[dependabot]

Bumps the minor-and-patch group with 12 updates in the /a2a/file_organizer directory:

Package	From	To
langgraph	1.2.12	1.2.19
langchain-core	1.6.6	1.7.4
langchain-openai	1.6.6	1.7.3
openinference-instrumentation-langchain	0.1.76	0.1.81
pydantic-settings	2.15.0	2.16.2
opentelemetry-exporter-otlp	1.45.0	1.45.2
opentelemetry-proto	1.45.0	1.45.2
python-multipart	0.0.32	0.0.33
aiohttp	3.14.3	3.14.5
langsmith	0.14.1	0.14.17
orjson	3.12.0	3.13.0
pyasn1	0.6.4	0.6.5

Updates langgraph from 1.2.12 to 1.2.19

Release notes

Sourced from langgraph's releases.

langgraph==1.2.19

Changes since 1.2.18

• release(langgraph): 1.2.19 (#9504)
• release(checkpoint-sqlite): 3.1.3 (#9505)
• fix(langgraph): keep trace_policy from rewriting streamed node payloads (#9486)
• fix(langgraph): give messages and tools events the namespace of their graph (#9458)
• chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph (#9433)
• fix(langgraph): emit node-output messages from a graph streamed inside a node (#9463)
• fix(langgraph): respect subgraphs=False in RemoteGraph.stream under a streaming parent (#9453)
• fix(langgraph): don't report a paused tool as failed on the tools stream (#9406)
• fix(langgraph): return an awaited @​task's value while streaming (#9407)
• feat(langgraph): list ToolNode tool names in graph node metadata (#9449)

langgraph==1.2.18

Changes since 1.2.17

• release(checkpoint): 4.3.1 (#9447)
• release(langgraph): 1.2.18 (#9445)
• fix(langgraph): let error_handler recover on every path and stream failed task results (#9408)
• feat(langgraph): default delta snapshots to 100 updates (#9420). DeltaChannel now takes a full snapshot every 100 updates instead of 1000: faster reads on long threads, more storage. Pass snapshot_frequency=1000 to keep the old behavior.
• fix(langgraph): stream the last checkpoint of a run stopped by interrupt_after or the recursion limit (#9409)
• fix(langgraph): stop duplicating tags at every subgraph level (#9400)
• chore(deps): bump opentelemetry-api from 1.39.1 to 1.45.1 in /libs/langgraph (#9424)
• chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/langgraph (#9426)

langgraph==1.2.17

Changes since 1.2.16

• release(langgraph): 1.2.17 (#9418)
• fix(langgraph): apply an explicit recursion_limit equal to the default (#9417)
• fix(langgraph): keep the caller's namespace in RemoteGraph.stream(subgraphs=True) (#9401)
• chore(deps): remove precautionary third-party upper bounds (#9390)
• chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/langgraph (#9375)
• chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 6 updates (#9150)

langgraph==1.2.16

Changes since 1.2.15

• release(langgraph): 1.2.16 (#9334)
• fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
• fix(langgraph): apply a resumed Command's update once (#9322)
• fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (#9315)
• fix(langgraph): save a resumed exit run's pending writes once (#9314)
• release(prebuilt): 1.1.1 (#9316)
• release(checkpoint-postgres): 3.2.0 (#9313)
• feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver (#9290)
• fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer (#9302)
• release(checkpoint-postgres): 3.1.3 (#9287)
• release(checkpoint-sqlite): 3.1.2 (#9288)

... (truncated)

Commits

• 5bd231c release(langgraph): 1.2.19 (#9504)
• 3eaf06c release(checkpoint-sqlite): 3.1.3 (#9505)
• 6fab323 release(sdk-py): 0.4.11 (#9503)
• 8d5637b fix(langgraph): keep trace_policy from rewriting streamed node payloads (#9486)
• 1f0cf81 fix(langgraph): give messages and tools events the namespace of their graph (...
• 6f2df05 test(sdk-py): check that a reconnect loop resumes after the newest event (#9483)
• ffc3336 fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects with back...
• 5f4b28a fix(sdk-py): warn when a stream reconnects without a Last-Event-ID (#9482)
• 5c96bce chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph (#9433)
• 2f46bb3 fix(sdk-py): preserve SSE data and cursor state across chunks (#9477)
• Additional commits viewable in compare view

Updates langchain-core from 1.6.6 to 1.7.4

Release notes

Sourced from langchain-core's releases.

langchain-core==1.7.4

[!WARNING] Python 3.10 support will be dropped in langchain-core 1.8.0 and langchain 1.5.0. The current minor versions are the last to support Python 3.10. Please upgrade to Python 3.11 or later.

Changes since langchain-core==1.7.3

release(core): 1.7.4 (#41635) fix(core): avoid mutating message content in Anthropic translator (#40213)

langchain-core==1.7.3

Changes since langchain-core==1.7.2

release(core): 1.7.3 (#41564)

langchain-core==1.7.2

Changes since langchain-core==1.7.1

release(core): 1.7.2 (#41562) feat(core): add add_notification_metadata and get_notification_metadata (#41540) fix(core): stop merge_content from changing the first message's content (#41502)

langchain-core==1.7.1

Changes since langchain-core==1.7.0

release(core): version 1.7.1 (#41548) fix(core): preserve gateway tracing metadata in v3 streams (#41504) fix(core): escape node metadata in Mermaid labels (#41512) chore(deps): bump the minor-and-patch group across 3 directories with 32 updates (#41465) chore(deps-dev): bump setuptools from 83.0.0 to 84.1.0 in /libs/core (#41442) chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/core (#41425) chore(infra): relax third-party dependency upper bounds (#41407)

langchain-core==1.7.0

Changes since langchain-core==1.6.13

release(core): 1.7.0 (#41418) feat(core): emit tool-call-delta for streamed tool-call args (#41257)

Notes

• Tool-call args now stream as tool-call-delta slices instead of block-delta snapshots of the args so far. If you read raw stream events and their block-delta args mid-stream, read tool-call-delta instead. .tool_calls.get() and .output are unchanged. To keep snapshots, pin langchain-core<1.7.
• Since 1.6.13, iterating ChatModelStream.tool_calls yields each call's new args slice, not a snapshot of the args so far.

langchain-core==1.6.13

Changes since langchain-core==1.6.12

release(core): 1.6.13 (#41397) chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/core (#41373) feat(core,langchain,standard-tests): read tool-call-delta in stream consumers (#41246)

... (truncated)

Commits

• e936943 release(anthropic): 1.7.8 (#41638)
• 4570d3b fix(anthropic): strip index from compaction blocks (#41637)
• 640f209 release(langchain): 1.4.8 (#41636)
• 7f91a1b release(core): 1.7.4 (#41635)
• 3b6dbfb chore(infra): support prefix on release notes (#41634)
• 7c77783 docs: update OpenWiki (#41602)
• 6f28e05 fix(core): avoid mutating message content in Anthropic translator (#40213)
• e26358a chore(model-profiles): refresh model profile data (#41627)
• aa13e9c chore(deps): bump the minor-and-patch group across 2 directories with 4 updat...
• 957c8a6 chore(deps): bump vcrpy from 8.3.0 to 8.5.0 in /libs/standard-tests in the ma...
• Additional commits viewable in compare view

Updates langchain-openai from 1.6.6 to 1.7.3

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.7.3

Changes since langchain-openai==1.7.2

test(openai): use current lightweight model in integration tests (#41509) release(openai): 1.7.3 (#41506) chore(model-profiles): refresh openai model profile data (#41505) build(infra): patch test-only Pillow without dropping Python 3.10 (#41484) revert: patch vulnerable integration dependencies (#41481) build(deps): patch vulnerable integration dependencies (#41473) chore(infra): relax third-party dependency upper bounds (#41407) chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/openai (#41379) chore(deps): bump certifi from 2025.10.5 to 2026.10.19 in /libs/partners/openai (#41380) chore(deps): bump aiohttp from 3.14.3 to 3.14.4 in /libs/partners/openai (#41362) chore(model-profiles): refresh model profile data (#41325) chore(deps): bump pytest from 9.0.3 to 9.1.1 in /libs/partners/openai (#41328) chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/openai (#41333) chore(deps): bump requests from 2.33.0 to 2.34.2 in /libs/partners/openai (#41331) chore(deps): bump orjson from 3.11.6 to 3.13.0 in /libs/partners/openai (#41329) fix: fix dependencies in some partner packages (#41266)

langchain-openai==1.7.2

Changes since langchain-openai==1.7.1

release(openai): 1.7.2 (#41245) fix(openai): keep Responses stream items on one block when output_index drifts (#41121)

langchain-openai==1.7.1

Changes since langchain-openai==1.7.0

release(openai): 1.7.1 (#41222) feat(core,anthropic,openai): declare mid-conversation support in model profiles (#41180)

langchain-openai==1.7.0

Changes since langchain-openai==1.6.7

release(openai): 1.7.0 (#41154) feat(openai): support decisions api (#41125) chore(deps): bump langgraph-sdk from 0.4.4 to 0.4.6 in /libs/partners/openai (#41096) chore(deps): bump langgraph-sdk from 0.4.2 to 0.4.4 in /libs/partners/openai (#41072) chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/partners/openai (#40951) chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/openai (#40952)

langchain-openai==1.6.7

Changes since langchain-openai==1.6.6

release(openai): 1.6.7 (#40933) chore(model-profiles): refresh model profile data (#40924) test(openai): drop retired completions live tests (#40910) chore(model-profiles): refresh model profile data (#40869) feat(openai): discover Azure workload identity (#40532)

Commits

• 575db57 test(openai): use current lightweight model in integration tests (#41509)
• 0d29456 release(openai): 1.7.3 (#41506)
• 8635846 chore(model-profiles): refresh openai model profile data (#41505)
• 0c09d02 chore(deps): bump the minor-and-patch group across 3 directories with 32 upda...
• 621a915 ci(infra): harden release workflow against supply-chain tampering (#41489)
• b2f6837 docs: update OpenWiki (#41497)
• 7b8bc18 chore(model-profiles): refresh model profile data (#41494)
• d57f1ea build(infra): avoid vulnerable filelock releases without dropping compatibili...
• 2cc234c ci(infra): run matrix regression tests before generating jobs (#41487)
• 28ec094 build(infra): patch test-only Pillow without dropping Python 3.10 (#41484)
• Additional commits viewable in compare view

Updates openinference-instrumentation-langchain from 0.1.76 to 0.1.81

Release notes

Sourced from openinference-instrumentation-langchain's releases.

python-openinference-instrumentation-langchain: v0.1.81

0.1.81 (2026-10-29)

Bug Fixes

• bump openinference-semantic-conventions minimum to >=0.1.42 (#4135) (dc343d0)

Commits

• 95716f6 chore: release main (#4140)
• 1832ad0 fix(anthropic): stop anthropic>=1.14.0 from adding a second span to each trac...
• d174edc fix(portkey): record only caller-set params and surface tools from kwargs (#4...
• ab17075 test(anthropic): re-record beta cassettes on anthropic 2.3 (#4169)
• 0f276d4 fix(google-adk): keep call_llm span and suppress raw ADK spans on google-adk ...
• ff57216 test: fix CI for anthropic 2.x and together 3.x (#4157)
• dc343d0 fix: bump openinference-semantic-conventions minimum to >=0.1.42 (#4135)
• 54997b9 chore: release main (#4035)
• b6ac421 chore(deps): update opentelemetry-sdk requirement from >=1.45.0 to >=1.45.1 i...
• 68f3e24 chore(deps): update opentelemetry-instrumentation requirement from >=0.66b0 t...
• Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits

• 94150a0 Prepare release 2.16.2 (#1111)
• 9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
• 7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
• 2d1f924 Fix explicit nested secrets directory precedence (#1093)
• e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
• e71a53e Decode nested dictionary values with complex union types (#1089)
• 8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
• c50c853 Detect nested Field discriminators in default partial updates (#1076)
• 9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
• 4e286e2 Prepare release 2.16.1 (#1087)
• Additional commits viewable in compare view

Updates opentelemetry-exporter-otlp from 1.45.0 to 1.45.2

Release notes

Sourced from opentelemetry-exporter-otlp's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-exporter-otlp's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
• 78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates opentelemetry-proto from 1.45.0 to 1.45.2

Release notes

Sourced from opentelemetry-proto's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Changelog

Sourced from opentelemetry-proto's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

• opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
• opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
• opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
• opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Commits

• ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
• 78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
• 14971ce Prepare release 1.45.1/0.66b1 (#5752)
• 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
• a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
• d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
• db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
• See full diff in compare view

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33

• Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
• Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
• UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
• Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
• parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

• Faster opening boundary matching (#328). Complete boundaries are matched in one step.
• Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
• Faster querystring callback dispatch (#316).

🐍 Python support

• Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
• Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

• Drop Python 3.10 support #329.
• Add Python 3.15 support #350.
• Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
• Normalize the content type returned by parse_options_header when the header has parameters #287.
• Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
• Keep only the incomplete escape when quoted-printable data is split across writes #355.
• Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
• Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
• Speed up parser state lookups #330.
• Speed up opening boundary matching #328.
• Speed up querystring callback dispatch #316.

Commits

• 9217f26 Bump version to 0.0.33 (#357)
• d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
• 44871df Handle nameless uploads when keeping the filename or extension (#343)
• b21ea59 Add streaming field limits to FormParser (#333)
• 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
• 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
• 95f6376 Use the shared security policy (#353)
• 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
• d7af81c Rewrite README for newcomers (#351)
• b035d14 Add Python 3.15 classifier (#350)
• Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates langsmith from 0.14.1 to 0.14.17

Release notes

Sourced from langsmith's releases.

v0.14.17

0.14.17 (2026-11-02)

Features

• cli: add langsmith evaluators create-decision-model (534a040)
• sandboxes: AWS session tags on proxy role rules (bc15831)
• sdk: read profile api_key_env in Python, JS and Java SDKs (ce4946f)

Bug Fixes

• evaluators: show the effective spend limit in the evaluator tables (b00e161)
• expose v1 session creation and updates in Python and TypeScript SDKs (LSO-4121, LSO-4130) (de2293b)
• restore disposable Engine sandboxes with released SDK (6529456)
• sdks: unify shared-profile OAuth refresh locking (d9c5731)

Chores

• deps-dev: bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 in /sdks/python (6c9be7b)

Documentation

• sandboxes: document match_paths on proxy rules (b764565)

Build System

• refresh CA bundles for dev ops (b202202)

v0.14.16

0.14.16 (2026-10-29)

Features

• py: trace OpenAI Agents API sessions in wrap_openai (dac7037)
• sdks: add create_decision_model to the generated SDKs (61afde1)

Bug Fixes

• sdk: drop the base workspace for write replicas on another instance (1a255bb)

Reverts

... (truncated)

Description has been truncated