Skip to content

build(deps): bump the python-minor-patch group across 1 directory with 27 updates - #124

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/python-minor-patch-9225ff7ce3
Open

build(deps): bump the python-minor-patch group across 1 directory with 27 updates#124
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/python-minor-patch-9225ff7ce3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 27 updates in the / directory:

Package From To
rawpy 0.27.0 0.27.1
uvicorn 0.52.1 0.52.4
transformers 5.15.0 5.16.1
bitsandbytes 0.50.0 0.50.2
click 8.4.2 8.5.0
filelock 3.32.2 3.32.4
grpcio 1.83.0 1.83.1
huggingface-hub 1.26.0 1.29.0
hypothesis 6.165.2 6.167.1
kiwisolver 1.5.0 1.5.1
llvmlite 0.48.0 0.49.0
ml-dtypes 0.5.4 0.6.0
narwhals 2.24.0 2.25.0
ninja 1.13.0 1.13.2
numba 0.66.0 0.67.0
optree 0.19.1 0.20.0
pre-commit 4.6.1 4.6.2
protobuf 7.35.1 7.36.0
pydantic 2.13.4 2.13.5
python-discovery 1.5.1 1.6.0
regex 2026.7.19 2026.8.31
ruff 0.16.1 0.16.5
starlette 1.4.1 1.6.0
timm 1.0.28 1.0.29
typer 0.27.1 0.27.2
typing-inspection 0.4.2 0.4.4
virtualenv 21.7.1 21.7.7

Updates rawpy from 0.27.0 to 0.27.1

Release notes

Sourced from rawpy's releases.

0.27.1

What's Changed

New Contributors

Full Changelog: letmaik/rawpy@v0.27.0...v0.27.1

Commits

Updates uvicorn from 0.52.1 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Commits

Updates transformers from 5.15.0 to 5.16.1

Release notes

Sourced from transformers's releases.

Release v5.16.1

This is a special release as we include GLM! (and a few small fixes)

GLM-5.3-Flash

GLM-5.3-Flash, the first natively multimodal model in the GLM-5 series. With 320B total parameters and just 18B active parameters, it outperforms GLM-5.2 across benchmarks and real-world workloads at one-tenth the price, while approaching Claude Opus 4.8 on coding and agentic benchmarks.

GLM-5.3-Flash starts from a newly trained base model, with its architecture and training recipe redesigned around capability and efficiency. For the first time in the GLM series, we introduce a hybrid architecture combining sparse and linear attention, sharply reducing long-context serving costs while preserving precise long-context capabilities. The model also adopts Manifold-Constrained Hyper-Connections (mHC) to further improve scaling efficiency. Together with our latest 30T-token multimodal pre-training corpus, these changes enable GLM-5.3-Flash to deliver more intelligence with less compute.

Links: Documentation

Small patch fixes

Mainly BC behavior for TP and pinning a hf kernel for security reasons 🤗

Full Changelog: huggingface/transformers@v5.16.0...v5.16.1

Release: v5.16.0

Release v5.16.0

New Model additions

Qwen4-Exp

Qwen4-Exp builds on Qwen3.5's hybrid text and multimodal architecture with three key components: GatedResidual (GR), Qwen Sparse Attention (QSA), and Per-Layer Embedding (PLE).

GR is a Qwen-developed residual architecture that combines Hyper-Connection with GatedNorm. It mixes multiple residual streams with fine-grained elementwise gating before each attention and Mixture-of-Experts (MoE) block, then controls how much of the block output is injected back into each stream.

QSA uses multiple query heads to score compressed key blocks, selects the most relevant contiguous token blocks, and keeps the incomplete trailing block uncompressed. This block-level selection reduces indexing overhead and improves memory locality for long sequences. Combined with Gated DeltaNet, QSA makes Qwen4-Exp the first hybrid architecture to integrate linear and sparse attention, substantially improving inference efficiency for long-context workloads.

PLE enriches selected decoder layers with layer-specific lexical features derived from hashed token n-grams and a dilated depthwise convolution.

Links: Documentation

GraniteSpeech5

... (truncated)

Commits

Updates bitsandbytes from 0.50.0 to 0.50.2

Release notes

Sourced from bitsandbytes's releases.

0.50.2

Highlights

  • ROCm 10.0 build is now included for both Linux and Windows.
  • Additional AMD GPU targets are included in our prebuilt wheels.
  • Performance improvement for certain 4bit GEMM shapes on NVIDIA GB10.

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.1...0.50.2

0.50.1: RTX Spark Support

This release adds support for additional hardware platforms and improves performance on RTX Spark / DGX Spark.

Highlights

  • Support added for NVIDIA RTX Spark products running Windows on ARM64 (#2038, #2037, #2032)
  • Improved 4bit GEMM dispatch heuristics for NVIDIA GB10 (#2030)
  • Support for AMD CDNA5 hardware (e.g. MI455X)

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.0...0.50.1

Commits
  • 08a9956 Release 0.50.2
  • 4f1fc6c [ROCm] Add CI for ROCm 10.0 (#2061)
  • 906ff4d ci: expand ROCm architecture coverage (#2046)
  • d9e4440 Restore Wave64 warp size for all gfx9 targets (#2059)
  • 3fe95b5 Revert "[ROCm] Rework ROCm build to use ROCm version instead of HIP version (...
  • 3ac90c4 [ROCm] Rework ROCm build to use ROCm version instead of HIP version (#1888)
  • 95f9af3 chore(deps): bump the actions group across 1 directory with 2 updates (#2036)
  • d2d08f6 Add sm121 (GB10) to the wide_n_simt 4-bit GEMM dispatch rule (#2039)
  • d8ccdd9 Mask the absmax store in the Triton 4-bit quantize kernels (#2043)
  • 2b6cfb7 Bump dev version
  • Additional commits viewable in compare view

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits
  • 8b19813 Release version 8.5.0
  • 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
  • 131c86a Add FAQ entry about UnicodeEncodeError on Windows
  • e1fd594 Add support of pathlib.Path to edit (#3781)
  • a1d8785 Add support of pathlib.Path to edit
  • 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
  • a6256bf Forwards all user's parameters set in PAGER
  • 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
  • 9835b0f Resolve the pager command once, in _pager_contextmanager
  • f36d58b Refactor pager stream handling (#3767)
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 3.32.4

Release notes

Sourced from filelock's releases.

3.32.4

What's Changed

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits
  • cb493d6 Release 3.32.4
  • fe07a11 escape the hostname every marker publishes (#709)
  • 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
  • 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
  • 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
  • f12a52f build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#711)
  • 54c7b6c [pre-commit.ci] pre-commit autoupdate (#710)
  • 49f8035 🧪 test: cover a reclaimed private record for real (#706)
  • bb16d39 🧪 test: deflake six scheduled-run failures (#704)
  • 13b82a6 🐛 fix: retry transient denials on open and claim read (#705)
  • Additional commits viewable in compare view

Updates grpcio from 1.83.0 to 1.83.1

Release notes

Sourced from grpcio's releases.

Release v1.83.1

This is release gRPC Core 1.83.1 (garden).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Commits
  • aae2670 [Backport][v1.83.x] Fix legacy_channel.cc compile error with `std::optional<a...
  • b77ea36 [Backport][v1.83.x] Memory optimization (#43297)
  • 9dcd5aa [CI] Fix Python 3.15 Sanity (#43299)
  • ed8899e [Backport][v1.83.x] Fixing bug in GoAway and gRPC Message Compression (#43270)
  • 5f8d6df [Release] Bump version to 1.83.1 (on v1.83.x branch) (#43274)
  • 291e0be [Backport][v1.83.x][Python] Fix the StatusCode Enums to be int (#43252)
  • 05ceb5d [CI][Backport][v1.83.x][Python] Fix PSM Interop xds-v3 Python continuous fail...
  • dbc73b8 [Backport][v1.83.x][PHP]updated workflow to preserve github folder (#43243)
  • See full diff in compare view

Updates huggingface-hub from 1.26.0 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

  • [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
  • Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

🖥️ CLI

... (truncated)

Commits
  • 4237d95 Release: v1.29.0
  • dd44abc Release: v1.29.0.rc1
  • 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
  • b1bf950 Release: v1.29.0.rc0
  • 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
  • c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
  • 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
  • 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
  • 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
  • c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
  • Additional commits viewable in compare view

Updates hypothesis from 6.165.2 to 6.167.1

Commits
  • a8dcd74 Bump hypothesis version to 6.167.1 and update changelog
  • c862b6f Merge pull request #4874 from Zac-HD/claude/cu-many-reject-span-discard-yhaidc
  • df39994 Merge pull request #4873 from HypothesisWorks/create-pull-request/patch
  • afe5b0b Bump hypothesis version to 6.167.0 and update changelog
  • 06bfa69 Merge pull request #4870 from Zac-HD/claude/status-reason-ideas-dum8wm
  • 1d0e155 Add return annotation to satisfy mypy's disallow_incomplete_defs
  • a0a7dfc Report the failing assume() when .map() gives up
  • d010799 Rename _filter_gave_ups test helper to _get_filter_gave_ups
  • ef98ff9 Fix the type of Bundle transformations
  • 8e36c8f Require passing data to SampledFromStrategy._transform
  • Additional commits viewable in compare view

Updates kiwisolver from 1.5.0 to 1.5.1

Release notes

Sourced from kiwisolver's releases.

1.5.1

What's Changed

New Contributors

Full Changelog: nucleic/kiwi@1.5.0...1.5.1

Changelog

Sourced from kiwisolver's changelog.

Wrappers 1.5.1 | Solver 1.5.1 | 28/08/2026

  • add support for Python 3.15 PR #243
  • fix bad version reported in C++ code PR #243
Commits
  • 166899b cut release 1.5.1
  • 1af7c11 ci: start testing on Python 3.15 (#243)
  • 2e7291d build(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 (#242)
  • e8acf1e Add iOS build configuration. (#238)
  • bd4b983 build(deps): bump actions/setup-python from 6 to 7 (#239)
  • 00be78d build(deps): bump codecov/codecov-action from 5 to 7 (#235)
  • 91a75dd build(deps): bump actions/checkout from 6 to 7 (Description has been truncated

@dependabot
build(deps): bump the python-minor-patch group across 1 directory wit…
effd272 
…h 27 updates

Bumps the python-minor-patch group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [rawpy](https://github.com/letmaik/rawpy) | `0.27.0` | `0.27.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [transformers](https://github.com/huggingface/transformers) | `5.15.0` | `5.16.1` |
| [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes) | `0.50.0` | `0.50.2` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.4` |
| [grpcio](https://github.com/grpc/grpc) | `1.83.0` | `1.83.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.26.0` | `1.29.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.165.2` | `6.167.1` |
| [kiwisolver](https://github.com/nucleic/kiwi) | `1.5.0` | `1.5.1` |
| [llvmlite](https://github.com/numba/llvmlite) | `0.48.0` | `0.49.0` |
| [ml-dtypes](https://github.com/jax-ml/ml_dtypes) | `0.5.4` | `0.6.0` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.25.0` |
| [ninja](https://github.com/ninja-build/ninja) | `1.13.0` | `1.13.2` |
| [numba](https://github.com/numba/numba) | `0.66.0` | `0.67.0` |
| [optree](https://github.com/metaopt/optree) | `0.19.1` | `0.20.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.1` | `7.36.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.5.1` | `1.6.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.19` | `2026.8.31` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.5` |
| [starlette](https://github.com/Kludex/starlette) | `1.4.1` | `1.6.0` |
| [timm](https://github.com/huggingface/pytorch-image-models) | `1.0.28` | `1.0.29` |
| [typer](https://github.com/fastapi/typer) | `0.27.1` | `0.27.2` |
| [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.2` | `0.4.4` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.7.1` | `21.7.7` |



Updates `rawpy` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/letmaik/rawpy/releases)
- [Commits](letmaik/rawpy@v0.27.0...v0.27.1)

Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.1...0.52.4)

Updates `transformers` from 5.15.0 to 5.16.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.15.0...v5.16.1)

Updates `bitsandbytes` from 0.50.0 to 0.50.2
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.50.0...0.50.2)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `filelock` from 3.32.2 to 3.32.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.4)

Updates `grpcio` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.83.0...v1.83.1)

Updates `huggingface-hub` from 1.26.0 to 1.29.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.26.0...v1.29.0)

Updates `hypothesis` from 6.165.2 to 6.167.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.165.2...v6.167.1)

Updates `kiwisolver` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/nucleic/kiwi/releases)
- [Changelog](https://github.com/nucleic/kiwi/blob/main/releasenotes.rst)
- [Commits](nucleic/kiwi@1.5.0...1.5.1)

Updates `llvmlite` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/numba/llvmlite/releases)
- [Commits](numba/llvmlite@v0.48.0...v0.49.0)

Updates `ml-dtypes` from 0.5.4 to 0.6.0
- [Release notes](https://github.com/jax-ml/ml_dtypes/releases)
- [Changelog](https://github.com/jax-ml/ml_dtypes/blob/main/CHANGELOG.md)
- [Commits](jax-ml/ml_dtypes@v0.5.4...v0.6.0)

Updates `narwhals` from 2.24.0 to 2.25.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.24.0...v2.25.0)

Updates `ninja` from 1.13.0 to 1.13.2
- [Release notes](https://github.com/ninja-build/ninja/releases)
- [Commits](ninja-build/ninja@v1.13.0...v1.13.2)

Updates `numba` from 0.66.0 to 0.67.0
- [Release notes](https://github.com/numba/numba/releases)
- [Commits](numba/numba@0.66.0...0.67.0)

Updates `optree` from 0.19.1 to 0.20.0
- [Release notes](https://github.com/metaopt/optree/releases)
- [Changelog](https://github.com/metaopt/optree/blob/main/CHANGELOG.md)
- [Commits](metaopt/optree@v0.19.1...v0.20.0)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `protobuf` from 7.35.1 to 7.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `python-discovery` from 1.5.1 to 1.6.0
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.5.1...1.6.0)

Updates `regex` from 2026.7.19 to 2026.8.31
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.7.19...2026.8.31)

Updates `ruff` from 0.16.1 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.16.5)

Updates `starlette` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.4.1...1.6.0)

Updates `timm` from 1.0.28 to 1.0.29
- [Release notes](https://github.com/huggingface/pytorch-image-models/releases)
- [Commits](huggingface/pytorch-image-models@v1.0.28...v1.0.29)

Updates `typer` from 0.27.1 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.1...0.27.2)

Updates `typing-inspection` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/pydantic/typing-inspection/releases)
- [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md)
- [Commits](pydantic/typing-inspection@v0.4.2...v0.4.4)

Updates `virtualenv` from 21.7.1 to 21.7.7
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.1...21.7.7)

---
updated-dependencies:
- dependency-name: rawpy
  dependency-version: 0.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: transformers
  dependency-version: 5.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: bitsandbytes
  dependency-version: 0.50.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: filelock
  dependency-version: 3.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: grpcio
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: huggingface-hub
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: hypothesis
  dependency-version: 6.167.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: kiwisolver
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: llvmlite
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ml-dtypes
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: narwhals
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ninja
  dependency-version: 1.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: numba
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: optree
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: python-discovery
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: regex
  dependency-version: 2026.8.31
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: timm
  dependency-version: 1.0.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: typing-inspection
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: virtualenv
  dependency-version: 21.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants