chore(deps): bump the all-dependencies group across 1 directory with 25 updates

[dependabot]

Bumps the all-dependencies group with 24 updates in the /libs/bog-agents directory:

Package	From	To
anyio	4.13.0	4.14.1
langchain-core	1.4.0	1.4.8
langchain	1.3.1	1.3.11
langchain-anthropic	1.4.3	1.4.8
langchain-google-genai	4.2.2	4.2.6
wcmatch	6.1	10.2
cryptography	48.0.0	49.0.0
starlette	1.2.1	1.3.1
uvicorn	0.47.0	0.49.0
sse-starlette	3.4.4	3.4.5
pypdf	6.13.3	6.14.2
langchain-aws	1.5.0	1.6.1
langchain-openai	1.2.1	1.3.3
pytest	9.0.3	9.1.1
pytest-socket	0.7.0	0.8.0
ruff	0.15.13	0.15.20
ty	0.0.37	0.0.55
pytest-asyncio	1.3.0	1.4.0
langsmith	0.8.5	0.9.4
langchain-mistralai	1.1.4	1.1.5
langchain-deepseek	1.0.1	1.1.0
langchain-groq	1.1.2	1.1.3
langchain-baseten	0.2.0	0.2.1
datasets	4.8.5	5.0.0

Updates anyio from 4.13.0 to 4.14.1

Release notes

Sourced from anyio's releases.

4.14.1

• Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
• Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)

4.14.0

• Added support for Python 3.15

• Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

• Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

• Added support for custom capacity limiters in async path and file I/O functions and classes

• Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

• Changed TaskGroup.start_soon() to return a TaskHandle

• Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

• Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

• Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

• Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

• Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

• Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

  • TaskGroup.start_soon()
  • TaskGroup.start()
  • anyio.from_thread.run()

  This reverts an earlier change from v3.7.0 which was made in error. (#1153)

• Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

• Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

  • anyio.CancelScope
  • anyio.CapacityLimiter
  • anyio.Condition
  • anyio.Event
  • anyio.Lock
  • anyio.ResourceGuard
  • anyio.Semaphore

• Fixed cancellation exception escaping a cancel scope when triggered via check_cancelled() in a worker thread (#1113)

• Fixed TaskGroup raising AttributeError instead of a clear error when entered more than once (#1109; PR by @​bahtya)

... (truncated)

Commits

• 149b9e9 Bumped up the version
• 377518c Bump actions/checkout from 6 to 7 in the github-actions group (#1186)
• b42a2f5 [pre-commit.ci] pre-commit autoupdate (#1185)
• 3ceb6ff Allow 0 tokens in a CapacityLimiter instantiated outside an event loop (#1183)
• e10d1db Add missing await to open_file() in file I/O concurrency example (#1182)
• 1dbc3b6 OutcomeException should not discard test runner_task (#1180)
• ffe9133 Bumped up the version
• f8b9f01 Fixed asyncio lock waiter deadlocks after cancellation (#1145)
• d517ee1 [pre-commit.ci] pre-commit autoupdate (#1176)
• 550b68e Make anyio.run support Awaitable at runtime on all backends (#1171)
• Additional commits viewable in compare view

Updates langchain-core from 1.4.0 to 1.4.8

Release notes

Sourced from langchain-core's releases.

langchain-core==1.4.8

Changes since langchain-core==1.4.7

chore: bump jupyter-server from 2.18.0 to 2.20.0 in /libs/core (#38252) chore: bump tornado from 6.5.6 to 6.5.7 in /libs/core (#38184) chore: bump bleach from 6.3.0 to 6.4.0 in /libs/core (#38198) release(core): 1.4.8 (#38254) refactor(langchain-classic): remove code for Python < 3.10 (#38194) perf(core): memoize BaseTool.tool_call_schema subset model and cache model_json_schema (#38073) style(core): fix style in langchain_core/_security (#38189) fix(core): preserve usage token details in v3 streaming events (#38021) fix(core): disallow_any_generics (#38156) chore(core): add mypy warn_unreachable (#38109) docs: refresh README installation and resources (#38119) test(core,langchain): update tests for explicit deserialization allowlists (#38118)

langchain-core==1.4.7

Changes since langchain-core==1.4.6

chore: bump tornado from 6.5.5 to 6.5.6 in /libs/core (#38115) release(core): 1.4.7 (#38111) fix(core,partners): rename package version trace metadata (#38110) fix(core): fix Pydantic v1 support in tools/runnable (#33698) style(core,langchain,langchain-classic,partners): replace double backticks in docstrings (#38095)

langchain-core==1.4.6

Changes since langchain-core==1.4.5

release(core): 1.4.6 (#38061) feat(core,partners): add package version tracking to tracing metadata (#35295) fix(core,openai): normalize v1 streamed tool calls (#35983) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470)

langchain-core==1.4.5

Changes since langchain-core==1.4.4

release(core): 1.4.5 (#38056) feat(standard-tests): validate tool call chunks during streaming (#34707) fix(core): async tracer on_chat_model_start fallback in sync context (#35233) fix(langchain): tighten structured output model fallbacks (#38042)

langchain-core==1.4.4

Changes since langchain-core==1.4.3

hotfix(core): bump lockfile(s) (#38032) release(core): 1.4.4 (#38031) fix(core): support content block tokens in callbacks (#34739) chore(core): improve typing of Runnable __or__ (#34530) chore(core): fix some any generics (#34545) fix(core): accept sequence tool error content (#38005)

... (truncated)

Commits

• 15b0a49 chore: bump jupyter-server from 2.18.0 to 2.20.0 in /libs/core (#38252)
• 612139f chore: bump tornado from 6.5.6 to 6.5.7 in /libs/text-splitters (#38175)
• 921e370 chore: bump cryptography from 46.0.7 to 48.0.1 in /libs/langchain_v1 (#38176)
• 1aabc26 chore: bump aiohttp from 3.14.0 to 3.14.1 in /libs/langchain_v1 (#38179)
• 8d51355 chore: bump aiohttp from 3.14.0 to 3.14.1 in /libs/langchain (#38180)
• 0b1b7bb chore: bump cryptography from 46.0.7 to 48.0.1 in /libs/langchain (#38181)
• dfd0627 chore: bump starlette from 1.0.1 to 1.3.1 in /libs/langchain (#38182)
• 0269392 chore: bump tornado from 6.5.6 to 6.5.7 in /libs/langchain (#38183)
• 24d0b37 chore: bump tornado from 6.5.6 to 6.5.7 in /libs/core (#38184)
• f368854 chore: bump bleach from 6.2.0 to 6.4.0 in /libs/text-splitters (#38195)
• Additional commits viewable in compare view

Updates langchain from 1.3.1 to 1.3.11

Release notes

Sourced from langchain's releases.

langchain==1.3.11

Changes since langchain==1.3.10

release(langchain): 1.3.11 (#38377) fix(langchain,openai): only set strict=True on tools for OpenAI-compatible models in ProviderStrategy (#38370) chore: bump pydantic-settings from 2.12.0 to 2.14.2 in /libs/langchain_v1 (#38279) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/langchain_v1 (#38280) chore: bump langsmith from 0.8.9 to 0.8.18 in /libs/langchain_v1 (#38281) docs(langchain): document summarization prompt contract (#38256)

langchain==1.3.10

Changes since langchain==1.3.9

release(langchain): 1.3.10 (#38255) chore: bump cryptography from 46.0.7 to 48.0.1 in /libs/langchain_v1 (#38176) chore: bump aiohttp from 3.14.0 to 3.14.1 in /libs/langchain_v1 (#38179) fix(langchain): switch summary format (#38171) fix(langchain): detect provider strategy for dated gpt-5.2/gpt-5.4 snapshots (#38222) chore(langchain): improve typing in tests (#38163) chore: bump pyjwt from 2.12.0 to 2.13.0 in /libs/langchain_v1 (#38168) release(openai): 1.3.2 (#38130) hotfix(openai): switch version (#38123) release(openai): 1.4.0 (#38120) docs: refresh README installation and resources (#38119) test(core,langchain): update tests for explicit deserialization allowlists (#38118) release(core): 1.4.7 (#38111) release(anthropic): 1.4.6 (#38105)

langchain==1.3.9

Changes since langchain==1.3.8

release(anthropic): 1.4.6 (#38105) release(langchain): 1.3.9 (#38104) fix(langchain,anthropic): confine file-search results and tighten anthropic allowed_prefixes (#38106)

langchain==1.3.8

Changes since langchain==1.3.7

release(langchain): 1.3.8 (#38096) style(core,langchain,langchain-classic,partners): replace double backticks in docstrings (#38095) release(core): 1.4.6 (#38061) chore(langchain): add overloads to create_agent (#34309) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470) fix(langchain): support async middleware decorator typing (#34584) fix(langchain): tighten structured output model fallbacks (#38042) release(anthropic): 1.4.5 (#38036) hotfix(core): bump lockfile(s) (#38032) refactor(langchain): refactor test_create_agent_tool_validation (#34443)

langchain==1.3.7

... (truncated)

Commits

• 83e8249 release(langchain): 1.3.11 (#38377)
• 6dd45c9 hotfix(anthropic): regenerate cassette (#38376)
• 4a83756 release(openai): 1.3.3 (#38375)
• 792c1a7 fix(openai): drop response item ids when store is false (#38372)
• 9f7e46f release(anthropic): 1.4.7 (#38373)
• 9ef324c fix(langchain,openai): only set strict=True on tools for OpenAI-compatible ...
• 05b5af1 chore(infra): update workflow key name (#38367)
• 8e81774 test(groq): xfail flaky tool choice test (#38365)
• 946fbbb fix(groq): replace deprecated Groq llama models (#38363)
• d11b1fc chore(model-profiles): refresh model profile data (#38341)
• Additional commits viewable in compare view

Updates langgraph from 1.2.0 to 1.2.7

Release notes

Sourced from langgraph's releases.

langgraph==1.2.7

Changes since 1.2.6

• release(langgraph): 1.2.7 (#8223)
• fix(langgraph): snapshot DeltaChannel overwrite supersteps (#8125)
• fix(langgraph): Make Overwrite survive JSON roundtrips (#8127)
• chore(deps): bump redis in /libs/langgraph (#7976)
• chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/langgraph (#8176)
• chore(deps): bump jupyterlab from 4.5.7 to 4.5.9 in /libs/langgraph (#8164)
• fix(langgraph): emit valid UUIDs for exit-mode delta task_ids for langgraph-api (#8165)
• chore(deps): bump bleach from 6.3.0 to 6.4.0 in /libs/langgraph (#8107)
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 in /libs/langgraph (#8106)
• chore(deps): bump jupyter-server from 2.18.0 to 2.20.0 in /libs/langgraph (#8134)
• chore(deps): bump tornado from 6.5.6 to 6.5.7 in /libs/langgraph (#8108)
• chore(deps): bump pyjwt from 2.12.0 to 2.13.0 in /libs/langgraph (#8092)

langgraph==1.2.6

Changes since 1.2.5

• release(langgraph): 1.2.6 (#8139)
• fix: nested subgraph inherits parent checkpoint_ns (regression in 1.2.3) (#8053)
• fix: cancel running subgraphs on v3 stream abort [closes #8029] (#8057)
• release(cli): 0.4.30 (#8101)
• docs: standardize package README.md structure (#8064)
• chore(deps): bump tornado from 6.5.5 to 6.5.6 in /libs/langgraph (#8063)

langgraph==1.2.5

Changes since 1.2.4

• release(langgraph): 1.2.5 (#8062)
• fix(langgraph): merge lc_versions config metadata (#8052)
• release(cli): 0.4.28 (#8041)
• fix: updateState bug for deltaChannel on empty thread (#8011)
• chore: migrate Python type checking to ty (#8002)
• chore(deps-dev): bump types-requests from 2.33.0.20260408 to 2.33.0.20260518 in /libs/langgraph (#7977)
• chore(deps): bump the minor-and-patch group in /libs/langgraph with 14 updates (#7975)

langgraph==1.2.4

Changes since 1.2.3

• release(langgraph): 1.2.4 (#7991)
• test(sdk-py): add factory-graph integration test exercising the server factory path (#7978)
• fix(langgraph): keep _on_started backward-compatible with overrides predating cause (#7987)

langgraph==1.2.3

Changes since 1.2.2

• release(langgraph): 1.2.3 (#7945)
• feat(langgraph): wire RemoteGraph.interleave to sdk-py interleave_projections (#7938)
• feat(langgraph): add v3 streaming support to RemoteGraph (#7927)

... (truncated)

Commits

• 5931a5f release(langgraph): 1.2.7 (#8223)
• 9a27693 fix(langgraph): snapshot DeltaChannel overwrite supersteps (#8125)
• 1b5ca0a fix(langgraph): Make Overwrite survive JSON roundtrips (#8127)
• d2f9719 chore(deps): bump redis in /libs/langgraph (#7976)
• c1aad8b chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 in /libs/sdk-py (#8104)
• d5dfeaf chore(deps): bump starlette from 1.0.1 to 1.3.1 in /libs/cli (#8105)
• bdb323e chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/checkpoint-sqlite (...
• 31f6955 chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/checkpoint-postgres...
• 6b767de chore(deps): bump langsmith from 0.8.2 to 0.8.18 in /libs/checkpoint-conforma...
• e6574a8 chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/cli (#8172)
• Additional commits viewable in compare view

Updates langchain-anthropic from 1.4.3 to 1.4.8

Release notes

Sourced from langchain-anthropic's releases.

langchain-anthropic==1.4.8

Changes since langchain-anthropic==1.4.7

release(anthropic): 1.4.8 (#38490) fix(anthropic): keep initial text on content_block_start (#38442) chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/partners/anthropic (#38479) fix(core): add messages to bare raise ValueError calls (#38158)

langchain-anthropic==1.4.7

Changes since langchain-anthropic==1.4.6

hotfix(anthropic): regenerate cassette (#38376) release(anthropic): 1.4.7 (#38373) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/partners/anthropic (#38324) chore: bump langsmith from 0.8.5 to 0.8.18 in /libs/partners/anthropic (#38325) docs(anthropic): clarify prompt caching middleware docstring (#38206) docs: refresh README installation and resources (#38119) test(core,langchain): update tests for explicit deserialization allowlists (#38118) release(core): 1.4.7 (#38111) fix(core,partners): rename package version trace metadata (#38110)

langchain-anthropic==1.4.6

Changes since langchain-anthropic==1.4.5

release(anthropic): 1.4.6 (#38105) fix(langchain,anthropic): confine file-search results and tighten anthropic allowed_prefixes (#38106) release(core): 1.4.6 (#38061) feat(core,partners): add package version tracking to tracing metadata (#35295) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470) feat(standard-tests): validate tool call chunks during streaming (#34707) test(anthropic): make expected warnings explicit (#38044) test(anthropic): make tests robust to gateway base URL (#38043)

langchain-anthropic==1.4.5

Changes since langchain-anthropic==1.4.4

release(anthropic): 1.4.5 (#38036) fix(core): support content block tokens in callbacks (#34739) chore(model-profiles): refresh model profile data (#38012) hotfix(openai): min core dep (#37990) test(langchain,partners): disable pytest-benchmark under xdist to silence PytestBenchmarkWarning (#37901) chore(model-profiles): refresh model profile data (#37895) chore(model-profiles): refresh model profile data (#37771)

langchain-anthropic==1.4.4

Changes since langchain-anthropic==1.4.3

release(anthropic): 1.4.4 (#37757) fix(anthropic): normalize cross-provider tool-call IDs (#37756) test(anthropic): retry integration tests on transient failures (#37697)

... (truncated)

Commits

• e495651 release(anthropic): 1.4.8 (#38490)
• bfc65cc fix(anthropic): keep initial text on content_block_start (#38442)
• 00ad96c chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/partners/huggin...
• e7c3834 chore: bump langgraph-checkpoint from 4.0.3 to 4.1.1 in /libs/langchain (#38477)
• 9b245de chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/partners/openai...
• 0a71a1d chore: bump langgraph-sdk from 0.3.13 to 0.3.15 in /libs/langchain (#38475)
• 5f99048 chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/model-profiles ...
• 3e6f1e3 chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/partners/anthro...
• d3eb229 fix(core): avoid dict shadowing in language models (#38480)
• 20ba43d release(fireworks): 1.4.3
• Additional commits viewable in compare view

Updates langchain-google-genai from 4.2.2 to 4.2.6

Release notes

Sourced from langchain-google-genai's releases.

langchain-google-genai==4.2.6

Changes since libs/genai/v4.2.5

release(genai): 4.2.6 (#1871) fix(genai): propagate generation config fields (#1870) fix(genai): support constructor thinking config (#1869) chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/genai (#1860) test(genai,vertexai,community): refresh Gemini model references (#1856) chore: bump types-google-cloud-ndb from 2.4.0.20260402 to 2.4.0.20260518 in /libs/genai (#1778) chore: bump cryptography from 46.0.7 to 48.0.1 in /libs/genai (#1851) chore: bump the major group across 1 directory with 3 updates (#1810) feat(genai,vertexai): add package version metadata (#1841) fix(genai): stop docstring cross-refs resolving to wrong class (#1839) chore(genai,vertexai): bump min version of langchain-core (#1835) test(genai): make tool-calling integration tests deterministic (#1833)

langchain-google-genai==4.2.5

Changes since libs/genai/v4.2.4

release(genai): 4.2.5 (#1831) fix(genai): merge per-request http options into chat config (#1830)

langchain-google-genai==4.2.4

Changes since libs/genai/v4.2.3

release(genai): 4.2.4 (#1815) fix(genai): fix tests (#1814) chore(genai): Update google-genai dependency to support 2.x (#1766) test(genai): force google_search use in structured-output test (#1801) chore: bump the minor-and-patch group across 1 directory with 5 updates (#1797) test(genai): fix context caching assertions, increase flaky retries (#1798) fix(genai): walrus operator precedence in v1 image/file url conversion (#1683) chore(genai): silence pytest-benchmark xdist warning (#1794)

langchain-google-genai==4.2.3

Changes since libs/genai/v4.2.2

release(genai): 4.2.3 (#1795) feat(genai): expose api_version (#1793) chore(model-profiles): refresh model profile data (#1792) chore: bump idna from 3.11 to 3.15 in /libs/genai (#1786) fix(genai): fix tests (#1785) chore(model-profiles): refresh model profile data (#1790) chore: bump langchain-core from 1.3.3 to 1.4.0 in /libs/genai (#1771) fix(genai, vertexai): reflect per-call model overrides in traces (#1774) chore: bump langchain-core from 1.3.2 to 1.3.3 in /libs/genai (#1758) docs(genai): fix deprecated safety settings documentation link (#1762) chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/genai (#1763) chore: bump langsmith from 0.7.31 to 0.8.0 in /libs/genai (#1769) chore(model-profiles): refresh model profile data (#1755)

... (truncated)

Commits

• 29780ea release(genai): 4.2.6 (#1871)
• d2fb18c fix(genai): propagate generation config fields (#1870)
• 3086854 fix(genai): support constructor thinking config (#1869)
• 32b18c6 chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/vertexai (#1858)
• f7d4530 chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/genai (#1860)
• 985efce chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/community (#1859)
• eeb409f chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/vertexai (#1861)
• 146a016 fix(vertexai): route labels to request envelope instead of GenerationConfig...
• bab2961 fix(vertexai): replace removed bison integration test models (#1863)
• 643f772 test(genai,vertexai,community): refresh Gemini model references (#1856)
• Additional commits viewable in compare view

Updates wcmatch from 6.1 to 10.2

Release notes

Sourced from wcmatch's releases.

10.2

• NEW: Require bracex 3.0 for bug fixes.
• NEW: Drop support for Python 3.9 which is "end of life".

10.1

• NEW: Drop support for Python 3.8 which is "end of life".
• NEW: Add support for Python 3.14.
• NEW: Add wcmatch.glob.compile(pattern) and wcmatch.fnmatch.compile(pattern) to allow for precompiled matcher objects that can be reused.

10.0

• NEW: Added GLOBSTARLONG which adds support for the Zsh style *** which acts like ** with GLOBSTAR but but traverses symlinks.
• NEW: pathlib.match will respect symlink rules (when the REALPATH flag is given). Hidden file rules will be respected at all times. Enable DOTALL to match hidden files.
• NEW: Symlinks should not be traversed when GLOBSTAR is enabled unless FOLLOW is also enabled, but they should still be matched. Prior to this change, symlinks were not traversed and they were ignored from matching which contradicts how Bash works and could be confusing to users.
• FIX: Fix some inconsistencies with globmatch and symlink handling when REALPATH is enabled.

9.0

• NEW: Remove deprecated function glob.raw_escape.
• NEW: Officially support Python 3.13.

8.5.2

• FIX: Fix pathlib issue with inheritance on Python versions greater than 3.12.
• FIX: Fix EXTMATCH case with !(...) patterns.

8.5.1

• FIX: Fix issue with type check failure in wcmatch.glob.

8.5

• NEW: Formally support Python 3.11 (no change).
• NEW: Add support for Python 3.12 (pathlib changes).
• NEW: Drop Python 3.7 support.
• FIX: Fix handling of current directory when magic and non-magic patterns are mixed in glob pattern list.

8.4.1

• FIX: Windows drive path separators should normalize like other path separators.
• FIX: Fix a Windows pattern parsing issue that caused absolute paths with ambiguous drives to not parse correctly.

8.4

... (truncated)

Commits

• 3057590 Require Bracex 3.0 for bug fixes
• 88f45e9 Docs: Update admonition style to the more common form
• bf5e6e5 Drop Python 3.9 (#234)
• 58c594d Switch docs to Zensical (#233)
• 8fa740d Remove CI badge as it rarely works as intended these days
• 98a09de Fix new lint errors
• 5150a7e Add note about when precompiling was added
• a9d5bf2 Elaborate a little more on capturing groups
• f714c34 Fix document grammar
• a6578f3 Update copyright
• Additional commits viewable in compare view

Updates cryptography from 48.0.0 to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12

* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table> 

... (truncated)

Commits

• e300bbe bump version and changelog for 49.0.0 (#15030)
• fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
• f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
• 608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
• a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
• 33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
• 6080dc7 Bump dependencies that dependabot isn't (#15026)
• 121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
• 829520b Add more robust processing for DH parameters. (#15016)
• 0f05001 Bump downstream dependencies in CI (#15025)
• Additional commits viewable in compare view

Updates starlette from 1.2.1 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @​Kludex in Kludex/starlette#3119
• Enforce max_fields and max_part_size in FormParser by @​Kludex in Kludex/starlette#3329
• Enforce FormParser limits in parser callbacks by @​Kludex in Kludex/starlette#3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

• Clamp oversized suffix ranges in FileResponse by @​jiyujie2006 in Kludex/starlette#3307
• Catch OSError alongside MultiPartException when closing temp files by @​N3XT3R1337 in Kludex/starlette#3191
• Add httpx2 to the full extra by @​Kludex in Kludex/starlette#3323
• Adjust testclient typing and warnings by @​waketzheng in Kludex/starlette#3322
• Fix IndexError in URL.replace() on a URL with no authority by @​LeSingh1 in Kludex/starlette#3317
• Annotate URLPath protocol parameter with Literal by @​Chang-LeHung in Kludex/starlette#3285
• avoid collapsing exception groups from user code by @​graingert in Kludex/starlette#2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @​gnosyslambda in Kludex/starlette#3193
• Build request.url from structured components by @​Kludex in

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.