Skip to content

chore(deps): bump the uv group across 1 directory with 2 updates - #16082

Closed
dependabot[bot] wants to merge 2 commits into
Dev_new_guifrom
dependabot/uv/uv-60fe04b633
Closed

chore(deps): bump the uv group across 1 directory with 2 updates#16082
dependabot[bot] wants to merge 2 commits into
Dev_new_guifrom
dependabot/uv/uv-60fe04b633

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the uv group with 1 update in the /autobot-infrastructure/shared/mcp/tools/knowledge-base-mcp directory: httpcore2.

Updates httpcore2 from 2.9.1 to 2.10.0

Release notes

Sourced from httpcore2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

  • Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
  • SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
  • Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

Changed

Fixed

httpcore2

Added

Changed

Fixed

🙏 New Contributors

... (truncated)

Commits
  • a966320 Version 2.10.0 (#1129)
  • 586f968 Avoid quadratic copying when sending large HTTP/2 request bodies (#1127)
  • dee1d1a Return str | None instead of Any from Headers.get (#1121)
  • dec24ad Use httpx2-jsfetch on Emscripten (#1119)
  • 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
  • cbfc0e0 Improve SSE chunk buffering performance (#1117)
  • ad141d8 Refactor SSE parser coordination (#1118)
  • e0b0124 Make _client depend on the _transports package instead of its submodules ...
  • e52f963 Skip dependencies not needed on Emscripten (#1114)
  • 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
  • Additional commits viewable in compare view

Updates httpx2 from 2.9.1 to 2.10.0

Release notes

Sourced from httpx2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

  • Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
  • SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
  • Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

Changed

Fixed

httpcore2

Added

Changed

Fixed

🙏 New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.10.0 (August 9th, 2026)

Added

  • Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
  • Add max_event_size to cap SSE event buffering. (#1071)
  • Add RFC 9110 status code constants. (#1069)
  • Add support for Python 3.15. (#1090)

Changed

  • Improve SSE chunk buffering performance. (#1117)
  • Skip cookie extraction for responses without Set-Cookie headers. (#1107)
  • Return str | None instead of Any from Headers.get. (#1121)

Fixed

  • Enforce the WebSocket max message size across fragmented messages. (#1085)
  • Ignore unsolicited and duplicate WebSocket Pong frames. (#1122)
Commits
  • a966320 Version 2.10.0 (#1129)
  • dee1d1a Return str | None instead of Any from Headers.get (#1121)
  • dec24ad Use httpx2-jsfetch on Emscripten (#1119)
  • 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
  • cbfc0e0 Improve SSE chunk buffering performance (#1117)
  • ad141d8 Refactor SSE parser coordination (#1118)
  • e0b0124 Make _client depend on the _transports package instead of its submodules ...
  • e52f963 Skip dependencies not needed on Emscripten (#1114)
  • 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
  • 55fad71 Bump the python-packages group across 1 directory with 15 updates (#1112)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

mrveiss and others added 2 commits August 31, 2026 12:37
@mrveiss
Merge pull request #15326 from mrveiss/Dev_new_gui
b94f51a 
release: promote Dev_new_gui to main (activates the parked-branch schedule, #15306)
@dependabot
chore(deps): bump the uv group across 1 directory with 2 updates
8bc93c7 
Bumps the uv group with 1 update in the /autobot-infrastructure/shared/mcp/tools/knowledge-base-mcp directory: [httpcore2](https://github.com/pydantic/httpx2).


Updates `httpcore2` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Commits](pydantic/httpx2@v2.9.1...v2.10.0)

Updates `httpx2` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.9.1...v2.10.0)

---
updated-dependencies:
- dependency-name: httpcore2
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: httpx2
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 8, 2026
@dependabot
dependabot Bot requested a review from mrveiss as a code owner September 8, 2026 21:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 8, 2026
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

AutoBot Phase Validation Results

System Maturity: 96.5%

Phase Status:

PASS Phase 1: Core Infrastructure: 100.0%
PASS Phase 2: Knowledge Base and Memory: 100.0%
IN PROGRESS Phase 3: LLM Integration: 66.7%
PASS Phase 4: Security and Authentication: 100.0%
PASS Phase 5: Agent Orchestration: 100.0%
PASS Phase 6: Enhanced UI/UX: 100.0%
PASS Phase 7: Testing and Validation: 100.0%
PASS Phase 8: Advanced Features: 100.0%
PASS Phase 9: Multi-Modal AI: 100.0%
PASS Phase 10: Production Readiness: 100.0%

Recommendations:

  • 🟡 MEDIUM: Phase 3: LLM Integration requires attention (66.7% complete): Review and implement
  • ✅ System is production-ready - consider advanced features and scaling: Review and implement

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Retargeted to Dev_new_gui (Dev_new_gui-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.

@github-actions
github-actions Bot changed the base branch from main to Dev_new_gui September 8, 2026 21:20
@mrveiss

mrveiss commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Same staleness as #16083 — requesting a recreate before the red lands

This branch is 264 commits behind Dev_new_gui, and its head does not carry --allow-id PYSEC-2026-3740 in .github/workflows/security.yml. That allowance landed on base in f4e015527e ("clear the two advisories that redden every PR from base"), so Dependency Security Scan will fail here the moment its checks reach that gate — exactly as it already has on #16083.

Asking for a recreate now rather than spending a full suite to discover a known-stale result. Merging base by hand is not the answer either: on #16083 the same merge produced conflicts in three lockfiles, and resolving those means guessing at a resolver's output or running npm install inside the checkout to clear a CI red.

@dependabot recreate

Two dependabot PRs 264 commits behind, both failing on an advisory base allowed weeks ago, is the same argument #16083 makes for the merge queue (#15937 / #14054): strict: false lets a branch drift arbitrarily far and only surfaces it when a run happens to fire.

@mrveiss

mrveiss commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Closing so dependabot can reopen against current base

This branch is 264 commits behind Dev_new_gui and red on Dependency Security Scan for an advisory base allowed weeks ago — --allow-id PYSEC-2026-3740, added in f4e015527e ("clear the two advisories that redden every PR from base"). The gate is correct; the branch predates the allowance.

@dependabot recreate was requested and the branch has not moved since. Rather than leave a permanent red on the board for everyone to re-triage, closing lets dependabot regenerate this on its next run: fresh base, and lockfiles written by the resolver that owns them.

Merging base by hand is not the alternative. On the sibling PR that produced conflicts in three lockfiles — autobot-frontend, mcp-structured-thinking and libs/autobot-sdk-ts. Hand-resolving a lockfile is guesswork about a resolver's output, and regenerating one means running npm install inside the checkout to clear a CI red.

Nothing is lost: the bump is still outstanding upstream and dependabot will raise it again. Whatever it reopens gets reviewed as a new PR, carrying no verdict over from this one — a verdict about a 264-commit-stale branch says nothing about its replacement.

Related: this is the clearest case on the board for the merge queue (#15937 / #14054). With strict: false a branch can drift arbitrarily far and only discovers it when a run happens to fire.

@mrveiss mrveiss closed this Sep 8, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/uv/uv-60fe04b633 branch September 8, 2026 22:24
@dependabot @github

dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Oh no! Something went wrong on our end. Please try again later.

If the problem persists, please contact GitHub support for assistance 🙇

@mrveiss mrveiss mentioned this pull request Sep 8, 2026
Closed
2 of 5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrveiss mrveiss Awaiting requested review from mrveiss mrveiss is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mrveiss