choose from.

... (truncated)

Commits

• 239e919 Fix botocore Signed Headers (#1862)
• 9b12182 Fix Anthropic token/content capture for langchain-anthropic (with_raw_respons...
• 6034dd0 Patch botocore to insert DT headers before signing (#1848)
• f3fd99b OpenSearch Instrumentation (#1858)
• c70d8e4 Merge pull request #1851 from newrelic/mvick/team-transfer
• a8bd1fc Merge branch 'main' into mvick/team-transfer
• 3cc688a Gemini tools fix (#1854)
• e7eb50e Merge branch 'main' into mvick/team-transfer
• 582d8c9 Anthropic 1.0.0 Support (#1829)
• 645c7b8 Merge branch 'main' into mvick/team-transfer
• Additional commits viewable in compare view

Updates servestatic from 4.3.4 to 4.4.0

Release notes

Sourced from servestatic's releases.

4.4.0

Added

• Support the ASGI http.response.pathsend extension for full-file sends. When the ASGI server advertises this extension (e.g. Granian), ServeStatic now offloads the file transmission to the server via pathsend instead of streaming the file through Python file IO. Range (sliced) requests continue to stream over http.response.body since pathsend has no slicing support.
• Support the ASGI http.response.zerocopysend extension (e.g. nonecorn or anycorn). When the ASGI server advertises this extension, ServeStatic offloads file transmission to the server via zerocopysend. Unlike pathsend, zerocopysend supports slicing, so both full-file and Range (sliced) requests are transmitted zero-copy. When a server advertises both extensions, zerocopysend is preferred for performance reasons.

Changed

• Make the standalone ASGI/WSGI serving core compatible with the trio async backend. Thread-offload now detects the running async library (via sniffio, lazily and optionally) and dispatches to asyncio or trio, so ServeStatic no longer returns empty responses under trio-based servers (e.g. Anycorn --worker-class trio).

Changelog

Sourced from servestatic's changelog.

[4.4.0] - 2026-10-02

Added

• Support the ASGI http.response.pathsend extension for full-file sends. When the ASGI server advertises this extension (e.g. Granian), ServeStatic now offloads the file transmission to the server via pathsend instead of streaming the file through Python file IO. Range (sliced) requests continue to stream over http.response.body since pathsend has no slicing support.
• Support the ASGI http.response.zerocopysend extension (e.g. nonecorn or anycorn). When the ASGI server advertises this extension, ServeStatic offloads file transmission to the server via zerocopysend. Unlike pathsend, zerocopysend supports slicing, so both full-file and Range (sliced) requests are transmitted zero-copy. When a server advertises both extensions, zerocopysend is preferred for performance reasons.

Changed

• Make the standalone ASGI/WSGI serving core compatible with the trio async backend. Thread-offload now detects the running async library (via sniffio, lazily and optionally) and dispatches to asyncio or trio, so ServeStatic no longer returns empty responses under trio-based servers (e.g. Anycorn --worker-class trio).

Commits

• b716df8 4.4.0
• 5efbab1 Add support for ASGI zerocopysend extension (#122)
• 1457b60 Add support for ASGI pathsend extension (#121)
• 6853e71 Add trio backend compatibility to the ASGI serving core (#118)
• 4b1827b Update SECURITY.md to link to security advisory (#117)
• 3f8ea4a [pre-commit.ci] pre-commit autoupdate (#116)
• See full diff in compare view

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

Updates uvloop from 0.22.1 to 0.23.0

Release notes

Sourced from uvloop's releases.

v0.23.0

Changes

• Add Python 3.15 and 3.15t wheel builds and CI coverage (#758) (by @​honglei @​fantix in f7c05473)

• Add support for the eager_start keyword argument in create_task() (#748) (by @​samypr100 in 3cbb0956 for #746 #718)

• Add thread name prefix to the default thread pool executor (#636) (by @​inikolaev @​fantix in 0582f946 for #562)

• Add support for special hostname <broadcast> (#592) (by @​jpbede in 3060cebc for #540)

• Upgrade libuv to v1.52.1 (#753) (by @​fantix in e8efea40 for #752)

• Improve performance by using Python C API to enter/exit context (#627) (by @​tarasko in 837ef22c)

• Improve performance/latency of Transport.write (#619) (by @​tarasko in 1d9b6e0d)

• Replace some SSL vectorcall with direct methods (#626) (by @​tarasko in 6a27cbe2)

• Optimize SSL buffered reads using C values (#629) (by @​tarasko in a308f75f)

Fixes

• Detach socket on create_connection cancellation to prevent fd double-close (#740) (by @​junjzhang @​fantix in dc680eb2 for #645 #738)

• Remove loop._ready_len in favor of len(loop._ready) (#721) (by @​x42005e1f in 5910a183 for #720)

• Prefer inspect.iscoroutinefunction (#705) (by @​MatthieuDartiailh in fd650276 for #703)

• Fix context tests by explicitly yielding after run_in_executor (#743) (by @​samypr100 in 6cd24cbb)

• Fix test_create_connection_open_con_addr with Python 3.13.9+ (#713) (by @​shadchin in b93141a5 for #701)

• Skip flaky test_cancel_post_init on asyncio 3.13+ (#714)

... (truncated)

Commits

• c5f7deb uvloop 0.23.0
• f7c0547 Add Python 3.15 to CI and fix test issues (#758)
• e8efea4 Upgrade libuv to v1.52.1 (#753)
• 3cbb095 feat: support eager_start kwarg (#748)
• 0582f94 Add thread name prefix to the default thread pool executor (#636)
• 963a5f3 Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
• 173e88c Get rid of wheel as a build dependency (#696)
• b74c2f1 Update the example to work with 3.14 (#710)
• dc680eb Detach socket on create_connection cancellation to prevent fd double-close (#...
• 6cd24cb fix: explicit yield after run_in_executor as it was implicitly needed (#743)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[brianglass]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.