Skip to content

Bump the "all" group with 1 update across multiple ecosystems - #142

Merged
ezhuk merged 3 commits into
mainfrom
dependabot/all-5987540bf5
Jul 17, 2026
Merged

Bump the "all" group with 1 update across multiple ecosystems#142
ezhuk merged 3 commits into
mainfrom
dependabot/all-5987540bf5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the all group with 5 updates:

Package From To
fastmcp 3.3.1 3.4.0
pymodbus 3.12.1 3.13.0
typer 0.25.1 0.26.7
pytest-asyncio 1.3.0 1.4.0
ruff 0.15.13 0.15.15

Updates fastmcp from 3.3.1 to 3.4.0

Release notes

Sourced from fastmcp's releases.

v3.4.0: Remote Control

FastMCP 3.4 is about reaching servers that live somewhere else. The headline is fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, this release hardens the proxy layer those remote connections depend on — making bridges fail loudly instead of silently, and keeping authenticated sessions alive across the long idle periods that remote clients are prone to.

fastmcp-remote

Some MCP hosts still insist on launching a local stdio command, even when the server you want is already running over HTTP. FastMCP could already proxy a remote URL through fastmcp run, but that pulls in the full server-runner surface. fastmcp-remote is the small, single-purpose version: one URL in, one local stdio proxy out.

{
  "mcpServers": {
    "linear": {
      "command": "uvx",
      "args": ["fastmcp-remote", "https://mcp.linear.app/mcp"]
    }
  }
}

OAuth is enabled automatically for HTTPS servers, with support for explicit bearer tokens and custom headers when you need them. The implementation stays on FastMCP primitives — Client, OAuth, create_proxy, and stdio — and credits the original npm mcp-remote project for the command shape.

Bridges That Fail Loudly

Proxies are lazy bridges: they don't touch the upstream server during construction, but they do forward real MCP requests once a client connects. As of 3.4, initialize is part of that forwarded surface — so a proxy only reports a successful handshake after the upstream server initializes too. A missing backend, a wrong URL (the server root instead of /mcp), denied upstream auth, or a non-MCP upstream now fails the downstream initialize instead of producing a "connected" proxy whose capability fetches quietly come back empty. The proxy also forwards ping upstream now.

This is an intentional behavior change from 3.3, and the reason bridge callers like fastmcp-remote surface real upstream failures instead of degrading into empty tool lists.

Auth That Survives Idle Time

Remote sessions sit idle, and short-lived upstream tokens punish that. fastmcp_access_token_expiry_seconds decouples the FastMCP-issued token's lifetime from the upstream expires_in — the FastMCP token is just a reference into proxy storage, re-validated and transparently refreshed on every request, so it can safely outlive a 5-minute upstream token without forcing a full OAuth flow after every idle period. When the upstream issues no refresh token, the lifetime is capped to match.

from fastmcp.server.auth.providers.github import GitHubProvider
auth = GitHubProvider(
client_id="...",
client_secret="...",
base_url="https://your-server.com",
fastmcp_access_token_expiry_seconds=60 * 60 * 24,  # 24h client-facing token
)

Alongside it, token_expiry_threshold_seconds treats tokens as expired N seconds early to close refresh races, and WorkOSProvider gains valid_scopes and extra_authorize_params.

Returnable Tool Errors

A tool could previously only signal an error by raising, which flattens to a text-only result and discards structured content. ToolResult now accepts is_error, mapping to CallToolResult.isError so a tool can hand back a rich error the model can see and act on. The proxy uses this to forward upstream tool errors intact instead of collapsing them.

@mcp.tool
def lookup(id: str) -> ToolResult:
</tr></table>

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.0: Remote Control

FastMCP 3.4 is about reaching servers that live somewhere else. The headline is fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, the proxy layer those connections depend on is hardened: a proxy now forwards initialize upstream and fails loudly when the backend is missing or misconfigured, instead of reporting a connected-but-empty proxy. And FastMCP-issued access tokens can now outlive short-lived upstream tokens, so authenticated sessions survive the long idle periods remote clients are prone to.

New Features 🎉

Breaking Changes ⚠️

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Commits

Updates pymodbus from 3.12.1 to 3.13.0

Release notes

Sourced from pymodbus's releases.

pymodbus v3.13.0

  • Correct missing types. (#2914)
  • Altherma heat pump control, with Home Assistant and updating server. (#2907)
  • SimDevice, use_bit_address allows different addressing for BITS. (#2908)
  • Remove 3.5char frame time check. (#2912)
  • Fixed Modbus*Context. (#2910)
  • Fix bug in ModbusDeviceContext. (#2909)
  • Fix log level in examples (#2902)
  • Fix CSS lookup for simulator server (#2904)
  • Fix usage docs in examples: add missing option --baudrate (#2903)
  • Doc:Finalice server/simulator narrative (#2896)
  • Fix codespell bug. (#2900)
  • Datastores uses SimData/SimDevice. (#2897)
  • Doc on how to convert to SimData/SimDevice. (#2899)
  • Fix Read Fifo Query RTU Frame Size (#2898)
  • Update server documentation (datstore). (#2895)
  • Update server examples to use SimData/SimDevice. (#2893)
  • Add server.async_get/setValues. (#2889)
  • Solve codeql caching problem. (#2890)
  • Remove unused methods in datastore. (#2888)
  • Remove datastore get/setValues (async_get/set exist) (#2886)
  • Revert "Combine ModbusSparseDataBlock with ModbusSequentialDataBlock."
  • Combine ModbusSparseDataBlock with ModbusSequentialDataBlock.
  • Remove RemoteDeviceContext datastore. (#2885)
Changelog

Sourced from pymodbus's changelog.

Version 3.13.0

  • Correct missing types. (#2914)
  • Altherma heat pump control, with Home Assistant and updating server. (#2907)
  • SimDevice, use_bit_address allows different addressing for BITS. (#2908)
  • Remove 3.5char frame time check. (#2912)
  • Fixed Modbus*Context. (#2910)
  • Fix bug in ModbusDeviceContext. (#2909)
  • Fix log level in examples (#2902)
  • Fix CSS lookup for simulator server (#2904)
  • Fix usage docs in examples: add missing option --baudrate (#2903)
  • Doc:Finalice server/simulator narrative (#2896)
  • Fix codespell bug. (#2900)
  • Datastores uses SimData/SimDevice. (#2897)
  • Doc on how to convert to SimData/SimDevice. (#2899)
  • Fix Read Fifo Query RTU Frame Size (#2898)
  • Update server documentation (datstore). (#2895)
  • Update server examples to use SimData/SimDevice. (#2893)
  • Add server.async_get/setValues. (#2889)
  • Solve codeql caching problem. (#2890)
  • Remove unused methods in datastore. (#2888)
  • Remove datastore get/setValues (async_get/set exist) (#2886)
  • Revert "Combine ModbusSparseDataBlock with ModbusSequentialDataBlock."
  • Combine ModbusSparseDataBlock with ModbusSequentialDataBlock.
  • Remove RemoteDeviceContext datastore. (#2885)
Commits

Updates typer from 0.25.1 to 0.26.7

Release notes

Sourced from typer's releases.

0.26.7

Fixes

0.26.6

Fixes

  • 🐛 Ensure that the default of a list argument is used correctly. PR #1821 by @​svlandeg.

Internal

0.26.5

Fixes

  • 🐛 Ensure that hidden commands are not shown when Rich markup is disabled. PR #1812 by @​svlandeg.

Internal

0.26.4

Features

  • 📝 Update AI Library Skill to avoid verbose code for CLI Options. PR #1808 by @​tiangolo.

Internal

0.26.3

Refactors

Internal

0.26.2

Fixes

  • 🐛 Ensure that an envvar set for a typer.Option list is split on whitespace. PR #1791 by @​svlandeg.

... (truncated)

Changelog

Sourced from typer's changelog.

0.26.7 (2026-06-03)

Fixes

0.26.6 (2026-06-02)

Fixes

  • 🐛 Ensure that the default of a list argument is used correctly. PR #1821 by @​svlandeg.

Internal

0.26.5 (2026-06-01)

Fixes

  • 🐛 Ensure that hidden commands are not shown when Rich markup is disabled. PR #1812 by @​svlandeg.

Internal

0.26.4 (2026-05-30)

Features

  • 📝 Update AI Library Skill to avoid verbose code for CLI Options. PR #1808 by @​tiangolo.

Internal

0.26.3 (2026-05-28)

Refactors

Internal

... (truncated)

Commits

Updates pytest-asyncio from 1.3.0 to 1.4.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

  • Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

  • Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

    The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

    Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

  • Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
  • Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)
  • Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

  • Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

  • Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)

pytest-asyncio v1.4.0a2

1.4.0a2 - 2026-05-02

Deprecated

  • Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

  • Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

    The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.

    Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

  • Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
  • Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)

... (truncated)

Commits
  • 6e14cd2 chore: Prepare release of v1.4.0.
  • 4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
  • ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
  • a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
  • e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
  • fc43340 Build(deps): Bump idna from 3.14 to 3.15
  • 762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
  • b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
  • 9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
  • 82a393c ci: Remove unnecessary debug output.
  • Additional commits viewable in compare view

Updates ruff from 0.15.13 to 0.15.15

Release notes

Sourced from ruff's releases.

0.15.15

Release Notes

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.15

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

... (truncated)

Commits
  • db5aa0a Bump 0.15.15 (#25431)
  • 366fe21 [ty] Improve diagnostics for syntax errors in forward annotations (#25158)
  • e2e1e64 [ty] Remove excess capacity from more Salsa cached collections (#25411)
  • 1bd77e1 [ty] Use diagnostic message as tie breaker when sorting (#25424)
  • 7e1bc1e Add agent skills for working on ty (#25422)
  • 574e107 Expand semantic syntax errors for invalid walruses (#25415)
  • 4a7ca06 [ty] Display docs for matching parameter when hovering over the name of an ar...
  • 5432709 Refine a few agents instructions (#25423)
  • 3cb09eb [ty] Support typing.TypeForm (#25334)
  • c8cd59f [ty] Infer class attributes assigned by metaclass initialization (#25342)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all group with 5 updates
61704cb 
Bumps the all group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.3.1` | `3.4.0` |
| [pymodbus](https://github.com/pymodbus-dev/pymodbus) | `3.12.1` | `3.13.0` |
| [typer](https://github.com/fastapi/typer) | `0.25.1` | `0.26.7` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.3.0` | `1.4.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.13` | `0.15.15` |


Updates `fastmcp` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.3.1...v3.4.0)

Updates `pymodbus` from 3.12.1 to 3.13.0
- [Release notes](https://github.com/pymodbus-dev/pymodbus/releases)
- [Changelog](https://github.com/pymodbus-dev/pymodbus/blob/dev/CHANGELOG.rst)
- [Commits](pymodbus-dev/pymodbus@v3.12.1...v3.13.0)

Updates `typer` from 0.25.1 to 0.26.7
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.25.1...0.26.7)

Updates `pytest-asyncio` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.3.0...v1.4.0)

Updates `ruff` from 0.15.13 to 0.15.15
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.13...0.15.15)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pymodbus
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: typer
  dependency-version: 0.26.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ruff
  dependency-version: 0.15.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 3, 2026
@ezhuk
ezhuk merged commit 70823d6 into main Jul 17, 2026
6 checks passed
@dependabot
dependabot Bot deleted the dependabot/all-5987540bf5 branch July 17, 2026 00:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ezhuk