Skip to content

build(deps): bump the uv group across 1 directory with 2 updates#954

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/uv-c3ff8e39ea
Closed

build(deps): bump the uv group across 1 directory with 2 updates#954
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/uv-c3ff8e39ea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the uv group with 1 update in the / directory: fastapi-sso.

Updates fastapi-sso from 0.16.0 to 0.19.0

Release notes

Sourced from fastapi-sso's releases.

0.19.0

️⚠️ A critical OAuth login CSRF vulnerability caused by missing state validation was reported by @​davidbors-snyk (Snyk Security Labs) in #266 and has been resolved in version 0.19.0.

Starting with fastapi-sso==1.0.0, OAuth state will be backed by a pluggable server-side store (in-memory by default, with support for external stores such as Redis).

What's Changed

New Contributors

Full Changelog: tomasvotava/fastapi-sso@0.18.0...0.19.0

0.18.0

What's Changed

Removed support for python 3.8

Full Changelog: tomasvotava/fastapi-sso@0.17.0...0.18.0

0.17.0

What's Changed

... (truncated)

Commits
  • c905eaf chore: 0.18.0 => 0.19.0
  • 94343bf docs(#266): warn against using state as an arbitrary data transport (#269)
  • d057c1d chore(deps): bump the all group across 1 directory with 7 updates (#265)
  • 6117d1a fix: enforce state validation (#267)
  • da63c19 chore(deps): bump the all group across 1 directory with 12 updates (#259)
  • 0ccaedd chore(deps): bump the all group with 2 updates (#254)
  • a43e62e chore(deps-dev): bump the all group with 2 updates (#253)
  • 8cd706d chore(deps-dev): bump the all group with 3 updates (#252)
  • ea769fa chore(deps-dev): bump the all group across 1 directory with 3 updates (#251)
  • 7aba1e6 chore(deps-dev): bump the all group with 3 updates (#248)
  • Additional commits viewable in compare view

Updates litellm from 1.83.0 to 1.89.1

Release notes

Sourced from litellm's releases.

v1.89.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.89.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.89.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.89.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.89.0...v1.89.1

v1.88.2

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 16, 2026
@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown

👋 Thanks for the PR! This one targets master, which is our
stable branch (it's what live installs track). Please retarget it to
dev — click Edit next to the PR title and change the base
branch dropdown from master to dev. Your commits and any review
carry over, nothing is lost.

See CONTRIBUTING.md for the branch model.

@kilo-code-bot

kilo-code-bot Bot commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 1
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
PR metadata N/A Existing PR comment notes this PR targets master, the stable branch. The repository workflow expects dependency PRs to target dev.
Other Observations (not in diff)

Issues found outside the code diff that cannot receive inline comments:

File Line Issue
PR metadata N/A Existing comment from github-actions asks to retarget the PR from master to dev.
Files Reviewed (1 files)
  • uv.lock - 0 inline issues; generated lock-file changes were not inline-commented per review policy.

Fix these issues in Kilo Cloud

Reviewed by nex-n2-pro:free · 1,609,053 tokens

@dependabot dependabot Bot force-pushed the dependabot/uv/uv-c3ff8e39ea branch from 216f1f1 to f57059b Compare June 16, 2026 13:47
@dependabot
build(deps): bump the uv group across 1 directory with 2 updates
e12d079 
Bumps the uv group with 1 update in the / directory: [fastapi-sso](https://github.com/tomasvotava/fastapi-sso).


Updates `fastapi-sso` from 0.16.0 to 0.19.0
- [Release notes](https://github.com/tomasvotava/fastapi-sso/releases)
- [Commits](tomasvotava/fastapi-sso@0.16.0...0.19.0)

Updates `litellm` from 1.83.0 to 1.89.1
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](https://github.com/BerriAI/litellm/commits/v1.89.1)

---
updated-dependencies:
- dependency-name: fastapi-sso
  dependency-version: 0.19.0
  dependency-type: indirect
- dependency-name: litellm
  dependency-version: 1.89.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/uv-c3ff8e39ea branch from f57059b to e12d079 Compare June 16, 2026 17:07
@jaylfc

jaylfc commented Jun 17, 2026

Copy link
Copy Markdown
Owner

Closing this one. dependabot.yml now has a uv ecosystem entry pinned to target-branch: dev (the project is fully on uv, so the old pip entry was stale and is replaced). Future uv lockfile bumps will open against dev automatically, so this master-targeted PR is superseded rather than retargeted.

@jaylfc jaylfc closed this Jun 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/uv/uv-c3ff8e39ea branch June 17, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jaylfc