chore(deps): bump the all-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the all-dependencies group with 4 updates in the / directory: fastmcp, platformdirs, posthog and ruff.

Updates fastmcp from 3.4.5 to 3.4.6

Release notes

Sourced from fastmcp's releases.

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in PrefectHQ/fastmcp#4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in PrefectHQ/fastmcp#4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in #4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in #4810

Full Changelog: v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in #4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in #4761

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in #4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
• Forward-port Hugging Face auth provider by @​jlowin in #4475
• Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483

... (truncated)

Commits

• c587bdd Docs: add v3.4.6 changelog entries (#4761)
• fcdf422 Backport #4412 to 3.x: support trusted SSRF proxies (#4755)
• See full diff in compare view

Updates platformdirs from 4.11.0 to 4.11.1

Release notes

Sourced from platformdirs's releases.

4.11.1

What's Changed

• Let the non-ctypes resolvers find the desktop folder by @​darrenhuai in tox-dev/platformdirs#519

New Contributors

• @​darrenhuai made their first contribution in tox-dev/platformdirs#519

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.11.2 (2026-08-10)

---

• Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

---

4.11.1 (2026-08-07)

---

• Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

---

4.11.0 (2026-07-21)

---

• Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

---

4.10.1 (2026-07-18)

---

• Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

---

4.10.0 (2026-05-28)

---

• Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
• Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
• Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

... (truncated)

Commits

• a9f2ba9 Release 4.11.1
• 30a9549 Let the non-ctypes resolvers find the desktop folder (#519)
• cc97359 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the al...
• 328e15d [pre-commit.ci] pre-commit autoupdate (#517)
• 76fd346 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 in the all group (#516)
• 13a531d [pre-commit.ci] pre-commit autoupdate (#515)
• 070777b build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 in the al...
• 5d09cb0 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the all group (#513)
• See full diff in compare view

Updates posthog from 7.37.3 to 7.38.3

Release notes

Sourced from posthog's releases.

posthog-v7.38.3

Patch changes

• bd5cff4 fix: declare Gemini's cache accounting model on generations with cache reads, so ingestion prices cached tokens from $ai_cache_reporting_exclusive instead of inferring it from the token counts. — Thanks @​fivestarspicy!

posthog-v7.38.2

Patch changes

• 100f993 group_identify() now validates the group identity before enqueuing. Previously group_identify("company", None) (or an empty-string group_type / group_key) sent a $groupidentify event with a null/empty $group_type or $group_key, which cannot address a group profile and just adds an unusable event to the project. Missing values are now dropped with a warning instead, matching the sdk-specs group-identify contract. Valid values, including non-string group keys, are passed through unchanged. — Thanks @​posthog[bot]!

posthog-v7.38.1

Patch changes

• 55370ee fix: prevent client lifecycle deadlocks when error callbacks, concurrent join()/shutdown() calls, or forked sync-mode clients interact with queue and worker teardown. — Thanks @​marandaneto!

posthog-v7.38.0

Minor changes

• 77821ce feat: FeatureFlagEvaluations.is_enabled() accepts a default_value returned when the flag has no value in the evaluation — the key was not part of the evaluated set, or the evaluation came back empty (failed /flags request, quota limit, no resolvable distinct_id). A flag that has a value still wins, so a disabled flag returns False even with default_value=True. The default is False, so existing calls behave exactly as before. — Thanks @​posthog[bot]!

Patch changes

• 7b6a8d8 evaluate_flags() now JSON-decodes payloads for locally-evaluated flags, the same way it already did for flags resolved remotely. Previously get_flag_payload() returned a parsed value ({"copy": "new"}) when the flag came back from /flags but the raw JSON string ('{"copy": "new"}') when the poller evaluated it locally, so the payload's type depended on where the flag happened to resolve. The $feature_flag_payload property on $feature_flag_called events is decoded for locally-evaluated flags too. Payload strings that aren't valid JSON are still passed through unchanged. — Thanks @​posthog[bot]!
• 92625cf The $feature_flag_called dedupe tracker now evicts its oldest entry when it reaches capacity instead of clearing every entry. Previously, each time a client accumulated 50,000 distinct IDs the whole tracker was wiped, so the next flag read for every previously seen distinct ID re-emitted a $feature_flag_called event it had already deduped. — Thanks @​posthog[bot]!

posthog-v7.37.6

Patch changes

• c5f4e8f Normalize Gemini tool calls and tool responses in captured input so they render in traces and reach evaluations — Thanks @​marco-g-pm!

posthog-v7.37.5

Patch changes

• ae26014 fix: flush() no longer waits out flush_interval before delivering a partial batch. A consumer holding fewer than flush_at events now sends them as soon as flush() (or shutdown()) asks it to, instead of blocking the caller for the rest of the batching window — which previously made flush() deliver nothing at all when flush_interval was longer than the flush timeout. Timer-based batching without an explicit flush is unchanged. — Thanks @​posthog[bot]!

posthog-v7.37.4

Patch changes

• 6397d78 alias() now validates both identities before enqueuing. Previously alias(None, "user-123") (or an empty-string previous_id) sent a $create_alias event with a null/empty distinct_id, which cannot link anything and just adds an unusable event to the project. Missing identities are now dropped with a warning instead, matching the sdk-specs alias contract. The drop that already happened when no alias target could be resolved now logs a warning too, and a non-string previous_id such as 0 is stringified consistently in both distinct_id and properties.distinct_id. — Thanks @​posthog[bot]!

Commits

• d398948 chore: Release v7.38.3 [skip ci]
• bd5cff4 fix(gemini): declare cache reporting as inclusive on generations (#860)
• 204522c chore(deps): bump the ai-providers group with 5 updates (#857)
• c9ae360 chore(deps): bump the github-actions group with 9 updates (#858)
• fa9bb47 chore: expand Dependabot ecosystems (#854)
• c78bc4d Update generated references
• 34c3355 chore: Release v7.38.2 [skip ci]
• 9b4690e chore(deps): bump the uv group across 4 directories with 3 updates (#855)
• 4bbc449 chore(deps): bump lxml from 6.0.0 to 6.1.0 (#853)
• 7fb2517 chore(deps): bump the uv group across 6 directories with 7 updates (#852)
• Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Commits

• 5b48a04 Bump 0.16.2 (#27555)
• 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
• c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
• 17a00de [ty] Reuse primer commands in memory reports (#27553)
• 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
• 2fc445f [ty] Diagnose invalid getattr calls (#27502)
• 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
• 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
• baea3d0 [ty] Expose strict analysis options in the playground (#27543)
• c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.