Skip to content

deps(python): Bump the python-minor group with 7 updates#8332

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-ee29f60d7a
Open

deps(python): Bump the python-minor group with 7 updates#8332
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-ee29f60d7a

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026

Bumps the python-minor group with 7 updates:

Package From To
mcp 1.27.1 1.27.2
fastmcp 3.3.1 3.4.0
scikit-learn 1.8.0 1.9.0
anthropic 0.104.1 0.105.2
pandas-stubs 3.0.0.260204 3.0.3.260530
ruff 0.15.14 0.15.15
plotnine 0.15.4 0.15.5

Updates mcp from 1.27.1 to 1.27.2

Release notes

Sourced from mcp's releases.

v1.27.2

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

Commits
  • 6213787 [v1.x] Scope experimental tasks to the session that created them (#2720)
  • ce267b6 [v1.x] Bind transport sessions to the authenticated principal (#2719)
  • 1abcca2 [v1.x] Add subject and claims to AccessToken (#2690)
  • 9773a3f [v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact (...
  • See full diff in compare view

Updates fastmcp from 3.3.1 to 3.4.0

Release notes

Sourced from fastmcp's releases.

v3.4.0: Remote Control

FastMCP 3.4 is about reaching servers that live somewhere else. The headline is fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, this release hardens the proxy layer those remote connections depend on — making bridges fail loudly instead of silently, and keeping authenticated sessions alive across the long idle periods that remote clients are prone to.

fastmcp-remote

Some MCP hosts still insist on launching a local stdio command, even when the server you want is already running over HTTP. FastMCP could already proxy a remote URL through fastmcp run, but that pulls in the full server-runner surface. fastmcp-remote is the small, single-purpose version: one URL in, one local stdio proxy out.

{
  "mcpServers": {
    "linear": {
      "command": "uvx",
      "args": ["fastmcp-remote", "https://mcp.linear.app/mcp"]
    }
  }
}

OAuth is enabled automatically for HTTPS servers, with support for explicit bearer tokens and custom headers when you need them. The implementation stays on FastMCP primitives — Client, OAuth, create_proxy, and stdio — and credits the original npm mcp-remote project for the command shape.

Bridges That Fail Loudly

Proxies are lazy bridges: they don't touch the upstream server during construction, but they do forward real MCP requests once a client connects. As of 3.4, initialize is part of that forwarded surface — so a proxy only reports a successful handshake after the upstream server initializes too. A missing backend, a wrong URL (the server root instead of /mcp), denied upstream auth, or a non-MCP upstream now fails the downstream initialize instead of producing a "connected" proxy whose capability fetches quietly come back empty. The proxy also forwards ping upstream now.

This is an intentional behavior change from 3.3, and the reason bridge callers like fastmcp-remote surface real upstream failures instead of degrading into empty tool lists.

Auth That Survives Idle Time

Remote sessions sit idle, and short-lived upstream tokens punish that. fastmcp_access_token_expiry_seconds decouples the FastMCP-issued token's lifetime from the upstream expires_in — the FastMCP token is just a reference into proxy storage, re-validated and transparently refreshed on every request, so it can safely outlive a 5-minute upstream token without forcing a full OAuth flow after every idle period. When the upstream issues no refresh token, the lifetime is capped to match.

from fastmcp.server.auth.providers.github import GitHubProvider
auth = GitHubProvider(
client_id="...",
client_secret="...",
base_url="https://your-server.com",
fastmcp_access_token_expiry_seconds=60 * 60 * 24,  # 24h client-facing token
)

Alongside it, token_expiry_threshold_seconds treats tokens as expired N seconds early to close refresh races, and WorkOSProvider gains valid_scopes and extra_authorize_params.

Returnable Tool Errors

A tool could previously only signal an error by raising, which flattens to a text-only result and discards structured content. ToolResult now accepts is_error, mapping to CallToolResult.isError so a tool can hand back a rich error the model can see and act on. The proxy uses this to forward upstream tool errors intact instead of collapsing them.

@mcp.tool
def lookup(id: str) -> ToolResult:
</tr></table>

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.0: Remote Control

FastMCP 3.4 is about reaching servers that live somewhere else. The headline is fastmcp-remote, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, the proxy layer those connections depend on is hardened: a proxy now forwards initialize upstream and fails loudly when the backend is missing or misconfigured, instead of reporting a connected-but-empty proxy. And FastMCP-issued access tokens can now outlive short-lived upstream tokens, so authenticated sessions survive the long idle periods remote clients are prone to.

New Features 🎉

Breaking Changes ⚠️

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Commits

Updates scikit-learn from 1.8.0 to 1.9.0

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.0

We're happy to announce the 1.9.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_9_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.9.html

This release adds narwhals as a new dependency that will help to improve dataframe interoperability across the project.

This version supports Python versions 3.11 to 3.14.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn
Commits
  • 77def0e trigger wheel builder [cd build]
  • ee7c0b0 generate changelog
  • 3d7fb04 bump version
  • 8954e7b DOC Release highlights for 1.9 (#34147)
  • 73a3eab Fix: Array-API - avoid failing for numpy fit + predict with sparse or array-l...
  • 8839aae DOC Thread-safety requirement for open_listener message consumer callback (#3...
  • 4d2476a DOC Refactor array API docs page (#34054)
  • f9f812f 🔒 🤖 CI Update lock files for scipy-dev CI build(s) 🔒 🤖 ...
  • d779dc3 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
  • 6a03cf0 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
  • Additional commits viewable in compare view

Updates anthropic from 0.104.1 to 0.105.2

Release notes

Sourced from anthropic's releases.

v0.105.2

0.105.2 (2026-05-29)

Full Changelog: v0.105.1...v0.105.2

v0.105.1

0.105.1 (2026-05-29)

Full Changelog: v0.105.0...v0.105.1

Chores

  • internal: use Trusted Publishing for PyPI releases (1d04fc5)

v0.105.0

0.105.0 (2026-05-28)

Full Changelog: v0.104.1...v0.105.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (f18b014)
  • support custom file size caps (#1825) (7e5f944)

Chores

  • examples: rename managed-agents private-sandbox-worker to self-hosted-sandbox-worker (#1822) (750f956)

Documentation

  • replace literal newlines (8f7f6c0)
Changelog

Sourced from anthropic's changelog.

0.105.2 (2026-05-29)

Full Changelog: v0.105.1...v0.105.2

0.105.1 (2026-05-29)

Full Changelog: v0.105.0...v0.105.1

Chores

  • internal: use Trusted Publishing for PyPI releases (1d04fc5)

0.105.0 (2026-05-28)

Full Changelog: v0.104.1...v0.105.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (f18b014)
  • support custom file size caps (#1825) (7e5f944)

Chores

  • examples: rename managed-agents private-sandbox-worker to self-hosted-sandbox-worker (#1822) (750f956)

Documentation

  • replace literal newlines (8f7f6c0)
Commits
  • ddd43b7 release: 0.105.2
  • 6213e77 ci: grant id-token permission for PyPI trusted publishing (#1837)
  • d88cede release: 0.105.1
  • 2ace39f codegen metadata
  • 24fe7d6 chore(internal): use Trusted Publishing for PyPI releases
  • c1d9307 codegen metadata
  • 9eaf324 codegen metadata
  • 43b5b1f Update CHANGELOG.md
  • daca1ac release: 0.105.0
  • 2b82676 feat(api): Add support for claude-opus-4-8, mid-conversation system blocks, a...
  • Additional commits viewable in compare view

Updates pandas-stubs from 3.0.0.260204 to 3.0.3.260530

Commits
  • 1a40eec Version 3.0.3.260530
  • 0f063ec Make mypy reject float(Series) calls (#1753)
  • a073669 GH1415 Enhance typing of Series[Categorical] (#1748)
  • 9df3c52 TYP: GH1727 Narrow Series.to_numpy return types based on the dtype argument (...
  • 2da5f78 GH1742 fix nightly CI (#1747)
  • 84e7d1a BUG: allow kwargs in Styler apply_index and map_index (#1725)
  • 82c9851 GH1654 Pandas 3.0 support (#1741)
  • 4f6f533 MNT: Fix missing check/assert_type harness where missing (#1749)
  • 3bbd508 chore(ci): declare contents: read on test (#1751)
  • ee82af5 Modernize project settings in pyproject.toml (#1746)
  • Additional commits viewable in compare view

Updates ruff from 0.15.14 to 0.15.15

Release notes

Sourced from ruff's releases.

0.15.15

Release Notes

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.15

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

Commits
  • db5aa0a Bump 0.15.15 (#25431)
  • 366fe21 [ty] Improve diagnostics for syntax errors in forward annotations (#25158)
  • e2e1e64 [ty] Remove excess capacity from more Salsa cached collections (#25411)
  • 1bd77e1 [ty] Use diagnostic message as tie breaker when sorting (#25424)
  • 7e1bc1e Add agent skills for working on ty (#25422)
  • 574e107 Expand semantic syntax errors for invalid walruses (#25415)
  • 4a7ca06 [ty] Display docs for matching parameter when hovering over the name of an ar...
  • 5432709 Refine a few agents instructions (#25423)
  • 3cb09eb [ty] Support typing.TypeForm (#25334)
  • c8cd59f [ty] Infer class attributes assigned by metaclass initialization (#25342)
  • Additional commits viewable in compare view

Updates plotnine from 0.15.4 to 0.15.5

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(python): Bump the python-minor group with 7 updates
995b552 
Bumps the python-minor group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.27.1` | `1.27.2` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.3.1` | `3.4.0` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.8.0` | `1.9.0` |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.104.1` | `0.105.2` |
| [pandas-stubs](https://github.com/pandas-dev/pandas-stubs) | `3.0.0.260204` | `3.0.3.260530` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.14` | `0.15.15` |
| [plotnine](https://github.com/has2k1/plotnine) | `0.15.4` | `0.15.5` |


Updates `mcp` from 1.27.1 to 1.27.2
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.27.1...v1.27.2)

Updates `fastmcp` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.3.1...v3.4.0)

Updates `scikit-learn` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.8.0...1.9.0)

Updates `anthropic` from 0.104.1 to 0.105.2
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v0.104.1...v0.105.2)

Updates `pandas-stubs` from 3.0.0.260204 to 3.0.3.260530
- [Changelog](https://github.com/pandas-dev/pandas-stubs/blob/main/docs/release_procedure.md)
- [Commits](pandas-dev/pandas-stubs@v3.0.0.260204...v3.0.3.260530)

Updates `ruff` from 0.15.14 to 0.15.15
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.14...0.15.15)

Updates `plotnine` from 0.15.4 to 0.15.5
- [Release notes](https://github.com/has2k1/plotnine/releases)
- [Changelog](https://github.com/has2k1/plotnine/blob/main/doc/changelog.qmd)
- [Commits](has2k1/plotnine@v0.15.4...v0.15.5)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 1.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: fastmcp
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: scikit-learn
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: anthropic
  dependency-version: 0.105.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: pandas-stubs
  dependency-version: 3.0.3.260530
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: ruff
  dependency-version: 0.15.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: plotnine
  dependency-version: 0.15.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python labels Jun 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants