chore(deps): bump the all-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the all-dependencies group with 4 updates in the / directory: fastmcp, platformdirs, posthog and ruff.

Updates fastmcp from 3.4.4 to 3.4.5

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in #4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
• Forward-port Hugging Face auth provider by @​jlowin in #4475
• Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483
• Add guard-mode multi-round-trip tools (SEP-2322) by @​jlowin in #4544
• Add FastMCP-native server extension API (SEP-2133) by @​jlowin in #4602
• Add stateless session state (UserSession / SessionId) by @​jlowin in #4604
• Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by @​jlowin in #4603

Breaking Changes ⚠️

• Emit one SERVER span per request and adopt spec-correct error codes by @​jlowin in #4445
• Remove 3.x deprecated module shims and dead parameters by @​jlowin in #4447
• Remove 3.0-deprecated FastMCP server methods by @​jlowin in #4451
• Remove 3.x deprecated parameters and object-mode decorators by @​jlowin in #4453
• Migrate to MCP SDK v2.0.0b2 (httpx2) by @​jlowin in #4503
• Fix typos by @​szepeviktor in #4498
• Stop proxies from validating backend results or mutating shared transports by @​jlowin in #4552
• Surface resource, prompt, and proxy errors on the modern protocol by @​jlowin in #4579
• Negotiate the best mutual protocol era by default by @​jlowin in #4572
• Remove server-initiated sampling and roots from the server API by @​jlowin in #4648
• Remove 3.x-era compatibility shims by @​jlowin in #4661

Enhancements ✨

• Deprecate ctx.sample and add clear errors for push features on 2026 connections by @​jlowin in #4448
• Add server-level cache hints (SEP-2549) by @​jlowin in #4464
• Add KeyValueResponseCacheStore for distributed client response caching by @​jlowin in #4479
• Test lifespan fires once per process over HTTP by @​jlowin in #4480
• Add telemetry off-switch and mcp.protocol.version span attribute by @​jlowin in #4481
• Trace client task management requests by @​jlowin in #4525
• Stabilize upgraded ty checks by @​jlowin in #4526
• Improve DescopeProvider scope discovery and well-known URL support by @​gaokevin1 in #4489
• Add examples/ to the ty static-analysis gate by @​jlowin in #4466
• Expose telemetry attributes on span start by @​zzstoatzz in #4487
• Fix-issue-4284 : Add Auth0MCPProvider for Auth0 Auth for MCP by @​vijaydeepsinha in #4411
• Run FastMCP middleware for every inbound message by @​jlowin in #4553
• Add 'prs welcome' label to waive the PR assignment gate by @​jlowin in #4557
• Rename martian workflows to marvin by @​jlowin in #4558
• Bump pinned Claude models to current versions by @​jlowin in #4561

... (truncated)

Commits

• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• See full diff in compare view

Updates platformdirs from 4.10.0 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

• 👷 ci: run the test suite against Python 3.15 by @​gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

• 🐛 fix(windows): stop leaking memory on repeated folder lookups by @​gaborbernat in tox-dev/platformdirs#507
• 🚀 ci(release): towncrier changelog + publish on tag push by @​gaborbernat in tox-dev/platformdirs#509
• 📝 docs(changelog): rebuild against release history by @​gaborbernat in tox-dev/platformdirs#510

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

---

4.10.0 (2026-05-28)

---

• Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
• Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
• Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

---

4.9.6 (2026-04-09)

---

• Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
• Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

---

4.9.4 (2026-03-05)

---

• Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
• Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

---

... (truncated)

Commits

• 2140495 Release 4.11.0
• a562df9 👷 ci: run the test suite against Python 3.15 (#512)
• 7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
• 2e74013 Release 4.10.1
• 3076722 📝 docs(changelog): rebuild against release history (#510)
• 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
• d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
• 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
• f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
• 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
• Additional commits viewable in compare view

Updates posthog from 7.25.0 to 7.34.0

Release notes

Sourced from posthog's releases.

posthog-v7.34.0

Minor changes

• 3c9aa59 feat(ai): Prompts.get(..., with_metadata=True) results now include config, the JSON object of model parameters or agent configuration stored with the prompt version in PostHog prompt management (None when the version has none). Config is carried through the client-side cache and the stale-cache fallback. The hardcoded fallback string has no config, so use defensive access like (result.config or {}).get("temperature", 0). — Thanks @​jurajmajerik!

posthog-v7.33.0

Minor changes

• 170f4e2 feat(mcp): emit $mcp_protocol_version on MCP analytics events — the MCP spec version, recovered from the session token across stateless pods (parity with the TypeScript SDK). PostHogMCP capture methods gain a protocol_version argument. — Thanks @​gesh for your first contribution 🎉!

posthog-v7.32.0

Minor changes

• cdc0825 Preserve Anthropic cache-write TTL breakdowns across Python SDK AI integrations. — Thanks @​gouveags!

posthog-v7.31.1

Patch changes

• 13de879 Fix module-level settings propagation to the default client — Thanks @​marandaneto!

posthog-v7.31.0

Minor changes

• 5535ecd fix(errors): emit $exception_list in canonical order — index 0 is the caught/outermost exception, causes follow in unwrap order, and the root cause is last (previously the list was reversed with the root cause first). This aligns posthog-python with the cross-SDK exception ordering spec. Frame order within each stacktrace is unchanged. — Thanks @​cat-ph!

posthog-v7.30.1

Patch changes

• 4c8a85a AI capture now records multimodal and structured content (thinking blocks, tool calls, media, and Responses API output items) faithfully across all providers and streaming paths, and redacts base64 media structurally without leaking raw bytes or over-redacting legitimate values. — Thanks @​carlos-marchal-ph!

posthog-v7.30.0

Minor changes

• 37aafd3 feat(mcp): stateless and multi-pod server support — carry $session_id and the client identity (harness) across pods via a self-encoded Mcp-Session-Id token minted at initialize and replayed on every request. Auto-wired on the instrument() FastMCP path (stateless_http=True); custom PostHogMCP dispatchers add PostHogMcpStatelessSessionMiddleware and read get_mcp_session(). — Thanks @​gesh!

posthog-v7.29.0

Minor changes

• f9a163c Refactored capture internals to support multiple delivery lanes per client. Added an internal test lane for heavy AI events.

  Events captured after shutdown() are now dropped with a warning instead of being silently queued with no consumer to deliver them. — Thanks @​carlos-marchal-ph!

posthog-v7.28.0

Minor changes

• 2d7f8cc The client.metrics config can now be set through module-level settings: assign posthog.metrics = {"service_name": ..., ...} alongside posthog.api_key and the dict is applied when setup() builds the global client. Previously module-configured apps had no way to pass the metrics config, so every series recorded through the global client shipped service.name='unknown_service'. Late assignment (e.g. a Django ready() hook running after an early setup()) still applies on the next setup() call, as long as the metrics API hasn't been used yet. — Thanks @​DanielVisca!

Patch changes

• 6766309 Harden the alpha posthog.metrics client based on review follow-ups.

... (truncated)

Commits

• 6278ac4 chore: Release v7.34.0 [skip ci]
• 3c9aa59 feat(ai): expose prompt config on fetched prompts (#801)
• 231b060 test: clean up deprecation warnings (#798)
• 4d864e2 ci: clean up workflow warnings and pin tooling (#796)
• 36dd1d4 Update generated references
• c7d6377 chore: Release v7.33.0 [skip ci]
• 170f4e2 feat(mcp): emit $mcp_protocol_version on events (#795)
• 5b79479 Update generated references
• 168f304 chore: Release v7.32.0 [skip ci]
• cdc0825 fix(ai): preserve Anthropic cache-write TTL breakdowns (#746)
• Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view