Skip to content

chore(deps): bump the python-maintenance group across 1 directory with 10 updates - #4222

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-maintenance-a0941ae8d1
Open

chore(deps): bump the python-maintenance group across 1 directory with 10 updates#4222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-maintenance-a0941ae8d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-maintenance group with 10 updates in the / directory:

Package From To
httpx2 2.13.1 2.14.0
jiter 0.17.0 0.18.0
aiohttp 3.14.3 3.14.5
botocore 1.43.106 1.43.118
ty 0.0.87 0.0.91
ruff 0.16.9 0.17.2
inline-snapshot 0.35.4 0.36.1
azure-identity 1.25.3 1.26.0
playwright 1.63.0 1.64.1
pluggy 1.6.0 1.7.0

Updates httpx2 from 2.13.1 to 2.14.0

Release notes

Sourced from httpx2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).
  • Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

  • Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).
  • Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).
  • Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

Changelog

Sourced from httpx2's changelog.

2.14.0 (October 18th, 2026)

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
  • Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)
Commits
  • 4fa853a Prepare version 2.14.0 (#1271)
  • dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
  • cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
  • 53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
  • d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
  • 76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
  • See full diff in compare view

Updates jiter from 0.17.0 to 0.18.0

Commits
  • fc2da0b Lower uv required-version to 0.13.4 (#313)
  • a5b6e0f Fix CI (#312)
  • 5f3f0dc Avoid ahash dependency unless python feature enabled (#297)
  • e547453 Take a string cache from the pool with one atomic exchange (#303)
  • e02134b pyo3-v0.30.x (#308)
  • 4045394 ci: upgrade uv lock (#310)
  • 4c8fa34 ci: fix lint with rust 1.99 (#309)
  • c03ab2f Add Jiter::with_tape and Jiter::into_tape (#298)
  • 60965bf Scan number digit runs in NumberRange with the SIMD digit-run scan (#300)
  • c23680e Upgrade pyodide-build so the wasm build parses the current Pyodide lockfile (...
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates botocore from 1.43.106 to 1.43.118

Commits
  • 444e17a Merge branch 'release-1.43.118'
  • e6a2aa0 Bumping version to 1.43.118
  • f704c6a Update endpoints model
  • f623757 Update to latest models
  • 9313a4d Backfill 1.43.117 changelog entry for CA bundle fix (#3839)
  • ece3056 Merge branch 'release-1.43.117'
  • 9dc596d Merge branch 'release-1.43.117' into develop
  • 5c706c0 Bumping version to 1.43.117
  • 27fc40e Update to latest models
  • 0a6c7b6 Remove Comodo AAA root from vendored cert bundle (#3838)
  • Additional commits viewable in compare view

Updates ty from 0.0.87 to 0.0.91

Release notes

Sourced from ty's releases.

0.0.91

Release Notes

Released on 2026-10-22.

Bug fixes

  • Improve generics solving when an intersection is passed into a generic call to prefer solving the call to a more precise type when it is safe to do so (#29578)
  • Fix recursive type materialization (#29532)
  • Infer return intersections from correlated call specializations (#28303)
  • Preserve Self when checking universal protocols (#29207)
  • Fix stack overflows involving recursive descriptor setter types (#29148)
  • Preserve the namespace-package fallback in module discovery when the namespace-package fallback is obscured by a partial stub package (#29559)
  • Report all missing @override decorators together (#29557)
  • Fix false-positive invalid-argument-type diagnostics when inferring constrained type variables from callbacks that return an invariant generic with a gradual type argument (#29577)

Performance improvements

  • Compare protocol receiver restrictions before binding (#29443)

LSP server

  • Avoid cancelling requests for unrelated file changes (#29604)

Core type checking

  • Generics solving: check for unsatisfiable bodies before existentially quantifying (#29504)
  • Liskov diagnostics: Check inherited attribute conflicts (#28559)
  • Return type inference: eneralize nested types in inferred return types (#29488)

Contributors

Install ty 0.0.91

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.91/ty-installer.sh | sh

Install prebuilt binaries via powershell script

</tr></table>

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.91

Released on 2026-10-22.

Bug fixes

  • Improve generics solving when an intersection is passed into a generic call to prefer solving the call to a more precise type when it is safe to do so (#29578)
  • Fix recursive type materialization (#29532)
  • Infer return intersections from correlated call specializations (#28303)
  • Preserve Self when checking universal protocols (#29207)
  • Fix stack overflows involving recursive descriptor setter types (#29148)
  • Preserve the namespace-package fallback in module discovery when the namespace-package fallback is obscured by a partial stub package (#29559)
  • Report all missing @override decorators together (#29557)
  • Fix false-positive invalid-argument-type diagnostics when inferring constrained type variables from callbacks that return an invariant generic with a gradual type argument (#29577)

Performance improvements

  • Compare protocol receiver restrictions before binding (#29443)

LSP server

  • Avoid cancelling requests for unrelated file changes (#29604)

Core type checking

  • Generics solving: check for unsatisfiable bodies before existentially quantifying (#29504)
  • Liskov diagnostics: Check inherited attribute conflicts (#28559)
  • Return type inference: eneralize nested types in inferred return types (#29488)

Contributors

0.0.90

Released on 2026-10-20.

Bug fixes

  • Allow subclasses to restore hashability (#29471)
  • Avoid crashes when negating recursive aliases (#29429)
  • Avoid stack overflow for recursive descriptor setter checks (#29467)
  • Defer constructor type variable defaults (#29469)
  • Preserve bound receivers for strict signature checks (#29396)
  • Preserve read types for dynamic attributes (#29461)

... (truncated)

Commits

Updates ruff from 0.16.9 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates inline-snapshot from 0.35.4 to 0.36.1

Release notes

Sourced from inline-snapshot's releases.

v0.36.1

Changed

  • Defer generating source representations until they are needed, improving performance when comparing matching snapshots with updates disabled.

  • Speed up snapshot conversion for literal constants, especially in large lists and dictionaries.

  • Built-in literal values are always managed; attempting to register their types as unmanaged raises TypeError.

  • Scope unmanaged type registrations to the current snapshot context, inheriting registrations from the parent context.

  • Speed up snapshot comparisons by avoiding unnecessary deep copies of immutable built-in values.

  • Speed up snapshot conversion by reading AST constant values directly instead of compiling and evaluating them.

Fixed

  • Respect show-updates in the short report, hiding snapshot representation change messages when it is disabled.

0.36.0

Added

  • The customize hook now receives a snapshot_value argument with the corresponding existing snapshot value, or ... when there is no corresponding snapshot.
Changelog

Sourced from inline-snapshot's changelog.

v0.36.1 — 2026-10-12

Changed

  • Defer generating source representations until they are needed, improving performance when comparing matching snapshots with updates disabled.

  • Speed up snapshot conversion for literal constants, especially in large lists and dictionaries.

  • Built-in literal values are always managed; attempting to register their types as unmanaged raises TypeError.

  • Scope unmanaged type registrations to the current snapshot context, inheriting registrations from the parent context.

  • Speed up snapshot comparisons by avoiding unnecessary deep copies of immutable built-in values.

  • Speed up snapshot conversion by reading AST constant values directly instead of compiling and evaluating them.

Fixed

  • Respect show-updates in the short report, hiding snapshot representation change messages when it is disabled.

0.36.0 — 2026-10-02

Added

  • The customize hook now receives a snapshot_value argument with the corresponding existing snapshot value, or ... when there is no corresponding snapshot.

Commits
  • 5471fe0 bump: version 0.36.0 → 0.36.1
  • 17fd47d Merge pull request #396 from 15r10nk/fix/scriv-release-tag-prefix
  • a8c4ebd ci: align Scriv release tags with Commitizen
  • 114e1d0 Merge pull request #392 from 15r10nk/performance
  • f9df27d perf: measure snapshot comparisons with cold caches
  • 65b7cec perf: evaluate AST constants directly
  • e907681 perf: skip deepcopy for immutable built-in values
  • e9af200 perf: speed up literal snapshot conversion and scope unmanaged types
  • 40be64f perf: defer snapshot source representation generation
  • 323de2f perf: skip update processing for matching snapshots
  • Additional commits viewable in compare view

Updates azure-identity from 1.25.3 to 1.26.0

Release notes

Sourced from azure-identity's releases.

azure-identity_1.26.0

1.26.0 (2026-09-30)

Features Added

  • ManagedIdentityCredential now supports user-assigned managed identities on Azure Arc-enabled servers. An identity can be selected by client ID, object ID, or resource ID. Token responses that do not confirm the requested identity are rejected. (#48967)

Bugs Fixed

  • Fixed synchronous Service Fabric managed identity authentication with MSAL 1.39.0 and later. Service Fabric now uses the session from an Azure Core RequestsTransport. (#48967)
  • Fixed an issue where AuthorizationCodeCredential and the asynchronous OnBehalfOfCredential could return a cached token for another account when multiple credentials shared a token cache. (#49001)

Other Changes

  • Added RequestIdPolicy to the default pipeline policies to ensure a unique x-ms-client-request-id header is sent with each request. (#46070)
  • CertificateCredential now passes the PEM private key to MSAL as a str rather than bytes, matching MSAL's documented client_credential contract. (#46801)
  • Bumped the minimum dependency on msal to >=1.39.0.
Commits
  • 30d8bb9 [identity] prepare azure-identity 1.26.0 release (#49290)
  • c7148b7 [identity] Enable user-assigned managed identity for AzureArcCredential (#48967)
  • c5b1f4f [Identity] Fix identity cache issue (#49001)
  • 9d085c1 [AutoPR azure-mgmt-compute-bulkaction]-generated-from-SDK Generation - Python...
  • efc412d [TA] fix release error (#49261)
  • 3d9b8b3 Prepare Responses 2.3.0b2 release (#49281)
  • 8e49d15 [AutoPR azure-mgmt-resiliencemanagement]-generated-from-SDK Generation - Pyth...
  • ef68c78 Preserve canonical agent reference in response snapshots (#49256)
  • 3754db9 Configurations: 'specification/applink/AppLink.Management/tspconfig.yaml', a...
  • 0929352 [Mgmt] Make review drafts and incomplete outcomes reliable (#49275)
  • Additional commits viewable in compare view

Updates playwright from 1.63.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Highlights

microsoft/playwright-python#3283 - chore: roll Node.js to 24.22.1

The bundled Node.js 24.22.1 is a security release that distrusts the compromised eMudhra intermediate CAs. The driver uses Node's CA store for its own TLS connections, for example connect_over_cdp to a wss:// endpoint.

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

browser = chromium.launch(args=["--enable-features=WebMCP"])
page = browser.new_page()
page.goto("https://example.com")
for tool in page.webmcp.tools():
print(tool["name"], tool["description"])
result = page.webmcp.call_tool("add", {"a": 2, "b": 40})
print(result["content"][0]["text"])  # "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

... (truncated)

Commits
  • bcb9deb cherry-pick(#3283): chore: roll Node.js to 24.22.1
  • 387a8a9 cherry-pick(#3252): devops: publish to PyPI from GitHub Actions with trusted ...
  • 71d2a17 chore: roll Playwright to v1.64.0 (#3251)
  • d566fc5 fix(fetch): JSON-stringify NaN and Infinity string data (#3249)
  • 2959d19 docs(skills): add a skill to prepare a release (#3250)
  • 5313ac2 fix(network): keep blank values in Request.post_data_json for form bodies (#3...
  • 9d8c50f chore(codegen): use alphabetical order in the generated API (#3242)
  • 478282f chore(codegen): generate the public TypedDicts from the docs (#3247)
  • b8b7155 fix: raise Error instead of assert for user input validation (#3245)
  • 1de5d37 fix(network): do not add missing headers when looking them up (#3246)
  • Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

  • [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

  • [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

  • [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

    A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

  • [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

  • [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

  • [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

  • [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

    As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits
  • 4c7f636 Preparing release 1.7.0
  • 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
  • 628959b docs: remove outdated hookimpl default args paragraph
  • 2edab5e Merge pull request #752 from bluetech/register-none-allow
  • 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
  • 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
  • 6a7e84e Add changelog fragment for #776
  • d22cfb5 Drop tox from the dev dependency group
  • 74cbfa2 Relock pytest and tox that dependabot downgraded
  • 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 1, 2026 21:02
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Nov 1, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T09:32:16.802838Z 1a59623 New commits
🔒 Security Review ✅ Completed 2026-11-02T09:31:51.640244Z 1a59623 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Nov 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 642f2c5f25

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread uv.lock
@@ -1421,7 +1463,7 @@ wheels = [

[[package]]
name = "openai"
version = "3.42.1" # x-release-please-version
version = "3.42.1"

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restore the release-please version marker

Restore # x-release-please-version on this line. The dependency validation job in .github/workflows/ci.yml:63-67 explicitly requires the exact marked version string, so this change makes that job fail with AssertionError: Preserve the uv.lock release-please marker and project version; it also prevents release-please from identifying this lockfile version field.

Useful? React with 👍 / 👎.

@dependabot
chore(deps): bump the python-maintenance group across 1 directory wit…
1a59623 
…h 10 updates

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-maintenance
- dependency-name: azure-identity
  dependency-version: 1.26.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: botocore
  dependency-version: 1.43.118
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-maintenance
- dependency-name: httpx2
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: inline-snapshot
  dependency-version: 0.36.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: jiter
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-maintenance
- dependency-name: ty
  dependency-version: 0.0.91
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-maintenance
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-maintenance-a0941ae8d1 branch from 642f2c5 to 1a59623 Compare November 2, 2026 09:30
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Nov 2, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a5962387c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread pyproject.toml
Comment on lines +75 to +76
provider-browser = ["playwright==1.64.1"]
browser-demo = ["playwright==1.64.1"]

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update documented Playwright pins with the tested version

When users set up either browser example using docs/browser.md:19, examples/browser/README_read_only.md:16, or examples/browser-use-demo/README.md:14, they are still told to install exactly Playwright 1.63.0, while both CI-tested dependency groups now install 1.64.1. Those documented installations therefore bypass this upgrade—including its bundled Node.js security update—and no longer match the browser version exercised by the repository's type and security checks; update the three installation commands alongside these pins.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants