Bump the python group with 4 updates by dependabot[bot] · Pull Request #45 · ipinfo/mcp

dependabot · 2026-11-12T18:55:26Z

Bumps the python group with 4 updates: fastmcp, joserfc, pydantic and ruff.

Updates fastmcp from 4.1.5 to 4.1.6

Release notes

v4.1.6: Group Therapy

ClientGroup keeps its known tool routes after the group context exits, so a resolved tool can be called with only its own client connected (#6271). Thanks to @hntrl and @YingzuoLiu.

What's Changed

Fixes 🐞

fix(client): keep ClientGroup tool routes after the group context exits by @zzstoatzz, @hntrl and @YingzuoLiu in PrefectHQ/fastmcp#6271

Full Changelog: PrefectHQ/fastmcp@v4.1.5...v4.1.6

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" description: "Release notes for every FastMCP version, with the changes, fixes, and contributors in each release." icon: "list-check" rss: true tag: NEW

v4.2.0a4: Skills to Pay the Bills

FastMCP 4.2.0a4 requires Python 3.11 or newer and adds Annotated dependencies. Depends(...) and built-ins such as CurrentContext() can now be declared as Annotated metadata, so a type alias like Config = Annotated[dict, Depends(get_config)] works across tools, resources, and prompts. Skill discovery over plain resources no longer lists a nested supporting SKILL.md as its own skill, and download_skill URIs now encode manifest paths. Since a3, the redirect URI helpers normalize raw strings the way browsers read them, the joserfc and Authlib floors pick up security fixes, and fixes land for OpenAPI request bodies, CIMD redirect URIs, multi-select elicitation schemas, search indexing, and docstring parsing. Skills support remains experimental; this prerelease is intended for integration testing. Thanks to our 68 contributors, including 40 first-time contributors.

Breaking Changes ⚠️

Make Skill a storage-neutral object with folders as one loader by @zzstoatzz in #6065

Require Python 3.11 by @zzstoatzz in #6377

Enhancements ✨

Rename the resource-era list_skills helper to list_skill_summaries by @zzstoatzz in #6051

Discover skills through mounted servers by @zzstoatzz in #6067

Share Prefab renderer resources across equivalent tools by @jlowin, @fprieto14, and @keremoktener in #6077

Export Skill from fastmcp by @zzstoatzz in #6071

Add skills discovery to ClientGroup by @zzstoatzz in #6072

Add --skills to fastmcp list by @zzstoatzz in #6073

Add Client.read_skill and tighten skills docs by @zzstoatzz in #6087

Verify and export skills with resource-manifest fallback by @zzstoatzz in #6086

Forward Skills discovery through proxies by @jakekaplan in #5788

Share strict skill snapshot projection by @zzstoatzz in #6089

Use scoped local tests and leave full suites to CI by @zzstoatzz in #6094

Share ClientGroup skill client lookup by @zzstoatzz in #6101

Share filesystem skill supporting-file reads by @zzstoatzz in #6102

Deliver concurrent triage reviews, draft fixes and mutation proposals by @zzstoatzz in #6116

Post Marvin's dedupe and too-long comments from workflow steps by @gaker in #6170

Remove the unused triage mutation batch by @zzstoatzz in #6208

Restore the status site by @zzstoatzz in #6216

Add agno, Agent Framework, and OpenAI Agents SDK to downstream smoke by @zzstoatzz in #6222

Close external PRs until their author is assigned again by @zzstoatzz in #6227

Let private triage sweeps run without the Sol reviewer by @zzstoatzz in #6229

Add named model tiers to the agentic triage plans by @zzstoatzz in #6228

Add reproducible public triage leads to backlog dashboard by @zzstoatzz in #6293

Add a strict SkillsDirectoryProvider to fastmcp.skills.provider by @zzstoatzz in #6278

Point experimental_skills at the new provider and drop alpha-only skills code by @zzstoatzz in #6279

Deprecate the 4.1 skills API for removal in 4.3 by @zzstoatzz in #6280

Add app restart to the smart home Fire TV example by @zzstoatzz in #6356

Add a workflow that deploys agentic triage to Prefect Cloud by @zzstoatzz in #6380

Support Annotated dependencies by @zzstoatzz and @Kludex in #6378

Post triage outcomes instead of run starts, and skip maintainer events by @zzstoatzz in #6382

Security 🔒

Verify advertised skill frontmatter when reading content by @zzstoatzz in #6090

Check skill limits before reading directory and remote files by @zzstoatzz in #6092

... (truncated)

Commits

1302563 [4.1] fix(client): keep ClientGroup tool routes after the group context exits...
See full diff in compare view

Updates joserfc from 1.7.7 to 1.8.0

Release notes

Sourced from joserfc's releases.

1.8.0

🐞 Bug Fixes

Use python>=3.11, improve type hints - by @lepture (7c6de)

Replace typing as t syntax - by @lepture (7422a)

Treat claims option "value" as the expected claim value - by @choksi2212 (232d6)

jwe: Refresh ECDH ephemeral keys per encryption - by @lepture (cc6ec)

jwe: Reject explicitly empty AAD - by @lepture (96ef5)

jwk: Reject certificates and prefixed public keys as oct - by @lepture (bf664)

jws: Protect critical JSON headers and b64 mode - by @lepture (04cb5)

jwt: Reject tokens whose exp equals the current time - by @carlok and Claude Sonnet 5.5 (e2e3a)

jwt: Reject NaN and Infinity in exp, nbf and iat - by @carlok and Claude Sonnet 5.5 (b8a23)

jwt: Reject True/False in exp/nbf/iat - by @lepture (953e5)

mypy: Use NotRequired in TypedDict - by @lepture (351c1)

View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.8.0

Released on November 3, 2026

JWT: Reject non-finite and boolean NumericDate claims, and reject JWT payloads that are not JSON objects.

JWK: Reject X.509 certificates and prefixed asymmetric public keys as oct keys.

JWS: Require critical headers and RFC 7797 b64 parameters to be protected, and require a consistent b64 value across General JSON signatures.

JWE: Generate fresh ECDH ephemeral keys for each encryption and reject an explicitly empty AAD member.

Drop Python 3.10 support; Python 3.11 or newer is required.

Preserve key subclasses in factory return types with typing.Self.

Improve claim validation type narrowing with typing.TypeGuard and refine password, native key, and equality annotations.

Commits

f345ff7 chore: release 1.8.0
f1a3e43 chore: update deps
96ef53a fix(jwe): reject explicitly empty AAD
cc6ec3f fix(jwe): refresh ECDH ephemeral keys per encryption
04cb5d8 fix(jws): protect critical JSON headers and b64 mode
bf66415 fix(jwk): reject certificates and prefixed public keys as oct
953e509 fix(jwt): reject True/False in exp/nbf/iat
6ec88f2 Merge pull request #109 from carlok/fix/exp-boundary
b8a2394 fix(jwt): reject NaN and Infinity in exp, nbf and iat
e2e3a29 fix(jwt): reject tokens whose exp equals the current time
Additional commits viewable in compare view

Updates pydantic from 2.14.2 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Build wheels for GraalPy 3.13 by @msimacek in #14136.

The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

Improve schema generation for fixed type handlers by @alexmojaki in #14130

Skip general schema dispatch for builtin scalars by @alexmojaki in #14141

Skip annotation handler setup when annotations are empty by @alexmojaki in #14149

Fix quadratic serialization time with per-index include/exclude on sequences by @Viicos in #14160

Avoid type lookups when checking for None during serialization by @Viicos in #14167

Improve performance of model serialization by @Viicos in #14171

Improve performance of dict serialization by @Viicos in #14172

Improve performance of type inference during serialization by @Viicos in #14173

Avoid cloning the field name when using the default value during validation by @Viicos in #14175

Do not evaluate model_config annotations by @Viicos in #14195

Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @Viicos in #14196

Use a lightweight @contextmanager implementation internally by @Viicos in #14199

Fixes

Fix various issues about GC tracking in pydantic-core by @Viicos in #13819

Include null in serialization JSON Schema for unless-none field serializers by @Kropiunig in #13848

Fix RecursionError when copying or unpickling models with defer_build by @Viicos in #14115

Remove dead default_factory check in unsupported Field() attribute by @owtaylor in #14129

Disallow non string extra keys during validation by @Viicos in #14135

Fix deeply nested data being reported as a cyclic reference by @Viicos in #14164

New Contributors

@owtaylor made their first contribution in #14129

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

ea492e0 Bump pydantic-core to v2.50.4
4f4a33f Prepare release v2.14.3
dca067b Benchmark TypedDict schema generation across builds
a2d1f6c Skip annotation handler setup when annotations are empty
3ae0a40 Construct builtin scalar union schemas directly
358d36f Skip general schema dispatch for builtin scalars
3cc701a Improve schema generation for fixed type handlers
762db7e Remove redundant None check in union schema generation
c214986 Bump pytest-codspeed to v5.0.4
038ee97 Bump typing-inspection to v0.4.5
Additional commits viewable in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

[flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)

[security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

Accept a bare raise before a semicolon (#29761)

Allow match identifiers after a semicolon (#29760)

Fix panic on BOM-prefixed files in diagnostic renderer (#30017)

[flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

Coalesce source slices when formatting attributes (#29841)

Collect return statements with a statement-only visitor (#29911)

[pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)

Format node fields directly when comment handling is unnecessary (#29853)

Reduce formatter source-slice overhead (#29855)

Reuse a callee's qualified name across lint rules (#29916)

Skip invalid string character checks when the source contains none (#29883)

Use a Bloom filter for formatter comment lookups (#29852)

Use a concrete buffer for ordinary writes (#29819)

CLI

Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)

Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

Correct the documented version and src defaults for ruff-action (#29880)

[flake8-bugbear] Make B014 example error out-of-the-box (#29941)

[flake8-no-pep420] Document preview behavior (INP001) (#29764)

[isort] Expand I001 documentation (#29843)

Other changes

[syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

[flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)

[security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

Accept a bare raise before a semicolon (#29761)

Allow match identifiers after a semicolon (#29760)

Fix panic on BOM-prefixed files in diagnostic renderer (#30017)

[flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

Coalesce source slices when formatting attributes (#29841)

Collect return statements with a statement-only visitor (#29911)

[pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)

Format node fields directly when comment handling is unnecessary (#29853)

Reduce formatter source-slice overhead (#29855)

Reuse a callee's qualified name across lint rules (#29916)

Skip invalid string character checks when the source contains none (#29883)

Use a Bloom filter for formatter comment lookups (#29852)

Use a concrete buffer for ordinary writes (#29819)

CLI

Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)

Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

Correct the documented version and src defaults for ruff-action (#29880)

[flake8-bugbear] Make B014 example error out-of-the-box (#29941)

[flake8-no-pep420] Document preview behavior (INP001) (#29764)

[isort] Expand I001 documentation (#29843)

Other changes

[syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

05cdc36 Bump version to 0.17.4 (#30073)
c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
926ccc8 [ty] Handle output errors when generating shell completions (#29997)
c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
c9150f0 Add project walltime benchmarks for Ruff (#30061)
64989ec [ty] Report invalid module globs once per override pattern (#30031)
367a563 [ty] Fix conditional type and tuple annotations (#29987)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python group with 4 updates: [fastmcp](https://github.com/PrefectHQ/fastmcp), [joserfc](https://github.com/authlib/joserfc), [pydantic](https://github.com/pydantic/pydantic) and [ruff](https://github.com/astral-sh/ruff). Updates `fastmcp` from 4.1.5 to 4.1.6 - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v4.1.5...v4.1.6) Updates `joserfc` from 1.7.7 to 1.8.0 - [Release notes](https://github.com/authlib/joserfc/releases) - [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst) - [Commits](authlib/joserfc@1.7.7...1.8.0) Updates `pydantic` from 2.14.2 to 2.14.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.14.2...v2.14.3) Updates `ruff` from 0.17.3 to 0.17.4 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.17.3...0.17.4) --- updated-dependencies: - dependency-name: fastmcp dependency-version: 4.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python - dependency-name: joserfc dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: pydantic dependency-version: 2.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python - dependency-name: ruff dependency-version: 0.17.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 12, 2026

Merge branch 'main' into dependabot/uv/python-89be4df65a

99a24cb

silvanocerza approved these changes Nov 13, 2026

View reviewed changes

silvanocerza merged commit 4eb1c3b into main Nov 13, 2026
4 checks passed

silvanocerza deleted the dependabot/uv/python-89be4df65a branch November 13, 2026 13:46

Navigation Menu

Repository navigation

Bump the python group with 4 updates - #45

Bump the python group with 4 updates#45
silvanocerza merged 2 commits into
mainfrom
dependabot/uv/python-89be4df65a

dependabot Bot commented on behalf of github Nov 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 12, 2026

v4.1.6: Group Therapy

What's Changed

Fixes 🐞

title: "Changelog" description: "Release notes for every FastMCP version, with the changes, fixes, and contributors in each release." icon: "list-check" rss: true tag: NEW

Breaking Changes ⚠️

Enhancements ✨

Security 🔒

1.8.0

🐞 Bug Fixes

View changes on GitHub

1.8.0

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Performance

Fixes

New Contributors

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

0.17.4

Release Notes

Preview features

Bug fixes

Rule changes

Performance

CLI

Documentation

Other changes

Contributors

0.17.4

Preview features

Bug fixes

Rule changes

Performance

CLI

Documentation

Other changes

Contributors

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant