Update all non-major dependencies

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Confidence
isort (changelog)	>=5.12,<6.1 -> >=6.1,<7
openai	>=1.102,<1.103 -> >=1.109,<1.110
pytest-mock (changelog)	>=3.12,<3.15 -> >=3.15,<3.16
semgrep	>=1.134,<1.135 -> >=1.139,<1.140

---

Release Notes

PyCQA/isort (isort)

v6.1.0

Compare Source

Changes

• Update docs discussions channel (#​2410) @​staticdev
• Add python 3.14 classifier and badge (#​2409) @​staticdev
• Drop use of non-standard pkg_resources API (#​2405) @​dvarrazzo
• Use working isort version in pre-commit example (#​2402) @​iainelder
• fix typo in _get_files_from_dir_cached test (#​2392) @​tiltingpenguin
• Resolve bandit warnings (#​2379) @​kurtmckee
• Add tox for cross-platform, parallel test suite execution (#​2378) @​kurtmckee
• Add Project URLs to PyPI Side Panel (#​2387) @​guillermodotn
• Fix typos (#​2376) @​co63oc

👷 Continuous Integration

• Add make bash scripts portable (#​2377) @​staticdev

📦 Dependencies

• Bump actions/checkout from 4 to 5 in the github-actions group (#​2406) @​dependabot[bot]
• Bump astral-sh/setup-uv from 5 to 6 in the github-actions group (#​2395) @​dependabot[bot]

openai/openai-python (openai)

v1.109.1

Compare Source

Full Changelog: v1.109.0...v1.109.1

Bug Fixes

• compat: compat with pydantic<2.8.0 when using additional fields (5d95ecf)

v1.109.0

Compare Source

Full Changelog: v1.109.0...v1.109.1

Bug Fixes

• compat: compat with pydantic<2.8.0 when using additional fields (5d95ecf)

v1.108.2

Compare Source

Full Changelog: v1.108.2...v1.109.0

Features

• api: gpt-5-codex (34502b5)

v1.108.1

Compare Source

Full Changelog: v1.108.1...v1.108.2

Bug Fixes

• api: fix mcp tool name (fd1c673)

Chores

• api: openapi updates for conversations (3224f6f)
• do not install brew dependencies in ./scripts/bootstrap by default (6764b00)
• improve example values (20b58e1)

v1.108.0

Compare Source

Full Changelog: v1.108.0...v1.108.1

Features

• api: add reasoning_text (18d8e12)

Chores

• types: change optional parameter type from NotGiven to Omit (acc190a)

v1.107.3

Compare Source

Full Changelog: v1.107.3...v1.108.0

Features

• api: type updates for conversations, reasoning_effort and results for evals (c2ee28c)

Chores

• internal: update pydantic dependency (369d10a)

v1.107.2

Compare Source

Full Changelog: v1.107.2...v1.107.3

Chores

• api: docs and spec refactoring (9bab5da)
• tests: simplify get_platform test (0b1f6a2)

v1.107.1

Compare Source

Full Changelog: v1.107.1...v1.107.2

Chores

• api: Minor docs and type updates for realtime (ab6a10d)
• tests: simplify get_platform test (01f03e0)

v1.107.0

Compare Source

Full Changelog: v1.107.0...v1.107.1

Chores

• api: fix realtime GA types (570fc5a)

v1.106.1

Compare Source

Full Changelog: v1.106.1...v1.107.0

Features

• api: ship the RealtimeGA API shape (dc319d8)

Chores

• internal: codegen related update (b79b7ca)

v1.106.0

Compare Source

Full Changelog: v1.106.0...v1.106.1

Chores

• internal: move mypy configurations to pyproject.toml file (ca413a2)

v1.105.0

Compare Source

Full Changelog: v1.105.0...v1.106.0

Features

• client: support callable api_key (#​2588) (e1bad01)
• improve future compat with pydantic v3 (6645d93)

v1.104.2

Compare Source

Full Changelog: v1.104.2...v1.105.0

Features

• api: Add gpt-realtime models (8502041)

v1.104.1

Compare Source

Full Changelog: v1.104.1...v1.104.2

Bug Fixes

• types: add aliases back for web search tool types (2521cd8)

v1.104.0

Compare Source

Full Changelog: v1.104.0...v1.104.1

Chores

• api: manual updates for ResponseInputAudio (0db5061)

v1.103.0

Compare Source

Full Changelog: v1.103.0...v1.104.0

Features

• types: replace List[str] with SequenceNotStr in params (bc00bda)

Bug Fixes

• types: update more types to use SequenceNotStr (cff135c)
• types: update some types to SequenceNotStr (03f8b88)

Chores

• remove unused import (ac7795b)

pytest-dev/pytest-mock (pytest-mock)

v3.15.1

Compare Source

2025-09-16

• #&#8203;529 <https://github.com/pytest-dev/pytest-mock/issues/529>_: Fixed itertools._tee object has no attribute error -- now duplicate_iterators=True must be passed to mocker.spy to duplicate iterators.

v3.15.0

Compare Source

2025-09-04

• Python 3.8 (EOL) is no longer supported.
• #&#8203;524 <https://github.com/pytest-dev/pytest-mock/pull/524>_: Added spy_return_iter to mocker.spy, which contains a duplicate of the return value of the spied method if it is an Iterator.

returntocorp/semgrep (semgrep)

v1.139.0

Compare Source

Added

• --pro-intrafile scans will now add built-in taint propagators, like --pro does,
  hence producing extra findings. For example, in Java, list.add(taint) will now
  make list tainted even if the rule does not explicitly request that. Scan times
  should not be generally affected in a significant way. (code-9103)
• Scala: Enable pattern { ... } to match partial functions like { case 1 => "1" }. (code-9106)
• Associate Containerfiles with the dockerfile language (gh-11091)

Changed

• Rule parsing now happens solely in OCaml. This should have no change in the behavior of whether a rule successfully parses or not, but will change the parse errors emitted (#​4346, #​4269, #​4379) (gh-4379)
• MCP: Removed the config parameter from the semgrep_scan tools, to prevent
  agents from inserting unwanted config files to scan with. (saf-2258)

Fixed

• scala: Fixed matching of { case ... => ... } patterns. (code-9111)
• Fixed a bug preventing metavariable-comparisons with more than two subsequent "and" or "or" conditions from producing findings. For example, the condition $X > 1 or $Y > 1 or $Z > 1 would previously always evaluate to false. Now, it will behave as expected. (gh-11209)
• MCP: Fixed an issue where the semgrep_scan tool, when invoking the RPC-based
  scanning approach, would return JSON output not consistent with the CLI tool. (saf-2250)
• MCP: The semgrep_findings tool now gives a suitable error message when erring due
  to insufficient permissions on standard semgrep login tokens. (saf-2254)
• MCP: Fixed a bug where if the user is already logged in when running the setup flow,
  the Semgrep Pro Engine installation step would be ignored. (saf-2259)

v1.138.0

Added

• pro: scala: Method dispatching through traits (code-9092)

Changed

• Pro: additionally improved prefiltering for taint rules, especially when using
  taint labels. This allows for the generation of more specific conditions than
  the previously released version (v1.133.0). (code-9097)

Fixed

• pro: python: Fix resolution of implicit namespace modules (code-9008)
• We now filter SEMGREP_APP_TOKEN from any request made to non semgrep URLs
  passed to -f/-c/--config during config/rules fetching. (gh-11016)
• Typescript: Made it so that the pattern var $X = $FUNC($REQ, $RES, ...) {...}
  no longer fails to parse. (saf-2159)
• pro: improved performance of tsconfig.json matching for Typescript projects
  that contain multiple tsconfig.jsons. (saf-2163)
• Semgrep no longer fails to validate a config when a rule lang is capitalized (Introduced 1.137.0) (saf-2247)

v1.137.0

Compare Source

Added

• pro: typescript: Improved name resolution for destructuring parameters. (code-9088)
• Added a new semgrep mcp subcommand, which runs the Semgrep MCP server, which previously
  used to live at https://github.com/semgrep/mcp. That repository will be deprecated
  as of this release, and future MCP contributions / issues should go into this repo. (saf-2239)

Changed

• Update semgrep-interfaces to only accept valid lanugage keys for editor (PR-4600)
• The minimum Python version for Semgrep is now 3.10. We are dropping support for Python 3.9.

Fixed

• Fix incorrect interpretation of \# and \ in glob patterns found in
  Semgrepignore and included Gitignore files. (fix-glob-escape)
• Removed pkg_resources is deprecated warning by bumping opentelemetry-*
  packages (gh-11069)
• Fixes an issue in Dart language processing to return better results (gh-11173)

v1.136.0

Compare Source

No significant changes.

v1.135.0

Compare Source

No significant changes.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud