Skip to content

chore(deps): bump the python-security group across 1 directory with 4 updates - #227

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-security-21b732a67a
Open

chore(deps): bump the python-security group across 1 directory with 4 updates#227
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-security-21b732a67a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown

Bumps the python-security group with 4 updates in the / directory: json-repair, mcp, mistune and pillow.

Updates json-repair from 0.59.5 to 0.60.1

Release notes

Sourced from json-repair's releases.

Release 0.60.1

Added

  • A potential infinite loop in schema resolution could cause an application using the library to crash if the schema was self referential

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.60.0

Added

  • Support for repairing string values that contain low smart quote spans like „... when the closing quote is emitted as ASCII " instead of Unicode ”. Issue #198

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.10

Fixed

  • Fixed a parser-path repair bug where balanced brace groups inside string values, such as LaTeX fragments like \frac{x^2}{m}, could be mistaken for object structure when a later inline JSON-like snippet appeared in the same string.
  • Improved preservation of malformed-but-string-intended explanations containing inline literals such as {"blank_1": "5"} without splitting the surrounding object.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.9

Fixed

-Fix #196, a regression introduced to fix #170 caused issue with top-level object duplication.

... (truncated)

Commits

Updates mcp from 1.27.0 to 1.28.1

Release notes

Sourced from mcp's releases.

v1.28.0

Deprecations

Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is called - importing the modules stays silent.

  • WebSocket transport - mcp.client.websocket.websocket_client and mcp.server.websocket.websocket_servermodelcontextprotocol/typescript-sdk#1783
  • Experimental tasks API - ClientSession.experimental, Server.experimental, ServerSession.experimental, and the experimental_task_handlers= kwarg on ClientSession. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.

If your test suite runs with filterwarnings = ["error"] and exercises these paths, add a scoped ignore such as ignore:The experimental tasks API is deprecated:DeprecationWarning or ignore:The WebSocket .* transport is deprecated:DeprecationWarning.

See #2828 for full details.

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/python-sdk@v1.27.2...v1.28.0

v1.27.2

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

v1.27.1

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

Commits
  • 777b8d0 [v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...
  • 4720467 [v1.x] Set Development Status classifier to Production/Stable (#2976)
  • 6df3d73 [v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...
  • 32d3290 [v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...
  • 0dca751 [v1.x] Deflake the child process cleanup tests (#2839)
  • 52258a9 [v1.x] Add a v2 status banner to the README (#2835)
  • b8f4917 [v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...
  • 2309e5e fix: omit null optional fields from task result payloads (#2809)
  • 494eb11 [v1.x] Support Python 3.14 (#2769)
  • 6213787 [v1.x] Scope experimental tasks to the session that created them (#2720)
  • Additional commits viewable in compare view

Updates mistune from 3.2.1 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

  • Improve CommonMark compatibility and parser performance.
  • Add command line entrypoint with UTF-8 output.
  • Support display and backtick math.
  • Render plugin list and table nodes in Markdown renderer.
  • Escape leading block markers in Markdown renderer.
  • Fix RST renderer for block quotes nested in lists.
  • Avoid generated heading ID collisions in TOC.
  • Harden URL, image, figure, and include directive handling.
  • Fix quadratic scans in inline links, reference links, and formatting markers.
  • Fix math escaping, currency pattern matching, and cross-line matching.
Commits
  • 15c3b79 chore: release 3.3.0
  • bdc01ad tests: increase run time on pypy
  • 7cf1814 tests: increase run time for pypy
  • 6dfdc3d tests: add more tests
  • 17c50f6 chore: fix mypy issues
  • 63abe4b chore: use ruff check and format
  • e6c1b18 chore: resolve mypy issues
  • dcf8902 test(math): cover escaped math output
  • c4093c4 fix(toc): avoid generated id collisions
  • e3e51de fix(image): validate figure width option
  • Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the python-security group across 1 directory with 4…
12234c6 
… updates

Bumps the python-security group with 4 updates in the / directory: [json-repair](https://github.com/mangiucugna/json_repair), [mcp](https://github.com/modelcontextprotocol/python-sdk), [mistune](https://github.com/lepture/mistune) and [pillow](https://github.com/python-pillow/Pillow).


Updates `json-repair` from 0.59.5 to 0.60.1
- [Release notes](https://github.com/mangiucugna/json_repair/releases)
- [Commits](mangiucugna/json_repair@v0.59.5...v0.60.1)

Updates `mcp` from 1.27.0 to 1.28.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.27.0...v1.28.1)

Updates `mistune` from 3.2.1 to 3.3.0
- [Release notes](https://github.com/lepture/mistune/releases)
- [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst)
- [Commits](lepture/mistune@v3.2.1...v3.3.0)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

---
updated-dependencies:
- dependency-name: json-repair
  dependency-version: 0.60.1
  dependency-type: direct:development
  dependency-group: python-security
- dependency-name: mcp
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: python-security
- dependency-name: mistune
  dependency-version: 3.3.0
  dependency-type: direct:production
  dependency-group: python-security
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: indirect
  dependency-group: python-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants