[dependabot]

Updates the requirements on ruff, aiohttp, ta-lib, litellm, confluent-kafka and redis to permit the latest version.
Updates ruff to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates aiohttp to 3.14.5
Updates ta-lib from 0.8.1 to 0.8.2

Release notes

Sourced from ta-lib's releases.

v0.8.2

• [NEW]: Support free-threaded CPython without enabling the GIL on import.

• [NEW]: Include Python 3.15 wheels.

Changelog

Sourced from ta-lib's changelog.

0.8.2

• [NEW]: Support free-threaded CPython without enabling the GIL on import.

Commits

• 1543b71 .github: ignore 3.9 and 3.10 for now
• cb94803 .github: not sure why v4 doesn't resolve
• 403d443 .github/workflows: update
• 4f7bf2e Bump version to 0.8.2 and document threading support
• ce84452 Support free-threaded Python and release the GIL around native work
• See full diff in compare view

Updates litellm to 1.106.0

Release notes

Sourced from litellm's releases.

v1.106.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• test(mcp): fire MCP client test deadlines on conditions instead of wall-clock time by @​devin-ai-integration[bot] in BerriAI/litellm#44166
• fix(cost-map): add OpenAI TTS and GPT-5.x deprecation dates by @​devin-ai-integration[bot] in BerriAI/litellm#44175
• fix(tracing): unify ClickHouse storage configuration by @​yujonglee-berri in BerriAI/litellm#43941
• feat(docker): one-command quickstart that starts the gateway, Postgres, and the admin UI by @​misbahsy in BerriAI/litellm#43673
• fix(lens): simplify the example investigation preview by @​moe-berri in BerriAI/litellm#44123
• chore(helm): drop migrationJob values the chart never reads by @​Bernedotcom2312 in BerriAI/litellm#42141
• fix(ui): register tencent in the Add Model provider dropdown by @​jimaldon in BerriAI/litellm#40924
• test: remove 130 legacy tests owned by stronger unit proofs by @​devin-ai-integration[bot] in BerriAI/litellm#44157
• feat(mcp)!: disable stdio MCP servers by default by @​yuneng-berri in BerriAI/litellm#44066
• fix(proxy): exit when DATABASE_URL is set but the Prisma toolchain is missing by @​devin-ai-integration[bot] in BerriAI/litellm#44207
• fix(proxy): preserve lifespan state across all entrypoints by @​tin-berri in BerriAI/litellm#44214
• fix(oci): resolve the GenAI endpoint realm from the compartment OCID instead of hardcoding oraclecloud.com by @​fede-kamel in BerriAI/litellm#43180
• fix(chatgpt): preserve requested service tier in Responses calls by @​SteffanWolter in BerriAI/litellm#40108
• fix(ui): leave unset callback select params out of the save payload by @​devin-ai-integration[bot] in BerriAI/litellm#44213
• fix(proxy-extras): hand libpq a root cert, not Prisma's sslcert, when the migration job builds indexes by @​devin-ai-integration[bot] in BerriAI/litellm#44203

... (truncated)

Commits

• 955bdaa test(e2e): backport three stale e2e test fixes from main to rc/1.106.0 (#47229)
• d50932d fix(caching): backport #45784 and #46488 to rc/1.106.0 (#47006)
• f5eabf9 Merge pull request #46827 from BerriAI/litellm_backport_46408_rc_1_106_0
• 574ad49 fix(proxy): check previous_response_id ownership on /v1/responses/compact (#4...
• 6468f7f Merge pull request #46628 from BerriAI/litellm_backport_45474_45811_45734_465...
• f3904e2 feat(typesafe): support Jev 1.14 images, box questions, and long-context head...
• a89c618 fix(cost): price typesafe/jev-1.14.0 (#46594)
• 0ac0a42 feat(decisions)!: send images to Cloudflare Clef through its images field (#4...
• 4b94671 feat(decisions): support Clef-omni audio and video (#45811)
• 9c6b0f1 feat(decisions): accept decisions as a model mode alongside evaluation (#45474)
• Additional commits viewable in compare view

Updates confluent-kafka to 2.16.0

Release notes

Sourced from confluent-kafka's releases.

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

• confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
• Add Python 3.14t wheels (#2352)
• Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
• Producer close() now aborts any open transaction (#2347)
• Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
• SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
• Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
• New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
• New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
• New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
• Add support for saving Azure key version with DEK (#2306)
• Pass context when clients make KEK calls to DEK Registry (#2308)
• Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
• Add support for inline validation rules (#2326)
• Add Variant, Decimal, and Timestamp CEL functions (#2332)

Fixes

... (truncated)

Changelog

Sourced from confluent-kafka's changelog.

v2.16.0

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

• confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
• Add Python 3.14t wheels (#2352)
• Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
• Producer close() now aborts any open transaction (#2347)
• Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
• Add support for CPython free-threading (PEP 703) to enable true multi-core parallel execution in No-GIL environments (#2347)
• SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
• Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
• New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
• New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
• New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
• Add support for saving Azure key version with DEK (#2306)
• Pass context when clients make KEK calls to DEK Registry (#2308)
• Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
• Add support for inline validation rules (#2326)
• Add Variant, Decimal, and Timestamp CEL functions (#2332)

... (truncated)

Commits

• 4a1bcb0 Copy pyproject.toml into smoketest temp dir so asyncio_mode=auto applies (#2384)
• 16ba967 Fix Unicode errors in string serialization (#2379)
• 73a71f8 2.16.0 (#2380)
• 20614ae Integrate Schema Registry serdes into the Kafka clients: serde builders, clus...
• 7f2e72f Add s390x wheels to the build and verification matrix (#2360)
• 6a54a83 chore: normalize service.yml field names (#2193)
• c57c5b8 Fix Producer.purge() ignoring boolean flags on big-endian platforms (#2345)
• 89c99e0 On Windows, the tag isn't currently given when building librdkafka, that affe...
• cc1c970 v2.16.0rc2 (#2369)
• d245efd Fix crash on nullable array of $ref items in JSON Schema CSFLE (#2370)
• Additional commits viewable in compare view

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

• Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
• Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
• Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
• Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
• Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
• Sentinel — replica sentinel aliases (#4127).

🚀 New Features

• Add replica sentinel aliases (#4127)
• Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
• feat: add TS.READ command support to the timeseries module (#4170)
• feat: add SDIFFCARD and SUNIONCARD command support (#4171)
• feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
• feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
• feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
• feat: add COLLECT reducer support to search aggregations (#4179)
• feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
• feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
• feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

• feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

• fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
• Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits

• e013126 Testing with 8.10 GA (#4227)
• 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
• d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
• fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
• 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
• 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
• 227280a Update lib version to 8.1.0
• 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
• 599fd75 feat: add FT.ALIASLIST support (#4198)
• 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
• Additional commits viewable in compare view