Skip to content

Bump the python-minor-patch group across 1 directory with 8 updates - #657

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-c1548acafb
Open

Bump the python-minor-patch group across 1 directory with 8 updates#657
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-c1548acafb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 8 updates in the / directory:

Package From To
python-dotenv 1.2.2 1.2.3
langchain-core 1.5.1 1.6.0
langchain-openai 1.4.1 1.6.0
nltk 3.10.0 3.10.3
sentry-sdk 2.66.1 2.68.1
langfuse 4.14.1 4.14.5
opentelemetry-instrumentation-anthropic 0.62.1 0.62.3
ruff 0.16.0 0.16.4

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates langchain-core from 1.5.1 to 1.6.0

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.0

Changes since langchain-core==1.5.6

release(core): 1.6.0 (#39760) fix(core): resolve postponed annotations in StructuredTool._injected_args_keys (#39602) feat(core): add standard model exception types (#39538) fix(core): allow deserializing RunnablePick (#39753) fix(core): make convert_to_openai_function handle callables and non-dict mappings (#39750) fix(core): make subprocess and temporary file tests portable on Windows (#39664) fix(core): fail fast when tool schemas can't resolve forward refs during serialization (#39570) test(core): avoid version-dependent runnable snapshots (#39705) fix(core): require all nested properties for strict tool schemas (#39306) fix(core): remove stale sync-stream xfail [closes #39720] (#39723) perf(core): Lazily import transformers (#38037) fix(core): accept non-dict Mapping values in mustache templates (#39680) docs(core): clarify Runnable pipe coercion [closes #39075] (#39707) fix(core): finalize chain-group runs on BaseException (#39699)

langchain-core==1.5.6

Changes since langchain-core==1.5.5

chore(core): release 1.5.6 (#39704) feat(core): incorporate gateway metadata to traces (#39703)

langchain-core==1.5.5

Changes since langchain-core==1.5.4

release(core): 1.5.5 (#39655) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (#39367) fix(core): respect pydantic aliases when validating tool inputs (#39572) fix(core): issues in merging chunks (#39535) fix(core): handle v1 base model validation in async path (#39576) fix(core): handle tool descriptions for infer_schema=False (#39573) fix(core): clear usage metadata callback on exceptions in context manager (#39616) fix(core): handle falsy LLM and chat model caches (#39283) chore(core): add httpx as an explicit dep (#39612) fix(core): preserve non-str/non-dict items in DictPromptTemplate list values (#39588) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (#39142) fix(core): guard malformed Anthropic content blocks (#38670)

langchain-core==1.5.4

Changes since langchain-core==1.5.3

release(core): 1.5.4 (#39592) fix(core): compat with pydantic 2.14 (#39328) fix(core): stop StructuredPrompt from mutating caller kwargs (#39174) fix(core): preserve flat tool args schema for RootModel runnables (#39307) fix(core): close internally created event loops in streaming tracers (#39222) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(core): preserve OpenAI file blocks (#39205)

... (truncated)

Commits
  • 85602c3 release(core): 1.6.0 (#39760)
  • 5c3538e fix(core): resolve postponed annotations in `StructuredTool._injected_args_ke...
  • 9984a87 feat(core): add standard model exception types (#39538)
  • b3e9eef chore(model-profiles): refresh model profile data (#39751)
  • ded2a1f fix(core): allow deserializing RunnablePick (#39753)
  • 04ae744 fix(core): make convert_to_openai_function handle callables and non-dict ma...
  • 37f2662 feat(langchain): support custom token_counter in ContextEditingMiddleware (#3...
  • 2019bf5 fix(openai): raise clear error on unexpected response type in `_create_chat_r...
  • e92c6db fix(langchain): re-raise non-retryable exceptions in ModelRetryMiddleware (#3...
  • f368888 fix(partners): isolate unit tests from network [closes #39727] (#39729)
  • Additional commits viewable in compare view

Updates langchain-openai from 1.4.1 to 1.6.0

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.6.0

Changes since langchain-openai==1.5.2

release(openai): 1.6.0 (#39762) feat(core): add standard model exception types (#39538) fix(openai): raise clear error on unexpected response type in _create_chat_result (#39731)

langchain-openai==1.5.2

Changes since langchain-openai==1.5.1

release(openai): 1.5.2 (#39719) fix(openai): preserve reasoning item boundaries (#39278) release(openai): 1.5.2a1 (#39709) feat(openai): extract gateway metadata from response headers when available (#39706) chore(openai): update snapshots (#39657) fix(openai): support o-series models in get_num_tokens_from_messages (#38710)

langchain-openai==1.5.2a1

Initial release

release(openai): 1.5.2a1 (#39709) feat(openai): extract gateway metadata from response headers when available (#39706) chore(openai): update snapshots (#39657) fix(openai): support o-series models in get_num_tokens_from_messages (#38710) release(openai): 1.5.1 (#39653) fix(openai): preserve streamed encrypted reasoning (#39635) chore(infra): support langsmith gateway in CI (#39651) release(openai): 1.5.0 (#39629) feat(openai): support openai 3.0 SDK (#39613) chore(partners): bump langgraph floor in openai and huggingface lockfiles (#39617) release(openai): 1.4.3 (#39485) fix(openai): filter invalid tool calls from content (#39366) chore(openai): update guidance for responses API for OpenAI-compatible providers (#39327) chore(openai): update docstring for include_response_headers (#39326) release(openai): 1.4.2 (#39322) fix(openai): handle ContextWindowExceededError (#39300) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(openai): filter langchain-generated content block IDs (#39209) fix(openai): preserve Responses text options (#39204) fix(openai): redact MCP authorization (#39155) chore(model-profiles): refresh model profile data (#39050) release(openai): 1.4.1 (#39045) feat(anthropic,fireworks,openai): support langsmith gateway through env var (#38742) fix(openai): correct gpt-5.3-chat-latest profile (#39009) release(openai): 1.4.0 (#38983) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/openai (#38999) feat(core): add reasoning_effort as a standard chat model parameter (#38887) chore(model-profiles): refresh model profile data (#38797) release(openai): 1.3.5 (#38785) feat(openai): support explicit prompt caching (#38762)

... (truncated)

Commits
  • 3478c28 release(anthropic): 1.6.0 (#39763)
  • 420dfc9 release(openai): 1.6.0 (#39762)
  • 85602c3 release(core): 1.6.0 (#39760)
  • 5c3538e fix(core): resolve postponed annotations in `StructuredTool._injected_args_ke...
  • 9984a87 feat(core): add standard model exception types (#39538)
  • b3e9eef chore(model-profiles): refresh model profile data (#39751)
  • ded2a1f fix(core): allow deserializing RunnablePick (#39753)
  • 04ae744 fix(core): make convert_to_openai_function handle callables and non-dict ma...
  • 37f2662 feat(langchain): support custom token_counter in ContextEditingMiddleware (#3...
  • 2019bf5 fix(openai): raise clear error on unexpected response type in `_create_chat_r...
  • Additional commits viewable in compare view

Updates nltk from 3.10.0 to 3.10.3

Release notes

Sourced from nltk's releases.

v3.10.3

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

New Contributors

Full Changelog: nltk/nltk@v3.10.2...v3.10.3

v3.10.3-rc1

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • 303f6e2 Prepare release 3.10.3 (#3745)
  • cf2aaac Merge pull request #3744 from alvations/ci-guard-open
  • 6cd8320 test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)
  • e965330 fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...
  • df1bb4c test: make pathsec security tests platform-independent (fix Linux/Windows CI)
  • 0e5c7be ci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)
  • 5017826 Merge commit from fork
  • 40d0f06 Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...
  • 483c5fe Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...
  • 722778f Merge commit from fork
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.66.1 to 2.68.1

Release notes

Sourced from sentry-sdk's releases.

2.68.1

enable_logs

  • (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

    If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)

    Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

2.68.0

Important

  • We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

    Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

    Action Needed

    If you had enable_logs set to True:

    • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
    • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.68.1

enable_logs

  • (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

    If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)

    Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

2.68.0

Important

  • We're making enable_logs and enable_metrics no-op with this release (#7177), and they'll be dropped in the next major.

    Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

    Action Needed

    If you had enable_logs set to True:

    • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
    • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
    

    • 






... (truncated)





Commits

    

  • 98f7d91 Update changelog
    • 

  • 8f886ff release: 2.68.1
    • 

  • df4ec02 fix(logs): Don't stop sending auto-collected logs when enable_logs=True (#7...
    • 

  • e320318 test(pyramid): Add tests for data_collection gating of request body (#7218)
    • 

  • 7b8a385 test(bottle): Add tests for data_collection gating of request body (#7217)
    • 

  • cbcadc9 test(sanic): Add tests for data_collection gating of request body (#7216)
    • 

  • e42c798 feat(tornado): Gate request body collection on data_collection option (#7215)
    • 

  • d05bb60 test(django): Add tests for data_collection gating of request body (#7213)
    • 

  • bcce67b feat(wsgi): Gate request body collection on data_collection option (#7212)
    • 

  • 41220c4 fix(google_genai): Gate streaming gen_ai.response.tool_calls on outputs, no...
    • 

  • Additional commits viewable in compare view
    • 







Updates langfuse from 4.14.1 to 4.14.5



Commits






Updates opentelemetry-instrumentation-anthropic from 0.62.1 to 0.62.3



Release notes

Sourced from opentelemetry-instrumentation-anthropic's releases.




0.62.3


v0.62.3 (2026-08-10)


Fix


    

  • litellm: register instrumentation in commitizen version files (#4408)
    • 



[main 62e24c2ff] bump: version 0.62.2 → 0.62.3
66 files changed, 71 insertions(+), 65 deletions(-)


0.62.2


v0.62.2 (2026-08-09)


Fix


    

  • sdk,openai-agents: stop entity names leaking onto sibling and parent spans (#4405)
    • 



[main c2f3f45e2] bump: version 0.62.1 → 0.62.2
64 files changed, 69 insertions(+), 63 deletions(-)







Changelog

Sourced from opentelemetry-instrumentation-anthropic's changelog.




v0.62.3 (2026-08-10)


Fix


    

  • litellm: register instrumentation in commitizen version files (#4408)
    • 



v0.62.2 (2026-08-09)


Fix


    

  • sdk,openai-agents: stop entity names leaking onto sibling and parent spans (#4405)
    • 








Commits

    

  • 62e24c2 bump: version 0.62.2 → 0.62.3
    • 

  • 9965d24 fix(litellm): register instrumentation in commitizen version files (#4408)
    • 

  • c2f3f45 bump: version 0.62.1 → 0.62.2
    • 

  • e561195 fix(sdk,openai-agents): stop entity names leaking onto sibling and parent spa...
    • 

  • See full diff in compare view
    • 







Updates ruff from 0.16.0 to 0.16.4



Release notes

Sourced from ruff's releases.




0.16.4


Release Notes


Released on 2026-08-20.


Preview features


    

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
    • 

  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
    • 

  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
    • 



Bug fixes


    

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
    • 

  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
    • 

  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
    • 



Rule changes


    

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
    • 

  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
    • 

  • [syntax-errors] Detect duplicate keyword arguments (#17804)
    • 

  • [syntax-errors] Detect parameters declared nonlocal (#27628)
    • 



Server


    

  • Offer display-only fixes and mark safe fixes preferred (#27807)
    • 

  • Support pull diagnostics for notebook cells (#27779)
    • 



Documentation


    

  • Add default indicator to rules table (#27724)
    • 

  • Fix broken link to Python docs (#27757)
    • 



Other changes


    

  • Fix s390x stacker assembly in release builds (#27776)
    • 

  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
    • 

  • Reduce configuration deserialization code size (#27924)
    • 

  • Check packed AST index bounds (#27849)
    • 



Contributors






... (truncated)





Changelog

Sourced from ruff's changelog.




0.16.4


Released on 2026-08-20.


Preview features


    

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
    • 

  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
    • 

  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
    • 



Bug fixes


    

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
    • 

  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
    • 

  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
    • 



Rule changes


    

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
    • 

  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
    • 

  • [syntax-errors] Detect duplicate keyword arguments (#17804)
    • 

  • [syntax-errors] Detect parameters declared nonlocal (#27628)
    • 



Server


    

  • Offer display-only fixes and mark safe fixes preferred (#27807)
    • 

  • Support pull diagnostics for notebook cells (#27779)
    • 



Documentation


    

  • Add default indicator to rules table (#27724)
    • 

  • Fix broken link to Python docs (#27757)
    • 



Other changes


    

  • Fix s390x stacker assembly in release builds (#27776)
    • 

  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
    • 

  • Reduce configuration deserialization code size (#27924)
    • 

  • Check packed AST index bounds (#27849)
    • 



Contributors






... (truncated)





Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          Bump the python-minor-patch group across 1 directory with 8 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          754fac2
        
      

    

  

    

      
Bumps the python-minor-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.1` | `1.6.0` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.4.1` | `1.6.0` |
| [nltk](https://github.com/nltk/nltk) | `3.10.0` | `3.10.3` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.66.1` | `2.68.1` |
| [langfuse](https://github.com/langfuse/langfuse) | `4.14.1` | `4.14.5` |
| [opentelemetry-instrumentation-anthropic](https://github.com/traceloop/openllmetry) | `0.62.1` | `0.62.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |



Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `langchain-core` from 1.5.1 to 1.6.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.5.1...langchain-core==1.6.0)

Updates `langchain-openai` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.4.1...langchain-openai==1.6.0)

Updates `nltk` from 3.10.0 to 3.10.3
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@v3.10.0...v3.10.3)

Updates `sentry-sdk` from 2.66.1 to 2.68.1
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.66.1...2.68.1)

Updates `langfuse` from 4.14.1 to 4.14.5
- [Release notes](https://github.com/langfuse/langfuse/releases)
- [Commits](https://github.com/langfuse/langfuse/commits)

Updates `opentelemetry-instrumentation-anthropic` from 0.62.1 to 0.62.3
- [Release notes](https://github.com/traceloop/openllmetry/releases)
- [Changelog](https://github.com/traceloop/openllmetry/blob/main/CHANGELOG.md)
- [Commits](traceloop/openllmetry@0.62.1...0.62.3)

Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)

---
updated-dependencies:
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: nltk
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: sentry-sdk
  dependency-version: 2.68.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langfuse
  dependency-version: 4.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: opentelemetry-instrumentation-anthropic
  dependency-version: 0.62.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  python

  An issue related to python/ML services

  labels


      Aug 28, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    python

  An issue related to python/ML services








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants