chore(deps): bump the python-minor-patch group with 6 updates

[dependabot]

Bumps the python-minor-patch group with 6 updates:

Package	From	To
boto3	1.43.106	1.43.108
pytz	2026.4	2026.5
commitizen	4.19.0	4.19.1
litellm	1.103.2	1.104.0
hypothesis	6.168.3	6.168.4
lefthook	2.1.16	2.1.17

Updates boto3 from 1.43.106 to 1.43.108

Commits

• e19423d Merge branch 'release-1.43.108'
• 3bc7624 Bumping version to 1.43.108
• fcf08ca Add changelog entries from botocore
• 402e09c Merge branch 'release-1.43.107'
• 65340de Merge branch 'release-1.43.107' into develop
• 4d32164 Bumping version to 1.43.107
• e6738b9 Add changelog entries from botocore
• c2a321b Bump https://github.com/astral-sh/ruff-pre-commit (#4855)
• fac0859 Merge branch 'release-1.43.106' into develop
• See full diff in compare view

Updates pytz from 2026.4 to 2026.5

Commits

• 21be17f Add Python 3.14 to test suite
• fddd01c Bump version numbers to 2026.5 (2026e)
• 8f05ab3 IANA 2026e
• d79605f Squashed 'tz/' changes from d633fe7ed3..db07415c7d
• See full diff in compare view

Updates commitizen from 4.19.0 to 4.19.1

Release notes

Sourced from commitizen's releases.

v4.19.1 (2026-10-03)

Refactor

• bump: use VersionIncrement ordering for bump detection (#2097)

Changelog

Sourced from commitizen's changelog.

v4.19.1 (2026-10-03)

Refactor

• bump: use VersionIncrement ordering for bump detection (#2097)

Commits

• b2eb0cb bump: version 4.19.0 → 4.19.1
• 667de74 refactor(bump): use VersionIncrement ordering for bump detection (#2097)
• 642b8be docs: add galaxy provider plugin docs (#2096)
• cc2f522 docs: document additional_dependencies for pre-commit plugin hooks
• 6eec06e docs(cli/screenshots): update CLI screenshots
• See full diff in compare view

Updates litellm from 1.103.2 to 1.104.0

Release notes

Sourced from litellm's releases.

v1.104.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• build(deps): re-suppress GHSA-h7x2-h6g9-p789 in osv-scan, mlflow still has no fixed release by @​devin-ai-integration[bot] in BerriAI/litellm#41036
• feat(auth): add breached password detection to password policy by @​ojensen-berri in BerriAI/litellm#39321
• feat(auth): add self-service password change and plug plaintext password leaks by @​ojensen-berri in BerriAI/litellm#39562
• feat(auth): force password reset for breached or admin-set passwords by @​ojensen-berri in BerriAI/litellm#40107
• perf(proxy): serialize /model/info listing once with orjson by @​devin-ai-integration[bot] in BerriAI/litellm#41061
• fix(utils): stop wrapper_async submitting the sync success handler twice by @​devin-ai-integration[bot] in BerriAI/litellm#41058
• test(integration): native responses and messages cost cases by @​devin-ai-integration[bot] in BerriAI/litellm#42010
• fix(proxy): stop re-sending un-resendable spend batches from the Redis buffer by @​devin-ai-integration[bot] in BerriAI/litellm#41994
• fix(router): skip cooldown for background response cost poll 404s by @​devin-ai-integration[bot] in BerriAI/litellm#42046
• fix(router): stamp model_group when retrieving a batch, so batch tokens are attributable (internal copy of #38499) by @​devin-ai-integration[bot] in BerriAI/litellm#42062
• test(mcp): restore scoped execution and credential isolation regressions by @​joshua-berri in BerriAI/litellm#42050
• feat(proxy)!: refuse to start with an unset, empty, or publicly known master key by @​ryan-crabbe-berri in BerriAI/litellm#42019
• docs: stop advertising sk-1234 as the master key in shipped configs and examples by @​ryan-crabbe-berri in BerriAI/litellm#42011
• test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden by @​devin-ai-integration[bot] in BerriAI/litellm#42061
• fix(router): add NotFoundErrorRetries so a retry policy can pin 404 retries by @​devin-ai-integration[bot] in BerriAI/litellm#42045

... (truncated)

Commits

• 7964577 Merge pull request #44397 from BerriAI/litellm_fix_d03a47
• 5bb3b88 fix(proxy-extras): keep the post-migration sanity check from building the han...
• 5aa0cd0 chore(release): backport part of #43902 and #43983 to rc/1.104.0 (#44332)
• 31d6c60 chore(release): backport #44283 and part of #44229 to rc/1.104.0 (#44312)
• 656daa0 chore(release): backport #44277 to rc/1.104.0 and bump oauthlib (#44304)
• a1f27fc test: fix three order-dependent and timing-flaky tests (#44271) (#44280)
• 6e747b0 test(integration): opt the config pass-through spend-log case into auth (#44267)
• 2e5981c Merge pull request #44224 from BerriAI/litellm_rc_1_104_0_extras_post1
• 13d3ba8 chore: bump litellm-proxy-extras to 0.4.102.post1
• e012755 Merge pull request #44206 from BerriAI/litellm_rc_1_104_0_enforce_migration_c...
• Additional commits viewable in compare view

Updates hypothesis from 6.168.3 to 6.168.4

Commits

• d862501 Bump hypothesis version to 6.168.4 and update changelog
• de4ec1c Merge pull request #4887 from HypothesisWorks/create-pull-request/patch
• 8a80889 add pypy312 support
• 9ee265d Update pinned dependencies
• See full diff in compare view

Updates lefthook from 2.1.16 to 2.1.17

Release notes

Sourced from lefthook's releases.

v2.1.17

Changelog

• 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
• c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
• 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
• 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)

Changelog

Sourced from lefthook's changelog.

Change log

2.2.1

• feat: support php composer (#1583) by @​mrexox
• fix: generate different patch names when in a worktree (#1582) by @​mrexox
• refactor: cache paths in wrapper (#1570) by @​mrexox

2.2.0

• fix: don't write an install-time lefthook path into AI hook configs (#1544) by @​anandghegde
• docs: publish JSON schema at lefthook.dev/schema.json (#1579) by @​BUTTERFINGERS7498
• fix: pass --output path to git diff as a single argument (#1581) by @​cpruijsen
• fix: ignore trailing NUL in --files-from-stdin (#1574) by @​jasonwbarnett
• deps: October 2026 (#1571) by @​mrexox

2.1.7

• fix: don't hash submodules when checking fail_on_changes (#1566) by @​tiagovilasboas
• refactor: naming of helpers (#1568) by @​mrexox
• fix: diff push files against the merge base with the default branch (#1565) by @​mrexox
• refactor: working with git (#1564) by @​mrexox
• docs: add protect-branch example to docs (#1563) by @​vim89

Commits

• 3064549 2.1.17: improve submodules and push_files support
• c12bccd fix: don't hash submodules when checking fail_on_changes (#1566)
• 03225ef refactor: naming of helpers (#1568)
• 8d8073d fix: diff push files against the merge base with the default branch (#1565)
• 66746ac refactor: working with git (#1564)
• 8824fa7 docs: add protect-branch example to docs (#1563)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions