Skip to content

Bump the minor group across 1 directory with 6 updates - #247

Merged
brianglass merged 1 commit into
mainfrom
dependabot/pip/minor-342646df6e
Oct 12, 2026
Merged

Bump the minor group across 1 directory with 6 updates#247
brianglass merged 1 commit into
mainfrom
dependabot/pip/minor-342646df6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor group with 6 updates in the / directory:

Package From To
django-ninja 1.7.0 1.7.1
django 6.1.1 6.1.2
mcp 2.1.1 2.3.0
servestatic 4.3.4 4.4.0
uvicorn 0.52.4 0.54.0
uvloop 0.22.1 0.23.0

Updates django-ninja from 1.7.0 to 1.7.1

Release notes

Sourced from django-ninja's releases.

1.7.1

What's Changed

New Contributors

Full Changelog: vitalik/django-ninja@v1.7.0...v1.7.1

1.7.1a2

Pre-release exercising PyPI Trusted Publishing (OIDC) via uv (#1771). No functional changes since 1.7.1a1.

1.7.1a1

Pre-release exercising the new uv-based CI/CD and publishing pipeline (#1770).

No functional changes since 1.7.0 — tooling migration only: flit → uv for contributing, CI, and publishing (build backend remains flit_core).

Commits
  • 1cb8426 Update version to 1.7.1
  • 1685055 fix(auth): preserve percent sequences in HTTP Basic credentials (#1780)
  • d1a5d88 Merge pull request #1776 from vitalik/docs-permissions-decorator-example
  • b570ded docs: add decorator example to permissions section
  • acd6da0 Merge pull request #1744 from namelessweakl1ng/docs-permissions-section
  • 0fcad9f Document why _await_coroutine exists in sync auth path
  • 7d2a27a Merge pull request #1755 from tunglambk/agent/fix-async-auth-double-call
  • e82e575 Merge pull request #1771 from vitalik/trusted-publishing
  • 276c251 Publish to PyPI via Trusted Publishing (OIDC)
  • 1d66bd3 Merge pull request #1770 from vitalik/uv-migration
  • Additional commits viewable in compare view

Updates django from 6.1.1 to 6.1.2

Commits

Updates mcp from 2.1.1 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

  • It used to send "experimental": {}. server/discover already left it out.
  • Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

  • MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
  • The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

  • The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
  • This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
  • A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

  • max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
  • MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
  • Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
  • Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

  • ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
  • An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
  • A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
  • Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
  • stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits
  • 2118f14 docs: refresh translations for recent English changes (#3636)
  • ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
  • d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
  • c15566c Link What's new to the Header parameters page (#3632)
  • 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
  • 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
  • c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
  • 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
  • cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
  • 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
  • Additional commits viewable in compare view

Updates servestatic from 4.3.4 to 4.4.0

Release notes

Sourced from servestatic's releases.

4.4.0

Added

  • Support the ASGI http.response.pathsend extension for full-file sends. When the ASGI server advertises this extension (e.g. Granian), ServeStatic now offloads the file transmission to the server via pathsend instead of streaming the file through Python file IO. Range (sliced) requests continue to stream over http.response.body since pathsend has no slicing support.
  • Support the ASGI http.response.zerocopysend extension (e.g. nonecorn or anycorn). When the ASGI server advertises this extension, ServeStatic offloads file transmission to the server via zerocopysend. Unlike pathsend, zerocopysend supports slicing, so both full-file and Range (sliced) requests are transmitted zero-copy. When a server advertises both extensions, zerocopysend is preferred for performance reasons.

Changed

  • Make the standalone ASGI/WSGI serving core compatible with the trio async backend. Thread-offload now detects the running async library (via sniffio, lazily and optionally) and dispatches to asyncio or trio, so ServeStatic no longer returns empty responses under trio-based servers (e.g. Anycorn --worker-class trio).
Changelog

Sourced from servestatic's changelog.

[4.4.0] - 2026-10-02

Added

  • Support the ASGI http.response.pathsend extension for full-file sends. When the ASGI server advertises this extension (e.g. Granian), ServeStatic now offloads the file transmission to the server via pathsend instead of streaming the file through Python file IO. Range (sliced) requests continue to stream over http.response.body since pathsend has no slicing support.
  • Support the ASGI http.response.zerocopysend extension (e.g. nonecorn or anycorn). When the ASGI server advertises this extension, ServeStatic offloads file transmission to the server via zerocopysend. Unlike pathsend, zerocopysend supports slicing, so both full-file and Range (sliced) requests are transmitted zero-copy. When a server advertises both extensions, zerocopysend is preferred for performance reasons.

Changed

  • Make the standalone ASGI/WSGI serving core compatible with the trio async backend. Thread-offload now detects the running async library (via sniffio, lazily and optionally) and dispatches to asyncio or trio, so ServeStatic no longer returns empty responses under trio-based servers (e.g. Anycorn --worker-class trio).
Commits

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates uvloop from 0.22.1 to 0.23.0

Release notes

Sourced from uvloop's releases.

v0.23.0

Changes

Fixes

... (truncated)

Commits
  • c5f7deb uvloop 0.23.0
  • f7c0547 Add Python 3.15 to CI and fix test issues (#758)
  • e8efea4 Upgrade libuv to v1.52.1 (#753)
  • 3cbb095 feat: support eager_start kwarg (#748)
  • 0582f94 Add thread name prefix to the default thread pool executor (#636)
  • 963a5f3 Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
  • 173e88c Get rid of wheel as a build dependency (#696)
  • b74c2f1 Update the example to work with 3.14 (#710)
  • dc680eb Detach socket on create_connection cancellation to prevent fd double-close (#...
  • 6cd24cb fix: explicit yield after run_in_executor as it was implicitly needed (#743)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor group across 1 directory with 6 updates
592bbfa 
Bumps the minor group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [django-ninja](https://github.com/vitalik/django-ninja) | `1.7.0` | `1.7.1` |
| [django](https://github.com/django/django) | `6.1.1` | `6.1.2` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `2.1.1` | `2.3.0` |
| [servestatic](https://github.com/Archmonger/ServeStatic) | `4.3.4` | `4.4.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [uvloop](https://github.com/MagicStack/uvloop) | `0.22.1` | `0.23.0` |



Updates `django-ninja` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/vitalik/django-ninja/releases)
- [Commits](vitalik/django-ninja@v1.7.0...v1.7.1)

Updates `django` from 6.1.1 to 6.1.2
- [Commits](django/django@6.1.1...6.1.2)

Updates `mcp` from 2.1.1 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.1...v2.3.0)

Updates `servestatic` from 4.3.4 to 4.4.0
- [Release notes](https://github.com/Archmonger/ServeStatic/releases)
- [Changelog](https://github.com/Archmonger/ServeStatic/blob/main/CHANGELOG.md)
- [Commits](Archmonger/ServeStatic@4.3.4...4.4.0)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `uvloop` from 0.22.1 to 0.23.0
- [Release notes](https://github.com/MagicStack/uvloop/releases)
- [Commits](MagicStack/uvloop@v0.22.1...v0.23.0)

---
updated-dependencies:
- dependency-name: django-ninja
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: django
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: servestatic
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: uvloop
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 12, 2026
@brianglass
brianglass merged commit 5bc7ed0 into main Oct 12, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/minor-342646df6e branch October 12, 2026 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brianglass