chore(deps): bump the uv-security group across 3 directories with 5 updates by dependabot[bot] · Pull Request #238 · kagenti/adk

dependabot · 2026-05-11T06:39:47Z

Bumps the uv-security group with 3 updates in the /apps/adk-cli directory: authlib, pytest and python-multipart.
Bumps the uv-security group with 4 updates in the /apps/adk-py directory: authlib, pytest, python-multipart and lxml.
Bumps the uv-security group with 4 updates in the /apps/adk-server directory: authlib, pytest, python-multipart and pillow.

Updates authlib from 1.6.9 to 1.6.11

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Changelog

Sourced from authlib's changelog.

Version 1.6.11

Released on Apr 16, 2026

Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Commits

0dc0e5b chore: bump to 1.6.11
aa7b8e4 Merge commit from fork
401a770 fix: CSRF issue with starlette client
ef09aeb chore: release 1.6.10
3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
See full diff in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)
f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
c34bfa3 Add explanation for string context diffs (#14257) (#14266)
Additional commits viewable in compare view

Updates python-multipart from 0.0.22 to 0.0.27

Release notes

Sourced from python-multipart's releases.

Version 0.0.27

What's Changed

Pass parse offsets via constructors by @Kludex in Kludex/python-multipart#268

Add multipart header limits by @Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Version 0.0.26

What's Changed

Skip preamble before first multipart boundary by @Kludex in Kludex/python-multipart#262

Silently discard epilogue data after the closing boundary by @Kludex in Kludex/python-multipart#259

Full Changelog: Kludex/python-multipart@0.0.25...0.0.26

Version 0.0.25

What's Changed

Apply Apache-2.0 properly by @Kludex in Kludex/python-multipart#247

Handle multipart headers case-insensitively by @Kludex in Kludex/python-multipart#252

Emit field_end for trailing bare field names on finalize by @bysiber in Kludex/python-multipart#230

Add UPLOAD_DELETE_TMP to FormParser config by @Kludex in Kludex/python-multipart#254

Remove custom FormParser classes by @Kludex in Kludex/python-multipart#257

Handle CTE values case-insensitively by @Kludex in Kludex/python-multipart#258

Add MIME content type info to File by @jhnstrk in Kludex/python-multipart#143

Full Changelog: Kludex/python-multipart@0.0.24...0.0.25

Version 0.0.24

What's Changed

Validate chunk_size in parse_form() by @Kludex in Kludex/python-multipart#244

Full Changelog: Kludex/python-multipart@0.0.23...0.0.24

Version 0.0.23

What's Changed

Remove unused trust_x_headers parameter and X-File-Name fallback by @jhnstrk in Kludex/python-multipart#196

Return processed length from QuerystringParser._internal_write by @bysiber in Kludex/python-multipart#229

Cleanup metadata dunders from __init__.py by @Chesars in Kludex/python-multipart#227

New Contributors

@Chesars made their first contribution in Kludex/python-multipart#227

@bysiber made their first contribution in Kludex/python-multipart#229

Full Changelog: Kludex/python-multipart@0.0.22...0.0.23

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

Add multipart header limits #267.

Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

Remove unused trust_x_headers parameter and X-File-Name fallback #196.

Return processed length from QuerystringParser._internal_write #229.

Cleanup metadata dunders from __init__.py #227.

Commits

6d1d689 Version 0.0.27 (#272)
0b10220 Run CI on main branch pull requests (#271)
3e64f5f Add multipart header limits (#267)
eb109cc Pass parse offsets via constructors (#268)
78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
28f4785 Version 0.0.26 (#263)
d4452a7 Silently discard epilogue data after the closing boundary (#259)
6a7b76d Skip preamble before first multipart boundary (#262)
4addb60 Version 0.0.25 (#261)
Additional commits viewable in compare view

Updates authlib from 1.6.9 to 1.6.11

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Changelog

Sourced from authlib's changelog.

Version 1.6.11

Released on Apr 16, 2026

Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Commits

0dc0e5b chore: bump to 1.6.11
aa7b8e4 Merge commit from fork
401a770 fix: CSRF issue with starlette client
ef09aeb chore: release 1.6.10
3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
See full diff in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)
f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
c34bfa3 Add explanation for string context diffs (#14257) (#14266)
Additional commits viewable in compare view

Updates python-multipart from 0.0.22 to 0.0.27

Release notes

Sourced from python-multipart's releases.

Version 0.0.27

What's Changed

Pass parse offsets via constructors by @Kludex in Kludex/python-multipart#268

Add multipart header limits by @Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Version 0.0.26

What's Changed

Skip preamble before first multipart boundary by @Kludex in Kludex/python-multipart#262

Silently discard epilogue data after the closing boundary by @Kludex in Kludex/python-multipart#259

Full Changelog: Kludex/python-multipart@0.0.25...0.0.26

Version 0.0.25

What's Changed

Apply Apache-2.0 properly by @Kludex in Kludex/python-multipart#247

Handle multipart headers case-insensitively by @Kludex in Kludex/python-multipart#252

Emit field_end for trailing bare field names on finalize by @bysiber in Kludex/python-multipart#230

Add UPLOAD_DELETE_TMP to FormParser config by @Kludex in Kludex/python-multipart#254

Remove custom FormParser classes by @Kludex in Kludex/python-multipart#257

Handle CTE values case-insensitively by @Kludex in Kludex/python-multipart#258

Add MIME content type info to File by @jhnstrk in Kludex/python-multipart#143

Full Changelog: Kludex/python-multipart@0.0.24...0.0.25

Version 0.0.24

What's Changed

Validate chunk_size in parse_form() by @Kludex in Kludex/python-multipart#244

Full Changelog: Kludex/python-multipart@0.0.23...0.0.24

Version 0.0.23

What's Changed

Remove unused trust_x_headers parameter and X-File-Name fallback by @jhnstrk in Kludex/python-multipart#196

Return processed length from QuerystringParser._internal_write by @bysiber in Kludex/python-multipart#229

Cleanup metadata dunders from __init__.py by @Chesars in Kludex/python-multipart#227

New Contributors

@Chesars made their first contribution in Kludex/python-multipart#227

@bysiber made their first contribution in Kludex/python-multipart#229

Full Changelog: Kludex/python-multipart@0.0.22...0.0.23

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

Add multipart header limits #267.

Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

Remove unused trust_x_headers parameter and X-File-Name fallback #196.

Return processed length from QuerystringParser._internal_write #229.

Cleanup metadata dunders from __init__.py #227.

Commits

6d1d689 Version 0.0.27 (#272)
0b10220 Run CI on main branch pull requests (#271)
3e64f5f Add multipart header limits (#267)
eb109cc Pass parse offsets via constructors (#268)
78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
28f4785 Version 0.0.26 (#263)
d4452a7 Silently discard epilogue data after the closing boundary (#259)
6a7b76d Skip preamble before first multipart boundary (#262)
4addb60 Version 0.0.25 (#261)
Additional commits viewable in compare view

Updates python-multipart from 0.0.22 to 0.0.27

Release notes

Sourced from python-multipart's releases.

Version 0.0.27

What's Changed

Pass parse offsets via constructors by @Kludex in Kludex/python-multipart#268

Add multipart header limits by @Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Version 0.0.26

What's Changed

Skip preamble before first multipart boundary by @Kludex in Kludex/python-multipart#262

Silently discard epilogue data after the closing boundary by @Kludex in Kludex/python-multipart#259

Full Changelog: Kludex/python-multipart@0.0.25...0.0.26

Version 0.0.25

What's Changed

Apply Apache-2.0 properly by @Kludex in Kludex/python-multipart#247

Handle multipart headers case-insensitively by @Kludex in Kludex/python-multipart#252

Emit field_end for trailing bare field names on finalize by @bysiber in Kludex/python-multipart#230

Add UPLOAD_DELETE_TMP to FormParser config by @Kludex in Kludex/python-multipart#254

Remove custom FormParser classes by @Kludex in Kludex/python-multipart#257

Handle CTE values case-insensitively by @Kludex in Kludex/python-multipart#258

Add MIME content type info to File by @jhnstrk in Kludex/python-multipart#143

Full Changelog: Kludex/python-multipart@0.0.24...0.0.25

Version 0.0.24

What's Changed

Validate chunk_size in parse_form() by @Kludex in Kludex/python-multipart#244

Full Changelog: Kludex/python-multipart@0.0.23...0.0.24

Version 0.0.23

What's Changed

Remove unused trust_x_headers parameter and X-File-Name fallback by @jhnstrk in Kludex/python-multipart#196

Return processed length from QuerystringParser._internal_write by @bysiber in Kludex/python-multipart#229

Cleanup metadata dunders from __init__.py by @Chesars in Kludex/python-multipart#227

New Contributors

@Chesars made their first contribution in Kludex/python-multipart#227

@bysiber made their first contribution in Kludex/python-multipart#229

Full Changelog: Kludex/python-multipart@0.0.22...0.0.23

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

Add multipart header limits #267.

Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

Remove unused trust_x_headers parameter and X-File-Name fallback #196.

Return processed length from QuerystringParser._internal_write #229.

Cleanup metadata dunders from __init__.py #227.

Commits

6d1d689 Version 0.0.27 (#272)
0b10220 Run CI on main branch pull requests (#271)
3e64f5f Add multipart header limits (#267)
eb109cc Pass parse offsets via constructors (#268)
78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
28f4785 Version 0.0.26 (#263)
d4452a7 Silently discard epilogue data after the closing boundary (#259)
6a7b76d Skip preamble before first multipart boundary (#262)
4addb60 Version 0.0.25 (#261)
Additional commits viewable in compare view

Updates authlib from 1.6.9 to 1.6.11

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Changelog

Sourced from authlib's changelog.

Version 1.6.11

Released on Apr 16, 2026

Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Commits

0dc0e5b chore: bump to 1.6.11
aa7b8e4 Merge commit from fork
401a770 fix: CSRF issue with starlette client
ef09aeb chore: release 1.6.10
3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
See full diff in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)
f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
c34bfa3 Add explanation for string context diffs (#14257) (#14266)
Additional commits viewable in compare view

Updates authlib from 1.6.9 to 1.6.11

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Changelog

Sourced from authlib's changelog.

Version 1.6.11

Released on Apr 16, 2026

Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Commits

0dc0e5b chore: bump to 1.6.11
aa7b8e4 Merge commit from fork
401a770 fix: CSRF issue with starlette client
ef09aeb chore: release 1.6.10
3be0846 fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError
See full diff in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)

…pdates Bumps the uv-security group with 3 updates in the /apps/adk-cli directory: [authlib](https://github.com/authlib/authlib), [pytest](https://github.com/pytest-dev/pytest) and [python-multipart](https://github.com/Kludex/python-multipart). Bumps the uv-security group with 4 updates in the /apps/adk-py directory: [authlib](https://github.com/authlib/authlib), [pytest](https://github.com/pytest-dev/pytest), [python-multipart](https://github.com/Kludex/python-multipart) and [lxml](https://github.com/lxml/lxml). Bumps the uv-security group with 4 updates in the /apps/adk-server directory: [authlib](https://github.com/authlib/authlib), [pytest](https://github.com/pytest-dev/pytest), [python-multipart](https://github.com/Kludex/python-multipart) and [pillow](https://github.com/python-pillow/Pillow). Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `lxml` from 6.0.2 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `python-multipart` from 0.0.22 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.27) Updates `authlib` from 1.6.9 to 1.6.11 - [Release notes](https://github.com/authlib/authlib/releases) - [Changelog](https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst) - [Commits](authlib/authlib@v1.6.9...v1.6.11) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `pillow` from 12.1.1 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.2.0) --- updated-dependencies: - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: lxml dependency-version: 6.1.0 dependency-type: indirect dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: direct:production dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: direct:production dependency-group: uv-security - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: direct:production dependency-group: uv-security - dependency-name: authlib dependency-version: 1.6.11 dependency-type: direct:production dependency-group: uv-security - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:development dependency-group: uv-security - dependency-name: pillow dependency-version: 12.2.0 dependency-type: indirect dependency-group: uv-security ... Signed-off-by: dependabot[bot] <support@github.com>

clawgenti · 2026-06-01T19:36:21Z

Security Bump Escalation

Package: uv-security group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 12 days
CI Status: failing

Advisory Context

Vulnerability references: CVE-2025-71176

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

P...
Action Required

This PR has exceeded the 7-day SLA for high-severity patches. Please review and merge, or document a deferral reason.

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-06-01-001)

clawgenti · 2026-06-02T16:01:14Z

Security Bump Escalation

Package: uv-security group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 12 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2025-71176

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

P...
Action Required

This PR has exceeded the 7-day SLA for high-severity patches. Please review and merge, or document a deferral reason.

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-06-02-002)

clawgenti · 2026-06-04T16:02:31Z

Security Bump Escalation

Package: uv-security group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 12 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2025-71176

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

P...
Action Required

This PR has exceeded the 7-day SLA for high-severity patches. Please review and merge, or document a deferral reason.

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-06-04-002)

clawgenti · 2026-06-09T16:01:23Z

Security Bump Escalation

Package: uv-security group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 12 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2025-71176

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

P...
Action Required

This PR has exceeded the 7-day SLA for high-severity patches. Please review and merge, or document a deferral reason.

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-06-09-002)

clawgenti · 2026-06-11T16:01:06Z

Security Bump Escalation

Package: uv-security group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 12 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2025-71176

Release notes

Sourced from authlib's releases.

v1.6.11

Full Changelog: authlib/authlib@v1.6.10...v1.6.11

Fix CSRF issue with starlette client

v1.6.10

Full Changelog: authlib/authlib@v1.6.9...v1.6.10

Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

P...
Action Required

This PR has exceeded the 7-day SLA for high-severity patches. Please review and merge, or document a deferral reason.

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-06-11-002)

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 11, 2026

dependabot Bot mentioned this pull request May 11, 2026

chore(deps): bump the uv-security group across 3 directories with 5 updates #227

Closed

rubambiza added this to Kagenti Issue Prioritization May 11, 2026

github-project-automation Bot moved this to Backlog in Kagenti Issue Prioritization May 11, 2026

xjacka mentioned this pull request May 11, 2026

Weekly Report 2026-05-11 kagenti/kagenti#1533

Closed

This was referenced May 18, 2026

Weekly Report 2026-05-18 kagenti/kagenti#1608

Closed

Weekly Report 2026-05-25 kagenti/kagenti#1662

Closed

rubambiza mentioned this pull request May 31, 2026

[dep-bump] Stale high bump: uv-security group in adk #254

Open

clawgenti mentioned this pull request Jun 1, 2026

Weekly Report 2026-06-01 kagenti/kagenti#1756

Closed

clawgenti mentioned this pull request Jun 8, 2026

Weekly Report 2026-06-08 kagenti/kagenti#1840

Open

Conversation

dependabot Bot commented on behalf of github May 11, 2026

v1.6.11

v1.6.10

Version 1.6.11

Version 1.6.10

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

Version 0.0.27

What's Changed

Version 0.0.26

What's Changed

Version 0.0.25

What's Changed

Version 0.0.24

What's Changed

Version 0.0.23

What's Changed

New Contributors

0.0.27 (2026-04-27)

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

v1.6.11

v1.6.10

Version 1.6.11

Version 1.6.10

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

Version 0.0.27

What's Changed

Version 0.0.26

What's Changed

Version 0.0.25

What's Changed

Version 0.0.24

What's Changed

Version 0.0.23

What's Changed

New Contributors

0.0.27 (2026-04-27)

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

Version 0.0.27

What's Changed

Version 0.0.26

What's Changed

Version 0.0.25

What's Changed

Version 0.0.24

What's Changed

Version 0.0.23

What's Changed

New Contributors

0.0.27 (2026-04-27)

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

v1.6.11

v1.6.10

Version 1.6.11

Version 1.6.10

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

v1.6.11

v1.6.10

Version 1.6.11