Skip to content

chore(deps): bump the dependencies group with 7 updates#32

Merged
Joilence merged 1 commit intomainfrom
dependabot/uv/dependencies-2c13522aee
Feb 9, 2026
Merged

chore(deps): bump the dependencies group with 7 updates#32
Joilence merged 1 commit intomainfrom
dependabot/uv/dependencies-2c13522aee

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Feb 9, 2026

Bumps the dependencies group with 7 updates:

Package From To
anthropic 0.77.0 0.79.0
fastmcp 2.14.4 2.14.5
openai 2.16.0 2.17.0
pip 26.0 26.0.1
ty 0.0.14 0.0.15
ruff 0.14.14 0.15.0
litellm 1.81.6 1.81.9

Updates anthropic from 0.77.0 to 0.79.0

Release notes

Sourced from anthropic's releases.

v0.79.0

0.79.0 (2026-02-07)

Full Changelog: v0.78.0...v0.79.0

Features

  • api: enabling fast-mode in claude-opus-4-6 (5953ba7)

Bug Fixes

  • pass speed parameter through in sync beta count_tokens (1dd6119)

v0.78.0

0.78.0 (2026-02-05)

Full Changelog: v0.77.1...v0.78.0

Features

  • api: Release Claude Opus 4.6, adaptive thinking, and other features (3ef1529)

v0.77.1

0.77.1 (2026-02-03)

Full Changelog: v0.77.0...v0.77.1

Bug Fixes

  • structured outputs: send structured output beta header when format is omitted (#1158) (258494e)

Chores

Changelog

Sourced from anthropic's changelog.

0.79.0 (2026-02-07)

Full Changelog: v0.78.0...v0.79.0

Features

  • api: enabling fast-mode in claude-opus-4-6 (5953ba7)

Bug Fixes

  • pass speed parameter through in sync beta count_tokens (1dd6119)

0.78.0 (2026-02-05)

Full Changelog: v0.77.1...v0.78.0

Features

  • api: Release Claude Opus 4.6, adaptive thinking, and other features (3ef1529)

0.77.1 (2026-02-03)

Full Changelog: v0.77.0...v0.77.1

Bug Fixes

  • structured outputs: send structured output beta header when format is omitted (#1158) (258494e)

Chores

Commits
  • cd1b39b release: 0.79.0
  • fb52a6a fix: pass speed parameter through in sync beta count_tokens
  • b7c2df2 feat(api): enabling fast-mode in claude-opus-4-6
  • 7c42e4b Update CHANGELOG.md (#1163)
  • f2b61ed release: 0.78.0
  • a4a29ca feat(api): manual updates
  • 3955600 release: 0.77.1
  • eca8ddf fix(structured outputs): send structured output beta header when format is om...
  • ee44c52 chore: remove claude-code-review workflow (#1338)
  • See full diff in compare view

Updates fastmcp from 2.14.4 to 2.14.5

Release notes

Sourced from fastmcp's releases.

v2.14.5: Sealed Docket

Fixes a memory leak in the memory:// docket broker where cancelled tasks accumulated instead of being cleaned up. Bumps pydocket to ≥0.17.2.

What's Changed

Enhancements 🔧

Docs 📚

Full Changelog: PrefectHQ/fastmcp@v2.14.4...v2.14.5

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true

v3.0.0b1: This Beta Work

FastMCP 3.0 rebuilds the framework around three primitives: components, providers, and transforms. Providers source components dynamically—from decorators, filesystems, OpenAPI specs, remote servers, or anywhere else. Transforms modify components as they flow to clients—renaming, namespacing, filtering, securing. The features that required specialized subsystems in v2 now compose naturally from these building blocks.

🔌 Provider Architecture unifies how components are sourced. FileSystemProvider discovers decorated functions from directories with optional hot-reload. SkillsProvider exposes agent skill files as MCP resources. OpenAPIProvider and ProxyProvider get cleaner integrations. Providers are composable—share one across servers, or attach many to one server.

🔄 Transforms add middleware for components. Namespace mounted servers, rename verbose tools, filter by version, control visibility—all without touching source code. ResourcesAsTools and PromptsAsTools expose non-tool components to tool-only clients.

📋 Component Versioning lets you register @tool(version="2.0") alongside older versions. Clients see the highest version by default but can request specific versions. VersionFilter serves different API versions from one codebase.

💾 Session-Scoped State persists across requests. await ctx.set_state() and await ctx.get_state() now survive the full session. Per-session visibility via ctx.enable_components() lets servers adapt dynamically to each client.

DX Improvements include --reload for auto-restart during development, automatic threadpool dispatch for sync functions, tool timeouts, pagination for large component lists, and OpenTelemetry tracing.

🔐 Component Authorization via @tool(auth=require_scopes("admin")) and AuthMiddleware for server-wide policies.

Breaking changes are minimal: for most servers, updating the import statement is all you need. See the migration guide for details.

What's Changed

New Features 🎉

  • Refactor resource behavior and add meta support by @​jlowin in #2611
  • Refactor prompt behavior and add meta support by @​jlowin in #2610
  • feat: Provider abstraction for dynamic MCP components by @​jlowin in #2622
  • Unify component storage in LocalProvider by @​jlowin in #2680
  • Introduce ResourceResult as canonical resource return type by @​jlowin in #2734
  • Introduce Message and PromptResult as canonical prompt types by @​jlowin in #2738
  • Add --reload flag for auto-restart on file changes by @​jlowin in #2816
  • Add FileSystemProvider for filesystem-based component discovery by @​jlowin in #2823
  • Add standalone decorators and eliminate fastmcp.fs module by @​jlowin in #2832
  • Add authorization checks to components and servers by @​jlowin in #2855
  • Decorators return functions instead of component objects by @​jlowin in #2856
  • Add transform system for modifying components in provider chains by @​jlowin in #2836
  • Add OpenTelemetry tracing support by @​chrisguidry in #2869
  • Add component versioning and VersionFilter transform by @​jlowin in #2894
  • Add version discovery and calling a certain version for components by @​jlowin in #2897
  • Refactor visibility to mark-based enabled system by @​jlowin in #2912
  • Add session-specific visibility control via Context by @​jlowin in #2917
  • Add Skills Provider for exposing agent skills as MCP resources by @​jlowin in #2944

Enhancements 🔧

... (truncated)

Commits
  • 21221b4 Add release notes for v2.14.4 and v2.14.5 (#3063)
  • 7d32409 Merge pull request #2992 from jlowin/pydocket-github-validation
  • 65d6f06 Bump pydocket to >=0.17.2
  • 5f68078 Bump pydocket to >=0.17.2b3
  • 0afa029 Make read_resource test flexible for MCP version differences
  • 7ad97d9 Update test snapshot for MCP 1.26.0 serialization change
  • cd0274c Bump pydocket to >=0.17.2b2
  • f1a89eb Bump pydocket to >=0.17.2b1
  • c9ed36e Point to fix-cancellation-handling branch
  • 8cec853 Point to fix-redis-connection-guards branch
  • Additional commits viewable in compare view

Updates openai from 2.16.0 to 2.17.0

Release notes

Sourced from openai's releases.

v2.17.0

2.17.0 (2026-02-05)

Full Changelog: v2.16.0...v2.17.0

Features

  • api: add shell_call_output status field (1bbaf88)
  • api: image generation actions for responses; ResponseFunctionCallArgumentsDoneEvent.name (7d96513)
  • client: add custom JSON encoder for extended type support (9f43c8b)

Bug Fixes

  • client: undo change to web search Find action (8f14eb0)
  • client: update type for find_in_page action (ec54dde)
Changelog

Sourced from openai's changelog.

2.17.0 (2026-02-05)

Full Changelog: v2.16.0...v2.17.0

Features

  • api: add shell_call_output status field (1bbaf88)
  • api: image generation actions for responses; ResponseFunctionCallArgumentsDoneEvent.name (7d96513)
  • client: add custom JSON encoder for extended type support (9f43c8b)

Bug Fixes

  • client: undo change to web search Find action (8f14eb0)
  • client: update type for find_in_page action (ec54dde)
Commits
  • e888873 release: 2.17.0
  • b982088 fix(client): undo change to web search Find action
  • b95c09d codegen metadata
  • 31b4218 codegen metadata
  • a1fb97b fix(client): update type for find_in_page action
  • 42cb178 feat(api): image generation actions for responses; ResponseFunctionCallArgume...
  • db4d871 feat(client): add custom JSON encoder for extended type support
  • 2360dfa codegen metadata
  • 7da396e codegen metadata
  • 27feb0a feat(api): add shell_call_output status field
  • See full diff in compare view

Updates pip from 26.0 to 26.0.1

Changelog

Sourced from pip's changelog.

26.0.1 (2026-02-04)

Bug Fixes

  • Fix --pre not being respected from the command line when a requirement file includes an option e.g. -extra-index-url. ([#13788](https://github.com/pypa/pip/issues/13788) <https://github.com/pypa/pip/issues/13788>_)
Commits

Updates ty from 0.0.14 to 0.0.15

Release notes

Sourced from ty's releases.

0.0.15

Release Notes

Released on 2026-02-04.

Bug fixes

  • Add support for resolving imports of packages installed into Debian/Ubuntu dist-packages directories (#22466)
  • Avoid not-iterable false positives when iterating over an instance of an intersection type with only negated elements (#22089)
  • Fix support for stringized annotations in very large files (#22913)
  • Don't emit Liskov diagnostics for methods with mangled names (#23062)
  • Enforce that a Final symbol cannot be reassigned even after a conditional binding (#22986)
  • Fix TypedDict construction from existing TypedDict values (#22904)
  • Fix Self resolution for classes nested within methods (#22964)
  • Fix bidirectional inference with PEP 695 union type aliases (#22988)
  • Fix edge-case bugs when narrowing tagged unions in match statements (#22870)
  • Fix false-positive diagnostics when iterating over an instance of an intersection that includes a TypeVar of which the upper bound is a union where the union includes a non-iterable type (#22117)
  • Fix lookup of __contains__ to respect descriptors (#23056)
  • Fix narrowing of nonlocal variables with conditional assignments (#22966)
  • Fix several bugs that could affect NewTypes of NewTypes of float (#22997)
  • Fix several type narrowing bugs involving PEP-695 type aliases (#22894)
  • Fix spurious query cycles in decorated functions with parameter defaults, for improved performance and improved determinism (#23014)
  • Fix unary and comparison operators for TypeVars with union bounds (#22925)
  • Understand functions as method descriptors even if they are decorated with a decorator annotated as returning a PEP-695 alias to a Callable type (#22902)
  • dataclass_transform: Fix visibility of field specifiers when models are nested inside methods (#23069)

LSP server

  • Fix hover showing Unknown for bare Final instance attributes (#23003)
  • Improve support for goto-type, goto-declaration, hover, and highlighting of string annotations (#22878)
  • Include setters and deleters when renaming properties (#22999)
  • Show type qualifiers like Final in on-hover hints (#23005)

Configuration

  • Add new unused-type-ignore-comment rule (#22790)
  • Add a mechanism to ignore/warn/select all rules (#22832)
  • Support multiple workspace folders in a single ty LSP server instance (#22953)
  • Only add ./src as a search path if ./src/__init__.py(i) does not exist (#22851)

Type checking

  • Add a diagnostic detecting if a variable is declared as Final but never has any bindings (#23001)
  • Add a diagnostic detecting overridden comparison dunder methods on order=True dataclasses (#22689)
  • Add a hint to invalid-argument-type and invalid-assignment diagnostics if a variable is annotated with a type from the numbers module (#22931, #22938)
  • Add diagnostic hint on unresolved-reference to suggest using "list" instead of "List" (#22827)
  • Add new diagnostic for invalid dataclass field orders (#19825)
  • Allow a subclass method with a positional-only parameter to override a superclass method without that parameter if the parameter in the subclass method has a default value (#23037)
  • Allow self-referential imports outside the global scope (#22963)
  • Ban ... in odd places inside tuple specializations (#22889)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.15

Released on 2026-02-04.

Bug fixes

  • Add support for resolving imports of packages installed into Debian/Ubuntu dist-packages directories (#22466)
  • Avoid not-iterable false positives when iterating over an instance of an intersection type with only negated elements (#22089)
  • Fix support for stringized annotations in very large files (#22913)
  • Don't emit Liskov diagnostics for methods with mangled names (#23062)
  • Enforce that a Final symbol cannot be reassigned even after a conditional binding (#22986)
  • Fix TypedDict construction from existing TypedDict values (#22904)
  • Fix Self resolution for classes nested within methods (#22964)
  • Fix bidirectional inference with PEP 695 union type aliases (#22988)
  • Fix edge-case bugs when narrowing tagged unions in match statements (#22870)
  • Fix false-positive diagnostics when iterating over an instance of an intersection that includes a TypeVar of which the upper bound is a union where the union includes a non-iterable type (#22117)
  • Fix lookup of __contains__ to respect descriptors (#23056)
  • Fix narrowing of nonlocal variables with conditional assignments (#22966)
  • Fix several bugs that could affect NewTypes of NewTypes of float (#22997)
  • Fix several type narrowing bugs involving PEP-695 type aliases (#22894)
  • Fix spurious query cycles in decorated functions with parameter defaults, for improved performance and improved determinism (#23014)
  • Fix unary and comparison operators for TypeVars with union bounds (#22925)
  • Understand functions as method descriptors even if they are decorated with a decorator annotated as returning a PEP-695 alias to a Callable type (#22902)
  • dataclass_transform: Fix visibility of field specifiers when models are nested inside methods (#23069)

LSP server

  • Fix hover showing Unknown for bare Final instance attributes (#23003)
  • Improve support for goto-type, goto-declaration, hover, and highlighting of string annotations (#22878)
  • Include setters and deleters when renaming properties (#22999)
  • Show type qualifiers like Final in on-hover hints (#23005)

Configuration

  • Add new unused-type-ignore-comment rule (#22790)
  • Add a mechanism to ignore/warn/select all rules (#22832)
  • Support multiple workspace folders in a single ty LSP server instance (#22953)
  • Only add ./src as a search path if ./src/__init__.py(i) does not exist (#22851)

Type checking

  • Add a diagnostic detecting if a variable is declared as Final but never has any bindings (#23001)
  • Add a diagnostic detecting overridden comparison dunder methods on order=True dataclasses (#22689)
  • Add a hint to invalid-argument-type and invalid-assignment diagnostics if a variable is annotated with a type from the numbers module (#22931, #22938)
  • Add diagnostic hint on unresolved-reference to suggest using "list" instead of "List" (#22827)
  • Add new diagnostic for invalid dataclass field orders (#19825)
  • Allow a subclass method with a positional-only parameter to override a superclass method without that parameter if the parameter in the subclass method has a default value (#23037)
  • Allow self-referential imports outside the global scope (#22963)
  • Ban ... in odd places inside tuple specializations (#22889)
  • Ban Required, NotRequired and ReadOnly in parameter annotations (#22888)

... (truncated)

Commits

Updates ruff from 0.14.14 to 0.15.0

Release notes

Sourced from ruff's releases.

0.15.0

Release Notes

Released on 2026-02-03.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now formats your code according to the 2026 style guide. See the formatter section below or in the blog post for a detailed list of changes.

  • The linter now supports block suppression comments. For example, to suppress N803 for all parameters in this function:

    # ruff: disable[N803]
    def foo(
        legacyArg1,
        legacyArg2,
        legacyArg3,
        legacyArg4,
    ): ...
    # ruff: enable[N803]

    See the documentation for more details.

  • The ruff:alpine Docker image is now based on Alpine 3.23 (up from 3.21).

  • The ruff:debian and ruff:debian-slim Docker images are now based on Debian 13 "Trixie" instead of Debian 12 "Bookworm."

  • Binaries for the ppc64 (64-bit big-endian PowerPC) architecture are no longer included in our releases. It should still be possible to build Ruff manually for this platform, if needed.

  • Ruff now resolves all extended configuration files before falling back on a default Python version.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.0

Released on 2026-02-03.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now formats your code according to the 2026 style guide. See the formatter section below or in the blog post for a detailed list of changes.

  • The linter now supports block suppression comments. For example, to suppress N803 for all parameters in this function:

    # ruff: disable[N803]
    def foo(
        legacyArg1,
        legacyArg2,
        legacyArg3,
        legacyArg4,
    ): ...
    # ruff: enable[N803]

    See the documentation for more details.

  • The ruff:alpine Docker image is now based on Alpine 3.23 (up from 3.21).

  • The ruff:debian and ruff:debian-slim Docker images are now based on Debian 13 "Trixie" instead of Debian 12 "Bookworm."

  • Binaries for the ppc64 (64-bit big-endian PowerPC) architecture are no longer included in our releases. It should still be possible to build Ruff manually for this platform, if needed.

  • Ruff now resolves all extended configuration files before falling back on a default Python version.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Commits

Updates litellm from 1.81.6 to 1.81.9

Release notes

Sourced from litellm's releases.

v1.81.3-stable

Full Changelog: BerriAI/litellm@v1.81.3.dev1...v1.81.3-stable

v1.81.9.rc.1

What's Changed

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.77.0` | `0.79.0` |
| [fastmcp](https://github.com/jlowin/fastmcp) | `2.14.4` | `2.14.5` |
| [openai](https://github.com/openai/openai-python) | `2.16.0` | `2.17.0` |
| [pip](https://github.com/pypa/pip) | `26.0` | `26.0.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.14` | `0.0.15` |
| [ruff](https://github.com/astral-sh/ruff) | `0.14.14` | `0.15.0` |
| [litellm](https://github.com/BerriAI/litellm) | `1.81.6` | `1.81.9` |


Updates `anthropic` from 0.77.0 to 0.79.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v0.77.0...v0.79.0)

Updates `fastmcp` from 2.14.4 to 2.14.5
- [Release notes](https://github.com/jlowin/fastmcp/releases)
- [Changelog](https://github.com/jlowin/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v2.14.4...v2.14.5)

Updates `openai` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v2.16.0...v2.17.0)

Updates `pip` from 26.0 to 26.0.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.0...26.0.1)

Updates `ty` from 0.0.14 to 0.0.15
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.14...0.0.15)

Updates `ruff` from 0.14.14 to 0.15.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.14.14...0.15.0)

Updates `litellm` from 1.81.6 to 1.81.9
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](https://github.com/BerriAI/litellm/commits)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 0.79.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fastmcp
  dependency-version: 2.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: openai
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pip
  dependency-version: 26.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ty
  dependency-version: 0.0.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: litellm
  dependency-version: 1.81.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Feb 9, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from Joilence as a code owner February 9, 2026 07:25
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 9, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

uv.lock

PackageVersionLicenseIssue Type
litellm1.81.9NullUnknown License
pydocket0.17.5NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/anthropic 0.79.0 UnknownUnknown
pip/croniter 6.0.0 UnknownUnknown
pip/fastmcp 2.14.5 UnknownUnknown
pip/litellm 1.81.9 UnknownUnknown
pip/openai 2.17.0 🟢 6.2
Details
CheckScoreReason
Code-Review⚠️ -1Found no human activity in the last 4 changesets
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pip 26.0.1 🟢 5.9
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 7Found 8/11 approved changesets -- score normalized to 7
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts⚠️ 0binaries present in source code
CII-Best-Practices⚠️ 2badge detected: InProgress
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pydocket 0.17.5 UnknownUnknown
pip/python-dateutil 2.9.0.post0 🟢 5.2
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 5Found 8/14 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
License🟢 9license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases🟢 82 out of the last 2 releases have a total of 2 signed artifacts.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pytz 2025.2 🟢 4.6
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 1Found 3/25 approved changesets -- score normalized to 1
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/ruff 0.15.0 UnknownUnknown
pip/six 1.17.0 🟢 4.2
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/ty 0.0.15 UnknownUnknown

Scanned Files

  • uv.lock

@Joilence Joilence enabled auto-merge (squash) February 9, 2026 07:55
@Joilence Joilence merged commit c94a1cb into main Feb 9, 2026
3 checks passed
@Joilence Joilence deleted the dependabot/uv/dependencies-2c13522aee branch February 9, 2026 07:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant