build(deps): bump the python-dependencies group across 1 directory with 34 updates

[dependabot]

Updates the requirements on crawl4ai, faiss-cpu, google-genai, litellm, openai, pinecone, playwright, pypdf, redis, psycopg2-binary, requests, faker, fastapi, uvicorn, pymupdf, pymupdf4llm, prometheus-client, python-multipart, sqlalchemy, alembic, httpx-oauth, arq, greenlet, aiosqlite, pytest, pytest-asyncio, opentelemetry-api, opentelemetry-sdk, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-fastapi, opentelemetry-instrumentation-redis, opentelemetry-instrumentation-sqlalchemy, opentelemetry-instrumentation-httpx and pgvector to permit the latest version.
Updates crawl4ai to 0.9.2

Release notes

Sourced from crawl4ai's releases.

Release v0.9.2

🎉 Crawl4AI v0.9.2 Released!

📦 Installation

PyPI:

pip install crawl4ai==0.9.2

Docker:

docker pull unclecode/crawl4ai:0.9.2
docker pull unclecode/crawl4ai:latest

Note: Docker images are being built and will be available shortly. Check the Docker Release workflow for build status.

📝 What's Changed

See CHANGELOG.md for details.

Changelog

Sourced from crawl4ai's changelog.

Changelog

All notable changes to Crawl4AI will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.9.0] - 2026-06-18

0.9.0 is a major, secure-by-default release of the Crawl4AI Docker API server. The out-of-the-box deployment is now hardened with defense in depth: authentication is on by default, the server binds loopback unless you give it a token, and the network request body is treated as an untrusted trust boundary. This release contains breaking changes for the self-hosted HTTP server only. The core pip library (SDK / in-process use) is unchanged.

What changed: the Docker server moved from an open, trust-the-caller posture to a closed, secure-by-default one. Defaults that used to be permissive (open bind, no auth, request-supplied browser internals, TLS verification off, Redis with no password) are now safe by default and gated behind explicit configuration.

What you must do: set CRAWL4AI_API_TOKEN and re-issue any tokens, then review whether you relied on any of the request fields or features that are now configured server-side. Most plain "crawl these URLs" users only need the two steps in the "Everyone" section of the migration guide. The full guide is at deploy/docker/MIGRATION.md.

Security

This release completes the secure-by-default hardening of the Docker API server begun in 0.8.7 and 0.8.8. It moves the worst remaining issues from mitigation to architecture: unauthenticated access and request-supplied code/config are eliminated by design rather than patched in place. Every change is hardening; users self-hosting the Docker server should upgrade and follow the migration guide.

• Authentication on by default, loopback bind: the server no longer serves an unauthenticated API on 0.0.0.0. With no token it binds 127.0.0.1 and prints a one-off local token; exposing it requires CRAWL4AI_API_TOKEN and Authorization: Bearer <token> on every request except GET /health.
• Request trust boundary: a crawl request body now carries declarative, scalar options only. Fields that previously let a caller drive browser internals or arbitrary code are rejected at the network boundary.
• Declarative hooks replace hook code: arbitrary Python hook strings are replaced by a fixed set of declarative actions, removing request-supplied code from the server entirely.
• Strengthened JWT, admin-scoped monitor actions, deny-by-default CORS, strict security headers, TLS verification on, password-protected loopback-only Redis, bounded job queue, generic error responses with correlation ids, and validated webhook headers round out the defense-in-depth posture. See the migration guide for the full list.
• Download path confinement (CWE-22): both download sinks now confine writes with basename plus realpath plus O_NOFOLLOW, closing a path-traversal-to-file-write class. Credit: Y4tacker.
• SSRF destination validation on the streaming crawl path (CWE-918): /crawl/stream and /crawl with stream=true now validate the destination and return HTTP 400 for disallowed targets, matching the non-streaming handlers. Credit: KOH Jun Sheng.
• Request-supplied browser_config.extra_args rejected (CWE-94): launch arguments can no longer be supplied over the network, closing a Chromium launch-arg injection class. Credit: Y4tacker, UDU_RisePho (hoanggxyuuki).

All reporters are credited in SECURITY-CREDITS.md. GitHub Security Advisories accompany this release.

Breaking Changes

These apply to the self-hosted Docker API server only. The pip library is unaffected. See deploy/docker/MIGRATION.md for the step-by-step migration and deploy/docker/SECURITY-VERIFY.md for the deployment checklist.

• Auth is on by default: set CRAWL4AI_API_TOKEN and send Authorization: Bearer <token>. With no token the server binds loopback only.
• Loopback bind by default: the server no longer binds 0.0.0.0 without a token; put a TLS-terminating reverse proxy in front when you expose it.
• Tokens must be re-issued: the JWT implementation changed and tokens from older versions are no longer valid. Re-mint via POST /token.
• Request trust boundary: js_code, js_code_before_wait, c4a_script, proxy / proxy_config, extra_args, user_data_dir, cdp_url, cookies, headers, init_scripts, base_url, deep_crawl_strategy, simulate_user, magic, process_in_browser, and nested LLM config objects are rejected with HTTP 400 when sent over the network. Configure them server-side or use the in-process SDK. Unknown fields are dropped; timeouts, viewport, and scroll counts are clamped.
• Hooks are declarative: hooks.code is replaced by a fixed action set (block_resources, add_cookies, set_headers, scroll_to_bottom, wait_for_timeout). See GET /hooks/info.
• output_path removed, replaced by an artifact id: /screenshot and /pdf store the result and return artifact_id + URL; fetch via authenticated GET /artifacts/{artifact_id} (TTL and quota apply).
• LLM base_url removed: /md, /llm, and /llm/job select a provider by name only; endpoint and key are configured server-side and constrained by config.llm.allowed_providers.
• Monitor actions require an admin token: POST /monitor/actions/* and /monitor/stats/reset need an admin-scope principal.
• CORS deny-by-default: cross-origin browser requests are denied unless listed in security.cors_allow_origins.
• TLS verification on: self-signed / internal TLS targets fail by default. Escape hatches for trusted internal testing: CRAWL4AI_ALLOW_INSECURE_TLS=true, CRAWL4AI_ALLOW_INTERNAL_URLS=true.
• Webhook headers validated: malformed or hop-by-hop / sensitive headers are rejected with HTTP 422.
• Redis requires a password: in-container Redis is loopback-only, password-protected, and its port is no longer published. For external Redis set REDIS_PASSWORD.
• Bounded background job queue: request body size, per-crawl wall clock, queue size, and per-principal concurrency are now capped (configurable; 0 = unbounded).
• Generic 5xx responses: server errors return {"error": "Internal server error", "correlation_id": "…"}; match the id in the logs for detail.

Security Credits

... (truncated)

Commits

• 7e80152 Merge pull request #2077 from unclecode/release/v0.9.2
• bd8b130 Update README.md
• 055e2ec release: Crawl4AI v0.9.2
• 9e9e826 fix(CONTRIBUTORS.md): update section title from 'Core Team' to 'Maintainers'
• 935f591 Merge pull request #2072 from reallav0/agent/cancel-streaming-dispatch-tasks
• 9fb2aa8 fix(dispatcher): clean up closed stream tasks
• 9ee84cc fix(test): update monitor auth test for WS-safe router config
• a94041c fix(test): correct regex group name in headless shell test
• f1fdf27 Merge branch 'develop' of https://github.com/unclecode/crawl4ai into develop
• 6357f85 Merge pull request #2067 from reallav0/agent/include-playwright-headless-shell
• Additional commits viewable in compare view

Updates faiss-cpu to 1.14.3

Release notes

Sourced from faiss-cpu's releases.

v1.14.3

Highlights

• Metal GPU backend expansion — new MetalIndexIVFFlat with IVF scan/merge kernels and expanded top-k support (#5202); Metal now enabled by default on Apple Silicon machines (#5280)
• TurboQuant in ScalarQuantizer — full Algorithm 2 (QJL stage) with SIMD and optimizations (#5170)
• Sapphire Rapids (SPR) optimizations — ScalarQuantizer L2/IP (#5173), VPOPCNTDQ-based HammingComputer (#5183), and VPOPCNTDQ-based RaBitQ kernel (#5149)
• faiss-gpu pip wheels — new GPU wheel packaging (#5131); musllinux wheels re-enabled for faiss-cpu (#5299)
• SVS static vamana support (#5224)
• HNSW is_similarity mode for IP/similarity metrics (#5246, #5226)
• HNSW search performance — reserve VisitedTableSet capacity to avoid rehashes (#5290), search_from_candidate_unbounded templatized for VisitedTable devirtualization (#5270), and runtime checks avoided in VisitedTable (#5234)
• NEON FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder (#5255)
• cuVS upgraded to 26.06 (#5240); CI updated to ROCm 7 (#5196)
• Deserialization hardening — bool-field validation (#5279) and null inner-index rejection in IDMap / BinaryFromFloat (#5239)
• Build robustness — fix non-AVX2 import SIGILL via .rodata partitioning tables (#5298), Windows ARM64 (MSVC) NEON build fix (#5274), and AVX512_SPR dispatch fix on AMD (#5281)

Full Changelog

Added

• 261d8f25aac03c980f1faf5df775248eff96cb6d Add IVFSQTurboQSearchParameters to init.pyi stub (#5304)
• 684a32d0404758bddd4f7fb9ec76db54252819e0 Add manual Faiss nightly workflow dispatch (#5300)
• 10b6b2a1e554afc4cbd66fe73d864728ff9e310c Add MetalIndexIVFFlat with IVF scan/merge kernels and expanded top-k support (#5202)
• 74d36198faac528fce715aa8731bf589727bef6d TurboQuant in ScalarQuantizer: full Algorithm 2 (QJL stage) with SIMD and optimizations (#5170)
• 506600962f8a58926710edd24715bc9002eb18e9 Add Python HNSW tutorial (#5260)
• 3cff0f419c459bdc7c4f56ea49effb6d7da1475c Add Sapphire Rapids optimizations for ScalarQuantizer (L2, IP) (#5173)
• 46ef80db639e4de03720e3c404065636846ed47e Support IndexIDMap/IndexIDMap2 in reverse_index_factory (#5266)
• 420158b10e0136228ff634d464fa90c4370a1ead Add VPOPCNTDQ-based HammingComputer for Sapphire Rapids+ (#5183)
• d8f1c2716d9c2c070c0d7e4e0c1017331e9e9e8a Implement NEON-based FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder (#5262)
• 0951b5337b72755ade5c02705396fb7d7cedceac Support user provided blas library (#5189)
• 215740ecc3add92d7c27e24436b2dffd8fdb157c SVS static vamana support (#5224)
• d24ad6ef5b3e40c0e4cf8b695923cbcd674d2573 Add is_similarity mode to HNSW (#5246)
• aa332cd5f0d6984075c849b32c387fffe067a49a Implement NEON-based FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder (#5255)
• 5d9aae6ee81078d33ff3c4e2fc97f7583e2e450d Add faiss-gpu pip wheel packaging (#5131)
• 6f1cf64531130db04843737d1f538999fc295583 Add VPOPCNTDQ-based RaBitQ kernel for Sapphire Rapids+ (#5149)

Changed

• 262fc3c7a2ec099cdd0cd21482931702171c60eb Re-enable musllinux wheels for faiss-cpu (#5299)
• 1cdc3709c656eea41ce3725024070f2516e3b30b Run CI on push to main to refresh ccache cache (#5291)
• 379ee758b1bb49cd167c6ed86e80be331e94c593 Reserve VisitedTableSet capacity to avoid rehashes during HNSW search (#5290)
• 6513a2497cbc29f5c0c74c0d17bbe8b9f6ff3230 Enable Metal by default on Apple machines (#5280)
• fe46c3c804296cc04238c2e17b02c671887791a8 Validate bool fields during deserialization (#5279)
• 480f91790080c8daa92fcb1941c5e8d0f56de237 Type imbalance_factor and wire the .pyi stub into the buck build (#5269)
• e60baeb7b61e617a483310fccb239ba204458c7b Templatize search_from_candidate_unbounded for VisitedTable devirtualization (#5270)
• c000190dc07c161898093a72a16f3918bd9fd621 Accelerate ScalarQuantizer::QT_bf16 with AVX512-BF16. (#4889)
• 7504fc8ddebdade7fcabd9dacd9861318d475b50 Upgrade CUVS Version to 26.06 (#5240)
• d12683c3b00247ca6333ac717f3a8af49aa835e3 facebook-unused-include-check in IndexBinaryIVF.cpp (#5263)
• 99d9013e1fbe232356759d3abedbe20df0e8dba1 facebook-unused-include-check in distances_simd.cpp (#5264)
• 2f0368b6205c92d910ae772417e71b68dde216aa facebook-unused-include-check in hamming_avx2.cpp (#5265)
• 0c72755eccff39f903d58ed1f46d6c278a914cae Remove unused include of platform_macros.h in partitioning.cpp
• e6b8f6de5380aed85c2450abd31ecdb749770bbe IndexHNSW: use HNSW::is_similarity for IP/similarity metrics + tests (#5226)

... (truncated)

Changelog

Sourced from faiss-cpu's changelog.

[1.14.3] - 2026-06-12

Added

• 261d8f25aac03c980f1faf5df775248eff96cb6d Add IVFSQTurboQSearchParameters to init.pyi stub (#5304)
• 684a32d0404758bddd4f7fb9ec76db54252819e0 Add manual Faiss nightly workflow dispatch (#5300)
• 10b6b2a1e554afc4cbd66fe73d864728ff9e310c Add MetalIndexIVFFlat with IVF scan/merge kernels and expanded top-k support (#5202)
• 74d36198faac528fce715aa8731bf589727bef6d TurboQuant in ScalarQuantizer: full Algorithm 2 (QJL stage) with SIMD and optimizations (#5170)
• 506600962f8a58926710edd24715bc9002eb18e9 Add Python HNSW tutorial (#5260)
• 3cff0f419c459bdc7c4f56ea49effb6d7da1475c Add Sapphire Rapids optimizations for ScalarQuantizer (L2, IP) (#5173)
• 46ef80db639e4de03720e3c404065636846ed47e Support IndexIDMap/IndexIDMap2 in reverse_index_factory (#5266)
• 420158b10e0136228ff634d464fa90c4370a1ead Add VPOPCNTDQ-based HammingComputer for Sapphire Rapids+ (#5183)
• d8f1c2716d9c2c070c0d7e4e0c1017331e9e9e8a Implement NEON-based FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder (#5262)
• 0951b5337b72755ade5c02705396fb7d7cedceac Support user provided blas library (#5189)
• 215740ecc3add92d7c27e24436b2dffd8fdb157c SVS static vamana support (#5224)
• d24ad6ef5b3e40c0e4cf8b695923cbcd674d2573 Add is_similarity mode to HNSW (#5246)
• aa332cd5f0d6984075c849b32c387fffe067a49a Implement NEON-based FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder (#5255)
• 5d9aae6ee81078d33ff3c4e2fc97f7583e2e450d Add faiss-gpu pip wheel packaging (#5131)
• 6f1cf64531130db04843737d1f538999fc295583 Add VPOPCNTDQ-based RaBitQ kernel for Sapphire Rapids+ (#5149)

Changed

• 262fc3c7a2ec099cdd0cd21482931702171c60eb Re-enable musllinux wheels for faiss-cpu (#5299)
• 1cdc3709c656eea41ce3725024070f2516e3b30b Run CI on push to main to refresh ccache cache (#5291)
• 379ee758b1bb49cd167c6ed86e80be331e94c593 Reserve VisitedTableSet capacity to avoid rehashes during HNSW search (#5290)
• 6513a2497cbc29f5c0c74c0d17bbe8b9f6ff3230 Enable Metal by default on Apple machines (#5280)
• fe46c3c804296cc04238c2e17b02c671887791a8 Validate bool fields during deserialization (#5279)
• 480f91790080c8daa92fcb1941c5e8d0f56de237 Type imbalance_factor and wire the .pyi stub into the buck build (#5269)
• e60baeb7b61e617a483310fccb239ba204458c7b Templatize search_from_candidate_unbounded for VisitedTable devirtualization (#5270)
• c000190dc07c161898093a72a16f3918bd9fd621 Accelerate ScalarQuantizer::QT_bf16 with AVX512-BF16. (#4889)
• 7504fc8ddebdade7fcabd9dacd9861318d475b50 Upgrade CUVS Version to 26.06 (#5240)
• d12683c3b00247ca6333ac717f3a8af49aa835e3 facebook-unused-include-check in IndexBinaryIVF.cpp (#5263)
• 99d9013e1fbe232356759d3abedbe20df0e8dba1 facebook-unused-include-check in distances_simd.cpp (#5264)
• 2f0368b6205c92d910ae772417e71b68dde216aa facebook-unused-include-check in hamming_avx2.cpp (#5265)
• 0c72755eccff39f903d58ed1f46d6c278a914cae Remove unused include of platform_macros.h in partitioning.cpp
• e6b8f6de5380aed85c2450abd31ecdb749770bbe IndexHNSW: use HNSW::is_similarity for IP/similarity metrics + tests (#5226)
• c0575f2c1319a702fa4ca615e2354014c42b3e67 avoid runtime checks in VisitedTable (#5234)
• 1cb760182917697677fe100f8a1cc2b4d0b9f751 Eliminate per-code denormalization in uniform SQ distance computation (#5166)
• f29d8621fa4250b381d1bfb1d8362c4867ee3de3 Revert D106693266: Implement NEON-based FINE_SIZE=2 specializations for Index2LevelDecoderImpl and IndexPQDecoder
• ef96e3d25ecbfaa52894b0f361e9d156ee92254a Updating CI to ROCm 7 (#5196)
• f5217d74960ead3a1d2c0b69baa63479b6f49ea2 facebook-unused-include-check in IndexBinaryHNSW.cpp (#5251)
• 3e6ed99bbb6cfb8daf98cadf904da449a4aaea48 facebook-unused-include-check in IndexBinaryIVF.cpp (#5252)
• 108868bfac5ad7e0ce1b4e46857d4724a62a309e Reject null inner index in IDMap and BinaryFromFloat deserialization (#5239)
• a64b5496762a93cb7836d013c2283c6da479f717 Add IndexLattice r2 limit to cap decode-cache build cost (#5238)
• 09937153dc55f64321ed7d96730fc3d673a9092d faiss: Replace remaining get_single_code calls with ScopedCodes (#5248)
• 910e435bccafedfac5aa69f87863085ce6d90a3c facebook-unused-include-check in hamming_avx2.cpp (#5242)
• d581f2f8406f8794f58794124b650ab7402ac848 Use per-SIMD TU scan for standalone PQ (AVX2 gather inlining) (#5233)

Fixed

• 20afed0fa3aefe2d4f5bf6a5f6ab1d1459efec05 make intentional cudaGetLastError() error-clears explicit ((void)) for clang21 -- fixes S674096 (#5302)
• e420e94ce694213a8338ac975d565f81d7251d96 Move partitioning shifts tables to .rodata to fix non-AVX2 import SIGILL (#5298)
• 15bd8238375a1650156dc6e4b8ea54def3a3dc23 Fix cuVS nightly (#5273)

... (truncated)

Commits

• 0ca9df4 Update backward compatibility test to v1.14.3 (#5308)
• 9104722 Increment to next release, v1.14.3 (#5307)
• 20afed0 make intentional cudaGetLastError() error-clears explicit ((void)) for clang2...
• e420e94 Move partitioning shifts tables to .rodata to fix non-AVX2 import SIGILL (#5298)
• 261d8f2 Add IVFSQTurboQSearchParameters to init.pyi stub (#5304)
• 262fc3c Re-enable musllinux wheels for faiss-cpu (#5299)
• 684a32d Add manual Faiss nightly workflow dispatch (#5300)
• 1cdc370 Run CI on push to main to refresh ccache cache (#5291)
• 379ee75 Reserve VisitedTableSet capacity to avoid rehashes during HNSW search (#5290)
• 6513a24 Enable Metal by default on Apple machines (#5280)
• Additional commits viewable in compare view

Updates google-genai to 2.12.1

Release notes

Sourced from google-genai's releases.

v2.12.1

2.12.1 (2026-07-16)

Bug Fixes

• Fix the normalization of Interactions inside triggers (be554d3)

Changelog

Sourced from google-genai's changelog.

2.12.1 (2026-07-16)

Bug Fixes

• Fix the normalization of Interactions inside triggers (be554d3)

2.12.0 (2026-07-15)

Features

• Add AntigravityAgentConfig to OpenAPI schema overlays and regenerate SDKs. (c68f857)
• Add trigger resource (0ab9525)
• Add Triggers resource to GoogleGenAI client. (60727fe)
• interactions: Add CodeMenderAgentConfig (50eca74)
• Populate per-modality prompt token count in embedding responses for gemini-embedding-2 (2ba0154)

2.11.0 (2026-07-09)

Features

• Add environment_id in network config (df5f13a)
• Add response_format and Translation_config in GenerationConfig (8928da3)
• Add retrieval result step and new fields to maps and search results (d2b19f6)
• Add Tool.exa_ai_search for Gemini Enterprise API (8928da3)
• Support Function declarations during Agent Creation (bbeb934)

Bug Fixes

• Avoid shadowing of built-in list in Python 3.14 (5a14046)
• Event loop mismatch in GenAI SDK (10df4b1)
• interactions: Accept both dict and list[dict] for transform (8c7cee3)

Documentation

• Add Agent Platform MCP example to readme (cb2a2a3)

Code Refactoring

• interactions: Remove cached_content, presence_penalty, and frequency_penalty; expose safety_settings and labels (ba552f7)

2.10.0 (2026-06-24)

Features

• Add Agent Platform MCP support to async generate_content_stream (a4772cc)

... (truncated)

Commits

• 6debc1c chore(main): release 2.12.1 (#2734)
• 94d59e5 Copybara import of the project:
• be554d3 fix: fix the normalization of Interactions inside triggers
• 939c667 chore(main): release 2.12.0 (#2696)
• 8115b16 chore: internal change
• c875069 feat: Add max_total_tokens for Interaction.
• d38eaca chore: defer mcp SDK import to first MCP usage
• 2a9350d test: add tests for private chat
• c68f857 feat: Add AntigravityAgentConfig to OpenAPI schema overlays and regenerate SDKs.
• 60727fe feat: Add Triggers resource to GoogleGenAI client.
• Additional commits viewable in compare view

Updates litellm from 1.83.1 to 1.92.0

Release notes

Sourced from litellm's releases.

v1.92.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.92.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.92.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.92.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• fix(proxy): gate team allowed_passthrough_routes to proxy admins by @​ryan-crabbe-berri in BerriAI/litellm#28097
• fix(tests): stabilize image-edit VCR cassettes to stop live gpt-image-1 spend by @​mateo-berri in BerriAI/litellm#28110
• fix(bedrock/cohere): send embedding_types as JSON array, not string by @​ishaan-berri in BerriAI/litellm#28172
• fix(tests): migrate realtime + rerank tests off shut-down upstream models by @​yuneng-berri in BerriAI/litellm#28191
• fix(caching): replay openai/responses bridge cache hits as chat streams by @​Sameerlite in BerriAI/litellm#28158
• Litellm oss staging by @​Sameerlite in BerriAI/litellm#28161
• feat(prometheus): add user_email and user_alias to user budget metrics by @​Sameerlite in BerriAI/litellm#28155
• test(callbacks): harden flaky proxy callback-leak detector by @​yuneng-berri in BerriAI/litellm#28195
• fix(bedrock): sanitize batch metadata to prevent Pydantic ValidationError by @​mateo-berri in BerriAI/litellm#28202
• fix(deepseek): use native /anthropic/v1/messages endpoint and sanitize tools by @​mateo-berri in BerriAI/litellm#28200
• feat(ui): add Interactions API endpoint to playground with SSE streaming by @​Sameerlite in BerriAI/litellm#28156
• fix(proxy): decode bytes and pass-through SSE for Google-native streamGenerateContent (#27444) by @​Sameerlite in BerriAI/litellm#28213
• refactor(bedrock/sagemaker): switch to lazy loading for response stre… by @​harish-berri in BerriAI/litellm#28189
• [Refactor] UI - Spend Logs: consolidate filter state and extract components by @​ryan-crabbe-berri in BerriAI/litellm#25847
• fix(tests): replace shut-down gpt-4o-audio-preview with gpt-audio-1.5 by @​yuneng-berri in BerriAI/litellm#28281

... (truncated)

Commits

• See full diff in compare view

Updates openai to 2.46.0

Release notes

Sourced from openai's releases.

v2.46.0

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

• api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (5a00941)
• api: add owner_project_access to APIKeyListParams (f589d04)
• api: manual updates (980f176)
• api: manual updates (2eae984)

Bug Fixes

• api: preserve generated type compatibility (00bd72a)
• api: remove beta annotation compatibility aliases (99dbd15)

Changelog

Sourced from openai's changelog.

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

• api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (5a00941)
• api: add owner_project_access to APIKeyListParams (f589d04)
• api: manual updates (980f176)
• api: manual updates (2eae984)

Bug Fixes

• api: preserve generated type compatibility (00bd72a)
• api: remove beta annotation compatibility aliases (99dbd15)

2.45.0 (2026-07-09)

Full Changelog: v2.44.0...v2.45.0

Features

• api: gpt-5.6-sol updates (039d1fe)

Bug Fixes

• api: restore beta resource accessors (2dfc130)

Chores

• retrigger release automation (7b61351)

2.44.0 (2026-06-24)

Full Changelog: v2.43.0...v2.44.0

Bug Fixes

• auth: prioritize first auth header (797e336)

2.43.0 (2026-06-17)

Full Changelog: v2.42.0...v2.43.0

Features

• api: update OpenAPI spec or Stainless config (2254235)

... (truncated)

Commits

• 0e6adb1 release: 2.46.0 (#3501)
• f16fbbd release: 2.45.0 (#3478)
• 6d9262d release: 2.44.0
• d356275 [codex] Add AWS Bedrock provider authentication (#3398)
• f47f9a2 fix(auth): prioritize first auth header
• e20b6b8 release: 2.43.0
• 4d35453 feat(api): update OpenAPI spec or Stainless config
• 2bba15e release: 2.42.0
• 1ec3e82 codegen metadata
• 93c2eca feat(api): manual updates
• Additional commits viewable in compare view

Updates pinecone to 9.1.0

Release notes

Sourced from pinecone's releases.

9.1.0

Release v9.1.0

v9.1.0 is the retry-resilience release. It overhauls how the SDK behaves under throttling: decorrelated jitter on every transport, plus automatic per-host concurrency back-off that shrinks in-flight bulk requests during a 429 storm and recovers as pressure eases. A new RateLimitError lets callers catch throttling distinctly, and a dedicated retries guide documents the full model. Secondary changes round out GrpcIndex parity with the REST clients and restore the v8 search(query={...}) request shape.

---

Highlights

• Decorrelated jitter on every transport. REST (sync and async) and gRPC now use AWS-style decorrelated jitter for retry backoff, so many clients throttled at the same moment no longer retry in lockstep.
• Automatic concurrency back-off under throttling. Bulk operations self-tune downward when the backend rate-limits a host and recover as throttling subsides — an AIMD control loop, per host, with no new knobs to configure.
• Bounded multi-namespace fan-out. AsyncIndex.query_namespaces no longer fires one unbounded request per namespace — a common cause of self-inflicted 429 storms. It's now capped at 10 in-flight.
• RateLimitError for HTTP 429. Rate-limit responses raise a dedicated pinecone.errors.RateLimitError, so you can catch throttling distinctly from other server errors.
• New retries guide at docs/guides/retries.md — defaults, jitter math, the adaptive-concurrency ceiling, and the limits of in-process retries under multi-process / serverless deployment.
• GrpcIndex parity with the REST clients. query_namespaces, query_namespaces_async, fetch_by_metadata, and the full bulk-import API now exist on GrpcIndex, so switching to grpc=True for throughput no longer loses functionality.
• Community contribution — search(query={...}) syntax from v8 has been restored. Thanks to @​pragnyanramtha, the single-argument request-body form that v9.0.x rejected works again on Index, AsyncIndex, and GrpcIndex.

---

Retry & resilience

Decorrelated jitter

REST and gRPC retries now use decorrelated jitter — each delay is drawn from a window that grows with the previous delay, capped at max_wait. This replaces the previous fixed full-jitter backoff and spreads retries from many clients across time instead of bunching them at the same instant. See the retries guide for the exact formula and defaults.

Automatic concurrency back-off

Bulk operations now self-tune their concurrency under throttling. When the backend rate-limits a host (HTTP 429/503, or gRPC RESOURCE_EXHAUSTED), the SDK reduces the number of in-flight requests it allows to that host, then recovers after a streak of successes — the same AIMD (additive-increase / multiplicative-decrease) approach used by TCP congestion control. It's per host, automatic, and requires no configuration; max_concurrency remains the ceiling the SDK tunes beneath.

RateLimitError

HTTP 429 responses now raise RateLimitError, a subclass of ApiError, so throttling can be caught distinctly from other server errors:

from pinecone.errors import RateLimitError
try:
pc.indexes.describe("my-index")
except RateLimitError:
# back off and retry, or surface to your orchestrator
...

Exported from pinecone.errors and the top-level pinecone namespace; a RateLimitException alias matches the existing exception-naming pattern.

Observability

The retry and concurrency layers emit namespaced log records with consistent key=value fields, so you can diagnose throttling from logs without adding instrumentation:

• pinecone._internal.http_client — DEBUG on each throttled retry attempt (status, host, attempt N/total, computed delay).

... (truncated)

Commits

• bb1304e release: 9.1.0
• 620933a chore(deps): bump idna from 3.11 to 3.15 in the uv group across 1 directory (...
• b0f1887 docs(retries): stop surfacing Retry-After / grpc-retry-pushback-ms
• 559ce7e revert(backcompat): drop DeprecationWarning on search(query=...)
• 366bb10 test(integration): add opt-in retry smoke test for quota-limited upserts
• 56d0e16 test(retry): add Hypothesis fuzz tests for Retry-After parsing; fix parser bugs
• 9fe9f9d fix(adaptive): bound _AdaptiveLimiterRegistry with LRU eviction at 256 entries
• 41ea434 feat(observability): log throttle events and AIMD transitions at INFO/DEBUG
• 17431f7 test(retry): add bulk-path regression tests under quota-starved backend (DX-0...
• 27d34cd test(retry): add gRPC storm simulation test and enable cross-transport parity...
• Additional commits viewable in compare view

Updates playwright to 1.61.0

Release notes

Sourced from playwright's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

context = browser.new_context()
Seed a passkey your backend provisioned for a test user.
context.credentials.create("example.com",
id=credential_id,
user_handle=user_handle,
private_key=private_key,
public_key=public_key,
)
context.credentials.install()
page = context.new_page()
page.goto("https://example.com/login")
The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

page.local_storage.set_item("token", "abc")
token = page.local_storage.get_item("token")
items = page.session_storage.items()

New APIs

• apiResponse.security_details() and apiResponse.server_addr() mirror the browser-side response.security_details() and response.server_addr().
• New option artifacts_dir in browserType.connect_over_cdp() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.show_actions() controls the cursor decoration rendered for pointer actions.
• The on_frame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

🛠️ Other improvements

• Playwright now supports Ubuntu 26.04.
• HAR and trace recordings now include WebSocket requests.

Browser Versions

• Chromium 149.0.7827.55
• Mozilla Firefox 151.0
• WebKit 26.5

This version was also tested against the following stable channels:

... (truncated)

Commits

• bd499b2 build(deps): bump typing-extensions from 4.14.1 to 4.15.0 (#3119)
• 5b318a5 build(deps): bump mypy from 1.19.1 to 2.1.0 (#3117)
• e6bfce9 build(deps): bump actions/checkout from 6 to 7 in the actions group across 1 ...
• 2b41bf8 devops(driver): assemble driver from npm package and Node.js builds (#3122)
• f75d727 feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image (#3113)
• 613c3bf chore(roll): v1.61.0 (