[dependabot]

Bumps the python-dependencies group in /fp-cloud-cli with 2 updates: pygments and posthog.

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
  • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

• New lexers:

  • BitBake (#3103)
  • Caddyfile (#3225)
  • CEL (#3048)
  • PureScript (#1077, #3054)

• Updated lexers:

  • Bash: Fix coloured keyword at the beginning of a name (#2926)
  • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
  • C#:
    • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
    • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
    • Recognize union (#3182)
  • C/C++:
    • Add C23/C++26 attributes (#3084)
    • Add more C2Y keywords (#3092)
    • Highlight a function following a namespace body (#2928)
    • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
    • Add .ipp as a file extension (#3141, #1008)
  • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
  • Csound: Add missing opcode parameter type letter (#3161)
  • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
  • D: Allow non-ASCII (Unicode) identifiers (#1088)
  • Fish: Fix single quote backslash escape (#3138, #2821)
  • Go: Various lexer improvements (#3199)
  • GoogleSQL: Require a word break after SET (#3167)
  • Hexdump: Only match valid digits (#3200, #2847)
  • JavaScript: Highlight the arguments object (#3146)
  • Jsonnet: Recognize colons in array slice expressions (#2828)
  • JSX: Allow apostrophes in element text (#2816)
  • Julia: Fix rstrings backslash (#3140, #2537)
  • Kotlin: Support companion objects without an explicit name (#2525)
  • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
  • Kusto: Recognize member-access dots in dynamic objects (#2779)
  • Lua: Various improvements (#3143)
  • Macaulay2: Update symbols to 1.26.05 (#3120)
  • Markdown:
    • Highlight bold-italics (***...*** and ___...___) (#3067)
    • Fix mention regex to support hyphens in usernames (#3139, #3135)
  • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

• a43b45d Get ready for the 2.21.0 release.
• d8f14cb Fix version_added for Purescript.
• 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
• 9992e09 Merge pull request #3191 from jvoisin/dupes
• bd22577 Fix regexlint warnings after latest update.
• 6a62df1 Release preparation: Update the changelog.
• aabba32 Merge pull request #3221 from jvoisin/alter
• d3441d0 Merge pull request #3225 from jvoisin/caddy
• c593f3f Add a lexer for Caddy
• 0644b53 Simplify single-character regex alternations to character classes
• Additional commits viewable in compare view

Updates posthog from 7.39.1 to 7.42.0

Release notes

Sourced from posthog's releases.

posthog-v7.42.0

Minor changes

• f483bab feat(mcp): capture $mcp_client_user_agent and $mcp_vendor_client so MCP usage can be attributed to a product surface. clientInfo.name only says which client library is calling — Anthropic reports claude-code from the CLI, the Agent SDK, the VS Code extension and the desktop app alike — so $mcp_client_name collapses every surface into one bucket and the harness breakdown reads 100% "Other" for Python-backed servers. The distinguishing detail lives in the User-Agent parenthetical (claude-code/2.1.0 (cli) vs (sdk-ts)) and in vendor headers like x-anthropic-client. Both are captured raw and classified at query time, so labels can improve without an SDK release. HTTP transports only: stdio and in-memory servers carry no headers and their events are unchanged. Custom dispatchers pass their own via new client_user_agent / vendor_client arguments on every PostHogMCP.capture_* method. Parity with @posthog/mcp. — Thanks @​gesh!

posthog-v7.41.0

Minor changes

• 2863909 feat(mcp): emit $mcp_error_message and $mcp_error_type on failed MCP events. The reason a tool call failed previously lived only on the sibling $exception event, so PostHog's failures view — which reads the scalars off the primary event — showed empty error rows for every Python-backed MCP server, and switching off enable_exception_autocapture removed the reason entirely. Both values are read from the same $exception_list the sibling carries, so the two surfaces can never disagree, and the message inherits the existing 2048-character cap. PostHogMCP.capture_tool_call() and capture_tools_list() take a new optional error_type for custom dispatchers that want a coarse category ("validation", "timeout") instead of the thrown class name. Exception messages are also redacted before they leave — previously nothing sanitized the error payload, so the $exception sibling had been shipping them raw. Credential-looking words go through the SDK's own detector (entropy, known key formats, PEM markers), per word, so a message like auth failed for sk-... keeps its diagnostic text and loses only the key. Parity with @posthog/mcp, which sanitizes exception values the same way. — Thanks @​gesh!

posthog-v7.40.0

Minor changes

• b0ab12c feat(mcp): support MCP Python SDK v2 and bring posthog.mcp to parity with the TypeScript SDK (@posthog/mcp). Most of this reaches SDK 1.x servers too — the parity work is not v2-only.

  MCP SDK v2 / spec 2026-07-28. instrument() now wraps mcp.server.mcpserver.MCPServer (the renamed FastMCP) and the v2 low-level Server (constructor-injected handlers, string-keyed registry, late add_request_handler registrations included), capturing tool calls, tools/list, errors, intent, client identity, and $mcp_protocol_version on both protocol eras — the legacy handshake and the stateless 2026-07-28 envelope, decided per request. Previously instrument() raised ImportError on mcp>=2 and took the host application down with it; it now degrades to a logged no-op on any unsupported or unrecognized SDK.

  Cross-SDK parity (SDK 1.x and 2.x alike). Conversation-anchored sessions land as the cross-pod correlation the stateless era needs: with enable_conversation_id, $session_id derives deterministically from the agent-echoed conversation_id (new export derive_session_id_from_conversation, byte-compatible with @posthog/mcp). Only a handle the SDK could have minted (a uuidv7) anchors a session, so two callers inventing the same id can no longer be merged. The handle is delivered over both channels a tool result has — a content text block carrying it as plain JSON data on the minting response (an imperative server sentence inside a tool result is prompt-injection-shaped, and a client that strips it silently breaks the feature), and an _mcp_instructions key declared on the tool's output schema and mirrored into structuredContent on every response. That second channel is what makes the feature work at all for tools with structured output: clients that read structuredContent never render content, so the agent had no handle to echo (0% echo rate measured against Claude Code before the mirror). The prompt-back now rides errored results too, so a failure on a conversation's first call doesn't split the retry into a new session. The session is resolved only once the handle's fate is known, so the call that mints a handle joins the same session as the calls that echo it — while a handle that could not be delivered anchors nothing, rather than stranding events in a conversation nobody holds. Host callbacks (identify, intent_fallback, event_properties) receive the SDK's own per-request context as extra["ctx"] identically on both majors, with a new exported get_request_headers(extra) to read HTTP headers off it — the underlying shape differs per major, and a hand-rolled read that works on one silently returns nothing on the other, sending every event out anonymous.

  Fixes affecting existing SDK 1.x users. Analytics could break a tool call in three ways, each now fixed and regression-tested: the SDK's tool cache is rebuilt from an internal listing pass we skipped injecting on, so after any call to an unlisted tool name a strict schema rejected either the analytics parameters we advertise (Input validation error) or the conversation key we write (Output validation error); the conversation handle was written into the caller's result object in place, so a tool returning a shared or cached result served one conversation's handle to every later caller; and on jlowin's FastMCP the advertised schema marked context required while the adapter strips it before validation, failing every call under strict_input_validation=True. Two behavioural changes come with the parity work: an invented (non-uuidv7) conversation_id echo is replaced with a fresh handle rather than trusted, and minted prompt-backs are now appended to errored results. — Thanks @​gesh!

posthog-v7.39.2

Patch changes

• 1adf542 Drop events when before_send callbacks raise exceptions — Thanks @​marandaneto!

Commits

• 79c0cb5 chore: Release v7.42.0 [skip ci]
• f483bab feat(mcp): capture $mcp_client_user_agent and $mcp_vendor_client (#883)
• acdaae2 Update generated references
• 390f72c chore: Release v7.41.0 [skip ci]
• 2863909 feat(mcp): emit $mcp_error_message and $mcp_error_type (#882)
• 2228a18 Update generated references
• 627c4a6 chore: Release v7.40.0 [skip ci]
• b0ab12c feat(mcp): support MCP Python SDK v2 and cross-SDK parity with TS SDK (#881)
• a64ee77 Update generated references
• dd50f9f chore: Release v7.39.2 [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Thanks @dependabot[bot] for keeping our dependencies current! 🙌

[github-actions]

Automated approval for Dependabot dependency update.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pygments@​2.20.0 ⏵ 2.21.0	+1
	pypi/​posthog@​7.39.1 ⏵ 7.42.0

View full report

[hermes-exosphere]

Approved automatically by the Hermes Dependabot approver.