chore(deps): bump the python-minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the python-minor-patch group with 5 updates in the / directory:

Package	From	To
botocore	1.43.83	1.43.91
mangum	0.19.0	0.22.0
pypdf	6.16.2	6.18.0
strands-agents	1.54.0	1.55.1
strands-agents-tools	0.8.7	0.8.8

Updates botocore from 1.43.83 to 1.43.91

Commits

• 49ca08d Merge branch 'release-1.43.91'
• e312467 Bumping version to 1.43.91
• 2c5b866 Update to latest models
• dc85104 Merge branch 'release-1.43.90'
• 52ed7af Merge branch 'release-1.43.90' into develop
• b623ca1 Bumping version to 1.43.90
• b0ae819 Update endpoints model
• 107acca Update to latest models
• b4c8dd9 Bump https://github.com/astral-sh/ruff-pre-commit (#3783)
• acf9b2f Merge branch 'release-1.43.89'
• Additional commits viewable in compare view

Updates mangum from 0.19.0 to 0.22.0

Release notes

Sourced from mangum's releases.

0.22.0 - Python 3.15, tested against the real thing

Python 3.15, tested against the real thing

Mangum 0.22.0 moves the supported Python window forward and backs every release with end-to-end tests against a real Lambda runtime.

pip install mangum==0.22.0

• Python 3.15 is supported. The full suite and strict type checking pass on 3.15 (#404).
• Python 3.9 is no longer supported. The minimum is now Python 3.10 (#393).
• Adapters are now verified against a real Lambda runtime. The test suite deploys Mangum to LocalStack and drives it through a Lambda Function URL and an API Gateway REST API with real HTTP requests - covering the HTTP v2 and REST v1 event formats plus lifespan startup, instead of relying only on hand-written mock events (#400, #401).

Full changelog: 0.21.0...0.22.0

Version 0.21.0

This release reverted the previous attempt on support Python 3.14 because it was not working as expected, and added proper support for Python 3.14 with minimal changes.

• Support Python 3.14 by @​Kludex in Kludex/mangum#375
• Revert "Support Python 3.14 (#354)" by @​Kludex in Kludex/mangum#364

---

Full Changelog: Kludex/mangum@0.20.0...0.21.0

Version 0.20.0

What's Changed

• Drop support for Python 3.7 by @​Kludex in Kludex/mangum#350
• Drop support for Python 3.8 by @​Kludex in Kludex/mangum#351
• Support Python 3.14 by @​Kludex in Kludex/mangum#354

New Contributors

• @​DhyeyShah794 made their first contribution in Kludex/mangum#340

Full Changelog: Kludex/mangum@0.19.0...0.20.0

Changelog

Sourced from mangum's changelog.

0.22.0

• Add Python 3.15 support by @​Kludex in Kludex/mangum#404
• Drop Python 3.9 support by @​Kludex in Kludex/mangum#393

0.21.0

This release reverted the previous attempt on support Python 3.14 because it was not working as expected, and added proper support for Python 3.14 with minimal changes.

• Support Python 3.14 by @​Kludex in Kludex/mangum#375
• Revert "Support Python 3.14 (#354)" by @​Kludex in Kludex/mangum#364

0.20.0

• Support Python 3.14 by @​Kludex in Kludex/mangum#354

Commits

• 042ac44 Version 0.22.0 (#405)
• 4240aac Add Python 3.15 support (#404)
• 87c062e Bump starlette to 1.3.1 and require starlette>=1.0 (#402)
• 160e5a7 Bump h2 from 4.3.0 to 4.4.1 (#396)
• 9d12429 Bump pytest from 9.0.2 to 9.0.3 (#395)
• 6c398a1 Add API Gateway REST v1 and lifespan end-to-end coverage (#401)
• fde0b82 Add LocalStack integration tests via testcontainers (#400)
• cfa53c0 Enforce strict type hints on the test suite (#399)
• 8b772f6 Use pyproject.toml for coverage config and close test coverage gaps (#398)
• 3c65805 Drop Python 3.9 support (#393)
• Additional commits viewable in compare view

Updates pypdf from 6.16.2 to 6.18.0

Release notes

Sourced from pypdf's releases.

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

• Use apply_configuration as a context manager to temporarily overwrite configuration values.
• Use overwrite_configuration to change the configuration values for the whole session.

The old overwrites should continue to work in most cases. If you have migrated successfully and do not need the legacy handling anymore (which can cause some overhead), consider using the temporary disable_legacy_handling setting:

from pypdf import overwrite_configuration
overwrite_configuration(disable_legacy_handling=True)

In case you are experiencing some unexpected issues after the migration, consider opening a new issue (or commenting on an existing one) with the necessary details to reproduce it.

Security (SEC)

• Limit allowed length of indirect object tokens (#4055) by @​stefan6419846

Deprecations (DEP)

• Rework configuration value handling (#4044) by @​stefan6419846

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033) by @​PJBrs

Full Changelog

Version 6.17.0, 2026-09-04

What's new

Security (SEC)

• Limit value for Roman numerals (#4047) by @​stefan6419846

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032) by @​PJBrs

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036) by @​petermik68-sudo

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026) by @​Anai-Guo
• Detect a duplicate dictionary key whose first value is falsy (#4024) by @​devYRPauli
• Make is_open=False collapse outline items (#3998) by @​SomSamantray

Robustness (ROB)

• Multiple changes for wrong inputs by @​RavSinghChandan

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

Full Changelog

Version 6.17.0, 2026-09-04

Security (SEC)

• Limit value for Roman numerals (#4047)

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032)

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036)

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026)
• Detect a duplicate dictionary key whose first value is falsy (#4024)
• Make is_open=False collapse outline items (#3998)

Robustness (ROB)

• Multiple changes for wrong inputs
• Skip trailing duplicate %%EOF markers when locating startxref (#4015)
• Do not crash on a non-array destination (#3976)
• Handle annotations without subtype during merge (#3999)

Documentation (DOC)

• Use AnnotationFlag enum instead of plain integers (#3997)

Code Style (STY)

• Multiple small changes detected from test runs

Full Changelog

Commits

• 18e4c22 REL: 6.18.0
• 82501d2 SEC: Limit allowed length of indirect object tokens (#4055)
• d35834b ENH: Draw borders and backgrounds for appearance streams and annotations (#4033)
• 4b16bbb STY: Rename variable for readability (#4049)
• a1ce7fb ROB: Do not crash when a page tree entry is not a dictionary (#4048)
• 06b97ce DEV: Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#4053)
• d3f790c ROB: Do not crash when the annotations are not an array (#4046)
• 3dc716e STY: Enforce lowercase function variables (#4045)
• ec2406f DEP: Rework configuration value handling (#4044)
• c76eed7 REL: 6.17.0
• Additional commits viewable in compare view

Updates strands-agents from 1.54.0 to 1.55.1

Release notes

Sourced from strands-agents's releases.

python/v1.55.1

Auto-drafted from commits in python/v1.55.0..python/v1.55.1, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

• feat(vended-tools): port notebook tool to Python (#4132) (545d9ed07)
• feat(bidi): simplify Google and OpenAI model configs (#4189) (6d4f61f28)
• feat(python): add backgroundTasks to Agent (#4226) (42e5a61bd)

🐛 Fixes

• fix(session): filter malformed immutable snapshot IDs (#4199) (6d6c8fcea)
• fix(telemetry): use semantic system instructions for agent spans (#4222) (e5ebbd67d)
• fix(models): resolve nested Bedrock model prefixes (#4221) (21b27d404)
• fix(context): fix various context manager parity items (#4228) (bebf3e83c)
• fix(openai): emit tool results before user text to preserve tool_use/tool_result adjacency (#4234) (5f636bbc2)

📚 Documentation

• docs(changelog): sync strands-agents/harness-sdk python/v1.55.0 (#4238) (57d070582)
• docs(changelog): sync strands-agents/harness-sdk typescript/v1.17.0 (#4239) (1317a4306)

python/v1.55.0

Auto-drafted from commits in python/v1.54.0..python/v1.55.0, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

• feat: export context manager types as experimental (#4231) (ec6eb54a5)
• feat: accept cache_config on Ollama, Writer, and SageMaker (#4232) (42aedfc03)
• feat(context-py): port stash integration (#4187) (a642b4177)
• feat(mcp): add prefix_with_server_name and continue_on_error defaults to load_servers (#4177) (def3be9b4)
• feat(context-py): port offloading stratgies (#4146) (e3f3ee49d)
• feat(bidi): add AudioCapable and typed model config (#4144) (d83525171)
• feat(mcp-py): relax mcp version to <2.2 (#4151) (24e556b74)
• feat(context-manager): add session support for L1 (#4118) (3f2ee2fe6)
• feat(mcp/py): support SEP-2663 tasks (#4125) (83982c2e5)
• feat(python): add internal in-process task engine / manager (#4115) (726478d0f)
• feat!: require Node.js 22+, drop Node 20 support (#4145) (24bc5c3d5)
• feat(py): add web_fetch vended tool (#4001) (8cd82e63a)
• feat(bidi): implement LocalAgent (#4108) (d1da8a050)
• feat: add cache config to llama.cpp (#4127) (9be952fde)
• feat: support caching for vercel provider (#4055) (a02c1db8c)
• feat(mcp-py): extend MRTR to prompts and resources, scope hand-sent cancel to 1.x (#4121) (582bb4803)
• feat(mcp-py): refresh tools on list-changed notifications for 2.x (#4112) (27a30e05a)
• feat(mcp-py): added MRTR input-required support for 2.x (#4094) (47b9dadd4)
• feat(bidi): add reconnect() for openai (#4104) (48d360d52)
• feat(agent): add LocalAgent protocol (#4091) (577a9d6a1)
• feat(models): add tools_ttl to CacheConfig and deprecate cache_tools (#3893) (#3985) (8e403d780)

... (truncated)

Commits

• 545d9ed feat(vended-tools): port notebook tool to Python (#4132)
• 6d6c8fc fix(session): filter malformed immutable snapshot IDs (#4199)
• e5ebbd6 fix(telemetry): use semantic system instructions for agent spans (#4222)
• 6d4f61f feat(bidi): simplify Google and OpenAI model configs (#4189)
• 42e5a61 feat(python): add backgroundTasks to Agent (#4226)
• 21b27d4 fix(models): resolve nested Bedrock model prefixes (#4221)
• bebf3e8 fix(context): fix various context manager parity items (#4228)
• 5f636bb fix(openai): emit tool results before user text to preserve tool_use/tool_res...
• 57d0705 docs(changelog): sync strands-agents/harness-sdk python/v1.55.0 (#4238)
• 1317a43 docs(changelog): sync strands-agents/harness-sdk typescript/v1.17.0 (#4239)
• Additional commits viewable in compare view

Updates strands-agents-tools from 0.8.7 to 0.8.8

Release notes

Sourced from strands-agents-tools's releases.

v0.8.8

Auto-drafted from commits in v0.8.7..v0.8.8, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🐛 Fixes

• fix(mem0): make memory_id ownership check fail-closed (#596) (fd4feb0)
• fix(http_request): strip non-standard headers on cross-host redirects (#595) (64db9d7)

Commits

• fd4feb0 fix(mem0): make memory_id ownership check fail-closed (#596)
• 64db9d7 fix(http_request): strip non-standard headers on cross-host redirects (#595)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.