[dependabot]

Updates the requirements on langchain-core, webauthn and ruff to permit the latest version.
Updates langchain-core to 1.7.6

Release notes

Sourced from langchain-core's releases.

langchain-core==1.7.6

Changes since langchain-core==1.7.5

release(core): 1.7.6 (#41698) perf(core): merge streamed AIMessageChunks once when accumulating runnable streams (#41697) perf(core): stop parse_partial_json from retrying one character at a time (#41467)

Commits

• b4aa7e7 release(core): 1.7.6 (#41698)
• df8fd17 perf(core): merge streamed AIMessageChunks once when accumulating runnable ...
• 7d72af0 perf(core): stop parse_partial_json from retrying one character at a time (...
• 6869934 fix(fireworks): report streamed token usage once (#41693)
• d3b3a8d fix(langchain): omit trace inputs from ModelRefusalMiddleware (#41689)
• 15306e3 fix(infra): use published langchain in min-version release check (#41691)
• 1f032fd release(fireworks): 1.7.2 (#41690)
• 9d57278 fix(fireworks): report the served model in response metadata (#41686)
• d1d95b7 release(langchain): 1.4.9 (#41684)
• bbcdd56 release(anthropic): 1.7.10 (#41685)
• Additional commits viewable in compare view

Updates webauthn to 3.0.1

Release notes

Sourced from webauthn's releases.

v3.0.1

Changes:

• verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

Changelog

Sourced from webauthn's changelog.

v3.0.1

Changes:

• verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

v3.0.0

Changes:

• verify_registration_response() and verify_authentication_response() now support use of PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 algorithms for credential public key signature verification (#282)
• generate_registration_options() will now encourage authenticators to create keypairs using EDDSA when available, signaling acceptance of ES256 or RS256 when EDDSA is unavailable (#284)
• Responses containing malformed CBOR data with duplicate keys will now be rejected (#285)

v2.8.0

Changes:

• "android-key" attestation verification is more tolerant of X.509 leaf certificates with values that violate ASN.1 DER parsing rules (#277)
• Dependencies have been updated, including cbor2>=5.6.5,<6.0.0 (#269, h/t @​typestring; #272), and cryptography>=46.0.0 and pyOpenSSL>=26.0.0 (#278)
• Two expired trust anchors have been retired (#279)
• A new trust anchor for "android-key" attestation has been added (#268)
• TPM manufacturer IDs are now normalized during "tpm" attestation verification to prevent casing-related lookup issues (#275)
• Registration verification will more consistently raise webauthn.helpers.exceptions.InvalidRegistrationResponse when encountering bad data. Likewise, authentication verification will more consistently raise webauthn.helpers.exceptions.InvalidAuthenticationResponse when encountering bad data (#271, #273, #276, #280)
• A docstring typo in verify_authentication_response() has been fixed (#266, h/t @​Densaugeo)

v2.7.1

Changes:

• This project now uses the pyasn1 library to parse ASN.1-encoded values (#263, h/t @​ggirol-rc)
• Some bare dict type annotations have been replaced with Dict[str, Any] to satisfy stricter type checking setups (#262, h/t @​typestring)

v2.7.0

Changes:

• The webauthn.helpers.options_to_json_dict helper has a new, optional bytes_encoder argument that accepts a Callable[[bytes], Any] method. This enables the use of custom encoding logic when serializing bytes values. When this argument is unspecified, bytes values will continue to be encoded into Base64URL (#257)

v2.6.0

Changes:

• The new webauthn.helpers.options_to_json_dict helper can be used to simplify registration and authentication options into a simple Dict[str, Any] value (#256)

v2.5.3

Changes:

• More X.509 validation exceptions will include the cause of the exception as reported by the third-party library handling the validation (#255)

... (truncated)

Commits

• d72e0f5 Bump version to v3.0.1
• 732ca23 Update CHANGELOG for v3.0.1
• b474c8d Merge pull request #288 from trail-of-forks/dm/reject-attestations-fmt
• 5557d97 Reject early invalid attestation formats
• 44330eb Bump version to v3.0.0
• 2a926d8 Update CHANGELOG for v3.0.0
• 4c4dbcb Merge pull request #285 from duo-labs/fix/reject-cbor-key-collision
• 6df40fb Refine CBOR encoder helper error message
• 91384ae Disallow duplicate keys in CBOR data
• 6cc7093 Upgrade to latest cbor2
• Additional commits viewable in compare view

Updates ruff from 0.16.9 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view