Bump python-dotenv from 1.1.1 to 1.2.2 in /python/samples/demos/mcp_with_oauth/server - #14369
Conversation
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.1.1 to 1.2.2. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.1.1...v1.2.2) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): ddbc3de4f4a8
Model: claude-opus-4.8
Overview
This is a Dependabot transitive-dependency bump confined to a single sample lockfile, python/samples/demos/mcp_with_oauth/server/uv.lock, raising python-dotenv 1.1.1 → 1.2.2 and, via uv re-resolution, adding Python 3.14/3.15 wheels and splitting pydantic, pydantic-core, and typing-inspection by a python_full_version >= '3.14' marker. The change is internally consistent: the marker split forms a complete four-quadrant partition, every version reference resolves to a present [[package]] node, and every new sdist/wheel carries an explicit sha256 pin that matches PyPI. The python-dotenv breaking changes affect only the write APIs (set_key/unset_key), which this read-only sample never invokes, and the sample is isolated from build/CI, so residual risk is negligible.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
|
Looks like python-dotenv is up-to-date now, so this is no longer needed. |
|
Superseded by #14385 |
### Motivation and Context Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies. ### Description Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest `main`. The incompatible MCP 2.x and Python 3.10 `onnxruntime-genai` updates are excluded, the private-feed-only `@humanfs/node` update is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency. ### Related Issue Supersedes: - microsoft#14177 - microsoft#14179 - microsoft#14180 - microsoft#14190 - microsoft#14209 - microsoft#14230 - microsoft#14233 - microsoft#14254 - microsoft#14257 - microsoft#14259 - microsoft#14260 - microsoft#14261 - microsoft#14271 - microsoft#14272 - microsoft#14273 - microsoft#14274 - microsoft#14276 - microsoft#14280 - microsoft#14282 - microsoft#14299 - microsoft#14300 - microsoft#14335 - microsoft#14337 - microsoft#14338 - microsoft#14339 - microsoft#14357 - microsoft#14358 - microsoft#14361 - microsoft#14365 - microsoft#14366 - microsoft#14367 - microsoft#14368 - microsoft#14369 ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rogerbarreto <19890735+rogerbarreto@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
Bumps python-dotenv from 1.1.1 to 1.2.2.
Release notes
Sourced from python-dotenv's releases.
... (truncated)
Changelog
Sourced from python-dotenv's changelog.
Commits
36004e0Bump version: 1.2.1 → 1.2.2eb20252docs: update changelog for v1.2.2790c5c0Merge commit from fork43340daRemove the use ofshin tests (#612)09d7ceedocs: clarify override behavior and document FIFO support (#610)c8de288ci: improve workflow efficiency with best practices (#609)7bd9e3dAdd Windows testing to CI (#604)1baaf04Drop Python 3.9 support and update to PyPy 3.11 (#608)4a22cf8ci: enable testing on Python 3.14t (free-threaded) (#588)e2e8e77Fix license specifier (#597)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.