[dependabot]

Bumps the minor-and-patch group with 5 updates in the /mcp/cloud_storage_tool directory:

Package	From	To
google-cloud-storage	3.15.0	3.17.1
boto3	1.43.104	1.43.123
azure-storage-blob	12.30.3	12.31.1
authlib	1.8.0	1.9.2
python-multipart	0.0.32	0.0.33

Updates google-cloud-storage from 3.15.0 to 3.17.1

Release notes

Sourced from google-cloud-storage's releases.

google-cloud-storage: v3.17.1

3.17.1 (2026-10-15)

Bug Fixes

• storage: set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (#18703) (a9ca134)

google-cloud-storage: v3.17.0

3.17.0 (2026-10-08)

Features

• storage: add OpenTelemetry metrics gating and configuration module (#18407) (654e768)

Changelog

Sourced from google-cloud-storage's changelog.

Changelog

PyPI History

3.17.0 (2026-10-29)

Features

• update API sources and regenerate (#18889) (8705243)

3.16.0 (2026-10-01)

Features

• declare Python3.15 support (8775794)

Commits

• 2d29c31 chore: release main (#18608)
• 7032a89 fix(gapic-generator): resolve showcase-mypy incompatible redefinition and add...
• 9025061 fix(bigquery): remove PendingDeprecationWarning from RowIterator.to_arrow (#1...
• 3743ff0 perf(spanner): avoid allocating empty RequestOptions on read and query paths ...
• a9ca134 fix(storage): set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (...
• 09a3823 refactor(bigquery): move Arrow query result reading to _arrow_query (#18644)
• 939bdd0 feat(bigquery-storage): add Arrow options and cancel to read_rows (#18643)
• 8e640e0 chore(deps): update dependency nox to v2026 (#18681)
• 706ced0 chore(deps): update dependency shapely to v2.2.0 (#18694)
• af32b51 chore(deps): update dependency typing-extensions to v4.16.0 (#18697)
• Additional commits viewable in compare view

Updates boto3 from 1.43.104 to 1.43.123

Commits

• 6334d9f Merge branch 'release-1.43.123'
• 51224ed Bumping version to 1.43.123
• 3dfd2b6 Add changelog entries from botocore
• f89caef Merge branch 'release-1.43.122'
• f0464ef Merge branch 'release-1.43.122' into develop
• 5af8c5f Bumping version to 1.43.122
• 1af5d47 Add changelog entries from botocore
• cc2e975 Merge branch 'release-1.43.121'
• 807ecf8 Merge branch 'release-1.43.121' into develop
• 21a159b Bumping version to 1.43.121
• Additional commits viewable in compare view

Updates azure-storage-blob from 12.30.3 to 12.31.1

Release notes

Sourced from azure-storage-blob's releases.

azure-storage-blob_12.31.1

12.31.1 (2026-10-20)

Bugs Fixed

• Fixed UTC conversion of timezone-aware datetimes in generate_account_sas, generate_container_sas, generate_blob_sas, and BlobServiceClient.get_user_delegation_key (sync and async). Datetimes without timezone information continue to be treated as UTC.
• Fixed an issue where certain headers were not being properly redacted when DEBUG logging was enabled.

azure-storage-blob_12.31.0

12.31.0 (2026-09-30)

This version and all future versions will require Python 3.10+. Python 3.9 is no longer supported.

Features Added

• Stable release of features from 12.31.0b1
• Added list support to BlobSasPermissions for use with directory-scoped SAS tokens.

Bugs Fixed

• Fixed an issue where destination_snapshot on a blob's copy properties was always None when listing blobs with response_format="arrow".

Commits

• 484b491 Sync eng/ and Storage CI files from main
• 4ab6ad9 [Storage] Prepare patch releases (#49611)
• 70d82d5 Sync more from main
• 0be3312 2026-09-29 -> 2026-09-30 changelog entries
• 9c0768f [Storage] Prep for STG104 GA Release (#49263)
• a124f0e [Storage] Add 12.30.3 bug fix to release branch (#49140)
• 329cc23 reject headers with \r or \n (#49070)
• 7e753be [Storage] Prepare STG 104 GA release (#48791)
• 9733992 [Storage] Update main CHANGELOG after patch (#48783)
• bdef02f added headers to redirect cleanup logic (#48771)
• Additional commits viewable in compare view

Updates authlib from 1.8.0 to 1.9.2

Release notes

Sourced from authlib's releases.

v1.9.2

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-2

Full Changelog: authlib/authlib@v1.9.1...v1.9.2

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

• Use scriv to handle the changelog by @​azmeuk in authlib/authlib#954

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

• feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @​BinoyOza-okta in authlib/authlib#898
• Fix empty signatures validation in JWS JSON deserialization by @​loporto in authlib/authlib#938
• fix(jose): reject boolean values for NumericDate claims by @​cpruijsen in authlib/authlib#942
• fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @​cpruijsen in authlib/authlib#943
• OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @​juneja-varun in authlib/authlib#929
• docs: add i18n wrappers in conf.py and templates by @​hwhsu1231 in authlib/authlib#901
• fix(oauth): enforce JOSE key, scope, and audience validation by @​lepture in authlib/authlib#945
• AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @​ckarnell in authlib/authlib#924
• fix(oauth): enforce nonce and JAR request validation by @​lepture in authlib/authlib#949
• fix(oauth): require client authentication for ID-JAG grants by @​lepture in authlib/authlib#955

New Contributors

• @​BinoyOza-okta made their first contribution in authlib/authlib#898
• @​loporto made their first contribution in authlib/authlib#938
• @​cpruijsen made their first contribution in authlib/authlib#942
• @​juneja-varun made their first contribution in authlib/authlib#929
• @​hwhsu1231 made their first contribution in authlib/authlib#901
• @​ckarnell made their first contribution in authlib/authlib#924

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

Commits

• d74dc90 chore: release 1.9.2
• 44c9617 fix(oauth): limit ID-JAG access tokens to the scope claim
• 46b9487 chore: release 1.9.1
• abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
• 1bd2a31 Merge commit from fork
• 311da11 docs: more detailed PKCE instructions
• 873f72c docs: rpinitiated instructions
• 4ff30db Merge commit from fork
• 9a86ff3 docs: rpinitiated sequence chart
• 1c35757 docs: RFC 9101 sequence chart
• Additional commits viewable in compare view

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33

• Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
• Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
• UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
• Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
• parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

• Faster opening boundary matching (#328). Complete boundaries are matched in one step.
• Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
• Faster querystring callback dispatch (#316).

🐍 Python support

• Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
• Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

• Drop Python 3.10 support #329.
• Add Python 3.15 support #350.
• Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
• Normalize the content type returned by parse_options_header when the header has parameters #287.
• Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
• Keep only the incomplete escape when quoted-printable data is split across writes #355.
• Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
• Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
• Speed up parser state lookups #330.
• Speed up opening boundary matching #328.
• Speed up querystring callback dispatch #316.

Commits

• 9217f26 Bump version to 0.0.33 (#357)
• d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
• 44871df Handle nameless uploads when keeping the filename or extension (#343)
• b21ea59 Add streaming field limits to FormParser (#333)
• 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
• 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
• 95f6376 Use the shared security policy (#353)
• 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
• d7af81c Rewrite README for newcomers (#351)
• b035d14 Add Python 3.15 classifier (#350)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions