chore(deps)(deps): bump the evaluator-deps group in /scripts/aidlc-evaluator with 5 updates by dependabot[bot] · Pull Request #727 · awslabs/aidlc-workflows

dependabot · 2026-08-08T12:27:08Z

Bumps the evaluator-deps group in /scripts/aidlc-evaluator with 5 updates:

Package	From	To
boto3	`1.43.31`	`1.43.64`
pytest	`9.1.0`	`9.1.1`
ruff	`0.15.17`	`0.16.1`
semgrep	`1.166.0`	`1.172.0`
strands-agents	`1.44.0`	`1.50.2`

Updates boto3 from 1.43.31 to 1.43.64

Commits

06a2e1b Merge branch 'release-1.43.64'
f2f83e3 Bumping version to 1.43.64
ba1d84c Add changelog entries from botocore
db26b21 Merge branch 'release-1.43.63'
3330ff0 Merge branch 'release-1.43.63' into develop
048abe3 Bumping version to 1.43.63
68e9338 Add changelog entries from botocore
f3e9c52 Merge branch 'release-1.43.62'
6c6ed32 Merge branch 'release-1.43.62' into develop
47765b7 Bumping version to 1.43.62
Additional commits viewable in compare view

Updates pytest from 9.1.0 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
501c4bc Merge pull request #14596 from bluetech/doc-classmethod
b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
9a567e0 [automated] Update plugin list (#14617) (#14618)
ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
Additional commits viewable in compare view

Updates ruff from 0.15.17 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

Add an option to opt out of human-readable names (#27160)

[flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)

[pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)

[ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)

[flake8-bugbear] Mark range as immutable (B008) (#27247)

[flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)

[flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)

[pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)

[refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

[flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)

[refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

Fix indexing of excluded nested Ruff workspaces (#27303)

Lint TOML files in the LSP (#26862)

Documentation

Cover pycon Markdown formatting (#27153)

[flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)

[flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)

[pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

Reduce syntax error noise by swallowing dedents like indents (#27170)

Vendor latest annotate-snippets (#27033)

Contributors

@bxff

@anishgirianish

@Avasam

@epage

@LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

Add an option to opt out of human-readable names (#27160)

[flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)

[pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)

[ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)

[flake8-bugbear] Mark range as immutable (B008) (#27247)

[flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)

[flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)

[pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)

[refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

[flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)

[refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

Fix indexing of excluded nested Ruff workspaces (#27303)

Lint TOML files in the LSP (#26862)

Documentation

Cover pycon Markdown formatting (#27153)

[flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)

[flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)

[pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

Reduce syntax error noise by swallowing dedents like indents (#27170)

Vendor latest annotate-snippets (#27033)

Contributors

@bxff

@anishgirianish

@Avasam

@epage

@LHMQ878

@MichaReiser

... (truncated)

Commits

80790b3 Bump 0.16.1 (#27330)
63830f3 [ty] Borrow from constraint set storage less often (#27328)
f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
0d80497 Lint TOML files in the LSP (#26862)
d91586b Update prek dependencies (#27293)
7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
b20daf7 [ty] refactor: add helper function to send partial results (#27249)
4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
7c3e2db [ty] Fix enum class container assignability (#27318)
d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
Additional commits viewable in compare view

Updates semgrep from 1.166.0 to 1.172.0

Release notes

Sourced from semgrep's releases.

Release v1.172.0

1.172.0 - 2026-07-28

### Added

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)

The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)

Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)

Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)

Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)

Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)

Release v1.171.0

1.171.0 - 2026-07-22

### Added

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)

Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.172.0 - 2026-07-28

### Added

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)

The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)

Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)

Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)

Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)

Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)

1.170.0 - 2026-07-15

### Added

Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)

Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)

semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

Increased the timeout for dynamic dependency resolution subprocesses from

... (truncated)

Commits

651f37e chore: release 1.172.0
9273440 chore(ruby): bump semgrep-ruby to C API scanner (tree-sitter 0.26.3) (semgrep...
d154edb atd: invert exclude_binary_files → optional include_binary_files (semgrep/sem...
5f976e2 chore(testo): remove testo pin and bump to 0.5.0 (semgrep/semgrep-proprietar...
2515f3asemgrep/semgrep-proprietary#6803
e086f55semgrep/semgrep-proprietary#6705
51cf5a9 fix(CLI): Only print non-zero product fragments (semgrep/semgrep-proprietary#...
914b610semgrep/semgrep-proprietary#6775
d6fad57 fix(metrics): improve install-semgrep-pro error reporting (semgrep/semgrep-pr...
7182c0asemgrep/semgrep-proprietary#6791
Additional commits viewable in compare view

Updates strands-agents from 1.44.0 to 1.50.2

Release notes

Sourced from strands-agents's releases.

python/v1.50.2

Auto-drafted from commits in python/v1.50.1..python/v1.50.2, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

feat: add context manager class design doc (#3307) (cb3bffba)

feat(ts): add agent-as-tool delegation (#3265) (a2761fd2)

feat(python): add per-call MCP tool cancellation (#3402) (67693b72)

🐛 Fixes

fix(context): legacy file storage accepts bare filenames and stems (#3495) (2828e442)

fix(streaming): consume reasoning signature per content block (#3472) (be30def9)

fix(mcp): deduplicate inverted-index postings (#3417) (0e517d62)

fix(bidi): gemini live mp to use updated api (#3424) (1531f732)

♻️ Refactoring

refactor(http_request): remove security features, accept httpx.AsyncClient (#3491) (fa63da5d)

📚 Documentation

docs(mcp): correct search tool contracts (#3456) (50b583f1)

docs(changelog): sync strands-agents/harness-sdk typescript/v1.11.1 (#3481) (8543db53)

docs(changelog): sync strands-agents/harness-sdk python/v1.50.1 (#3480) (0b727d05)

docs(changelog): sync strands-agents/evals backfill (#3442) (5bede649)

🔧 Chores

chore: update context offloader comments to deprecate legacy storage (#3476) (58a501c7)

chore(bidi): bump google-genai floor to >=1.67.0 (#3478) (ec1c0db8)

python/v1.50.1

Auto-drafted from commits in python/v1.50.0..python/v1.50.1, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

feat(site): add Storage category to community catalog (#3414) (7db6bc0c)

feat: add storage docs page (#3408) (972f3727)

feat(model-routing): thread per-call model through InvokeModelStage (#3434) (248896f3)

🐛 Fixes

fix(session): persist message strategy after invocation (#3440) (bfa080a2)

fix(site): emit static redirect stubs for legacy MkDocs URLs (#3343) (e52d8325)

♻️ Refactoring

... (truncated)

Commits

fa63da5 refactor(http_request): remove security features, accept httpx.AsyncClient (#...
2828e44 fix(context): legacy file storage accepts bare filenames and stems (#3495)
58a501c chore: update context offloader comments to deprecate legacy storage (#3476)
cb3bffb feat: add context manager class design doc (#3307)
50b583f docs(mcp): correct search tool contracts (#3456)
be30def fix(streaming): consume reasoning signature per content block (#3472)
0e517d6 fix(mcp): deduplicate inverted-index postings (#3417)
1531f73 fix(bidi): gemini live mp to use updated api (#3424)
ec1c0db chore(bidi): bump google-genai floor to >=1.67.0 (#3478)
8543db5 docs(changelog): sync strands-agents/harness-sdk typescript/v1.11.1 (#3481)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the evaluator-deps group in /scripts/aidlc-evaluator with 5 updates: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.31` | `1.43.64` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.0` | `9.1.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.17` | `0.16.1` | | [semgrep](https://github.com/semgrep/semgrep) | `1.166.0` | `1.172.0` | | [strands-agents](https://github.com/strands-agents/harness-sdk) | `1.44.0` | `1.50.2` | Updates `boto3` from 1.43.31 to 1.43.64 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.31...1.43.64) Updates `pytest` from 9.1.0 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.0...9.1.1) Updates `ruff` from 0.15.17 to 0.16.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.17...0.16.1) Updates `semgrep` from 1.166.0 to 1.172.0 - [Release notes](https://github.com/semgrep/semgrep/releases) - [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md) - [Commits](semgrep/semgrep@v1.166.0...v1.172.0) Updates `strands-agents` from 1.44.0 to 1.50.2 - [Release notes](https://github.com/strands-agents/harness-sdk/releases) - [Commits](strands-agents/harness-sdk@python/v1.44.0...python/v1.50.2) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.64 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: evaluator-deps - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: evaluator-deps - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: evaluator-deps - dependency-name: semgrep dependency-version: 1.172.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: evaluator-deps - dependency-name: strands-agents dependency-version: 1.50.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: evaluator-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-10T19:01:05Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 8, 2026

dependabot Bot requested review from a team, Kalindi-Dev, apackeer, harmjeff, leandrodamascena, raj-jain-aws, scottschreckengaust and spraja08 August 8, 2026 12:27

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 8, 2026

dependabot Bot requested a review from a team as a code owner August 8, 2026 12:27

leandrodamascena closed this Aug 10, 2026

dependabot Bot deleted the dependabot/uv/scripts/aidlc-evaluator/evaluator-deps-0417d73424 branch August 10, 2026 19:01

Navigation Menu

Uh oh!

chore(deps)(deps): bump the evaluator-deps group in /scripts/aidlc-evaluator with 5 updates - #727

chore(deps)(deps): bump the evaluator-deps group in /scripts/aidlc-evaluator with 5 updates#727
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/scripts/aidlc-evaluator/evaluator-deps-0417d73424

dependabot Bot commented on behalf of github Aug 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 8, 2026

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

0.16.1

Release Notes

Preview features

Bug fixes

Rule changes

Server

Documentation

Other changes

Contributors

0.16.1

Preview features

Bug fixes

Rule changes

Server

Documentation

Other changes

Contributors

Release v1.172.0

1.172.0 - 2026-07-28

### Added

### Changed

### Fixed

Release v1.171.0

1.171.0 - 2026-07-22

### Added

### Changed

### Fixed

1.172.0 - 2026-07-28

### Added

### Changed

### Fixed

1.170.0 - 2026-07-15

### Added

### Changed

python/v1.50.2

🚀 Features

🐛 Fixes

♻️ Refactoring

📚 Documentation

🔧 Chores

python/v1.50.1

🚀 Features

🐛 Fixes

♻️ Refactoring

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant