chore(deps): bump the uv-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the uv-dependencies group with 7 updates in the / directory:

Package	From	To
icalendar	7.2.2	7.3.0
mail-parser	4.6.2	4.6.4
nh3	0.3.6	0.3.7
html-to-markdown	3.10.6	3.12.0
mcp	2.0.0	2.1.1
anyio	4.14.2	4.15.0
ruff	0.16.3	0.16.6

Updates icalendar from 7.2.2 to 7.3.0

Release notes

Sourced from icalendar's releases.

v7.3.0

To view the changes, please see the Changelog. This release can be installed from PyPI.

Changelog

Sourced from icalendar's changelog.

7.3.0 (2026-08-19)

Removals and deprecations

- :attr:`vBinary.obj <icalendar.prop.binary.vBinary.obj>` is deprecated in favor of :attr:`vBinary.bytes <icalendar.prop.binary.vBinary.bytes>`. It is retained as a lossy string view of the value for backward compatibility, and will be removed in icalendar 8. The ``test_ical_value_rejects_non_base64_characters`` test was removed because :attr:`vBinary.ical_value <icalendar.prop.binary.vBinary.ical_value>` no longer validates or decodes Base64. @uwezkhan (`Issue [#1356](https://github.com/collective/icalendar/issues/1356) <https://github.com/collective/icalendar/issues/1356>`_)
New features

- Created an :meth:`~cal.journal.Journal.example` method for the :class:`~cal.journal.Journal` component and an :meth:`~cal.free_busy.FreeBusy.example` method for the :class:`~cal.free_busy.FreeBusy` component, added the :rfc:`5545` examples that they load, and documented their usage in both class docstrings. AI assistance: Kiro CLI with the claude-opus-5 model was used to draft this change. @Souptik96 (`Issue [#743](https://github.com/collective/icalendar/issues/743) &lt;https://github.com/collective/icalendar/issues/743&gt;`_)
- Add :meth:`Alarm.new_display() &lt;icalendar.cal.alarm.Alarm.new_display&gt;`, :meth:`Alarm.new_audio() &lt;icalendar.cal.alarm.Alarm.new_audio&gt;`, and :meth:`Alarm.new_email() &lt;icalendar.cal.alarm.Alarm.new_email&gt;` factory methods for creating :rfc:`5545#section-3.6.6` VALARM components. @klouds27 (`Issue [#865](https://github.com/collective/icalendar/issues/865) &lt;https://github.com/collective/icalendar/issues/865&gt;`_)
- :class:`~icalendar.prop.binary.vBinary` now stores the raw ``bytes`` of the value internally, so non-UTF-8 binary data round-trips losslessly. With the release of icalendar 7.1.0, and previous to this bug fix, :attr:`vBinary.ical_value &lt;icalendar.prop.binary.vBinary.ical_value&gt;` Base64-decoded the raw stored bytes and raised :class:`ValueError` for non-Base64 input. :attr:`vBinary.ical_value &lt;icalendar.prop.binary.vBinary.ical_value&gt;` now returns the raw stored bytes instead of Base64-decoding them, and no longer raises :class:`ValueError` for non-Base64 input. @uwezkhan (`Issue [#1356](https://github.com/collective/icalendar/issues/1356) &lt;https://github.com/collective/icalendar/issues/1356&gt;`_)
- Added :attr:`vBinary.bytes &lt;icalendar.prop.binary.vBinary.bytes&gt;`, exposing the raw binary value of a BINARY property. @uwezkhan (`Issue [#1356](https://github.com/collective/icalendar/issues/1356) &lt;https://github.com/collective/icalendar/issues/1356&gt;`_)
- Added the :exc:`~icalendar.error.ICalParsingError` exception as a public API for programmatic handling of iCalendar parsing failures. AI assistance: ChatGPT was used to help debug terminal errors encountered during development. @GAUTAMSANSWAL (`Issue [#1536](https://github.com/collective/icalendar/issues/1536) &lt;https://github.com/collective/icalendar/issues/1536&gt;`_)
- Created a script to automatically generate the :mod:`~icalendar.timezone.windows_to_olson` module from the Unicode Consortium's CLDR GitHub repository. Added lxml as a new development dependency. Added the target ``wo`` to the ``Makefile`` to generate the file from the root of the repository with ``make wo``. @stevepiercy (`Issue [#1548](https://github.com/collective/icalendar/issues/1548) &lt;https://github.com/collective/icalendar/issues/1548&gt;`_)
- Added :attr:`vBinary.base64data &lt;icalendar.prop.binary.vBinary.base64data&gt;`, a getter/setter for the Base64 string view of a BINARY property's value, so callers no longer need to call :func:`base64.b64encode` or :func:`base64.b64decode` manually. @gagana2023 (`Issue [#1550](https://github.com/collective/icalendar/issues/1550) &lt;https://github.com/collective/icalendar/issues/1550&gt;`_)
- Added :attr:`Alarm.ACTION &lt;icalendar.cal.alarm.Alarm.ACTION&gt;` and :attr:`AlarmTime.action &lt;icalendar.alarms.AlarmTime.action&gt;` access to the :rfc:`5545#section-3.8.6.1` ``ACTION`` property. I used OpenAI Codex with GPT-5 to assist with this change, then reviewed and tested the result. @bm1016bm-svg (`Issue [#1569](https://github.com/collective/icalendar/issues/1569) &lt;https://github.com/collective/icalendar/issues/1569&gt;`_)
- Record the exact CLDR commit used to generate the Windows-to-Olson timezone mapping and fetch the mapping from that pinned revision. I used AI to assist me with this change. @patrickswedish (`Issue [#1575](https://github.com/collective/icalendar/issues/1575) &lt;https://github.com/collective/icalendar/issues/1575&gt;`_)
- Used :meth:`vBinary.from_ical() &lt;icalendar.prop.binary.vBinary.from_ical&gt;` in :attr:`Image.data &lt;icalendar.prop.image.Image.data&gt;` for consistent Base64 validation, removing the manual :func:`base64.b64decode` call. @klouds27 (`Issue [#1638](https://github.com/collective/icalendar/issues/1638) &lt;https://github.com/collective/icalendar/issues/1638&gt;`_)
- Added ``REQUEST_STATUS`` property to :class:`~icalendar.cal.event.Event`, :class:`~icalendar.cal.todo.Todo`, :class:`~icalendar.cal.journal.Journal`, and :class:`~icalendar.cal.free_busy.FreeBusy` with ``request_status`` parameter in ``new()`` constructors per :rfc:`5545#section-3.8.8.3`. I used AI to assist with this change. @SemTiOne (`Issue [#1666](https://github.com/collective/icalendar/issues/1666) &lt;https://github.com/collective/icalendar/issues/1666&gt;`_)
- Improved :exc:`~icalendar.error.ICalParsingError` by including optional value, line, and line number information in exception messages for more consistent iCalendar parsing error reporting. AI assistance: ChatGPT was used to help debug terminal errors encountered during development. @GAUTAMSANSWAL
- Made :exc:`~icalendar.error.JCalParsingError` inherit from :exc:`~icalendar.error.InvalidCalendar` for consistency with :exc:`~icalendar.error.ICalParsingError`. AI assistance: ChatGPT was used to help debug terminal errors encountered during development. @GAUTAMSANSWAL
Bug fixes

- Resolve the timezone of a &amp;quot;globally unique&amp;quot; :rfc:`5545#section-3.2.19` ``TZID`` such as ``/freeassociation.sourceforge.net/Europe/Berlin``, which is emitted by some clients, including libical and Evolution. :meth:`TZP.timezone &amp;lt;icalendar.timezone.tzp.TZP.timezone&amp;gt;` now strips the leading vendor prefix and resolves the trailing Olson identifier, so the value is parsed as timezone-aware instead of being silently treated as naive. Prepared with AI assistance. @vjsai (`Issue [#313](https://github.com/collective/icalendar/issues/313) &amp;lt;https://github.com/collective/icalendar/issues/313&amp;gt;`_)
- Fixed the :file:`equivalent_timezone_ids.py` script after the call to generate the timezone Python code was removed. @gjabell (`Issue [#1392](https://github.com/collective/icalendar/issues/1392) &amp;lt;https://github.com/collective/icalendar/issues/1392&amp;gt;`_)
- Values of unrecognized properties and ``X-`` properties without a ``VALUE`` parameter were altered by escaping when parsed, serialized, or converted to and from jCal, so they did not round-trip unchanged as :rfc:`7265` specifies. These values are now preserved verbatim. Additionally, the ``PROXIMITY`` property (:rfc:`9074`) was treated as an unknown value type instead of ``TEXT`` and is now recognized correctly. AI disclosure: I used Claude Code (Anthropic's Claude Opus) to draft and refine this change and its tests; I reviewed the output and validated the change locally. @lcampanella98 (`Issue [#1445](https://github.com/collective/icalendar/issues/1445) &amp;lt;https://github.com/collective/icalendar/issues/1445&amp;gt;`_)
- Ship :file:`funding.json` in PyPI source distributions so packaging and test runs from the sdist no longer fail with :class:`FileNotFoundError`. @Hishamkhashman1 (`Issue [#1493](https://github.com/collective/icalendar/issues/1493) &amp;lt;https://github.com/collective/icalendar/issues/1493&amp;gt;`_)
- Avoid folding content lines between escape prefixes and their escaped characters. AI disclosure: I used GPT-5 Codex to help draft and refine this change and its tests; I reviewed and validated the output locally. @kingrubic (`Issue [#1501](https://github.com/collective/icalendar/issues/1501) &amp;lt;https://github.com/collective/icalendar/issues/1501&amp;gt;`_)
- Preserve ``URI`` value parameters on a jCal round-trip. :meth:`vUri.from_jcal &amp;lt;icalendar.prop.uri.vUri.from_jcal&amp;gt;` previously passed the parameters positionally, but ``vUri.__new__`` takes ``encoding`` as its second positional parameter. As a result, the ``URI`` value parameters were consumed as ``encoding`` and dropped. For example, ``ATTACH;FMTTYPE=...`` or ``CONFERENCE;FEATURE=...`` lost their parameters. They are now passed as the ``params`` keyword. Prepared with the assistance of an AI coding agent (Anthropic's Claude Opus 4.8). @gaoflow (`Issue [#1526](https://github.com/collective/icalendar/issues/1526) &amp;lt;https://github.com/collective/icalendar/issues/1526&amp;gt;`_)
- Updated the Windows timezone mapping for ``Mountain Standard Time (Mexico)`` to ``America/Mazatlan``, so dates after Mexico's 2022 timezone changes use the correct UTC-7 offset instead of UTC-6. Prepared with AI assistance. @RobHannay (`Issue [#1546](https://github.com/collective/icalendar/issues/1546) &amp;lt;https://github.com/collective/icalendar/issues/1546&amp;gt;`_)
- ``IMAGE`` properties now use their explicitly declared ``VALUE`` type instead of always being parsed as unknown, while ``IMAGE`` without a ``VALUE`` parameter remains unknown. I used OpenAI Codex with GPT-5 to assist with this change. @floze-the-genius (`Issue [#1561](https://github.com/collective/icalendar/issues/1561) &amp;lt;https://github.com/collective/icalendar/issues/1561&amp;gt;`_)
- Removed ``ATTACH`` from :attr:`Alarm.singletons &amp;lt;icalendar.cal.alarm.Alarm.singletons&amp;gt;`. An &amp;quot;email&amp;quot; ``VALARM`` may carry more than one ``ATTACH`` per :rfc:`5545#section-3.6.6`, so ``ATTACH`` belongs in ``multiple`` only; it was previously listed in both ``singletons`` and ``multiple``. Added a regression test that ``singletons`` and ``multiple`` are disjoint for every registered component. Prepared with the assistance of an AI coding agent (Anthropic's Claude Opus 4.8). @vtino17 (`Issue [#1569](https://github.com/collective/icalendar/issues/1569) &amp;lt;https://github.com/collective/icalendar/issues/1569&amp;gt;`_)
- :attr:`Alarm.REPEAT &amp;lt;icalendar.cal.alarm.Alarm.REPEAT&amp;gt;`, :attr:`Alarm.repeat &amp;lt;icalendar.cal.alarm.Alarm.repeat&amp;gt;`, :attr:`Event.sequence &amp;lt;icalendar.cal.event.Event.sequence&amp;gt;`, and :attr:`Event.priority &amp;lt;icalendar.cal.event.Event.priority&amp;gt;` now reject non-integers (including booleans) with :exc:`TypeError` and negative values with :exc:`~icalendar.error.InvalidCalendar`. @heyncth (`Issue [#1594](https://github.com/collective/icalendar/issues/1594) &amp;lt;https://github.com/collective/icalendar/issues/1594&amp;gt;`_)
- Added the missing ``BINARY`` member to :class:`icalendar.enums.VALUE`, per :rfc:`5545#section-3.2.20`. ``VALUE.BINARY`` previously raised :exc:`AttributeError`. Prepared with the assistance of an AI coding agent (Anthropic's Claude Opus 4.8). @vtino17 (`Issue [#1607](https://github.com/collective/icalendar/issues/1607) &amp;lt;https://github.com/collective/icalendar/issues/1607&amp;gt;`_)
- A ``PERIOD`` value written with dates instead of datetimes, such as ``RDATE;VALUE=PERIOD:19970101/19970102``, was accepted when a calendar was parsed and then raised an :exc:`AttributeError` when it was written out again, or a :exc:`TypeError` where only one half was a date. Such a value is now read as midnight, in the timezone of the other half where it has one. I used AI to assist me with this change. @lcampanella98 (`Issue [#1633](https://github.com/collective/icalendar/issues/1633) &amp;lt;https://github.com/collective/icalendar/issues/1633&amp;gt;`_)
- When :func:`timezone.use_pytz &amp;lt;icalendar.timezone.use_pytz&amp;gt;` was in effect, a date parsed with a ``TZID``, such as ``RDATE;TZID=America/New_York;VALUE=DATE:19970101``, was given the timezone's oldest known offset, its local mean time, so the value was minutes off. It is now read with the offset that applied on that date. Calendars read with zoneinfo, the default, were not affected. I used AI to assist me with this change. @lcampanella98 (`Issue [#1633](https://github.com/collective/icalendar/issues/1633) &amp;lt;https://github.com/collective/icalendar/issues/1633&amp;gt;`_)
- Escape a lone ``\r`` as ``\n`` in ``icalendar.parser.string._escape_char``, used by :meth:`vText.to_ical &amp;lt;icalendar.prop.text.vText.to_ical&amp;gt;`. A carriage return not followed by a line feed was previously left raw in the serialized content line, so a ``SUMMARY`` or ``DESCRIPTION`` built from untrusted text could carry a control character into the iCalendar stream and split the line for lenient consumers. ``\r\n`` and ``\n`` were already escaped, and the parameter escaper already mapped ``\r`` to ``^n``. @alhudz (`Pull Request [#1462](https://github.com/collective/icalendar/issues/1462) &amp;lt;https://github.com/collective/icalendar/pull/1462&amp;gt;`_)
- Reject non-ASCII digits in the ``ordwk`` part of :class:`~icalendar.prop.recur.weekday.vWeekday` (``BYDAY``, ``BYWEEKDAY``, and ``WKST``). The value validation regular expression ``\d`` matches non-ASCII digits, such as the Arabic-Indic ``١٢``. A value such as ``١٢MO`` was silently accepted as ``relative == 12``, instead of being rejected, as required by :rfc:`5545#section-3.3.10` (``ordwk = 1*2DIGIT``). This mirrors the earlier :class:`~icalendar.prop.recur.month.vMonth` fix. Drafted with AI assistance (Claude Opus 4.8); reviewed, tested, and verified by the author. @Labib-Bin-Salam
- Reject raw CR and LF in :class:`~icalendar.prop.uri.vUri`, :class:`~icalendar.prop.cal_address.vCalAddress`, :class:`~icalendar.prop.inline.vInline`, and :class:`~icalendar.prop.xml_reference.vXmlReference`. These value types are not escaped on serialization, so a lone ``\r`` in the value was written straight into the content line, slipping past the newline-only assertion in ``Contentline`` and reparsing as a separate property. This was reachable from untrusted jCal via ``URL``, ``ATTENDEE``, and ``ORGANIZER``. @alhudz
- jCal property names, parameter names, and ``RRULE`` part names are now validated as lowercase iCalendar tokens when parsing jCal (RFC 7265 sections :rfc:`7265#section-3.4`, :rfc:`7265#section-3.5`, and :rfc:`7265#section-3.6.10`). They were kept verbatim and re-emitted into the content line on serialization, so a name containing ``:``, ``;``, or a lone carriage return could inject parameters or a new content line for consumers that treat a bare ``\r`` as a break. @alhudz


Documentation
&amp;lt;/tr&amp;gt;&amp;lt;/table&amp;gt; 
&lt;/code&gt;&lt;/pre&gt;
&lt;/blockquote&gt;
&lt;p&gt;... (truncated)&lt;/p&gt;
&lt;/details&gt;
&lt;details&gt;
&lt;summary&gt;Commits&lt;/summary&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/138c8453db34fbb584bbcbc592fd7bd4b972e8ef&quot;&gt;&lt;code&gt;138c845&lt;/code&gt;&lt;/a&gt; remove duplicated news fragment&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/933ff2c789dab88e9fde0e249bcdec832dc1e5e4&quot;&gt;&lt;code&gt;933ff2c&lt;/code&gt;&lt;/a&gt; Merge main into 7.x&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/849919f4f6e9de4f684fcc2c391d347bdfada0e8&quot;&gt;&lt;code&gt;849919f&lt;/code&gt;&lt;/a&gt; version 7.3.0&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/8d20a43036fd5acbc5a36f9e885dbdc3267462cd&quot;&gt;&lt;code&gt;8d20a43&lt;/code&gt;&lt;/a&gt; move breaking change to feature (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1685&quot;&gt;#1685&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/bc179116e63a2447adf77de66034bd3d2078b9f3&quot;&gt;&lt;code&gt;bc17911&lt;/code&gt;&lt;/a&gt; [docs] Fix unqualified cross-references in Todo docstrings (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1678&quot;&gt;#1678&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/698624cacf4b48244a82acb3cc60de9cd0f33750&quot;&gt;&lt;code&gt;698624c&lt;/code&gt;&lt;/a&gt; Add REQUEST-STATUS property (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1672&quot;&gt;#1672&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/82b19379a16cea095659efc0f132d3b3b4ad1dba&quot;&gt;&lt;code&gt;82b1937&lt;/code&gt;&lt;/a&gt; Add return type hint to use_default (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1665&quot;&gt;#1665&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/514be871254a99ebbd35b72e9f155afa1f67431e&quot;&gt;&lt;code&gt;514be87&lt;/code&gt;&lt;/a&gt; fix: validate non-negative integer values for repeat, sequence, priority (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1598&quot;&gt;#1598&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/069e672ace766b3ed0db171d5fab5bbf40c3b864&quot;&gt;&lt;code&gt;069e672&lt;/code&gt;&lt;/a&gt; Rename timezone_datetime_property to _timezone_datetime_property (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1011&quot;&gt;#1011&lt;/a&gt;) (&lt;a href=&quot;https://redirect.github.com/collective/icalendar/issues/1675&quot;&gt;#1675&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/collective/icalendar/commit/b83927513910b6cbe740e8ab52d21c03a004d06a&quot;&gt;&lt;code&gt;b839275&lt;/code&gt;&lt;/a&gt; chore(deps): bump github/codeql-action/upload-sarif from ea14db8afdef5d462e69...&lt;/li&gt;
&lt;li&gt;Additional commits viewable in &lt;a href=&quot;https://github.com/collective/icalendar/compare/v7.2.2...v7.3.0&quot;&gt;compare view&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;/details&gt;

&lt;br /&gt;</code></pre>

Updates `mail-parser` from 4.6.2 to 4.6.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/SpamScope/mail-parser/releases">mail-parser's releases</a>.</em></p>
<blockquote>
<h2>4.6.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add link to GitHub repo to Project-URLs by <a href="https://github.com/kytta"><code>@​kytta</code></a> in <a href="https://redirect.github.com/SpamScope/mail-parser/pull/172">SpamScope/mail-parser#172</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/SpamScope/mail-parser/compare/4.6.3...4.6.4">https://github.com/SpamScope/mail-parser/compare/4.6.3...4.6.4</a></p>
<h2>4.6.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Add support for Python 3.15 by <a href="https://github.com/kytta"><code>@​kytta</code></a> in <a href="https://redirect.github.com/SpamScope/mail-parser/pull/169">SpamScope/mail-parser#169</a></li>
<li>fix: attachment integrity, batch availability, and date overflow on hostile mail by <a href="https://github.com/fedelemantuano"><code>@​fedelemantuano</code></a> in <a href="https://redirect.github.com/SpamScope/mail-parser/pull/171">SpamScope/mail-parser#171</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kytta"><code>@​kytta</code></a> made their first contribution in <a href="https://redirect.github.com/SpamScope/mail-parser/pull/169">SpamScope/mail-parser#169</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/SpamScope/mail-parser/compare/4.6.2...4.6.3">https://github.com/SpamScope/mail-parser/compare/4.6.2...4.6.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/SpamScope/mail-parser/commit/8aae56c9b6260152b57a3331ca3f4de3c9812183"><code>8aae56c</code></a> Merge branch 'release/4.6.4'</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/e43bebda2fc2b76d2036974337db68f19ec4391b"><code>e43bebd</code></a> bump: update version to 4.6.4</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/926a6672bb27a400cef7eb2983175372cc6d245f"><code>926a667</code></a> feat: add project URLs for homepage, issues, and changelog in pyproject.toml</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/fbf1f6908f5cced52152f71bf494db7cee3905ce"><code>fbf1f69</code></a> Add link to GitHub repo to Project-URLs (<a href="https://redirect.github.com/SpamScope/mail-parser/issues/172">#172</a>)</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/a268aac4ec920b4d5ecd9097e640e325da54bd2b"><code>a268aac</code></a> Merge branch 'release/4.6.3' into develop</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/d71432674218bc029b74677ed256490fd98e8288"><code>d714326</code></a> Merge branch 'release/4.6.3'</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/4d5ccd6d0d8d403dd84d0a4e7994174350d66b76"><code>4d5ccd6</code></a> bump: update version to 4.6.3</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/e1d9fe6778045d6e2c44406bc8822e3464c1097f"><code>e1d9fe6</code></a> fix: attachment integrity, batch availability, and date overflow on hostile m...</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/6752722f2cf4ae934e0582121dc7bb2b1e6e1843"><code>6752722</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/SpamScope/mail-parser/issues/169">#169</a>)</li>
<li><a href="https://github.com/SpamScope/mail-parser/commit/e81c37fcb2d53a0e2946dae453156ee07dbbc167"><code>e81c37f</code></a> Merge branch 'release/4.6.2' into develop</li>
<li>See full diff in <a href="https://github.com/SpamScope/mail-parser/compare/4.6.2...4.6.4">compare view</a></li>
</ul>
</details>
<br />

Updates `nh3` from 0.3.6 to 0.3.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/messense/nh3/releases">nh3's releases</a>.</em></p>
<blockquote>
<h2>v0.3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Expose ammonia's id_prefix option via id_prefix kwarg by <a href="https://github.com/gghez"><code>@​gghez</code></a> in <a href="https://redirect.github.com/messense/nh3/pull/134">messense/nh3#134</a></li>
<li>Don’t depend on deprecated pyo3/generate-import-lib feature by <a href="https://github.com/musicinmybrain"><code>@​musicinmybrain</code></a> in <a href="https://redirect.github.com/messense/nh3/pull/136">messense/nh3#136</a></li>
<li>Validate tag_attribute_values conflict with attributes by <a href="https://github.com/Mohammadjavad2412"><code>@​Mohammadjavad2412</code></a> in <a href="https://redirect.github.com/messense/nh3/pull/135">messense/nh3#135</a></li>
<li>Bump ammonia from 4.1.2 to 4.1.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/messense/nh3/pull/137">messense/nh3#137</a></li>
<li>Bump ammonia from 4.1.3 to 4.1.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/messense/nh3/pull/139">messense/nh3#139</a></li>
<li>Bump pyo3 from 0.29.0 to 0.29.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/messense/nh3/pull/140">messense/nh3#140</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/musicinmybrain"><code>@​musicinmybrain</code></a> made their first contribution in <a href="https://redirect.github.com/messense/nh3/pull/136">messense/nh3#136</a></li>
<li><a href="https://github.com/Mohammadjavad2412"><code>@​Mohammadjavad2412</code></a> made their first contribution in <a href="https://redirect.github.com/messense/nh3/pull/135">messense/nh3#135</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/messense/nh3/compare/v0.3.6...v0.3.7">https://github.com/messense/nh3/compare/v0.3.6...v0.3.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/messense/nh3/commit/74f36b850c5cb36435b7d9774fe20d1ba3dd663e"><code>74f36b8</code></a> Bump pyo3 from 0.29.0 to 0.29.2 (<a href="https://redirect.github.com/messense/nh3/issues/140">#140</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/5cb1a164b40de973cd70f55d2bcc52bcd4ae8d8d"><code>5cb1a16</code></a> Update ammonia and bump version to 0.3.7</li>
<li><a href="https://github.com/messense/nh3/commit/5bc937ad16f7007bfb69060be70fb3a840bf2095"><code>5bc937a</code></a> Bump ammonia from 4.1.3 to 4.1.4 (<a href="https://redirect.github.com/messense/nh3/issues/139">#139</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/5816c84fdb29ec5a0d788019c62476d4c8a4025d"><code>5816c84</code></a> Bump actions/setup-python from 6 to 7 in the github-actions group (<a href="https://redirect.github.com/messense/nh3/issues/138">#138</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/77188123ad1da497882fb9e093a2329e0bb28126"><code>7718812</code></a> Bump ammonia from 4.1.2 to 4.1.3 (<a href="https://redirect.github.com/messense/nh3/issues/137">#137</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/567c411f1b49d2c1b943b8de8a24ada6cf87149a"><code>567c411</code></a> Validate tag_attribute_values conflict with attributes (<a href="https://redirect.github.com/messense/nh3/issues/135">#135</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/c23021cac66acef448b54b224361c5c7484a68bb"><code>c23021c</code></a> Don’t depend on deprecated pyo3/generate-import-lib feature (<a href="https://redirect.github.com/messense/nh3/issues/136">#136</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/0343d0be878dde21ec6b2aa847dc6a9598595ffe"><code>0343d0b</code></a> Bump actions/checkout from 6 to 7 in the github-actions group (<a href="https://redirect.github.com/messense/nh3/issues/132">#132</a>)</li>
<li><a href="https://github.com/messense/nh3/commit/0573fe440c968a11e36d57954c6d396e31f0007e"><code>0573fe4</code></a> Expose ammonia's id_prefix option via id_prefix kwarg (<a href="https://redirect.github.com/messense/nh3/issues/134">#134</a>)</li>
<li>See full diff in <a href="https://github.com/messense/nh3/compare/v0.3.6...v0.3.7">compare view</a></li>
</ul>
</details>
<br />

Updates `html-to-markdown` from 3.10.6 to 3.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/xberg-io/html-to-markdown/releases">html-to-markdown's releases</a>.</em></p>
<blockquote>
<h2>v3.12.0</h2>
<h2>Swift Package Manager</h2>
<p>Add to your <code>Package.swift</code>:</p>
<pre lang="swift"><code>.package(url: &quot;https://github.com/xberg-io/html-to-markdown&quot;, from: &quot;3.12.0&quot;)
</code></pre>
<p>The Swift binding is distributed as a pre-built artifact bundle. No Rust toolchain required.</p>
<p><strong>Artifact</strong>: <a href="https://github.com/xberg-io/html-to-markdown/releases/download/v3.12.0/HtmlToMarkdown-rs.artifactbundle.zip">HtmlToMarkdown-rs.artifactbundle.zip</a>
<strong>Checksum</strong>: <code>33854e506db4b72de2d9de44da9ef7f9ce6e975dafdc7d890d3f1ec969ea951e</code></p>
<h2>v3.11.6</h2>
<h2>Swift Package Manager</h2>
<p>Add to your <code>Package.swift</code>:</p>
<pre lang="swift"><code>.package(url: &quot;https://github.com/xberg-io/html-to-markdown&quot;, from: &quot;3.11.6&quot;)
</code></pre>
<p>The Swift binding is distributed as a pre-built artifact bundle. No Rust toolchain required.</p>
<p><strong>Artifact</strong>: <a href="https://github.com/xberg-io/html-to-markdown/releases/download/v3.11.6/HtmlToMarkdown-rs.artifactbundle.zip">HtmlToMarkdown-rs.artifactbundle.zip</a>
<strong>Checksum</strong>: <code>ec1059f3bad2f58afe4a999d3c1d98fca3aaff35d8d9abb1c2e22949d92d6ef7</code></p>
<h2>v3.11.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(docs): correct webmanifest name and guard deploy job against PR runs by <a href="https://github.com/v-tan"><code>@​v-tan</code></a> in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/424">xberg-io/html-to-markdown#424</a></li>
<li>chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.18.2 to 2.22.0 in /e2e/java by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/423">xberg-io/html-to-markdown#423</a></li>
<li>feat(docs): add Dart/Flutter unofficial binding to README by <a href="https://github.com/shigomany"><code>@​shigomany</code></a> in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/425">xberg-io/html-to-markdown#425</a></li>
<li>fix: avoid stack overflows on deeply nested HTML by <a href="https://github.com/noahskelton"><code>@​noahskelton</code></a> in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/421">xberg-io/html-to-markdown#421</a></li>
<li>chore(deps): bump json from 2.19.5 to 2.19.9 in /e2e/ruby by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/442">xberg-io/html-to-markdown#442</a></li>
<li>feat(cli): add cargo-binstall support by <a href="https://github.com/GZTimeWalker"><code>@​GZTimeWalker</code></a> in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/448">xberg-io/html-to-markdown#448</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/shigomany"><code>@​shigomany</code></a> made their first contribution in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/425">xberg-io/html-to-markdown#425</a></li>
<li><a href="https://github.com/noahskelton"><code>@​noahskelton</code></a> made their first contribution in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/421">xberg-io/html-to-markdown#421</a></li>
<li><a href="https://github.com/GZTimeWalker"><code>@​GZTimeWalker</code></a> made their first contribution in <a href="https://redirect.github.com/xberg-io/html-to-markdown/pull/448">xberg-io/html-to-markdown#448</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/xberg-io/html-to-markdown/compare/v3.7.1...v3.11.5">https://github.com/xberg-io/html-to-markdown/compare/v3.7.1...v3.11.5</a></p>
<h2>v3.11.4</h2>
<h2>Swift Package Manager</h2>
<p>Add to your <code>Package.swift</code>:</p>
<pre lang="swift"><code>&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/xberg-io/html-to-markdown/blob/main/CHANGELOG.md">html-to-markdown's changelog</a>.</em></p>
<blockquote>
<h2>[3.12.0] - 2026-08-31</h2>
<p>Correctness release. A broad pass over converter correctness: defects in the shipped output,
plus a run of cases where the Tier-1 fast scanner and the Tier-2 converter disagreed on the same
input -- the library picks a tier automatically, so those meant one document could convert two
ways.</p>
<p>Test coverage behind it: every one of the 652 <code>CommonMark</code> spec examples is now exercised through
a conversion-fixpoint oracle (the exact-match test compares against the spec's own rendering, so
it can only run on the 131 examples admitting a single valid form), a Tier-1/Tier-2 differential
oracle over the benchmark corpus and a generated document set, and a fuzz target.</p>
<p>Against that fixpoint oracle, 644 of the 652 examples now round-trip unchanged with escaping
enabled and 629 with the shipped defaults, up from 607 and 597. Of the 8 that remain, three are inherent to the round trip -- adjacent
block quotes, and adjacent lists sharing a bullet, merge under any compliant reparse whatever we
emit -- and the other five differ only in the byte spelling of a link destination.</p>
<h3>Removed</h3>
<ul>
<li><strong><code>htm_conversion_options_update_visitor</code> is gone from the C API.</strong> The getter documented a
non-null return as caller-owned data, but <code>ConversionOptionsUpdate</code> is only ever constructed
through <code>htm_conversion_options_update_from_json</code>, and its <code>visitor</code> field carries a full
<code>serde(skip)</code> -- so <code>Deserialize</code> could never populate it and no FFI setter existed. The symbol
could only ever return <code>0</code>. <strong>Breaking for C consumers:</strong> it disappears from
<code>html_to_markdown.h</code> and from the compiled library, so a call that used to yield <code>NULL</code> at
runtime is now a link error. Nothing that worked stops working. <code>ConversionOptions.visitor</code> is
unaffected -- it carries the same attribute but is genuinely reachable, because
<code>htm_options_set_visitor</code> writes it directly, bypassing serde.</li>
</ul>
<h3>Added</h3>
<ul>
<li>CLI flags for six <code>ConversionOptions</code> fields that the library and the MCP surface already
exposed but the CLI hardcoded: <code>--exclude-selectors</code>, <code>--url-escape-style</code>,
<code>--max-image-size</code>, <code>--capture-svg</code>, <code>--no-infer-dimensions</code> and <code>--tier-strategy</code>. Each
now defaults to the library's own default, so an invocation that omits them is unchanged.
The three image flags require <code>--extract-inline-images</code>, which they are inert without.</li>
</ul>
<h3>Performance</h3>
<ul>
<li><code>escape_link_label</code> returns <code>Cow&lt;'_, str&gt;</code> and skips its two allocations when the text
contains no <code>[</code> or <code>]</code>, which is the common case for link labels, image alt text and
titles. The two-pass design is unchanged -- it exists to avoid an O(n^2) <code>String::insert</code>
shape.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><strong>Uppercase attribute names no longer discard link destinations and image sources.</strong>
HTML attribute names are case-insensitive, but the Tier-2 converter matched them
byte-for-byte as written, so <code>&lt;a HREF=&quot;up.html&quot;&gt;link&lt;/a&gt;</code> converted to bare <code>link</code> and
<code>&lt;img SRC=&quot;a.png&quot; ALT=&quot;cat&quot;&gt;</code> to <code>![](https://github.com/xberg-io/html-to-markdown/blob/main/&lt;&gt;)</code> -- the destination and the alt text were</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/18e973fe69b777bd4be1de8b654c07461ed3c377"><code>18e973f</code></a> chore(release): substitute Swift checksum for 3.12.0</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/fb4cd79196b2afb06c5454dcf935b03aea03f4d8"><code>fb4cd79</code></a> chore(release): 3.12.0</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/1d1b0fbfcc67a3614bb49a71acab8e041d37d666"><code>1d1b0fb</code></a> chore(alef): regenerate against alef 0.79.5</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/1cf185b68e2221d72b6adec3e9e867efd69c0ec0"><code>1cf185b</code></a> chore(alef): regenerate against alef 0.79.4</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/02e75868bc8b463733bc56323ba5cf32b2fb3825"><code>02e7586</code></a> chore(ci): bump pinned xberg-io/actions SHAs to v1.10.2</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/3ccd6471a38a0b9ff85fc38d71b26d94405da19c"><code>3ccd647</code></a> docs(changelog): record the unreleased tier-1 fixes and CLI flags</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/c7947d3facd43350a893dceb34a7f17f7e9e698e"><code>c7947d3</code></a> fix(tier1): emit GFM autolinks and bail on ambiguous nested labels</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/09d7b75fae4b9a946916b9e1c29df2f5cc21d3a2"><code>09d7b75</code></a> feat(cli): wire six conversion options to CLI flags</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/1c113c549c8c6c28f7de89c82d0eb917e9628a00"><code>1c113c5</code></a> chore(alef): pin alef 0.79.3 and mark visitor as unbindable</li>
<li><a href="https://github.com/xberg-io/html-to-markdown/commit/049254f363373880bc1fe905682d2c8537800093"><code>049254f</code></a> fix(deps): upgrade astral-tl to 0.8.0 for case-insensitive attributes</li>
<li>Additional commits viewable in <a href="https://github.com/xberg-io/html-to-markdown/compare/v3.10.6...v3.12.0">compare view</a></li>
</ul>
</details>
<br />

Updates `mcp` from 2.0.0 to 2.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/modelcontextprotocol/python-sdk/releases">mcp's releases</a>.</em></p>
<blockquote>
<h2>v2.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Point imports of mcp.server.fastmcp at the migration guide by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3388">modelcontextprotocol/python-sdk#3388</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v2.1.0...v2.1.1">https://github.com/modelcontextprotocol/python-sdk/compare/v2.1.0...v2.1.1</a></p>
<h2>v2.1.0</h2>
<h2>Highlights</h2>
<ul>
<li><code>Client</code> accepts <code>StdioServerParameters</code> directly: <code>Client(StdioServerParameters(command=&quot;uv&quot;, args=[&quot;run&quot;, &quot;server.py&quot;]))</code> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3321">#3321</a>).</li>
<li>Prompt messages accept <code>Image</code> and <code>Audio</code>, prompt functions may return bare content blocks, and <code>Message</code> / <code>UserMessage</code> / <code>AssistantMessage</code> are exported from <code>mcp.server.mcpserver</code> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3320">#3320</a>).</li>
<li>The 4 MiB request body limit now also covers the SSE transport and the OAuth endpoints; <code>SseServerTransport</code> and <code>MCPServer.sse_app()</code> take <code>max_request_body_size</code>, and the SSE message endpoint answers 405 to non-POST requests (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3336">#3336</a>).</li>
</ul>
<h2>Behaviour changes to be aware of</h2>
<ul>
<li>Handler exceptions (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3314">#3314</a>): an unexpected exception from a tool, resource or prompt handler is logged once at ERROR with its traceback, and the client now sees only <code>Error executing tool &lt;name&gt;</code> (or the resource/prompt equivalent) rather than the exception text. Raise <code>ToolError</code> / <code>ResourceError</code> when the message is meant for the model; those still reach the client and are logged at INFO without a traceback.</li>
<li>Content-block return annotations (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3320">#3320</a>): a tool annotated to return <code>TextContent</code>, <code>EmbeddedResource</code>, <code>Image</code>, <code>Audio</code>, or lists/unions of them no longer advertises <code>outputSchema</code> or returns <code>structuredContent</code>; its <code>content</code> is unchanged. Pass <code>structured_output=True</code> to keep the previous shape.</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>TypedDict tool results: <code>NotRequired</code> keys are omitted instead of serialized as <code>null</code>, and registration no longer fails on Python 3.10 (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3224">#3224</a>, <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3227">#3227</a>); recursive return types get an object-rooted <code>outputSchema</code> that pre-2026 clients accept (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3337">#3337</a>).</li>
<li>2026-07-28 over HTTP: a POSTed notification such as <code>notifications/cancelled</code> is acknowledged with 202 instead of rejected with 400 (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3324">#3324</a>).</li>
<li>Pre-2026 sessions ignore cache-hint fields from later revisions instead of failing <code>list_tools()</code> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3223">#3223</a>), and accept boolean sub-schemas in tool schema <code>properties</code> (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3353">#3353</a>).</li>
<li><code>mcp install</code> reads and preserves a Claude Desktop config containing non-ASCII text on any Windows code page (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3296">#3296</a>).</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Retire wording tied to pre-2.0 milestones by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3211">modelcontextprotocol/python-sdk#3211</a></li>
<li>Describe the maintenance line without hardcoding 1.28 by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3212">modelcontextprotocol/python-sdk#3212</a></li>
<li>Ask which release line a bug report is on by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3213">modelcontextprotocol/python-sdk#3213</a></li>
<li>Link the released 2026-07-28 spec and point migrators at /v1/ by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3214">modelcontextprotocol/python-sdk#3214</a></li>
<li>Bump conformance harness to 0.2.0-alpha.11 by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3282">modelcontextprotocol/python-sdk#3282</a></li>
<li>Read UTF-8 test fixtures with explicit encoding by <a href="https://github.com/ShuQingDollarVoyager"><code>@​ShuQingDollarVoyager</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3245">modelcontextprotocol/python-sdk#3245</a></li>
<li>Pin each conformance leg to a spec-revision wire by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3304">modelcontextprotocol/python-sdk#3304</a></li>
<li>docs: publish translated docs in twelve languages and the tool that maintains them by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3280">modelcontextprotocol/python-sdk#3280</a></li>
<li>Pin text I/O to UTF-8 and fail CI on locale-dependent reads/writes by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3296">modelcontextprotocol/python-sdk#3296</a></li>
<li>docs: lead the README client example with a URL, not the server object by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3315">modelcontextprotocol/python-sdk#3315</a></li>
<li>Publish versioning, roadmap, and dependency policies for v2 by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3215">modelcontextprotocol/python-sdk#3215</a></li>
<li>Drop later-revision cache-hint fields on pre-2026 sessions by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3223">modelcontextprotocol/python-sdk#3223</a></li>
<li>Stop framing breaking changes as a workflow in AGENTS.md by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3286">modelcontextprotocol/python-sdk#3286</a></li>
<li>MCPServer: content-block returns are unstructured, prompt messages take Image/Audio by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3320">modelcontextprotocol/python-sdk#3320</a></li>
<li>Let Client take StdioServerParameters directly by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3321">modelcontextprotocol/python-sdk#3321</a></li>
<li>Gate external PRs on an assigned, linked issue by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3291">modelcontextprotocol/python-sdk#3291</a></li>
<li>docs: cover the remaining Tier 1 audit items by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3325">modelcontextprotocol/python-sdk#3325</a></li>
<li>Acknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3326">modelcontextprotocol/python-sdk#3326</a></li>
<li>Shorten stdio test comments by <a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3329">modelcontextprotocol/python-sdk#3329</a></li>
<li>Hand TypedDict tool results to pydantic natively by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3331">modelcontextprotocol/python-sdk#3331</a></li>
<li>Apply the request body limit to the SSE and OAuth endpoints by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3336">modelcontextprotocol/python-sdk#3336</a></li>
<li>Accept boolean sub-schemas in 2025-11-25 tool schema properties by <a href="https://github.com/pja-ant"><code>@​pja-ant</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3354">modelcontextprotocol/python-sdk#3354</a></li>
<li>Log MCPServer handler exceptions by kind and keep crash details off the wire by <a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/3314">modelcontextprotocol/python-sdk#3314</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0921d94a74db900dccd2d534842aa7b6160542d2"><code>0921d94</code></a> Point imports of mcp.server.fastmcp at the migration guide (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3388">#3388</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/4d6f87e8d2df8b161bd279cecdb76c988d74bc8a"><code>4d6f87e</code></a> Build releases with the pinned hatchling and a publish action that accepts Me...</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/c5d7d0b6d0cc8e0a2cc2f5dd6caf0be9ad744352"><code>c5d7d0b</code></a> docs: refresh translations for recent English changes (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3379">#3379</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/d8b638304ec6c65a583268eb4a1c691d7e77816f"><code>d8b6383</code></a> Give recursive tool return types an object-rooted output schema (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3376">#3376</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/56af44727b291c5901d976bff6c6c8eff5649f23"><code>56af447</code></a> Log MCPServer handler exceptions by kind and keep crash details off the wire ...</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/f1c40b062f2ba4bfdb0b7583e3ab6687e68b7cfc"><code>f1c40b0</code></a> Accept boolean sub-schemas in 2025-11-25 tool schema properties (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3354">#3354</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb"><code>57394b0</code></a> Apply the request body limit to the SSE and OAuth endpoints (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3336">#3336</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0cee6249bad02d67a96678973f9db383519c64b4"><code>0cee624</code></a> Hand TypedDict tool results to pydantic natively (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3331">#3331</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0d92192765fa7d6a20fbfe7e62e242e44933574f"><code>0d92192</code></a> Shorten stdio test comments (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3329">#3329</a>)</li>
<li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/b2025ab815ee4013d12cd3af5e7dba50c2c2868c"><code>b2025ab</code></a> Acknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/3326">#3326</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v2.0.0...v2.1.1">compare view</a></li>
</ul>
</details>
<br />

Updates `anyio` from 4.14.2 to 4.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p>
<blockquote>
<h2>4.15.0</h2>
<ul>
<li>
<p>Added support for the newer keyword-only arguments on <code>anyio.Path</code> methods to match the standard library <code>pathlib.Path</code>:</p>
<ul>
<li><code>follow_symlinks</code> on <code>exists()</code> (Python 3.12+)</li>
<li><code>follow_symlinks</code> on <code>is_dir()</code> (Python 3.13+)</li>
<li><code>follow_symlinks</code> on <code>is_file()</code> (Python 3.13+)</li>
<li><code>follow_symlinks</code> on <code>owner()</code> (Python 3.13+)</li>
<li><code>follow_symlinks</code> on <code>group()</code> (Python 3.13+)</li>
<li><code>newline</code> on <code>read_text()</code> (Python 3.13+)</li>
</ul>
<p>(<a href="https://redirect.github.com/agronholm/anyio/pull/1286">#1286</a>, <a href="https://redirect.github.com/agronholm/anyio/pull/1293">#1293</a>; PR by <a href="https://github.com/jaideeppyne"><code>@​jaideeppyne</code></a>)</p>
</li>
<li>
<p>Added <code>amap</code>, <code>gather</code>, and <code>as_completed</code> utility functions to simplify common patterns (<a href="https://redirect.github.com/agronholm/anyio/pull/1173">#1173</a>; PR by <a href="https://github.com/Graeme22"><code>@​Graeme22</code></a>)</p>
</li>
<li>
<p>Added <code>--anyio-mode</code> command-line option as an alternative to the <code>anyio_mode</code> ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: <code>pytest_asyncio</code>). (<a href="https://redirect.github.com/agronholm/anyio/pull/1242">#1242</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@​EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Added the <code>anyio.Future</code> synchronization primitive which behaves similar to <code>asyncio.Future</code>, allowing tasks to wait for a value (or exception) from another task (<a href="https://redirect.github.com/agronholm/anyio/pull/1146">#1146</a>; PR by <a href="https://github.com/Vizonex"><code>@​Vizonex</code></a>)</p>
</li>
<li>
<p>Added guidance for managing multiple memory object stream producers and consumers with cloned streams (<a href="https://redirect.github.com/agronholm/anyio/issues/330">#330</a>; PR by <a href="https://github.com/nightcityblade"><code>@​nightcityblade</code></a>)</p>
</li>
<li>
<p>Added <code>StapledObjectStream.send_nowait()</code> that delegates to the underlying <code>ObjectSendStream</code>, if it implements it (<a href="https://redirect.github.com/agronholm/anyio/pull/1241">#1241</a>; PR by <a href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>)</p>
</li>
<li>
<p>Added the <code>move_on_at()</code> and <code>fail_at()</code> functions to complement <code>move_on_after()</code> and <code>fail_after()</code></p>
</li>
<li>
<p>Changed the default name for a task spawned with <code>TaskGroup.create_task(func())</code> to match the default task name for the analogous task spawned with <code>TaskGroup.start_soon(func)</code> or <code>TaskGroup.start(func)</code> in more situations. Previously, the default name of a <code>TaskGroup.create_task</code> task never included the module name. (The default name for a task spawned with <code>TaskGroup.start_soon</code> or <code>TaskGroup.start</code> typically includes the module name.) (<a href="https://redirect.github.com/agronholm/anyio/pull/1234">#1234</a>; PR by <a href="https://github.com/gschaffner"><code>@​gschaffner</code></a>)</p>
</li>
<li>
<p>Changed the <code>anyio</code> and <code>anyio.abc</code> modules to lazily (much like <code>810</code>) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the <code>if TYPE_CHECKING:</code> block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (<a href="https://redirect.github.com/agronholm/anyio/pull/1169">#1169</a>)</p>
</li>
<li>
<p>Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to <code>start_blocking_portal()</code> and <code>anyio.to_thread.run_sync()</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1224">#1224</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@​EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Fixed <code>SpooledTemporaryFile.readinto()</code> and <code>readinto1()</code> reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (<a href="https://redirect.github.com/agronholm/anyio/pull/1215">#1215</a>; PR by <a href="https://github.com/c-tonneslan"><code>@​c-tonneslan</code></a>)</p>
</li>
<li>
<p>Added a <code>reason</code> parameter to <code>fail_after</code> (and the new <code>fail_at</code>) allowing for added exception context when raising <code>TimeoutError</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1227">#1227</a>; PR by <a href="https://github.com/Graeme22"><code>@​Graeme22</code></a>)</p>
</li>
<li>
<p>Fixed the default <code>TaskHandle.name</code> missing part of the task name for tasks started with <code>TaskGroup.start</code> on Trio (<a href="https://redirect.github.com/agronholm/anyio/issues/1231">#1231</a>; PR by <a href="https://github.com/gschaffner"><code>@​gschaffner</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.run</code> leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a <code>RunVar</code>. (<a href="https://redirect.github.com/agronholm/anyio/issues/1203">#1203</a>; PR by <a href="https://github.com/tapetersen"><code>@​tapetersen</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.Path.with_stem()</code> silently producing a wrong path (e.g. <code>Path(&quot;.txt&quot;)</code>) instead of raising <code>ValueError</code> when given an empty stem on a path with a non-empty suffix, unlike <code>pathlib.PurePath.with_stem</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1200">#1200</a>; PR by <a href="https://github.com/Sanjays2402"><code>@​Sanjays2402</code></a>)</p>
</li>
<li>
<p>Fixed <code>UNIXSocketStream.aclose()</code> raising <code>asyncio.InvalidStateError</code> when a concurrent receive or send operation had just been cancelled on the asyncio backend (<a href="https://redirect.github.com/agronholm/anyio/issues/1267">#1267</a>; PR by <a href="https://github.com/alloutflo"><code>@​alloutflo</code></a>)</p>
</li>
<li>
<p>Fixed the pytest plugin importing the deprecated <code>_pytest.python.CallSpec2</code> alias, which triggers <code>PytestRemovedIn10Warning</code> on <code>pytest&gt;=9.2</code> and crashes pytest at startup when <code>filterwarnings = error</code> is configured (<a href="https://redirect.github.com/agronholm/anyio/issues/1271">#1271</a>; PR by <a href="https://github.com/matthewfeickert"><code>@​matthewfeickert</code></a>)</p>
</li>
<li>
<p>Fixed an asyncio worker thread race that could raise <code>RuntimeError</code> when the event loop closed between checking its state and scheduling the worker result (<a href="https://redirect.github.com/agronholm/anyio/issues/1265">#1265</a>; PR by <a href="https://github.com/hansu650"><code>@​hansu650</code></a>)</p>
</li>
<li>
<p>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens when <code>total_tokens</code> was raised while the limiter was over-subscribed (<a href="https://redirect.github.com/agronholm/anyio/pull/1223">#1223</a>; PR by <a href="https://github.com/zelinewang"><code>@​zelinewang</code></a>)</p>
</li>
<li>
<p>Fixed asyncio task groups leaking unawaited coroutines when a custom task constructor fails; default task creation is unaffected (<a href="https://redirect.github.com/agronholm/anyio/issues/1274">#1274</a>; PR by <a href="https://github.com/dsfaccini"><code>@​dsfaccini</code></a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/agronholm/anyio/commit/928366259543412a2deb1e2ba09ea45ffa92ef4f"><code>9283662</code></a> Bumped up the version</li>
<li><a href="https://github.com/agronholm/anyio/commit/d137692a90f76e4f71605e32ea5ca94cab3a539d"><code>d137692</code></a> Improved the instructions for AI agents</li>
<li><a href="https://github.com/agronholm/anyio/commit/033fc52b8fa8e90c5d0ef24b10b3860e974a6265"><code>033fc52</code></a> Shield TemporaryDirectory cleanup from cancellation (<a href="https://redirect.github.com/agronholm/anyio/issues/1304">#1304</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/942e9a6552cc10b5aaa779d84bfc8e2c3d5fcffc"><code>942e9a6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/agronholm/anyio/issues/1305">#1305</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/b825c3be7cb4ca1a8000b8065d4e147843deb704"><code>b825c3b</code></a> Fixed pyproject.toml changes not triggering the test suite</li>
<li><a href="https://github.com/agronholm/anyio/commit/9727dc504681e2986b5bc285de9571fb467539af"><code>9727dc5</code></a> Fixed start inconsistencies between trio and asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1198">#1198</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/b05fe6d160a640355c201363cab286a7d2581da8"><code>b05fe6d</code></a> Fixed wrong type in move_on_after (<a href="https://redirect.github.com/agronholm/anyio/issues/1297">#1297</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/44d0c93cc20079acbf38ba4dbed5ab9df323f153"><code>44d0c93</code></a> Fixed asyncio task group coroutine cleanup (<a href="https://redirect.github.com/agronholm/anyio/issues/1275">#1275</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/ae250440c90020b030ba4e83cccc37e9a84512c5"><code>ae25044</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/agronholm/anyio/issues/1290">#1290</a>)</li>
<li><a href="https://github.com/agronholm/anyio/commit/6d3a30d264637374b1b642d2e97217c816151cfe"><code>6d3a30d</code></a> Add follow_symlinks argument to anyio.Path.owner() and group() (<a href="https://redirect.github.com/agronholm/anyio/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.14.2...4.15.0">compare view</a></li>
</ul>
</details>
<br />

Updates `ruff` from 0.16.3 to 0.16.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p>
<blockquote>
<h2>0.16.6</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-03.</p>
<h3>Preview features</h3>
<ul>
<li>Move <code>pytest-fixture-autouse</code> to the <code>restriction</code> category (<a href="https://redirect.github.com/astral-sh/ruff/pull/28219">#28219</a>)</li>
<li>[<code>flake8-pytest-style</code>] Add an autofix for <code>PT020</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27993">#27993</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28262">#28262</a>)</li>
<li>[<code>isort</code>] Exclude pragma comments from line length calculation (<code>I001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27313">#27313</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Validate unary expressions when parsing (<a href="https://redirect.github.com/astral-sh/ruff/pull/28233">#28233</a>)</li>
<li>[<code>flake8-async</code>, <code>pylint</code>] Recognize <code>builtins.open</code> (<code>ASYNC230</code>, <code>PLW1514</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28021">#28021</a>)</li>
<li>[<code>flake8-bugbear</code>] Fix panic on <code>match</code> subjects (<code>B031</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27781">#27781</a>)</li>
<li>[<code>flake8-datetimez</code>] Reject <code>tzinfo=None</code> for <code>datetime</code> bounds (<code>DTZ901</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28022">#28022</a>)</li>
<li>[<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/27918">#27918</a>)</li>
<li>[<code>ruff</code>] Remove <code>lint.external</code> hint for Ruff-specific suppressions (<code>RUF102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27923">#27923</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add display-only fix for <code>os.listdir</code> (<code>PTH208</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28027">#28027</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Add another example and glob reference for <code>lint.per-file-ignores</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28106">#28106</a>)</li>
<li>Add duplicate work guidance (<a href="https://redirect.github.com/astral-sh/ruff/pull/28229">#28229</a>)</li>
<li>[<code>flake8-async</code>] Document thread offloading (<code>ASYNC240</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28008">#28008</a>)</li>
<li>[<code>pyupgrade</code>] Clarify default <code>encoding</code> argument handling (<code>UP012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27315">#27315</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Allow unary plus in match patterns on Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28231">#28231</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/flying-sheep"><code>@​flying-sheep<...

_Description has been truncated_