[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updates the requirements on numpy, pandas, scikit-learn, pyarrow, huggingface-hub, kaggle, kagglehub, ruff, pre-commit and uv-build to permit the latest version.
Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates pandas from 3.0.5 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

... (truncated)

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates scikit-learn from 1.9.0 to 1.9.1

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.1

We're happy to announce the 1.9.1 release.

This release contains a few bug fixes and is the first version supporting Python 3.15.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.9.html#version-1-9-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Thanks to everyone who contributed to this release !

Commits

• 866c0f5 generate changelog
• 12f135f update upper bounds
• 43ff2f2 bump version
• b851524 DOC Mark dev index as orphan (#34916)
• 01d56d4 DOC Fix wikipedia principal eigenvector example references (#34915)
• b86a1e2 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
• d282698 🔒 🤖 CI Update lock files for main CI build(s) 🔒 🤖 (#34897)
• eb34279 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
• 7581303 FIX: Fix QuantileTransformer(ignore_implicit_zeros=True) sub-sampling behav...
• ac47f4d FIX: avoid EfficiencyWarning in OPTICS with metric='precomputed' (#34692)
• Additional commits viewable in compare view

Updates pyarrow from 25.0.1 to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Apache Arrow 26.0.0 RC0

Release Notes: Release Candidate: 26.0.0 RC0

Commits

• 4461671 MINOR: [Release] Update versions for 26.0.0
• 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
• 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
• 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
• 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
• 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
• cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
• 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
• f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
• 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
• Additional commits viewable in compare view

Updates huggingface-hub from 1.30.0 to 2.3.0

Release notes

Sourced from huggingface-hub's releases.

[v2.3.0] Bucket live-follow, faster HfFileSystem listings and more

🔄 Keep Bucket listings fresh with live_follow=True

HfFileSystem caches directory listings, so files added to a Bucket by another process did not show up until you called invalidate_cache(). With live_follow=True, HfFileSystem opens one background connection per listed Bucket to receive its file changes from the Hub. When a change arrives, it removes the cached listings it affects.

>>> from huggingface_hub import HfFileSystem
>>> hffs = HfFileSystem(live_follow=True)
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # starts following that bucket
>>> # ... another process uploads a file to the bucket ...
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # refreshed as changes arrive
['buckets/my-username/my-bucket/data/train.csv', 'buckets/my-username/my-bucket/data/new-file.csv']

It also works through fsspec with fsspec.filesystem("hf", live_follow=True), and through the storage_options argument of libraries such as pandas and pyarrow. The option is off by default because it keeps a connection open for each followed Bucket. It only affects listings and metadata (ls, info, exists, glob, ...), because reading a file always fetches its content from the Hub. It is not available for model, dataset and Space repos: use refresh=True to see a new commit.

• [HfFileSystem] Add live-follow for Buckets by @​lhoestq in #5096

🚀 HfFileSystem lists large repos in parallel

Recursive listings such as find and glob used to be slow on large repos. The Hub returns a repo's file tree 1000 entries at a time, and each page can only be requested after the previous one has arrived. Listing datasets/allenai/objaverse (~800k files) took ~800 requests in a row, about 13 minutes.

HfFileSystem now splits recursive listings by sub-directory and lists them in parallel, with almost the same number of requests. A sub-tree that fits in a single page is never split. maxdepth is now applied during the listing, so the Hub only returns the levels you ask for.

datasets/allenai/objaverse	before	after
find(), 798,924 files	801 requests, 776 s	807 requests, 19.7 s
find(maxdepth=2), 328 entries	801 requests, 776 s	6 requests, 1.5 s

>>> from huggingface_hub import hffs
>>> files = hffs.glob("datasets/allenai/objaverse/**/*.glb", maxdepth=3)

The new max_workers argument of HfFileSystem sets the number of concurrent requests. It defaults to 16. Set it to 1 to list sequentially like before.

• [HfFileSystem] List large repos in parallel by @​lhoestq in #5153

📎 Attach images and videos to discussions and PRs

The new HfApi.upload_attachment(path) uploads an image, video or audio file and returns its URL, which you can embed in a discussion, PR description or comment. Before, this required calling an undocumented Hub endpoint by hand.

>>> from huggingface_hub import HfApi
>>> api = HfApi()
>>> url = api.upload_attachment("screenshot.png")
>>> api.comment_discussion("username/repo-name", 5, f"Here is the fix:\n\n![screenshot](https://github.com/huggingface/huggingface_hub/blob/HEAD/{url})")

... (truncated)

Commits

• 587e09a Release: v2.3.0
• ac4a5f0 Release: v2.3.0.rc1
• 64e9850 [HfFileSystem] Fix glob crash when the parent listing is outdated (#5237)
• b1066db Release: v2.3.0.rc0
• 0c7fd06 [HfApi] Support gated repos hiding requester username/email (#5047)
• c629fa3 [Jobs] Fix hf jobs run losing logs and ignoring Ctrl+C (#5162)
• 7858680 [HfFileSystem] List large repos in parallel (#5153)
• 75fbd6d fix(kernels): allow uploads and commits to kernel repos (#5233)
• e1f595d [CLI] Show the Job's scheduling status in hf jobs run (#5163)
• d03a05c Bump the actions group with 3 updates (#5228)
• Additional commits viewable in compare view

Updates kaggle from 2.2.4 to 2.2.5

Changelog

Sourced from kaggle's changelog.

2.2.5

• Require certifi >= 2026.10.19, which drops the compromised emSign/eMudhra root CAs (GHSA-6q48-6c7w-9gw2). kaggle only pulled in certifi through requests, which sets no minimum, so an existing install could keep a certifi that would accept a forged kaggle.com certificate and leak the user's API token to a man-in-the-middle
• Reject kernel version numbers in kaggle kernels delete instead of failing with a ValueError when a version is included in <owner>/<kernel>/<version>
• Report a 404 from kaggle competitions submit with a competition-specific hint on stderr, naming the notebook and version for code submissions. The check never matched a 404, so users got the generic <owner>/<slug> hint instead
• Exit non-zero from kaggle competitions submit when the submission file upload fails. It printed "Could not submit to competition" and exited 0, so scripts treated the failed submission as a success
• Include the UTC offset (+00:00) in refreshAt timestamps displayed by kaggle quota
• Recommend installing with pipx or uv and add troubleshooting guidance for externally-managed-environment errors in the installation docs
• Stream kaggle kernels output files to disk through the same download path as datasets and competitions, with a read timeout, a size check, and resume after a dropped connection. Each file used to be read into memory whole, so a 512 MiB output took about 1.2 GB of RAM, and a dropped connection failed the command and left an empty file behind
• Honor the version in <owner>/<kernel>/<version> for kaggle kernels pull, output, status, files and logs, which previously returned 403 for pull and acted on the latest version for the others
• Clarify in --accelerator help and kernels docs that NvidiaTeslaT4 maps to GPU T4 x2 and TpuV5E8 maps to TPU v5e-8
• Reject dataset version numbers in kaggle datasets delete to prevent unintentionally deleting an entire dataset when targeting a single version
• Show why a submission failed in kaggle competitions submission <ref>, which already comes back in the API response but was not displayed
• Honor -k/--kernel in kaggle kernels pull, which was ignored when the positional kernel argument was omitted, causing the CLI to fall back to the local kernel-metadata.json and pull a different kernel
• Refuse to write a kaggle kernels output file whose server-supplied name resolves outside the requested --path directory
• Add --no-run to kaggle kernels push to save a new version without executing the notebook, the equivalent of Quick Save in the web UI
• Honor --unzip when downloading a single file with kaggle datasets download -f, which extracts the file from the zip archive the server wraps large files in, and add --unzip to kaggle competitions download
• Fix misleading validation error messages in kaggle competitions submit when --kernel, --version, or --file is missing for a code competition submission
• Keep the requested folder when downloading a single file with kaggle datasets download -f or kaggle competitions download -f, instead of writing it to the download root
• Report slug instead of title in the kaggle datasets create error message when the requested slug is already in use
• Prevent HTTP errors during resumed Range downloads from overwriting existing partial download files
• Check the HTTP status when downloading kaggle kernels output files so error responses are not saved as output files
• Add kaggle competitions host-add <comp> -u <user> to grant host access on a competition to a Kaggle user
• Suggest a next step on 403/404/429/5xx API errors, report unexpected errors as bugs instead of a traceback (with a new --debug flag), and list common examples in kaggle --help
• Guard tar extraction in kaggle models instances versions download --untar against path traversal
• Store resumable upload state in a private per-user directory (0700) and verify directory ownership and permissions before use
• Add kaggle benchmarks quota to show Model Proxy (AI inference) spend quota, and bump kagglesdk to >= 0.1.38
• Honor --untar in kaggle models instances versions download when the archive is already cached locally
• Write kernel log files using UTF-8 in kaggle kernels output to avoid UnicodeEncodeError on Windows
• Exclude omitted overview and usage fields from the update mask when updating a model instance
• Add kaggle competitions submission-download <id> to download the submitted file for a single submission (requires kagglesdk >= 0.1.36)
• Add deadline (Competition Deadline) to the competition settings command and bump kagglesdk to >= 0.1.36
• Warn when kaggle kernels push requests a retired accelerator (NvidiaTeslaP100, TpuV38, Tpu1VmV38, TpuV232 or TpuV2256), since the server runs the session on a replacement instead. Drop the retired shapes from the docs
• Abort dataset, model version, and competition data uploads when a file upload fails instead of skipping the failed file and creating a partial upload
• Use GitHub alerts and fix the LLMS_AVAILABLE token reference in the benchmarks documentation
• Add unified kaggle search command across competitions, datasets, notebooks, models, users, and discussions
• Parse duration suffixes (s, m, h, d, w) in kaggle auth print-access-token --expiration instead of raising a TypeError
• Add --wait/--poll-interval to kaggle competitions submit to wait for scoring, and add kaggle competitions submission <ref> to look up a single submission's status and score
• Show N/A instead of Fail in kaggle benchmarks leaderboard for a task result the server returned without a pass/fail or numeric score, which was reported as a failed task

Commits

• 5da4593 Finish 2.2.5 release prep and bump twine to 7.0.0 (#1230)
• 941236a Release 2.2.5 (#1228)
• 1bd0dc4 Require certifi >= 2026.10.19 for the emSign/eMudhra CA compromise (#1227)
• 78003a1 fix(kernels): reject versioned kernel identifiers in delete (#1205)
• 8bace8a Bump certifi to 2026.10.19 to fix GHSA-6q48-6c7w-9gw2 (#1223)
• 6894864 fix(competitions): handle 404 errors during submission (#1216)
• 931014d fix(competitions): exit non-zero when submission upload fails (#1215)
• 9c57dd7 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /tools/releases (#1212)
• 51b64b0 fix(quota): include UTC offset in refresh timestamps (#1211)
• 6b40b6b docs: add pipx/uv install instructions and externally-managed-environment tro...
• Additional commits viewable in compare view

Updates kagglehub from 1.0.2 to 1.0.3

Changelog

Sourced from kagglehub's changelog.

v1.0.3 (October 21, 2026)

• Fix competition_download crashing with AttributeError when the server returns a Last-Modified header.
• Add the pyopenssl dependency missing from the signing extra.
• Require certifi>=2026.10.19 to drop the compromised emSign/eMudhra root CAs, which allowed forged TLS certificates to intercept Kaggle API credentials (GHSA-6q48-6c7w-9gw2). Also floor pip>=26.2.2 and uv>=0.13.4 in the development and CI tooling.
• Fix single-file downloads not being extracted from their server-side zip wrapper on Windows, which left the raw zip archive cached under the requested filename instead of the expected file. (#252)
• Support downloading one dataset directory through dataset_download(path=...), including nested files and cache reuse. (#306)
• Parallelize directory uploads (#298)

Commits

• 03c1f54 Release 1.0.3 (#319)
• 19f734b Require patched certifi, pip and uv for emSign CA compromise (#318)
• 4fe0a17 Set kagglesdk version to 0.1.36 (#309)
• 69b1ade Fix single-file zip auto-extraction on Windows (#252) (#307)
• 7b622f8 Support downloading dataset folders (#306)
• 2252773 Parallelize directory uploads (#298)
• See full diff in compare view

Updates ruff from 0.16.6 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits

• 30516b4 Bump version to 0.17.2 (#29637)
• 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
• 0d562aa [ty] Check inherited attribute conflicts (#28559)
• 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
• 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
• b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
• 32869b4 Avoid creating deployments for automation jobs (#29626)
• ec891ba Link the commit in pull request report footers (#29621)
• 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
• 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates uv-build to 0.13.5

Release notes

Sourced from uv-build's releases.

0.13.5

Release Notes

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements

• Report incompatible self-dependencies directly in resolution errors (#21845)

Python

• Add CPython 3.15.1, 3.14.9, and 3.13.17 (#22802)

Preview features

• Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#22535, #22536, #22687, #22688)

Performance

• Reduce peak memory use when resolving dependencies across multiple environments (#22769, #22770, #22784)
• Speed up exports with complex transitive extras by resolving activation across the dependency graph (#22751)
• Reduce uv's binary size by keeping additional error formatters out of line (#22775)
• Reduce overhead when parsing custom build cache keys (#22749)

Bug fixes

• Lock packages distributed only as Android wheels without a source distribution (#22806)
• Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#22751)
• Reject invalid custom build cache keys instead of silently falling back to the defaults (#22749)

Security

• Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#22777)
• Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#22773)

Install uv 0.13.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.5/uv-installer.sh | sh

Install prebuilt binaries via powershell script

</tr></table> 

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.13.5

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements

• Report incompatible self-dependencies directly in resolution errors (#21845)

Python

• Add CPython 3.15.1, 3.14.9, and 3.13.17 (#22802)

Preview features

• Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#22535, #22536, #22687, #22688)

Performance

• Reduce peak memory use when resolving dependencies across multiple environments (#22769, #22770, #22784)
• Speed up exports with complex transitive extras by resolving activation across the dependency graph (#22751)
• Reduce uv's binary size by keeping additional error formatters out of line (#22775)
• Reduce overhead when parsing custom build cache keys (#22749)

Bug fixes

• Lock packages distributed only as Android wheels without a source distribution (#22806)
• Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#22751)
• Reject invalid custom build cache keys instead of silently falling back to the defaults (#22749)

Security

• Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#22777)
• Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#22773)

0.13.4

Released on 2026-10-20.

Preview features

• Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under wheel-variants (#22512)

Other changes

• Update the bundled Mozilla root certificates via webpki-root-certs 1.0.10 (#22760)

... (truncated)

Commits

• 46776a9 Use checked-in Python metadata for trampoline checks (#22811)
• 5babfa9 Use checked-in Python download metadata for releases (#22810)
• 06fbc97 Reject Cargo.lock changes from forks (#22381)
• b3c01fd Prepare 0.13.5 (#22809)
• a02d446 Update to include Python 3.15.1, 3.14.9, 3.13.17 (#22802)
• 0ee565f Reproduce local-version marker rendering panic (#22807)
• e3810e1 Infer platform markers from Android wheel tags (#22806)
• 75698b1 Update rustup in Docker builders (#22803)
• 1765e51 Replace actions/attest-build-provenance action with actions/attest v4.2.2 (#2...
• 0abe802 Update Rust crate test-log to v0.2.21 (#19721)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase wil...

Description has been truncated