Skip to content

chore(deps): bump the runtime-dependencies group across 1 directory with 11 updates#8

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/runtime-dependencies-999ba5c983
Open

chore(deps): bump the runtime-dependencies group across 1 directory with 11 updates#8
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/runtime-dependencies-999ba5c983

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Updates the requirements on fastapi, gunicorn, langchain, langchain-community, langchain-openai, langfuse, langgraph, llama-index, openai, poethepoet and pymupdf to permit the latest version.
Updates fastapi to 0.136.1

Release notes

Sourced from fastapi's releases.

0.136.1

Upgrades

Internal

Commits

Updates gunicorn to 25.3.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 25.3.0

Bug Fixes

  • HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2 ASGI requests, causing JSON parsing errors with "Extra data" messages (#3558)

  • ASGI Chunked EOF Handling: Add finish() method to callback parser to handle chunked encoding edge case where connection closes before final CRLF after zero-chunk

  • HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string instead of list syntax (#3561)

  • Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112 (#3556)

  • Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented, instead of using default maximum. Works with both Python and fast C parser. (#3563)

Security

  • ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
    • Reject duplicate Content-Length headers
    • Reject requests with both Content-Length and Transfer-Encoding
    • Reject chunked transfer encoding in HTTP/1.0
    • Reject stacked chunked encoding
    • Validate Transfer-Encoding values
    • Strict chunk size validation

Changes

  • Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property and InvalidChunkExtension validation for bare CR rejection

  • ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

  • Docker Images: Update to Python 3.14

Commits
  • 9bce72c Update changelog with missing 25.3.0 changes
  • 2a15fdb Fix pylint isinstance-second-argument-not-valid-type warning
  • 8d08aaa Fix --limit-request-line 0 to mean unlimited
  • d40a374 Fix pytest-asyncio configuration and treq_asgi hex escapes
  • da8bd48 Remove unused AsyncRequest class
  • b00f125 Integrate gunicorn_h1c 0.6.3 with InvalidChunkExtension support
  • bdb2ebd Reject chunk extensions with bare CR bytes (RFC 9112)
  • 7057fc9 Fix http_protocols documentation to use string syntax
  • d43acb8 Update to gunicorn_h1c >= 0.6.2 for asgi_headers support
  • cbd27e8 Merge pull request #3559 from benleembruggen/fix/http2-asgi-body-duplication
  • Additional commits viewable in compare view

Updates langchain to 1.2.17

Release notes

Sourced from langchain's releases.

langchain-core==1.2.17

Changes since langchain-core==1.2.16

release(core): 1.2.17 (#35527) fix(core): extract usage metadata from serialized tracer message outputs (#35526) chore: bump the langchain-deps group across 3 directories with 7 updates (#35513) chore: bump the langchain-deps group across 3 directories with 14 updates (#35441)

Commits
  • b339f65 release(langchain): 1.2.17 (#37110)
  • 04e7a55 fix(fireworks): translate canonical multimodal content blocks for chat comple...
  • a1f336f fix(core): preserve structured inputs on tool runs in tracers (#37108)
  • ba56ac6 feat(langchain): add respond decision to HITL middleware (#37095)
  • b6b836a chore: bump notebook from 7.4.5 to 7.5.6 in /libs/langchain (#37104)
  • 3d96874 chore: bump notebook from 7.4.7 to 7.5.6 in /libs/text-splitters (#37105)
  • 5ac6224 chore: bump aiohttp from 3.13.4 to 3.13.5 in /libs/partners/fireworks (#37106)
  • 90caeef chore: bump requests from 2.33.0 to 2.33.1 in /libs/partners/fireworks (#37107)
  • 38553c3 release(perplexity): 1.2.0 (#37091)
  • 28f5448 feat(perplexity): add PerplexityEmbeddings (#37082)
  • Additional commits viewable in compare view

Updates langchain-community to 0.4.1

Release notes

Sourced from langchain-community's releases.

libs/community/v0.4.1

What's Changed

New Contributors

Full Changelog: langchain-ai/langchain-community@libs/community/v0.4...libs/community/v0.4.1

Commits

Updates langchain-openai to 1.2.1

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.2.1

Changes since langchain-openai==1.2.0

hotfix: bump min core versions (#36996) release(openai): 1.2.1 (#36995) fix(openai): add gpt-5.5 pro to Responses API check (#36994) feat(core): add content-block-centric streaming (v2) (#36834) chore(model-profiles): refresh model profile data (#36982)

Commits

Updates langfuse to 4.5.1

Commits

Updates langgraph to 1.1.10

Release notes

Sourced from langgraph's releases.

langgraph==1.1.10

Changes since 1.1.9

  • release(prebuilt): 1.0.12, langgraph 1.1.10 (#7623)
  • Revert "chore: node-level timeouts" (#7627)
  • release(checkpoint): 4.0.3 (#7625)
  • chore(deps): bump nbconvert from 7.17.0 to 7.17.1 in /libs/langgraph (#7573)
  • chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /libs/langgraph (#7574)
  • chore: node-level timeouts (#7599)
  • release(prebuilt): 1.0.11 (#7610)
  • feat(prebuilt): allow ToolNode tools to return list[Command | ToolMessage] (#7596)
Commits
  • cb328b5 release(prebuilt): 1.0.12, langgraph 1.1.10 (#7623)
  • d177a0d Revert "chore: node-level timeouts" (#7627)
  • 372d54d release(checkpoint): 4.0.3 (#7625)
  • f4aee54 fix(prebuilt): hydrate ToolNode state from channels via pregel helpers (#7594)
  • 85cd64e fix(checkpoint): revive lc=2 JSON blobs for safe types without allowlist (#7582)
  • 53a9806 chore(deps): bump nbconvert from 7.17.0 to 7.17.1 in /libs/langgraph (#7573)
  • 219fbbe chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /libs/langgraph (#7574)
  • aeff954 chore: node-level timeouts (#7599)
  • 1a248cb release(prebuilt): 1.0.11 (#7610)
  • 45246f6 feat(prebuilt): allow ToolNode tools to return list[Command | ToolMessage] (#...
  • Additional commits viewable in compare view

Updates llama-index to 0.14.21

Release notes

Sourced from llama-index's releases.

v0.14.21

Release Notes

[2026-04-21]

llama-index-callbacks-honeyhive [0.5.0]

  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-core [0.14.21]

  • fix(core): prevent KeyError in DocumentSummaryIndex.delete_nodes when invalid node ID is provided (#21067)
  • fix(core): handle ValueError and TypeError from structured output failures (#21090)
  • fix: add explicit UTF-8 encoding to persistence layer fs.open() calls (#21111)
  • Fix Breaking Change in Message Block Buffer Resolution (#21339)
  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-embeddings-huggingface-optimum [0.4.1]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-nvidia [0.5.1]

  • feat(embeddings-nvidia): add http client support (#21046)

llama-index-embeddings-oracleai [0.4.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-premai [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)
  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-embeddings-text-embeddings-inference [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-textembed [0.4.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-together [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-upstage [0.6.1]

... (truncated)

Changelog

Sourced from llama-index's changelog.

llama-index-core [0.14.21]

  • fix(core): prevent KeyError in DocumentSummaryIndex.delete_nodes when invalid node ID is provided (#21067)
  • fix(core): handle ValueError and TypeError from structured output failures (#21090)
  • fix: add explicit UTF-8 encoding to persistence layer fs.open() calls (#21111)
  • Fix Breaking Change in Message Block Buffer Resolution (#21339)
  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-embeddings-huggingface-optimum [0.4.1]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-nvidia [0.5.1]

  • feat(embeddings-nvidia): add http client support (#21046)

llama-index-embeddings-oracleai [0.4.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-premai [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)
  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-embeddings-text-embeddings-inference [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-textembed [0.4.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-together [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-upstage [0.6.1]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)
  • chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • chore(deps): bump the pip group across 68 directories with 2 updates (#21394)

llama-index-embeddings-vertex [0.5.0]

  • chore(deps): bump the pip group across 96 directories with 2 updates (#21381)

llama-index-embeddings-vertex-endpoint [0.4.0]

... (truncated)

Commits
  • 931f56e Release 0.14.21 (#21427)
  • 17fba87 fix: add explicit UTF-8 encoding to persistence layer fs.open() calls (#21111)
  • 33f7ba4 Adds Google Gemma models and Bump version to 0.14.6 (#21380)
  • 38c1716 chore(deps): bump the pip group across 96 directories with 2 updates (#21381)
  • 7921256 chore(deps): bump the pip group across 87 directories with 2 updates (#21382)
  • ffc726f chore(deps): bump the pip group across 68 directories with 2 updates (#21394)
  • 91fe33e Fix Breaking Change in Message Block Buffer Resolution (#21339)
  • 10955bf fix: parse MistralAI structured ThinkChunk/TextChunk without regex (#20916)
  • 9eb4c2d fix: filter unknown kwargs before VectorStoreQuery construction (#14557) (#21...
  • a61f2cf fix(core): handle ValueError and TypeError from structured output failure...
  • Additional commits viewable in compare view

Updates openai to 2.33.0

Release notes

Sourced from openai's releases.

v2.33.0

2.33.0 (2026-04-28)

Full Changelog: v2.32.0...v2.33.0

Features

Bug Fixes

  • api: correct prompt_cache_retention enum value from in-memory to in_memory (#1822) (f9d2d13)

Chores

  • ci: remove release-doctor workflow (00b2091)
Changelog

Sourced from openai's changelog.

2.33.0 (2026-04-28)

Full Changelog: v2.32.0...v2.33.0

Features

Bug Fixes

  • api: correct prompt_cache_retention enum value from in-memory to in_memory (#1822) (f9d2d13)

Chores

  • ci: remove release-doctor workflow (00b2091)

2.32.0 (2026-04-15)

Full Changelog: v2.31.0...v2.32.0

Features

  • api: Add detail to InputFileContent (60de21d)
  • api: add OAuthErrorCode type (0c8d2c3)
  • client: add event handler implementation for websockets (0280d05)
  • client: allow enqueuing to websockets even when not connected (67aa20e)
  • client: support reconnection in websockets (eb72a95)

Bug Fixes

  • ensure file data are only sent as 1 parameter (c0c2ecd)

Documentation

2.31.0 (2026-04-08)

Full Changelog: v2.30.0...v2.31.0

Features

  • api: add phase field to conversations message (3e5834e)
  • api: add web_search_call.results to ResponseIncludable type (ffd8741)
  • client: add support for short-lived tokens (#1608) (22fe722)
  • client: support sending raw data over websockets (f1bc52e)

... (truncated)

Commits

Updates poethepoet to 0.45.0

Release notes

Sourced from poethepoet's releases.

0.45.0

Enhancements

Fixes

New Contributors

Full Changelog: nat-n/poethepoet@v0.44.0...v0.45.0

Commits
  • 244cf0b Bump version to 0.45.0
  • 3a6c09a feat: support forwarding free arguments via $POE_EXTRA_ARGS (#380)
  • a1edcda fix: preserve quotes in :+/:- operator arguments (#333) (#377)
  • 3e60a85 fix: handle cancelled asyncio tasks correctly (#378)
  • bbdd435 fix: handle ctrl+c attempt on windows if running bat/cmd scripts (#382)
  • 67a623d Bump version to 0.44.0
  • 472f390 feat!: support recursive includes #317 (#372)
  • 3168956 chore: optimize tests to run 17pc faster (#371)
  • 6a25fba chore: bump version to 0.43.0
  • 83091a5 feat!: treat false boolean args as unset env vars and add private vars (#359)
  • Additional commits viewable in compare view

Updates pymupdf to 1.27.2.3

Release notes

Sourced from pymupdf's releases.

PyMuPDF-1.27.2.3 released

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.27.2.3

  • Fixed issues:

  • Other:

    • Fixed incorrect generation of lineJoin j in PDF content, introduced in 1.27.2.2.
    • Allow build to (incorrectly) claim to be thread-safe, for #4760. See setup.py for details.
    • Use pypi.org's pipcl package instead of our own pipcl.py file.
Changelog

Sourced from pymupdf's changelog.

Change Log

Changes in version 1.27.2.3 (2026-04-24)

  • Fixed issues:

    • Fixed 4928 <https://github.com/pymupdf/PyMuPDF/issues/4928>_: pymupdf.Document.scrub raises AttributeError for a document with annotations
    • Fixed 4942 <https://github.com/pymupdf/PyMuPDF/issues/4942>_: bug: IndexError for Page.get_links after Page.clip_to_rect
    • Fixed 4954 <https://github.com/pymupdf/PyMuPDF/issues/4954>_: get_drawings() returns incorrect lineJoin and width
    • Fixed 4958 <https://github.com/pymupdf/PyMuPDF/issues/4958>_: bug: inserting rotated pages to another document messes up link coordinates
  • Other:

    • Fixed incorrect generation of lineJoin j in PDF content, introduced in 1.27.2.2.
    • Allow build to (incorrectly) claim to be thread-safe, for #4760. See setup.py for details.
    • Use pypi.org's pipcl package instead of our own pipcl.py file.

Changes in version 1.27.2.2 (2026-03-20)

  • Fixed issues:

    • Fixed 4902 <https://github.com/pymupdf/PyMuPDF/issues/4902>_: Incorrect linewidth in elements returned by Page.get_texttrace()
    • Fixed 4932 <https://github.com/pymupdf/PyMuPDF/issues/4932>_: "Page" has no attribute "find_tables" in PyMuPDF 1.27
  • Other:

    • Added Annot.__bool__().

Changes in version 1.27.2. (2026-03-10)

  • Use MuPDF-1.27.2.

  • Fixed issues:

    • Fixed 4903 <https://github.com/pymupdf/PyMuPDF/issues/4903>_: Typing broken because of *_forward_decl
  • Other:

    • Retrospectively marked #4907 as fixed in pymupdf-1.27.1.

    • Improved get_textpage_ocr().

      For partial OCR, all page areas outside legible text are now OCRed, not just those within images. This means that OCR will now also be performed for vector graphics, and for text containing illegible characters.

    • Provide a Linux wheel for free-threading python,

... (truncated)

Commits
  • bf51516 Update version to 1.27.2.3.
  • e5bddbb scripts/ tests/: updated to match new location of pipcl.py in src/.
  • eda615d Move pipcl.py and wdev.py into src/.
  • a7fe8b3 changes.txt: updates for next release.
  • 61da30a tests/test_drawings.py: New tests for #4954: test_4954_1() test_4954_2().
  • 5445fc0 docs/conf.py: change how we look for version numbers in setup.py and scripts/...
  • 1792ef0 pyproject.toml: require package pipcl for building.
  • 237f097 tests/: fix tests if we are incorrectly claiming to be thread safe.
  • cd89bb0 tests/conftest.py: also install pipcl, as we move to using pipcl package.
  • 341eab2 setup.py: added support for incorrectly claiming to be thread-safe, for #4760.
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 11 updates

Updates the requirements on [fastapi](https://github.com/fastapi/fastapi), [gunicorn](https://github.com/benoitc/gunicorn), [langchain](https://github.com/langchain-ai/langchain), [langchain-community](https://github.com/langchain-ai/langchain-community), [langchain-openai](https://github.com/langchain-ai/langchain), [langfuse](https://github.com/langfuse/langfuse), [langgraph](https://github.com/langchain-ai/langgraph), [llama-index](https://github.com/run-llama/llama_index), [openai](https://github.com/openai/openai-python), [poethepoet](https://github.com/nat-n/poethepoet) and [pymupdf](https://github.com/pymupdf/pymupdf) to permit the latest version.

Updates `fastapi` to 0.136.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.111.1...0.136.1)

Updates `gunicorn` to 25.3.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...25.3.0)

Updates `langchain` to 1.2.17
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-box==0.1.0...langchain==1.2.17)

Updates `langchain-community` to 0.4.1
- [Release notes](https://github.com/langchain-ai/langchain-community/releases)
- [Commits](langchain-ai/langchain-community@libs/community/v0.3.25...libs/community/v0.4.1)

Updates `langchain-openai` to 1.2.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==0.3.25...langchain-openai==1.2.1)

Updates `langfuse` to 4.5.1
- [Release notes](https://github.com/langfuse/langfuse/releases)
- [Commits](https://github.com/langfuse/langfuse/commits)

Updates `langgraph` to 1.1.10
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@0.4.8...1.1.10)

Updates `llama-index` to 0.14.21
- [Release notes](https://github.com/run-llama/llama_index/releases)
- [Changelog](https://github.com/run-llama/llama_index/blob/main/CHANGELOG.md)
- [Commits](run-llama/llama_index@v0.12.40...v0.14.21)

Updates `openai` to 2.33.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v1.84.0...v2.33.0)

Updates `poethepoet` to 0.45.0
- [Release notes](https://github.com/nat-n/poethepoet/releases)
- [Commits](nat-n/poethepoet@v0.32.1...v0.45.0)

Updates `pymupdf` to 1.27.2.3
- [Release notes](https://github.com/pymupdf/pymupdf/releases)
- [Changelog](https://github.com/pymupdf/PyMuPDF/blob/main/changes.txt)
- [Commits](pymupdf/PyMuPDF@1.26.0...1.27.2.3)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.136.1
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: gunicorn
  dependency-version: 25.3.0
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: langchain
  dependency-version: 1.2.17
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: langchain-community
  dependency-version: 0.4.1
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: langchain-openai
  dependency-version: 1.2.1
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: langfuse
  dependency-version: 4.5.1
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: langgraph
  dependency-version: 1.1.10
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: llama-index
  dependency-version: 0.14.21
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: openai
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: poethepoet
  dependency-version: 0.45.0
  dependency-type: direct:production
  dependency-group: runtime-dependencies
- dependency-name: pymupdf
  dependency-version: 1.27.2.3
  dependency-type: direct:production
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants