[dependabot]

Bumps the uv group with 4 updates in the / directory: pydantic, openai, openai-agents and fastapi.

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates openai from 3.26.1 to 3.37.0

Release notes

Sourced from openai's releases.

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

v3.36.1

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

v3.36.0

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)

... (truncated)

Changelog

Sourced from openai's changelog.

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)
• api: add custom voice consent management (#4135) (de6d70d)
• types: prepare native synchronous WebSocket option type (#4118) (90c0bac)

... (truncated)

Commits

• e8a0fd2 release: 3.37.0 (#4154)
• fa9a161 chore(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109)
• 1e45ad1 feat(api): expand Decisions input and question types (#4158)
• 1f76a59 ci: allow time for browser dependency installation (#4159)
• 7db9d88 chore(api): preserve file and video polling helpers (#4155)
• a29dc39 chore(api): preserve upload helpers and Live connection defaults (#4152)
• 49e6757 release: 3.36.1 (#4145)
• 6ed945e chore(api): clarify service-account API key deletion (#4151)
• 7cd7028 refactor: prepare handwritten vector-store polling runtime (#4148)
• d40a5e1 fix(api): honor per-call WebSocket query settings (#4138)
• Additional commits viewable in compare view

Updates openai-agents from 0.23.1 to 0.24.0

Release notes

Sourced from openai-agents's releases.

v0.24.0

0.24.0 (2026-10-15)

Features

• expose MCP annotations on converted tools (#5356) (75813f8)
• support run-wide tool exception formatting (#5326) (8fd9a7c)

Bug Fixes

• batch OpenAI conversation session writes within the API limit (#5334) (26345c1)
• defer automatic compaction for pending approvals (#5363) (5eb47a5)
• deps-dev: bump fastapi from 0.139.2 to 0.141.1 (#5312) (cdf23bd)
• deps-dev: bump grpcio from 1.83.1 to 1.84.0 (#5310) (a85487e)
• deps-dev: bump pymdown-extensions from 11.0.2 to 12.1 (#5314) (d9758b0)
• deps-dev: bump pymongo from 4.18.1 to 4.18.2 (#5313) (858856f)
• deps: bump boto3 from 1.42.75 to 1.43.109 (#5378) (7da6a92)
• deps: bump filelock from 3.20.3 to 4.0.12 (#5375) (14f4553)
• deps: bump fsspec from 2025.7.0 to 2026.6.0 (#5317) (66504e9)
• deps: bump redis from 7.0.1 to 8.1.0 (#5379) (24ebf1c)
• deps: bump temporalio from 1.33.0 to 1.34.0 (#5377) (c148280)
• deps: bump vercel-sandbox from 0.7.0 to 0.8.0 (#5374) (2938d87)
• deps: update fastapi requirement from >=0.141.1 to >=0.142.2 in /examples/realtime/twilio_sip (#5372) (f47d2c3)
• deps: update fastapi requirement in /examples/realtime/twilio_sip (f47d2c3)
• deps: update openai requirement from <4,>=3.19.1 to >=3.20.0,<4 in /examples/realtime/twilio_sip (#5308) (f346950)
• deps: update openai requirement from <4,>=3.20.0 to >=3.26.0,<4 in /examples/realtime/twilio_sip (#5376) (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (f346950)
• deps: update pyjwt requirement from >=2.15.0 to >=2.15.1 in /examples/realtime/twilio (#5306) (7ca3c44)
• deps: update pyjwt requirement in /examples/realtime/twilio (7ca3c44)
• deps: update python-dotenv requirement (408c33f)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio (#5373) (c4cc409)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio_sip (#5371) (408c33f)
• deps: update python-dotenv requirement in /examples/realtime/twilio (c4cc409)
• deps: update twilio requirement from <10,>=9.11.1 to >=9.11.2,<10 in /examples/realtime/twilio (#5307) (cb03652)
• deps: update twilio requirement in /examples/realtime/twilio (cb03652)
• deps: update uvicorn requirement from >=0.53.0 to >=0.54.0 in /examples/realtime/twilio_sip (#5309) (f84fe73)
• deps: update uvicorn requirement in /examples/realtime/twilio_sip (f84fe73)
• examples: render realtime tool events as text (#5283) (81f0ccf)
• honor Runner tracing opt-out inside caller traces (#5296) (8c4aa08)
• memory: replace Redis compaction history atomically (#5354) (f50525c)
• omit unserializable dataclass run contexts (#5303) (d7e52c3)
• preserve caller-owned exceptions during sandbox redaction (#5367) (2244e9f)
• preserve completed tool outputs when a sibling fails (#5332) (1c1a28d)
• preserve embedded separators in sandbox patches (#5365) (67d4f8a)
• preserve function-call aliases across RunState restoration (#5358) (f093ced)
• Preserve parameter descriptions in Args-only docstrings (#5302) (a726a9c)
• preserve RunState agent ownership across hook state changes (#5362) (d8e0a76)

... (truncated)

Changelog

Sourced from openai-agents's changelog.

0.24.0 (2026-10-15)

Features

• expose MCP annotations on converted tools (#5356) (75813f8)
• support run-wide tool exception formatting (#5326) (8fd9a7c)

Bug Fixes

• batch OpenAI conversation session writes within the API limit (#5334) (26345c1)
• defer automatic compaction for pending approvals (#5363) (5eb47a5)
• deps-dev: bump fastapi from 0.139.2 to 0.141.1 (#5312) (cdf23bd)
• deps-dev: bump grpcio from 1.83.1 to 1.84.0 (#5310) (a85487e)
• deps-dev: bump pymdown-extensions from 11.0.2 to 12.1 (#5314) (d9758b0)
• deps-dev: bump pymongo from 4.18.1 to 4.18.2 (#5313) (858856f)
• deps: bump boto3 from 1.42.75 to 1.43.109 (#5378) (7da6a92)
• deps: bump filelock from 3.20.3 to 4.0.12 (#5375) (14f4553)
• deps: bump fsspec from 2025.7.0 to 2026.6.0 (#5317) (66504e9)
• deps: bump redis from 7.0.1 to 8.1.0 (#5379) (24ebf1c)
• deps: bump temporalio from 1.33.0 to 1.34.0 (#5377) (c148280)
• deps: bump vercel-sandbox from 0.7.0 to 0.8.0 (#5374) (2938d87)
• deps: update fastapi requirement from >=0.141.1 to >=0.142.2 in /examples/realtime/twilio_sip (#5372) (f47d2c3)
• deps: update fastapi requirement in /examples/realtime/twilio_sip (f47d2c3)
• deps: update openai requirement from <4,>=3.19.1 to >=3.20.0,<4 in /examples/realtime/twilio_sip (#5308) (f346950)
• deps: update openai requirement from <4,>=3.20.0 to >=3.26.0,<4 in /examples/realtime/twilio_sip (#5376) (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (f346950)
• deps: update pyjwt requirement from >=2.15.0 to >=2.15.1 in /examples/realtime/twilio (#5306) (7ca3c44)
• deps: update pyjwt requirement in /examples/realtime/twilio (7ca3c44)
• deps: update python-dotenv requirement (408c33f)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio (#5373) (c4cc409)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio_sip (#5371) (408c33f)
• deps: update python-dotenv requirement in /examples/realtime/twilio (c4cc409)
• deps: update twilio requirement from <10,>=9.11.1 to >=9.11.2,<10 in /examples/realtime/twilio (#5307) (cb03652)
• deps: update twilio requirement in /examples/realtime/twilio (cb03652)
• deps: update uvicorn requirement from >=0.53.0 to >=0.54.0 in /examples/realtime/twilio_sip (#5309) (f84fe73)
• deps: update uvicorn requirement in /examples/realtime/twilio_sip (f84fe73)
• examples: render realtime tool events as text (#5283) (81f0ccf)
• honor Runner tracing opt-out inside caller traces (#5296) (8c4aa08)
• memory: replace Redis compaction history atomically (#5354) (f50525c)
• omit unserializable dataclass run contexts (#5303) (d7e52c3)
• preserve caller-owned exceptions during sandbox redaction (#5367) (2244e9f)
• preserve completed tool outputs when a sibling fails (#5332) (1c1a28d)
• preserve embedded separators in sandbox patches (#5365) (67d4f8a)
• preserve function-call aliases across RunState restoration (#5358) (f093ced)
• Preserve parameter descriptions in Args-only docstrings (#5302) (a726a9c)
• preserve RunState agent ownership across hook state changes (#5362) (d8e0a76)
• preserve tool outputs after callback failures (#5318) (71c2da4)

... (truncated)

Commits

• 17d994b release: 0.24.0 (#5285)
• 24ebf1c fix(deps): bump redis from 7.0.1 to 8.1.0 (#5379)
• 2938d87 fix(deps): bump vercel-sandbox from 0.7.0 to 0.8.0 (#5374)
• c148280 fix(deps): bump temporalio from 1.33.0 to 1.34.0 (#5377)
• 7da6a92 fix(deps): bump boto3 from 1.42.75 to 1.43.109 (#5378)
• 14f4553 fix(deps): bump filelock from 3.20.3 to 4.0.12 (#5375)
• 172ff5e fix(deps): update openai requirement from <4,>=3.20.0 to >=3.26.0,<4 in /exam...
• c4cc409 fix(deps): update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examp...
• f47d2c3 fix(deps): update fastapi requirement from >=0.141.1 to >=0.142.2 in /example...
• 408c33f fix(deps): update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examp...
• Additional commits viewable in compare view

Updates fastapi from 0.143.0 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

... (truncated)

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mutiny	Ready	Preview	Oct 27, 2026 1:36pm UTC

[CodewithJha]

Merged after local verification. This is a lockfile-only change, and no package constraints moved.

Release notes checked

• openai-agents 0.23.1 → 0.24.0: a minor release (MCP annotations, run-wide tool error formatting, RunState fixes). Nothing changes the result items or raw_item shapes the adapter's extract_tool_calls reads, and the adapter tests pass. This is also the version chore(adapter): bound tested openai-agents minor #128 ([DEPENDENCY] MUT-042: PyPI openai-agents>=0.19 floats past the workspace lock #81) proposes to lock.
• fastapi 0.143 → 0.162: the breaking changes cover form/file field handling, removal of **extra on parameters and of openapi_prefix, root_path deprecation, and null-vs-omitted body values. The API uses none of the removed or deprecated APIs and has no form or file inputs.
• openai 3.26.1 → 3.37.0: the only breaking note is in Live/Decisions types, which we don't use.
• pydantic 2.14.1 / pydantic-core / typing-inspection: pydantic 2.14 drops Python 3.9. We require 3.11+.

Tests (merged onto main including #133): uv lock --check and uv sync --locked succeed. 762 tests passed and ruff check is clean. A live python -m mutiny_api smoke returned /api/health 200 and generated OpenAPI 3.1 with 26 paths. CI is green on 3.11 and 3.12.