Skip to content

Bump the patch group with 5 updates#6335

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/patch-7ed8473de0
Open

Bump the patch group with 5 updates#6335
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/patch-7ed8473de0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch group with 5 updates:

Package From To
boto3 1.43.47 1.43.50
claude-agent-sdk 0.2.116 0.2.121
libmozdata 0.2.12 0.2.14
weave 0.53.1 0.53.2
prefpicker 2.23.0 2.23.1

Updates boto3 from 1.43.47 to 1.43.50

Commits
  • a8ae7f0 Merge branch 'release-1.43.50'
  • b8c36a9 Bumping version to 1.43.50
  • fa19980 Add changelog entries from botocore
  • 2ce2fd5 Merge branch 'release-1.43.49'
  • d2937da Merge branch 'release-1.43.49' into develop
  • 159cb6a Bumping version to 1.43.49
  • 2b8f4d8 Add changelog entries from botocore
  • aa40f37 Merge branch 'release-1.43.48'
  • 652b573 Merge branch 'release-1.43.48' into develop
  • 13cce5d Bumping version to 1.43.48
  • Additional commits viewable in compare view

Updates claude-agent-sdk from 0.2.116 to 0.2.121

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121

v0.2.120

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.211

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.120/

pip install claude-agent-sdk==0.2.120

v0.2.119

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.210

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.119/

pip install claude-agent-sdk==0.2.119
</tr></table> 

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.211

0.2.119

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.210

0.2.118

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.209

0.2.117

Bug Fixes

  • Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.208
Commits
  • f604b8c docs: update changelog for v0.2.121
  • 0a87d2c chore: release v0.2.121
  • 1cd470d chore: bump bundled CLI version to 2.1.212
  • 0278287 Validate CLAUDE_CLI_VERSION and remove shell interpolation from the build scr...
  • 347a1cb Pass --resume and --session-id as a single argv token (#1123)
  • af69c01 docs: update changelog for v0.2.120
  • 07f1ab3 chore: release v0.2.120
  • 135bf9a chore: bump bundled CLI version to 2.1.211
  • 57f67cd docs: update changelog for v0.2.119
  • d434722 chore: release v0.2.119
  • Additional commits viewable in compare view

Updates libmozdata from 0.2.12 to 0.2.14

Release notes

Sourced from libmozdata's releases.

v0.2.14

  • set User-Agent for connections (#265)
  • Bump pre-commit hook versions (#286)
  • Bind response body to a local before indexing JSON keys (#285)
  • Fix CI by running on Python 3.13 (#288)
  • Retry all Phabricator API calls upon 50x HTTP error codes (#293)
  • Remove release_owners module (#294)
  • Update icalendar requirement from >=3.10 to >=7.2.0 (#291)
  • Update six requirement from >=1.10.0 to >=1.17.0 (#272)

Released with mozilla/task-boot

Commits

Updates weave from 0.53.1 to 0.53.2

Release notes

Sourced from weave's releases.

v0.53.2

What's Changed

... (truncated)

Commits
  • 59a9d18 Release version: 0.53.2-dev0 → 0.53.2
  • a91b60c feat(weave): export api contract (#7571)
  • b2685a7 feat(weave_ts): default JS client to calls_complete ingest path (#7386)
  • d160a7f add docstring to StringPrompt Python Class (#7583)
  • b49d5b6 chore(weave_ts): bump TS SDK version to 0.16.3 (#7582)
  • 9175d5b fix(weave_ts): propagate conversation attributes across runIsolated frames (#...
  • 90abcef fix(weave): normalize Claude Code chat projection (#7579)
  • 6c241d3 fix(weave): allow span_name in agent-spans group_by/filter (#7581)
  • 813b21b fix(weave): trace direct openai calls under otel_v2 (#7570)
  • c3064a9 fix(weave): guard ref converter recursion against deeply-nested payloads (#7578)
  • Additional commits viewable in compare view

Updates prefpicker from 2.23.0 to 2.23.1

Release notes

Sourced from prefpicker's releases.

2.23.1

v2.23.1 (2026-07-15)

Bug Fixes

  • prefs: Remove prefs that do not exist (ef8bba6)

  • prefs: Set more automation friendly prefs (00cfdc1)

Continuous Integration

  • Fix gh token permissions for release (acc13d3)

  • Remove redundant build step that produced bad PyPI version (b7d4271)

  • Skip PyPI upload when dist is empty (fb06bd3)

  • Use PyPI trusted publisher (OIDC) for publishing (d67c7f1)


Detailed Changes: 2.23.0...2.23.1

Commits
  • acc13d3 ci: fix gh token permissions for release
  • 00cfdc1 fix(prefs): set more automation friendly prefs
  • ef8bba6 fix(prefs): remove prefs that do not exist
  • fb06bd3 ci: skip PyPI upload when dist is empty
  • b7d4271 ci: remove redundant build step that produced bad PyPI version
  • d67c7f1 ci: use PyPI trusted publisher (OIDC) for publishing
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.47` | `1.43.50` |
| [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.116` | `0.2.121` |
| [libmozdata](https://github.com/mozilla/libmozdata) | `0.2.12` | `0.2.14` |
| [weave](https://github.com/wandb/weave) | `0.53.1` | `0.53.2` |
| [prefpicker](https://github.com/MozillaSecurity/prefpicker) | `2.23.0` | `2.23.1` |


Updates `boto3` from 1.43.47 to 1.43.50
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.47...1.43.50)

Updates `claude-agent-sdk` from 0.2.116 to 0.2.121
- [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-python@v0.2.116...v0.2.121)

Updates `libmozdata` from 0.2.12 to 0.2.14
- [Release notes](https://github.com/mozilla/libmozdata/releases)
- [Commits](mozilla/libmozdata@v0.2.12...v0.2.14)

Updates `weave` from 0.53.1 to 0.53.2
- [Release notes](https://github.com/wandb/weave/releases)
- [Changelog](https://github.com/wandb/weave/blob/master/dev_docs/RELEASE.md)
- [Commits](wandb/weave@v0.53.1...v0.53.2)

Updates `prefpicker` from 2.23.0 to 2.23.1
- [Release notes](https://github.com/MozillaSecurity/prefpicker/releases)
- [Commits](MozillaSecurity/prefpicker@2.23.0...2.23.1)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: claude-agent-sdk
  dependency-version: 0.2.121
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: libmozdata
  dependency-version: 0.2.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: weave
  dependency-version: 0.53.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: prefpicker
  dependency-version: 2.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 20, 2026 03:48
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants