⬆️ bump the uv-lock group with 7 updates

[dependabot]

Bumps the uv-lock group with 7 updates:

Package	From	To
jsonargparse	4.51.0	4.52.0
pydeprecate	0.11.0	0.12.0
inference-models	0.36.0	0.29.6
torch	2.13.0	2.14.0
torchvision	0.28.0	0.29.0
uv	0.12.7	0.12.9
mkdocstrings-python	2.0.7	2.0.8

Updates jsonargparse from 4.51.0 to 4.52.0

Changelog

Sourced from jsonargparse's changelog.

v4.52.0 (2026-09-01)

Added ^^^^^

• New import_path_denylist and import_path_allowlist settings in set_parsing_settings that limit which import paths a value is allowed to name, so that configs from an untrusted source can't reach arbitrary code. A set of standard library paths that give code execution, e.g. os, subprocess and pickle, is denied by default, see :ref:untrusted-configs ([#959](https://github.com/mauvilsa/jsonargparse/issues/959) <https://github.com/mauvilsa/jsonargparse/pull/959>, [#960](https://github.com/mauvilsa/jsonargparse/issues/960) <https://github.com/mauvilsa/jsonargparse/pull/960>).
• Class types nested in a tuple, set, frozenset or mapping, e.g. dict[str, SomeBaseClass], now have a --*.help option, and subclasses in any container are now included in the known subclasses shown in the help ([#960](https://github.com/mauvilsa/jsonargparse/issues/960) <https://github.com/mauvilsa/jsonargparse/pull/960>__).
• New jsonschema completion type, i.e. --print_completion=jsonschema and parser.get_completion_script("jsonschema"), which generates a JSON Schema (draft 2020-12) that describes the config files accepted by the parser, including descriptions from docstrings, defaults, required keys, type restrictions, the types that the plain argparse actions give and one entry per known subclass of subclass types. Configs can point to a schema with a $schema key, which is ignored when parsing. This feature is experimental, so the details of the generated schema might change in non-major releases ([#961](https://github.com/mauvilsa/jsonargparse/issues/961) <https://github.com/mauvilsa/jsonargparse/pull/961>__).
• A protocol whose single method is __call__ is now also implemented by a function with a compatible signature, so the import path of a function is accepted as value, see :ref:type-hints ([#963](https://github.com/mauvilsa/jsonargparse/issues/963) <https://github.com/mauvilsa/jsonargparse/pull/963>__).
• New fail_untyped="all" for the add signature methods and auto_cli, which raises an exception for all parameters that don't have a type annotation, not only the required ones ([#965](https://github.com/mauvilsa/jsonargparse/issues/965) <https://github.com/mauvilsa/jsonargparse/pull/965>__).
• Support for NamedTuple as a type. The value is an object with the fields as keys or an array of positional values, parsing gives an instance of the named tuple and dumping gives an object. It has a --*.help option that shows the accepted fields, is accepted by add_class_arguments and works subscripted when generic, see :ref:type-hints ([#967](https://github.com/mauvilsa/jsonargparse/issues/967) <https://github.com/mauvilsa/jsonargparse/pull/967>__).
• TypedDict now accepts ReadOnly for its keys ([#967](https://github.com/mauvilsa/jsonargparse/issues/967) <https://github.com/mauvilsa/jsonargparse/pull/967>__).
• Support for NewType and LiteralString as types. Previously they were not validated, i.e. any value was accepted. Now a NewType is validated as the supertype it stands for and a LiteralString as a str, in both cases the help showing the name as in the source code, see :ref:type-hints ([#967](https://github.com/mauvilsa/jsonargparse/issues/967) <https://github.com/mauvilsa/jsonargparse/pull/967>__).

Fixed ^^^^^

... (truncated)

Commits

• e063051 Bump version: 4.51.0 → 4.52.0
• eacf963 Fix union of class type and instance factory, and bash completion without tpu...
• e7b7989 Support for NewType, LiteralString, NamedTuple, TypedDict ReadOnly keys and s...
• c9e025b register_type replaces instead of failing, applies to subscripted types, an...
• 2b892ef New Untyped type, fail_untyped='all' and debug logs for adjusted signature pa...
• bbe7759 Concise documentation rewrite and a v4 to v5 migration guide (#964)
• d950f3f Support functions for callable protocols and typing aliases, plus a talks and...
• 72c4885 Generation of JSON schemas for parsers (#961)
• b4a91a2 Class types in containers: help option, known subclasses and set parsing; har...
• 09f2428 Deny import paths that allow code execution when given as values (#959)
• See full diff in compare view

Updates pydeprecate from 0.11.0 to 0.12.0

Release notes

Sourced from pydeprecate's releases.

v0.12.0: Module deprecation and the AUTO front door

pyDeprecate 0.12.0 finishes the family. You could already deprecate a function, a class, or an instance — but not a whole module, and a plain PEP 562 __getattr__ hook can't warn on attributes that already exist in __dict__. deprecated_module() closes that gap with three modes and warns on every public attribute access, star-imports included. Alongside it, @deprecated becomes an explicit crossroad: it defaults to the new TargetMode.AUTO, which figures out the mode at decoration time instead of quietly rendering your args_mapping inert, and the long-threatened TypeError for @deprecated on a class is formally withdrawn — that dispatch is permanent. deprecated_callable() is there when you want the strict opposite, and deprecated proxies finally leave breadcrumbs (__wrapped__, __signature__) so inspect, Sphinx, griffe, and your IDE can see through them. One narrow breaking change, and it delivers on a TypeError that v0.11.0 already warned was coming.

✨ Spotlights

deprecated_module() — retire an entire module

One call at the bottom of the module you're retiring. It reassigns the module's __class__ to a wrapper that warns on every public attribute access — including attributes already in __dict__, which is exactly what a PEP 562 __getattr__ hook can't reach.

# old_calculator.py
from deprecate import deprecated_module
def add(a: float, b: float) -> float:
return a + b
deprecated_module(name, deprecated_in="2.0", remove_in="3.0", message_template="Use new_calculator instead.")
old_calculator.add(1, 2)  # warns: FutureWarning, returns 3

Three modes: warn in place, redirect unknown lookups to a replacement module (with optional attrs_mapping), or expose the old sub-module name on the parent package. from old_calculator import * warns too — CPython's IMPORT_STAR routes each name through the same interception. Calling it twice with the same configuration is a no-op; calling it again with a different configuration warns and keeps the first. A pre-existing __getattr__ gets chained rather than clobbered.

Audit tooling comes along for the ride: find_deprecation_wrappers() discovers deprecated modules, and validate_deprecation_wrapper() takes module objects directly.

TargetMode.AUTO is the new @deprecated default

@deprecated used to default to TargetMode.NOTIFY, which meant passing args_mapping without a target landed you in warn-only mode with an inert mapping and a misconfiguration flag. It now defaults to AUTO and resolves at decoration time from what you actually wrote:

from deprecate import deprecated
A non-empty args_mapping, no explicit target → resolves to ARGS_REMAP
@​deprecated(args_mapping={"coef": "coefficient"}, deprecated_in="1.0", remove_in="2.0")
def scale(value: float, coefficient: float = 1.0) -> float:
return value * coefficient

AUTO never reaches DeprecationConfig — it resolves away before the config is frozen, so audit tooling always sees the concrete mode. It's the front-door default only; the strict forms reject it explicitly.

@deprecated on a class is permanent — and there's a strict form if you don't want that

Since v0.6 the warning said this would eventually become a TypeError. It won't. @deprecated on a class dispatches to deprecated_class with the full proxy and emits one informational UserWarning per module-qualified class name (silence it with stream=None). Only that notice goes away in v1.0.

If you want the opposite — a class handed to the decorator being an error — deprecated_callable() raises TypeError at decoration time, not call time. It shares every @deprecated parameter — with one default differing, since that is the whole point: deprecated_callable() defaults target to TargetMode.NOTIFY rather than TargetMode.AUTO, and rejects an explicit AUTO. It accepts functions, methods, lambdas, and the descriptor forms.

Proxies now leave AST breadcrumbs, and there's a public type to annotate them

... (truncated)

Changelog

Sourced from pydeprecate's changelog.

[0.12.0] — 2026-08-25 — Module deprecation, a strict callable form, & the AUTO front door

Added

• deprecated_module() — PEP-562-inspired module-level deprecation. Call deprecated_module(__name__, deprecated_in=..., remove_in=...) once at the bottom of a module to install a __class__ reassignment to a wrapper type that emits FutureWarning on every public attribute access (including real attributes already in __dict__). Three modes: in-place warn (Mode 1), redirect to replacement module with optional attrs_mapping (Mode 2), and parent alias via deprecated_instance() (Mode 3). find_deprecation_wrappers() discovers deprecated modules via the __deprecated__ attribute; validate_deprecation_wrapper() accepts module objects directly. Double-call is idempotent (returns early); pre-existing __getattr__ is chained with a UserWarning. (#203)
• deprecated_callable() — strict callable-only form of @deprecated. Shares every @deprecated parameter and raises TypeError at decoration time when applied to a class. Accepts functions, methods, lambdas, and descriptors (classmethod / staticmethod / property); parallels the deprecated_class / deprecated_instance / deprecated_module family and is exported from the package. (#221)
• TargetMode.AUTO — decoration-time inference default for the @deprecated front door. @deprecated now defaults target=TargetMode.AUTO (was TargetMode.NOTIFY): an omitted target resolves from the rest of the configuration — a non-empty args_mapping resolves to TargetMode.ARGS_REMAP on functions and methods (an empty {} counts as no mapping) (previously this fell into the NOTIFY default and was flagged as a misconfiguration); a class source forwards the unset target so the proxy auto-resolve applies (args_mapping → ARGS_REMAP); no mapping resolves to warn-only (TargetMode.NOTIFY on callables, target=None recorded on class proxies). AUTO is never stored in DeprecationConfig; the strict forms deprecated_callable() and deprecated_class() reject target=TargetMode.AUTO with TypeError. (#222)
• skip_if on deprecated_class() and deprecated_instance(). The proxies gained the conditional-skip option previously available only on the callable decorators: while the bool (or zero-argument callable returning strict bool) evaluates True at access time, the proxy transparently serves the wrapped source — no warning, no attrs_mapping redirect, no args_mapping/args_extra handling, no target forwarding, and no read_only enforcement. A non-bool return raises the same TypeError as the callable form. (#222)
• Public DeprecationProxy protocol for annotating proxies. from deprecate import DeprecationProxy replaces annotating against the private _DeprecatedProxy. It is @runtime_checkable, so isinstance(obj, DeprecationProxy) works; being a data protocol, issubclass() raises TypeError. DeprecationProxy[T] is generic in the type produced by calling the proxy — deprecated_class and deprecated_instance return the concrete _DeprecatedProxy type in every call shape, which is what keeps the proxy's forwarded dunders (int(), with, await) visible to type checkers; annotate the assignment explicitly where the target type should flow into call sites. (#226, #228)
• AST breadcrumbs on every proxy. deprecated_class and deprecated_instance proxies now carry __wrapped__ (the source object) and __signature__ (the source's signature), so inspect.unwrap, inspect.signature, Sphinx autodoc, griffe/mkdocstrings, and IDEs resolve through the proxy to the original. Reading either attribute emits no deprecation warning. Sources with no introspectable signature (a plain dict, C-level types) get __signature__ = None rather than an error — wrapping stays infallible. (#226)

Changed

• @deprecated on a class is now first-class and permanent. Applying @deprecated directly to a class dispatches to deprecated_class (full _DeprecatedProxy — isinstance/__class__ transparency, forwarding, budget semantics) and emits a one-time (per module-qualified class name, notice only — removed in 1.0) informational UserWarning — `@deprecated` on class `<Name>` now dispatches to `@deprecated_class`. — suppressed with stream=None. This replaces the v0.6 "will become a TypeError" warning; the threatened TypeError never ships. @deprecated_class stays the explicit, preferred form for classes. (#222)
• Explicit TargetMode.NOTIFY + a mapping stays flagged; auto-resolve applies only to an omitted target. Passing target=TargetMode.NOTIFY explicitly together with args_mapping (callables and proxies) or attrs_mapping (proxies) emits UserWarning at decoration time (TypeError in v1.0); the mode stays NOTIFY and the mapping is inert at runtime, preserved in audit metadata with misconfigured=True — explicit configuration is never silently rewritten. This flagging is unchanged from v0.11.0; what is new is that it no longer also applies to an omitted target, which now auto-resolves. Legacy proxy sentinels target=True (without a mapping) and target=False now resolve to an unset target and follow the same auto-resolve as an omitted target; warn-only proxies record DeprecationConfig.target=None. (#222)
• Non-callable sources raise a clear TypeError. Applying @deprecated to a plain object, a __call__ instance without __name__, or functools.partial of a class now raises TypeError naming deprecated_instance, instead of crashing later on __name__ access. (#222)
• deprecated() front door documented as the arguments common to both dispatch shapes (target, deprecated_in, remove_in, stream, num_warns, message_template, args_mapping, args_extra, skip_if, update_docstring, docstring_style). The class-only attrs_mapping is not among them and never has been — deprecated(attrs_mapping=...) raises TypeError (unexpected keyword argument) in v0.11.0 and v0.12.0 alike; use deprecated_class(attrs_mapping=...) directly. message_template and skip_if passed through @deprecated on a class are now forwarded to the proxy (message_template was previously dropped silently on the class-dispatch path). (#222)
• @deprecated(target=TargetMode.ATTRS_REMAP) now raises TypeError for a class source too. The mode needs attrs_mapping, which the front door does not expose, so it can never redirect anything through @deprecated; a class source previously built a no-op proxy — not silently: v0.11.0 emitted the class-dispatch notice plus a second UserWarning naming attrs_mapping and pre-announcing this TypeError. The callable path already raised as proxy-only. The error points to deprecated_class(attrs_mapping=...). (#222)
• Source builds now require setuptools>=82. The [build-system] requires floor moved from >=70 (via >=80 in #225); installing from an sdist on a build environment pinned below that will fail to bootstrap. Wheel installs are unaffected, and the package still declares zero runtime dependencies. (#227)

Deprecated

• template_mgs renamed to message_template. The custom-notice parameter on @deprecated, deprecated_callable, deprecated_class, and deprecated_instance was a typo (mgs for msg); it is now message_template. template_mgs stays as a deprecated keyword alias that emits a FutureWarning and forwards its value (passing both raises TypeError); it will be removed in v1.0. Audit code reading DeprecationConfig.template_mgs keeps working through a read-only property alias — the stored field is now message_template. (#223)

---

Commits

• afc9f63 releasing 0.12.0
• 84bb91b refine: rename Deprecated→DeprecationProxy, drop overloads (#228)
• 9add58b feat: AST breadcrumbs on proxies and a public Deprecated type (#226)
• 38e06cc chore(deps-dev): update setuptools requirement from >=80 to >=82 (#227)
• 43eba58 chore(deps-dev): update setuptools requirement from >=70 to >=80 (#225)
• 911a940 chore(deps): bump the github-actions group with 4 updates (#224)
• 61a15cd chore(docs): remove redundant rows and spacing from README
• 2963d32 refine: rename template_mgs→message_template with alias (#223)
• ad745fa refine: deprecated() becomes the class/callable crossroad on the front door...
• 22ea9db refine: add deprecated_callable; split engine into modules (#221)
• Additional commits viewable in compare view

Updates inference-models from 0.36.0 to 0.29.6

Updates torch from 2.13.0 to 2.14.0

Release notes

Sourced from torch's releases.

PyTorch 2.14.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Security
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

• torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

  The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

  Before:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="balanced")
  loss = torch.nn.functional.linear_cross_entropy(
      input, linear_weight, target, options=options
  )

  After:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="compact")
  loss = torch.nn.functional.linear_cross_entropy(

... (truncated)

Commits

• 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
• 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
• 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
• 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
• ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
• 65890f3 Fix docker-release validate job to use the channel matching the pushed image ...
• 1682388 Fix macOS py3.15 wheel builds: pin Cython < 3.3.0 and bump the cp315 numpy pi...
• 9724418 Fix Windows py3.15 builds: constrain Cython < 3.3.0 and bump the cp315 numpy ...
• f1b7554 [MPS] Fix pin_memory() recycling buffers still in use by the GPU (#194662)
• 9f205f7 [MPS] fail loudly on large reductions (#194661)
• Additional commits viewable in compare view

Updates torchvision from 0.28.0 to 0.29.0

Release notes

Sourced from torchvision's releases.

TorchVision 0.29: ABI stability!

TorchVision 0.29 is out! It comes with two major changes: ABI stability, and deprecation of the image decoders and encoders (now in TorchCodec)!

ABI Stability with torch 2.14

TorchVision is now ABI stable w.r.t. torch 2.14! This means that torchvision 0.29 will be compatible with future versions of torch: 2.15, 2.16, etc. You won’t need to install a new version of TorchVision when you upgrade torch.

As a result, we might stop releasing TorchVision in sync with pytorch. But TorchVision is still actively maintained and developed: we’ll still be pushing releases, just not with the same cadence.

Thanks to Adrian Abeyta @​adabeyta for the fantastic porting effort!

PRs: #9524, #9597, #9598, #9605, #9612, #9610, #9614, #9584, #9617, #9618, #9619, #9620, #9582, #9573, #9625, #9623, #9626, #9583, #9633, #9572, #9549, #9533, #9535, #9539, #9543, #9550, #9552, #9555, #9557, #9558, #9554

Image decoders and encoders are deprecated. Use TorchCodec!

The image decoders and encoders in torchvision.io are now deprecated, and they will be removed in a future release. They are now available in torchcodec >= 0.16, where they are significantly more capable. You’ll just need to pip install torchcodec, and you can refer to this migration guide for migrating your code (most APIs for decoding are the same).

This finalizes a clear separation of concerns for the three media-processing libraries of PyTorch: torchcodec is for decoding and encoding all media (images, videos, and audio), while torchvision and torchaudio focus on the transforms.

Bug fixes

[ops] Fix for deformable convolution kernels always running on default stream (#9522) [ops, MPS] Fix gradient overaccumulation in ROI ops (#9563, #9510) [transforms] Fix JPEG transform for non-contiguous batches (#9615)

Contributors

🎉 We're grateful for our community, which helps us improve Torchvision by submitting issues and PRs, and providing feedback and suggestions. The following persons have contributed patches for this release:

Adrian Abeyta, Andrey Talman, Dmitry Nikolaev, Irakli Salia, Jeff Daily , Kasra Ghodsi, Nicolas Hug, Nikita Shulga, Simon Byrne, Yutao Xu, Zhewen

Commits

• fc73f5a Merge branch 'release/0.29' of github.com:pytorch/vision into release/0.29
• f9b2669 [Cherry-pick for 0.29] (#9634)
• e1b5802 Revert "Update version.txt for 0.30.0 (#9607)"
• 2757376 Merge remote-tracking branch 'origin' into release/0.29
• 9e21b88 Consolidate CUDA helpers and remove the legacy _C extension in place of Stabl...
• 541c083 Port deform_conv2d (CUDA) to stable ABI. (#9626)
• 2f411e7 Port ps_roi_pool (CUDA) to stable ABI. (#9623)
• ae0ca92 Port ps_roi_align (CUDA) to stable ABI. (#9625)
• ff1a18d Port roi_align (CUDA) to stable ABI. (#9573)
• 8af7a68 Port roi_pool (CUDA) to stable ABI. (#9582)
• Additional commits viewable in compare view

Updates uv from 0.12.7 to 0.12.9

Release notes

Sourced from uv's releases.

0.12.9

Release Notes

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.9

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

0.12.8

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
• Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)

... (truncated)

Commits

• 9f92860 Bump version to 0.12.9 (#21422)
• 29c5462 Skip invalid scripts in uv workspace list --scripts (#21416)
• bf1d7e8 Encapsulate wheel extraction directory ownership (#21419)
• 6dacee0 Run streaming ZIP extraction in a blocking task (#21372)
• 91d1ebf Sync latest Python releases (#21415)
• 6a61ddb Revert "Limit CI planner checkout depth" (#21414)
• e9d1816 Add CPython 3.15.0rc2 (#21413)
• e888329 Remove unreachable lock configuration sources (#21409)
• bf041f9 Allow negating locked and frozen modes (#21408)
• feffc0b Bump async_http_range_reader to 0.11.1 (#21401)
• Additional commits viewable in compare view

Updates mkdocstrings-python from 2.0.7 to 2.0.8

Release notes

Sourced from mkdocstrings-python's releases.

2.0.8

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

• Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).

Changelog

Sourced from mkdocstrings-python's changelog.

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

• Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).

Commits

• 8125b0d chore: Prepare release 2.0.8
• 5054240 chore: Be a bit more minijinja compatible
• c0424f2 perf: Make template existence test (for locale templates) faster
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	torch@​2.13.0 ⏵ 2.14.0
	torchvision@​0.28.0 ⏵ 0.29.0	+1
	inference-models@​0.36.0 ⏵ 0.37.0
	jsonargparse@​4.51.0 ⏵ 4.52.0
	supervision@​0.30.1 ⏵ 0.30.2	+1
	uv@​0.12.7 ⏵ 0.12.9	+1
	mkdocstrings-python@​2.0.7 ⏵ 2.0.8	+1

View full report