[dependabot]

Bumps the locks group with 68 updates in the /requirements directory:

Package	From	To
ast-serialize	0.11.2	0.13.1
certifi	2026.7.22	2026.10.23
charset-normalizer	3.5.1	3.5.2
coverage	7.16.1	7.17.0
cryptography	50.0.1	50.0.2
googleapis-common-protos	1.75.3	1.76.0
griffelib	2.3.0	2.4.1
httpcore2	2.13.0	2.16.0
httpx2	2.13.0	2.16.0
hypothesis	6.168.0	6.170.12
idna	3.19	3.20
iniconfig	2.3.0	2.3.1
jiter	0.17.0	0.18.0
jsonpatch	1.33	1.37
jsonpointer	3.1.1	3.5
langchain	1.4.0	1.4.7
langchain-core	1.6.3	1.7.0
langchain-openai	1.6.2	1.7.2
langchain-protocol	0.0.19	0.0.20
langgraph	1.2.11	1.2.17
langgraph-checkpoint	4.2.0	4.3.0
langgraph-prebuilt	1.1.0	1.1.1
langgraph-sdk	0.4.4	0.4.9
langsmith	0.12.4	0.14.12
librt	0.15.0	0.16.0
mcp	2.2.0	2.3.0
mcp-types	2.2.0	2.3.0
mypy	2.3.1	2.4.0
openai	3.13.0	3.38.0
openai-agents	0.22.2	0.24.0
opentelemetry-api	1.44.0	1.45.1
opentelemetry-exporter-otlp-proto-common	1.44.0	1.45.1
opentelemetry-exporter-otlp-proto-http	1.44.0	1.45.1
opentelemetry-proto	1.44.0	1.45.1
opentelemetry-sdk	1.44.0	1.45.1
opentelemetry-semantic-conventions	0.65b0	0.66b1
orjson	3.12.0	3.13.0
ormsgpack	1.12.2	1.13.0
pluggy	1.6.0	1.7.0
protobuf	7.36.1	7.36.2
pycparser	3.0	3.12
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
pyjwt	2.14.0	2.15.1
pyproject-hooks	1.2.0	1.3.3
regex	2026.9.10	2026.9.29
rpds-py	2026.6.3	2026.9.1
ruff	0.16.7	0.17.2
setuptools	84.0.0	84.2.1
sse-starlette	3.4.11	3.6.0
starlette	1.6.0	1.10.0
tenacity	9.1.4	9.2.1
truststore	0.10.4	0.10.5
urllib3	2.7.0	2.8.0
uuid-utils	0.17.1	1.2.0
uvicorn	0.53.0	0.54.0
websockets	16.1.1	17.3
xxhash	4.0.1	4.0.2
more-itertools	11.1.0	11.2.1
chardet	5.2.0	7.7.0
cyclonedx-bom	7.3.1	7.5.0
fqdn	1.5.1	1.6.0
pyparsing	3.3.2	3.3.3
python-dateutil	2.9.0.post0	3.0.0
tzdata	2026.4	2026.5
psycopg	3.3.5	3.3.6
griffe	2.3.0	2.4.1
griffecli	2.3.0	2.4.1

Updates ast-serialize from 0.11.2 to 0.13.1

Commits

• e83de7d Bump version to 0.13.1
• 4b10d47 Make file-level type: ignore consistent with mypy: ignore (#97)
• 42628bd Bump version to 0.13.0
• 67659a0 Straighten type comment parsing (#95)
• 8d0a5c6 Bump version to 0.12.1
• a7f11b1 Fix parsing plain None type in a string (#96)
• bcf707f Bump version to 0.12.0
• 89b6e83 Allow colon in error codes (#94)
• See full diff in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates coverage from 7.16.1 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

• Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

• Fixes for obscure but legal file names:

  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

• 393ac71 docs: prep for 7.17.0
• 14257d3 test: check that 100% files haven't lost coverage
• db056ac docs: keep the ukraine banner #2344
• 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
• 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
• ff62a02 refactor: remove unused caching branches
• 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
• 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
• f95c980 fix: triply nested with statements don't cause false branch misses #1987
• 6aaa858 docs: more changelog gardening
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates googleapis-common-protos from 1.75.3 to 1.76.0

Release notes

Sourced from googleapis-common-protos's releases.

googleapis-common-protos: v1.76.0

1.76.0 (2026-10-22)

Features

• declare support for Python 3.15 (#18737) (65c8767)
• update API sources and regenerate (#18797) (be4d954)

Commits

• 82b0565 chore: release main (#18711)
• ab29d5f chore(main): release google-cloud-bigtable 2.50.2 (#18817)
• 157efe4 feat(bigquery): add column data policies to SchemaField (#18710)
• ea7299f fix: validate Host header in graph_server request handlers (#17932)
• b14c2e5 docs(bigquery-storage): mark ReadRows arrow serialization as beta (#18802)
• 3ccf5ac fix(bigquery): keep the Arrow schema for empty results (#18655)
• 8ac01b9 feat(bigquery): read Arrow results from explicit destinations (#18654)
• 6eab34e feat(bigquery-storage): add context manager to ReadRowsStream (#18781)
• 31d9365 feat(bigquery-storage): send gRPC keepalive pings by default (#18792)
• 89cbc50 feat(bigquery): share one BigQuery Storage client per Client (#18652)
• Additional commits viewable in compare view

Updates griffelib from 2.3.0 to 2.4.1

Release notes

Sourced from griffelib's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

• Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

• Stop checking attribute values (0670d03 by Timothée Mazzucotelli). Issue-506

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

• Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

• Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli dev@pawamoy.fr
• Propagate public value to inherited members (aliases) (8b94205 by Timothée Mazzucotelli). Issue-495, PR-503, Co-authored-by: Sydney Duckworth sydduckworth@users.noreply.github.com

Performance Improvements

• Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

  This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

2.3.2

2.3.2 - 2026-10-06

Compare with 2.3.1

Build

• Drop support for Python 3.10 in griffelib and griffecli packages (7c45a8f by Timothée Mazzucotelli).

2.3.1

2.3.1 - 2026-10-06

Compare with 2.3.0

Build

• Drop support for Python 3.10 (686993d by Timothée Mazzucotelli).

... (truncated)

Changelog

Sourced from griffelib's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

• Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

• Stop checking attribute values (0670d03 by Timothée Mazzucotelli). Issue-506

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

• Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

• Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli dev@pawamoy.fr
• Propagate public value to inherited members (aliases) (8b94205 by Timothée Mazzucotelli). Issue-495, PR-503, Co-authored-by: Sydney Duckworth sydduckworth@users.noreply.github.com

Performance Improvements

• Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

  This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

2.3.2 - 2026-10-06

Compare with 2.3.1

Build

• Drop support for Python 3.10 in griffelib and griffecli packages (7c45a8f by Timothée Mazzucotelli).

2.3.1 - 2026-10-06

Compare with 2.3.0

Enum values now inherit from StrEnum, so str(member) returns its value.

Build

• Drop support for Python 3.10 (686993d by Timothée Mazzucotelli).

Bug Fixes

... (truncated)

Commits

• a74c9d0 chore: Prepare release 2.4.1
• 0670d03 refactor: Stop checking attribute values
• f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
• da6f966 docs: Add periods to docstrings
• 9d51e51 docs: Single block license headers
• 5b833a9 docs: Fix code tree with annotations
• 731b3c5 docs: Various improvements
• 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
• ca60582 chore: Prepare release 2.4.0
• 07bd484 Merge branch 'issue448'
• Additional commits viewable in compare view

Updates httpcore2 from 2.13.0 to 2.16.0

Release notes

Sourced from httpcore2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• 6dd59b9 Prepare version 2.15.1 (#1279)
• 7715bf0 Configure the default Linux SSL context once instead of per handshake (#1253)
• 6078596 Prepare version 2.15.0 (#1278)
• 5b26c25 Drop support for Python 3.10 (#1274)
• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• Additional commits viewable in compare view

Updates httpx2 from 2.13.0 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

• Drop support for Python 3.10. (#1274)

2.14.0 (October 18th, 2026)

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
• Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

... (truncated)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• 6dd59b9 Prepare version 2.15.1 (#1279)
• 7715bf0 Configure the default Linux SSL context once instead of per handshake (#1253)
• 6078596 Prepare version 2.15.0 (#1278)
• 5b26c25 Drop support for Python 3.10 (#1274)
• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• Additional commits viewable in compare view

Updates hypothesis from 6.168.0 to 6.170.12

Commits

• 8fca8fd Bump hypothesis version to 6.170.12 and update changelog
• df163ff Merge pull request #4939 from Zac-HD/claude/bold-lovelace-1y9hgb
• 7851beb Make the branch-check description stack thread-local
• e2c5e71 Lazily import unittest.mock and urllib.request
• eaf0827 Defer traceback formatting for failing examples
• d863d2c Cheaper choices_key and boolean constraint keys
• e00d20e Add fast paths for is_empty and unwrap_strategies
• 4918dcf Accumulate ConjectureData nodes in a list
• a7415b3 Compute choice sizes without serializing
• ac78b73 Reuse a single branch sampler in OneOfStrategy
• Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ff14eec9-c9d2-4ad0-af33-764a8e752f3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}