Skip to content

chore(deps): bump the backend-dependencies group across 1 directory with 9 updates - #85

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-f2d859d1f6
Open

chore(deps): bump the backend-dependencies group across 1 directory with 9 updates#85
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-f2d859d1f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-dependencies group with 9 updates in the /backend directory:

Package From To
fastapi 0.142.2 0.143.2
sqlalchemy 2.1.2 2.1.4
pillow-heif 1.8.0 1.8.1
pydantic-settings 2.15.0 2.16.0
onnxruntime 1.30.0 1.31.0
numpy 2.5.3 2.5.4
sentry-sdk 2.71.0 2.72.0
google-auth 2.59.1 2.62.0
ruff 0.16.10 0.17.1

Updates fastapi from 0.142.2 to 0.143.2

Release notes

Sourced from fastapi's releases.

0.143.2

Fixes

Translations

Internal

0.143.1

Fixes

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

... (truncated)

Commits

Updates sqlalchemy from 2.1.2 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates pillow-heif from 1.8.0 to 1.8.1

Release notes

Sourced from pillow-heif's releases.

v1.8.1

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

  • libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499
  • Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499
  • libx265 was updated from the 4.2 to 4.3 version. #503
Changelog

Sourced from pillow-heif's changelog.

[1.8.1 - 2026-10-11]

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

  • libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499
  • Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499
  • libx265 was updated from the 4.2 to 4.3 version. #503
Commits
  • 0ed5379 v1.8.1
  • 39acefb feat(libheif): update libx265 to 4.3, download it from GitHub (#503)
  • 1a3f85a chore(deps): update dependency strukturag/libheif to v1.23.6 (#499)
  • 3937253 chore(deps): update msys2/setup-msys2 action to v2.33.0 (#495)
  • 2f183a4 [pre-commit.ci] pre-commit autoupdate (#497)
  • 33c51b7 chore(deps): update actions/download-artifact action to v8.0.2 (#500)
  • 7c08c7f chore(deps): update actions/upload-artifact action to v7.0.2 (#501)
  • b16be11 ci: fix leak tests failing on free-threaded Linux and Python 3.10 (#494)
  • 4ce7129 chore(deps): update dependency strukturag/libheif to v1.23.5 (#491)
  • f99594a chore(deps): update codecov/codecov-action action to v7.1.1 (#485)
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
  • CliSubCommand aliases keep their case with case_sensitive=False (#989).
  • Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
  • CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

  • Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
  • Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
  • A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
  • collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
  • A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
  • Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

  • With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
  • secrets_case_sensitive=True is now honored on Windows (#1001).
  • An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
  • TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

  • Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
  • Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
  • NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • 6ea85e6 Decode optional Annotated named union aliases (#1041)
  • ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
  • b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
  • bedb60e Honor explicit empty TOML table header overrides (#1027)
  • Additional commits viewable in compare view

Updates onnxruntime from 1.30.0 to 1.31.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

  • Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
  • Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
  • Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
  • Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
  • Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

  • CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
  • GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
  • Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
  • ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
  • The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
  • Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

  • Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
  • Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
  • Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
  • Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
  • Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

  • Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
  • Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
  • Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
  • Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

  • Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
  • Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
  • Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
  • Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

... (truncated)

Commits
  • 402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
  • 660125b [Compile API] Add support for writing external initializers and EP context to...
  • 06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
  • 864d871 Fix isolated provider tests in Windows GPU CI (#33203)
  • 1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
  • be3b8e8 Fix complex STFT window handling (#33136)
  • 40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
  • 430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
  • 26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
  • d8024cd Improve CUDA RMSNorm reduction and aligned half2 output (#33178)
  • Additional commits viewable in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.71.0 to 2.72.0

Release notes

Sourced from sentry-sdk's releases.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Commits
  • 9d24514 release: 2.72.0
  • 4dc1d72 fix: Fix span, metrics, log client reports (#7933)
  • 5780399 feat(types): Export DataCollectionUserOptions from sentry_sdk.types (#7957)
  • 1ca0326 chore(deps): lock file maintenance (#7848)
  • f5bf69b ci(mypy): Bump version to 2.4.0 (#7937)
  • 02210fa ci(openai-agents): Bump version for type checking to 0.23.1 (#7935)
  • fcccb7b ci(strawberry-graphql): Bump version for type checking to 0.332.0 (#7936)
  • 7cb8094 chore: Deprecate ai.monitoring.record_token_usage() (#7918)
  • 1f4ba26 chore: Deprecate send_default_pii (#7694)
  • 4b9d329 refactor: move FastAPI active thread tracking into Starlette (#7825)
  • Additional commits viewable in compare view

Updates google-auth from 2.59.1 to 2.62.0

Release notes

Sourced from google-auth's releases.

google-auth: v2.62.0

2.62.0 (2026-10-12)

Features

  • auth: enable bound ID tokens by default on Cloud Run (#18635) (8b625c4)

google-auth: v2.61.0

2.61.0 (2026-10-07)

Features

  • auth: support bound access and ID tokens for GKE (#18594) (9f5fd7b)

google-auth: v2.60.0

2.60.0 (2026-10-02)

Features

  • auth: Support sync credentials in AsyncAuthorizedSession (#18542) (3799568)
Commits
  • 5deaacb chore(main): release google-auth 2.62.0 (#18637)
  • 8b625c4 feat(auth): enable bound ID tokens by default on Cloud Run (#18635)
  • 98fc304 feat(dbapi): wire timeout parameter through Connection to execute_sql (#18484)
  • 0cabf7c test(spanner): increase stale database cleanup cutoff to 3 hours (#18633)
  • ab56473 perf(spanner): prune lock and begin event allocations on single-use snapshots...
  • 78b9da2 fix(google-cloud-spanner): do not replay DDL statements on transaction retry ...
  • f18a11e feat(db-dtypes): support pandas 3.1 (#18590)
  • 590e43d fix(bigquery): accept empty sourceFormat fields (#18472)
  • 05b3775 perf(spanner): optimize single-chunk results and single-row lookups (#18602)
  • a7678fd fix(spanner): eliminate duplicate metrics capture and measure full streaming ...
  • Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (Description has been truncated

@dependabot
chore(deps): bump the backend-dependencies group across 1 directory w…
a915f6e 
…ith 9 updates

Bumps the backend-dependencies group with 9 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.142.2` | `0.143.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.2` | `2.1.4` |
| [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.8.0` | `1.8.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.0` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.30.0` | `1.31.0` |
| [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.71.0` | `2.72.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.59.1` | `2.62.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.1` |



Updates `fastapi` from 0.142.2 to 0.143.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.143.2)

Updates `sqlalchemy` from 2.1.2 to 2.1.4
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `pillow-heif` from 1.8.0 to 1.8.1
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.8.0...v1.8.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.0)

Updates `onnxruntime` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.30.0...v1.31.0)

Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `sentry-sdk` from 2.71.0 to 2.72.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.71.0...2.72.0)

Updates `google-auth` from 2.59.1 to 2.62.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.59.1...google-auth-v2.62.0)

Updates `ruff` from 0.16.10 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.1)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: pillow-heif
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: onnxruntime
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: google-auth
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants