chore: bump the patch-updates group across 1 directory with 4 updates by dependabot[bot] · Pull Request #531 · elementsinteractive/twyn

dependabot · 2026-07-20T15:16:40Z

Bumps the patch-updates group with 4 updates in the / directory: tomlkit, fastmcp, ruff and commitizen.

Updates tomlkit from 0.15.0 to 0.15.1

Release notes

0.15.1

What's Changed

Fix inline table separator after append by @cyliu0 in python-poetry/tomlkit#477

chore(deps): bump idna from 3.7 to 3.15 in /docs by @dependabot[bot] in python-poetry/tomlkit#481

chore(deps-dev): bump idna from 3.7 to 3.15 by @dependabot[bot] in python-poetry/tomlkit#480

chore(deps): bump urllib3 from 2.5.0 to 2.7.0 in /docs by @dependabot[bot] in python-poetry/tomlkit#475

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#478

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#484

Fix duplicated comma when removing a middle inline table element by @sarathfrancis90 in python-poetry/tomlkit#486

Add native contains to Container, Table and InlineTable by @tfoutrein in python-poetry/tomlkit#487

Make Source index-based instead of materializing a char list by @tfoutrein in python-poetry/tomlkit#489

reject surrogate code points in \U unicode escapes by @netliomax25-code in python-poetry/tomlkit#493

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#496

Scan character runs in bulk while parsing by @tfoutrein in python-poetry/tomlkit#490

Fix doubled comma when inserting into a comma-first array by @gaoflow in python-poetry/tomlkit#499

reject tab characters in bare keys by @netliomax25-code in python-poetry/tomlkit#497

reject non-hex digits in \u and \U escapes by @netliomax25-code in python-poetry/tomlkit#501

Bulk-scan single-line string bodies by @tfoutrein in python-poetry/tomlkit#491

Remove the internal TOMLChar wrapper by @tfoutrein in python-poetry/tomlkit#492

Fix corrupt output when adding to a dotted key inside an inline table by @gaoflow in python-poetry/tomlkit#500

Compare StringType members by identity instead of building a set by @tfoutrein in python-poetry/tomlkit#502

Merge super tables in place instead of deep-copying on every merge by @tfoutrein in python-poetry/tomlkit#503

Move a value replacing a table out of the table region by @gaoflow in python-poetry/tomlkit#506

Restore dumps() delegating to as_string for non-Mapping wrappers by @gaoflow in python-poetry/tomlkit#508

Limit parser nesting depth instead of crashing with RecursionError by @gaoflow in python-poetry/tomlkit#510

Prefix every line of a multiline comment with # by @gaoflow in python-poetry/tomlkit#511

Add a native OutOfOrderTableProxy.contains by @tfoutrein in python-poetry/tomlkit#515

Place inline-table separator after the value, not a trailing comment (fix #512) by @gaoflow in python-poetry/tomlkit#514

reject a table redefined after its parent table header by @netliomax25-code in python-poetry/tomlkit#516

Don't build a discarded error when an array closes right after a value by @tfoutrein in python-poetry/tomlkit#517

Validate out-of-order tables incrementally while parsing by @gaoflow in python-poetry/tomlkit#509

Return a single key from key() for a single-element list (fixes #430) by @tienvantranspk-tech in python-poetry/tomlkit#520

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#522

Speed up unwrap() by resolving keys from the key map instead of items() by @tfoutrein in python-poetry/tomlkit#521

Merge AoT fragments when building an out-of-order table proxy by @gaoflow in python-poetry/tomlkit#507

Bulk-scan multiline string bodies by @tfoutrein in python-poetry/tomlkit#518

reject array-of-tables header missing its second closing bracket by @netliomax25-code in python-poetry/tomlkit#519

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#541

Fix ParseError when a sub-table extends an array of tables out of order by @sarathfrancis90 in python-poetry/tomlkit#498

Render inline tables in O(n) instead of O(n²) by @tfoutrein in python-poetry/tomlkit#525

Fix duplicated prefix and captured sibling when replacing a dotted key with a table by @Labib-Bin-Salam in python-poetry/tomlkit#526

Reject tables inserted into inline tables by @gaoflow in python-poetry/tomlkit#532

raise on malformed array element instead of dropping it by @netliomax25-code in python-poetry/tomlkit#527

fix: reject out-of-order concrete+super table redefinitions at parse time by @gaoflow in python-poetry/tomlkit#530

fix: keep newline after dotted inline table by @gaoflow in python-poetry/tomlkit#533

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#548

chore(deps): bump soupsieve from 2.5 to 2.8.4 in /docs by @dependabot[bot] in python-poetry/tomlkit#560

chore(deps-dev): bump soupsieve from 2.4.1 to 2.8.4 by @dependabot[bot] in python-poetry/tomlkit#559

Preserve whitespace when replacing super tables by @gaoflow in python-poetry/tomlkit#534

Preserve table display names on self assignment by @gaoflow in python-poetry/tomlkit#537

... (truncated)

Changelog

Sourced from tomlkit's changelog.

[0.15.1] - 2026-07-17

Changed

Speed up membership tests (key in ...) on Container, Table and InlineTable with native __contains__ implementations, avoiding the inherited MutableMapping round-trip through __getitem__ (which resolves the value and builds an exception on every absent key). (#483)

Speed up parsing by making Source index-based: it now tracks an integer position over the input string instead of materializing a list of (index, char) tuples up front, so construction is O(1) and state save/restore no longer copies an iterator. (#489)

Speed up parsing by scanning character runs in bulk: Source.advance_while/advance_until consume a whole run of whitespace, bare-key or number characters in a single pass over the input string instead of one inc() call per character. (#490)

Speed up parsing of single-line strings by bulk-appending the run of ordinary characters up to the next delimiter, backslash or control character in one pass, instead of one character at a time. (#491)

Speed up parsing by removing the internal TOMLChar wrapper: the parser now reads plain str characters from Source and detects end-of-input positionally, avoiding a per-character object construction and method dispatch. (#492)

Speed up parsing by comparing StringType members by identity (is) instead of building a set on every is_basic/is_literal/is_singleline/is_multiline call, avoiding millions of enum hashes while parsing. (#502)

Speed up merging super tables by merging in place instead of deep-copying the growing target on every merge, turning the parse of documents with many subtables under a shared super table (e.g. consecutive [a.b.c] / [a.b.d] headers) from O(n²) into O(n). (#503)

Speed up membership tests (key in ...) on out-of-order tables with a native OutOfOrderTableProxy.__contains__, completing #483 for the last mapping type that still inherited the slow MutableMapping mixin (which resolves the value and builds an exception on every absent key). (#515)

Speed up parsing documents with many dotted keys or table headers sharing a prefix by validating out-of-order tables incrementally: each new fragment is merged into a cached validation container once, instead of re-merging (and deep-copying) every earlier fragment on each append, turning a super-cubic worst case into linear time (80 shared-prefix dotted keys: ~8 s → ~10 ms). (#479)

Speed up parsing of arrays that close right after a value (e.g. the files = [...] blocks that dominate lock files): the parser no longer attempts to read a value while sitting on the closing ], which previously built an UnexpectedCharError just to discard it — and constructing that exception eagerly computes a line/column by scanning the whole document, making it O(document size) per such array. (#517)

Speed up parsing of multiline strings by bulk-appending the run of ordinary characters — across raw line feeds and tabs — up to the next delimiter, backslash, carriage return or control character, instead of one character at a time. This extends to """/''' bodies the single-line fast path added in #491; a \r still stops the scan so \r\n stays validated and byte-for-byte preserved. (#518)

Speed up unwrap() (converting a parsed document to a plain dict) by resolving each key directly from the container's key map instead of iterating the inherited MutableMapping view, which rebuilt a SingleKey from the bare string for every key just to re-look-up the value. Out-of-order tables still resolve through their proxy, so their validation is unchanged. (#521)

Speed up rendering (as_string() / dumps()) of inline tables with many keys by precomputing the last-key and last-deleted-element indices in a single pass, instead of rescanning the remaining body on every separator comma — turning an O(n²) render into O(n). (#525)

Raise on malformed array element instead of dropping it, (#527)

Fixed

Fix string() dropping a leading newline of a multiline string on round-trip: a value beginning with a newline is now rendered with an extra leading newline (the one the parser trims after the opening delimiter) so it survives re-parsing.

Fix invalid serialization with a duplicated comma when removing a non-edge element from a parsed inline table. (#486)

Fix invalid serialization with a duplicated comma when appending or inserting into a comma-first formatted array. (#499)

Fix ParseError when a sub-table extends the last element of an array of tables after an unrelated table. (#261)

Fix unparseable serialization when adding a key to a dotted-key table inside an inline table. (#500)

Fix a table replaced by a plain value being serialized inside the preceding table's body when other tables follow; the value now moves before the first table like other root-level values. (#504)

Fix assigning a table over a dotted key (e.g. doc["a"] = {...} where a came from a.b = ...): the dotted prefix was duplicated onto the new [a] header, and the header then swallowed any sibling that follows it on round-trip. The replacement now renders as a plain table and, when needed, moves before the inline entries (values and dotted keys) it would otherwise capture. (#513, #524)

Restore dumps() rendering mapping-like wrappers around a parsed document (e.g. dotty_dict's Dotty) through their delegated as_string, preserving the original table order and layout instead of re-encoding through a plain dict — a 0.15.0 regression. (#482)

Fix uncontrolled recursion when parsing deeply nested documents: crafted input could crash the process with a RecursionError. Values nested more than 100 levels deep and keys with more than 100 dotted fragments now raise ParseError. (#459)

Fix comment() producing invalid TOML for a multiline string by prefixing every line with #, not just the first. (#449)

Fix the separator comma being swallowed by a trailing comment when appending a key to a multiline inline table, leaving the new key without a separator so the result no longer round-trips. (#512)

Fix a KeyAlreadyPresent error when parsing or accessing an out-of-order table whose array-of-tables elements are split across the table's parts. (#505)

Out-of-order value-vs-table and dotted-key-vs-table redefinitions are now rejected at parse time instead of being silently accepted or raising only on access. The parser also detects when a non-dotted key is a prefix of an existing dotted key, matching the stdlib tomllib behaviour. (#523)

Reject tables inserted into inline tables instead of serializing invalid TOML. (#531)

Fix assigning an array of tables over a dotted key (e.g. doc["a"] = aot(...) where a came from a.b = ...): the new [[a]] header kept the dotted key's inline position and swallowed the following dotted sibling on round-trip. The array of tables now renders past the inline entries it would otherwise capture, mirroring the table fix for #513. (#542)

Fix a new top-level scalar being captured by a table rendered from a dotted key: appending a scalar after a dotted-key entry (e.g. a.b = 1) whose table had gained a [a.c]-style child placed the scalar inside that table's scope, silently re-nesting it on round-trip. Scalars now move before such an entry, like they do before regular tables. (#543)

Fix invalid serialization with a duplicated [table] header when adding a key to an out-of-order table whose concrete header is declared after its sub-tables; the new key now lands in the existing concrete part instead of giving the header-less super part a second header. (#545)

Fix a table's display name (its exact header spelling, including whitespace and quoting) being normalised when the table is assigned onto itself, e.g. doc[k] = doc[k] rewriting [keys .'a'.'c'] to [keys.a.'c']. (#291)

Fix missing newlines when appending a key after a dotted inline table, including when the original document has no trailing newline. (#533)

Preserve trailing whitespace when replacing a super table, including assigning it onto itself. (#534)

Fix str() and repr() of out-of-order table proxies to show their merged values. (#536)

Reject decimal integer literals that exceed Python's integer-string conversion limit instead of coercing them to infinity. (#538)

Commits

1bd7e3b chore: release 0.15..1
94e62fb Float is not a sequence (#563)
495a42e Fix top-level scalar captured by a table rendered from a dotted key (#550)
21a4942 reject a comment containing line breaks in Item.comment and add_line (#544)
8cd44f5 fix: preserve leading newline of multiline string built with string() (#551)
67d3e86 Fix array of tables replacing a dotted key swallowing the next sibling (#542)...
e23a254 fix: avoid duplicate table header when adding a key to an out-of-order table ...
34e51e2 Update CHANGELOG.md to reflect recent fixes and enhancements
b48c094 reject overlong decimal integer instead of coercing to inf (#538)
cc05afa Represent out-of-order table proxies with merged values (#536)
Additional commits viewable in compare view

Updates fastmcp from 3.4.2 to 3.4.4

Release notes

Sourced from fastmcp's releases.

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Hugging Face Auth Integration by @evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in PrefectHQ/fastmcp#4439

Restore HTTP host guard compatibility by @jlowin in PrefectHQ/fastmcp#4472

Docs 📚

Docs: add v3.4.4 changelog entries by @jlowin in PrefectHQ/fastmcp#4473

New Contributors

@evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

Dedupe discriminator-required helper across schema converters by @jlowin in PrefectHQ/fastmcp#4362

Add real Monty sandbox e2e coverage for CodeMode call_tool by @AlexlaGuardia in PrefectHQ/fastmcp#4274

Switch prettier hook to rbubley/mirrors-prettier by @jlowin in PrefectHQ/fastmcp#4366

feat(remote): add --verify flag for TLS certificate verification by @jlowin in PrefectHQ/fastmcp#4369

Security 🔒

fix(deps): clear Dependabot security alerts via lockfile bumps by @jlowin in PrefectHQ/fastmcp#4393

Clarify resource path parameter safety by @jlowin in PrefectHQ/fastmcp#4398

Fix dev apps launch escaping by @jlowin in PrefectHQ/fastmcp#4399

Block NAT64 SSRF bypass by @jlowin in PrefectHQ/fastmcp#4400

[codex] Fix event store replay isolation by @jlowin in PrefectHQ/fastmcp#4402

Fix DCR redirect URI validation by @jlowin in PrefectHQ/fastmcp#4408

Protect streamable HTTP from DNS rebinding by @jlowin in PrefectHQ/fastmcp#4405

Block unsafe OAuth redirect schemes by @jlowin in PrefectHQ/fastmcp#4419

Block IPv6 transition SSRF bypasses by @jlowin in PrefectHQ/fastmcp#4426

Fixes 🐞

fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @gmenziesint in PrefectHQ/fastmcp#4301

Fix: async rate limiting middleware get_client_id callbacks by @Chotom in PrefectHQ/fastmcp#4319

Recognize all GitHub issue-link forms in require-issue-link workflow by @jlowin in PrefectHQ/fastmcp#4359

fix: preserve required discriminator tags by @he-yufeng in PrefectHQ/fastmcp#4297

fix(proxy): shield stateful proxy disconnect during session teardown by @jlowin in PrefectHQ/fastmcp#4363

fix(fs): isolate same-named package imports across providers by @jlowin in PrefectHQ/fastmcp#4361

fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by @tcconnally in PrefectHQ/fastmcp#4328

fix: guard recursive refs in json_schema_to_type by @Epochex in PrefectHQ/fastmcp#4312

Forward IdP auth errors to MCP client instead of showing HTML error page by @bobbyjames839 in PrefectHQ/fastmcp#4293

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Hugging Face Auth Integration by @evalstate in #4385

Fixes 🐞

Relax host origin guard defaults by @jlowin in #4439

Restore HTTP host guard compatibility by @jlowin in #4472

New Contributors

@evalstate made their first contribution in #4385

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

Dedupe discriminator-required helper across schema converters by @jlowin in #4362

Add real Monty sandbox e2e coverage for CodeMode call_tool by @AlexlaGuardia in #4274

Switch prettier hook to rbubley/mirrors-prettier by @jlowin in #4366

feat(remote): add --verify flag for TLS certificate verification by @jlowin in #4369

Security 🔒

fix(deps): clear Dependabot security alerts via lockfile bumps by @jlowin in #4393

Clarify resource path parameter safety by @jlowin in #4398

Fix dev apps launch escaping by @jlowin in #4399

Block NAT64 SSRF bypass by @jlowin in #4400

[codex] Fix event store replay isolation by @jlowin in #4402

Fix DCR redirect URI validation by @jlowin in #4408

Protect streamable HTTP from DNS rebinding by @jlowin in #4405

Block unsafe OAuth redirect schemes by @jlowin in #4419

Block IPv6 transition SSRF bypasses by @jlowin in #4426

Fixes 🐞

fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @gmenziesint in #4301

Fix: async rate limiting middleware get_client_id callbacks by @Chotom in #4319

... (truncated)

Commits

9138d40 Docs: add v3.4.4 changelog entries (#4473)
d929882 Hugging Face Auth Integration (#4385)
5fe4fae Restore HTTP host guard compatibility (#4472)
400db61 Relax host origin guard defaults (#4439)
1eedd1f Docs: add v3.4.2 and v3.4.3 changelog entries (#4430)
3b1afe6 chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...
874425a chore: Update SDK documentation (#4427)
691766b [codex] Fix OpenAPI resource template requests (#4407)
47907e0 Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)
c1b0396 Block IPv6 transition SSRF bypasses (#4426)
Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

[pycodestyle] Add an autofix for E402 (#22212)

[refurb] Allow subclassing builtins in stub files (FURB189) (#26812)

[ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)

[ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)

[ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

[flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

[pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

Avoid redundant lexer token bookkeeping (#26765)

Avoid redundant pending-indentation writes (#26774)

Avoid unnecessary identifier lookahead (#26525)

Reuse parser scratch buffers (#26798)

Documentation

Document argfile support (#26803)

[flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)

[pycodestyle] Document E731 fix safety (#26847)

[ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

@dwego

@MichaReiser

@Joosboy

@KaufmanDmitriy

@PeterJCLaw

@ntBre

@charliermarsh

Install ruff 0.15.22

Install prebuilt binaries via shell script
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

[pycodestyle] Add an autofix for E402 (#22212)

[refurb] Allow subclassing builtins in stub files (FURB189) (#26812)

[ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)

[ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)

[ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

[flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

[pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

Avoid redundant lexer token bookkeeping (#26765)

Avoid redundant pending-indentation writes (#26774)

Avoid unnecessary identifier lookahead (#26525)

Reuse parser scratch buffers (#26798)

Documentation

Document argfile support (#26803)

[flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)

[pycodestyle] Document E731 fix safety (#26847)

[ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

@dwego

@MichaReiser

@Joosboy

@KaufmanDmitriy

@PeterJCLaw

@ntBre

@charliermarsh

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

0177a7e Bump 0.15.22 (#26884)
fe8ba85 [pycodestyle] Document E731 fix safety (#26847)
f3cf7c8 [ruff] Add rule-codes-in-selectors (RUF201) (#26772)
d244fd7 Document argfile support (#26803)
f239758 [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)
54acbcd [ty] Support TypeVarTuple and Unpack (#25240)
87fc38c [ty] Parallelize subtype hierarchy search (#26875)
e454f91 [ty] Share interned query keys across Salsa queries (#26794)
6f361a7 [ty] only collect expected types for files open in the editor (#25546)
6d6b2b3 [ty] Avoid allocations during Salsa interned lookups (#26877)
Additional commits viewable in compare view

Updates commitizen from 4.16.4 to 4.16.5

Release notes

Sourced from commitizen's releases.

v4.16.5 (2026-07-16)

Fix

exclude star-history API from lychee link checker (#2029)

Commits

6afcd8e bump: version 4.16.4 → 4.16.5
ff23c26 fix: exclude star-history API from lychee link checker (#2029)
40b409b ci(deps): bump soupsieve from 2.8.3 to 2.8.4 (#2024)
7812abe ci(deps): bump dawidd6/action-homebrew-bump-formula from 7 to 8 (#2022)
3885e8b build(deps): update argcomplete requirement from <3.7,>=1.12.1 to >=1.12.1,<3...
62fb12d docs(cli/screenshots): update CLI screenshots
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 4 updates in the / directory: [tomlkit](https://github.com/python-poetry/tomlkit), [fastmcp](https://github.com/PrefectHQ/fastmcp), [ruff](https://github.com/astral-sh/ruff) and [commitizen](https://github.com/commitizen-tools/commitizen). Updates `tomlkit` from 0.15.0 to 0.15.1 - [Release notes](https://github.com/python-poetry/tomlkit/releases) - [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md) - [Commits](python-poetry/tomlkit@0.15.0...0.15.1) Updates `fastmcp` from 3.4.2 to 3.4.4 - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.2...v3.4.4) Updates `ruff` from 0.15.20 to 0.15.22 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.15.22) Updates `commitizen` from 4.16.4 to 4.16.5 - [Release notes](https://github.com/commitizen-tools/commitizen/releases) - [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md) - [Commits](commitizen-tools/commitizen@v4.16.4...v4.16.5) --- updated-dependencies: - dependency-name: tomlkit dependency-version: 0.15.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: fastmcp dependency-version: 3.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: ruff dependency-version: 0.15.22 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: commitizen dependency-version: 4.16.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies label Jul 20, 2026

dependabot Bot requested review from scastlara and sdn4z as code owners July 20, 2026 15:16

github-actions Bot added the ignore-for-release label Jul 20, 2026

github-actions Bot enabled auto-merge (squash) July 20, 2026 15:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: bump the patch-updates group across 1 directory with 4 updates#531

chore: bump the patch-updates group across 1 directory with 4 updates#531
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/patch-updates-8b7b9f7214

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026

0.15.1

What's Changed

[0.15.1] - 2026-07-17

Changed

Fixed

v3.4.4: Host in Translation

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

v3.4.3: The Fast and the Secure-ious

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

title: "Changelog" icon: "list-check" rss: true tag: NEW

Enhancements ✨

Fixes 🐞

New Contributors

Enhancements ✨

Security 🔒

Fixes 🐞

0.15.22

Release Notes

Preview features

Bug fixes

Rule changes

Performance

Documentation

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

0.15.22

Preview features

Bug fixes

Rule changes

Performance

Documentation

Contributors

0.15.21

Preview features

v4.16.5 (2026-07-16)

Fix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants