[dependabot]

Bumps the uv-minor-patch group with 20 updates in the / directory:

Package	From	To
certifi	2026.10.19	2026.10.23
fastapi	0.143.0	0.162.0
fonttools	4.66.1	4.67.0
pandas	3.0.6	3.1.0
pycparser	3.11	3.12
reportlab	5.0.1	5.1.0
sqlalchemy	2.1.4	2.1.6
starlette	1.8.0	1.9.0
pymongo	4.18.3	4.19.0
sentence-transformers	6.1.0	6.2.0
streamlit	1.66.0	1.66.1
hypothesis	6.170.5	6.170.8
httpx2	2.13.1	2.16.0
markdown	3.11.1	3.11.2
pluggy	1.6.0	1.7.0
ruff	0.17.0	0.17.2
coverage	7.16.2	7.17.0
distlib	0.4.3	0.4.4
httpcore2	2.13.1	2.16.0
tzlocal	5.4.4	5.4.5

Updates certifi from 2026.10.19 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates fastapi from 0.143.0 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

... (truncated)

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

Updates fonttools from 4.66.1 to 4.67.0

Release notes

Sourced from fonttools's releases.

4.67.0

• [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
• [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
• [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
• [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
• [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
• [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
• [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
• [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
• [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
• [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
• [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
• [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
• [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
• [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
• [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
• [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
• [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
• [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
• [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
• [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
• [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or all single-byte codes map to .notdef (#4215). Formats 2 and 4 now reject glyph IDs above 65535 instead of wrapping them (#4226). Split format 14 default UVS ranges longer than 256 codepoints (#4229). Empty format 12 and 13 subtables round-trip (#4246).
• [glyf] Use unsigned instruction lengths, so programs of 32768-65535 bytes compile and decompile correctly (#4227). Keep instructions in zero-contour glyphs (#4228).
• [pens] Fix cubic off-curve detection in TTGlyphPointPen across contour starts (#4224). Glyph.drawPoints() now raises NotImplementedError for an all-off-curve cubic contour, which the point pen protocol cannot express (#3191, #4225). RoundingPen passes the all-off-curve None sentinel through (#4311, #4312).
• [CFF2] Preserve operands when a blend has zero regions (#4240).
• [cffLib] Read CFF font names as Latin-1, matching how they are written (#4253). Deleting a CFF dict attribute now actually removes it (#2725, #4264).
• [CFF2ToCFF] Fix conversion of fonts with local subroutines (#4258). A CFF2 table with a single FontDict is now converted to a name-keyed CFF font that keeps its glyph names (#3890, #4265).
• [subset] Handle a null GDEF variation store (#4230).
• [merge] Support merging fonts that both have a MATH table (#3823, #4257).
• [feaLib] Reject the same mark class used twice in one anchor list (#3628, #4255). Don't crash on value records whose devices are all NULL (#2396, #4261). Pad a short OS/2 Vendor with spaces (#4259).
• [feaLib] Raise FeatureLibError with a location, instead of a bare Python error, for: a BASE script list without a matching tag list (#4263), a UnicodeRange bit outside 0-127 (#4266), a name string that cannot be decoded (#4267), a STAT axis location with no or too many values (#4268), and a non-ASCII OS/2 Vendor (#4269).
• [name] Fix the BCP 47 tags of some Mac and Windows language IDs, e.g. es was mapped to Mac Estonian (#3733, #4256). getDebugName prefers the Windows English name over the Mac one (#3969, #4273).
• [post] Don't crash on a format 2.0 table with numGlyphs set to 0 (#3060, #4274).
• [VDMX] Recompute numRecs and numRatios when compiling (#4293).
• [Silf] Fix compiling a Silf table that was decompiled from binary (#4294).
• [woff2] Preserve minorVersion when copying flavor data (#4249, #4250).
• [ttGlyphSet] Compute glyph width lazily for glyf variable fonts without HVAR, so .width is correct before drawing (#3964, #4260).
• [varLib.interpolatable] Respect designspace source layers (#3951, #4275); fix --json output with SciPy (#3870, #4276).
• [misc.psLib] Fix tokenizing of escaped parentheses in PostScript strings (#4207).
• [svgLib] Raise ValueError instead of IndexError on a truncated path command (#4254).
• [misc.transform] Preserve the direction of the remaining axis when decomposing a transform whose first column is zero (#4242).
• [misc.textTools] Tag.__ne__ returns NotImplemented for unsupported types (#4305, #4306).
• [misc.dictTools] hashdict rejects in-place union (|=) (#4313, #4314).
• [misc.xmlReader] Close owned input streams when parsing fails (#4298).
• [misc.filesystem] WriteZipFS.close() can be called more than once (#4309, #4310).
• [EBDT] Keep EBDT/CBDT glyph metrics after probing a missing attribute (#3806, #4216).

Changelog

Sourced from fonttools's changelog.

4.67.0 (released 2026-10-14)

• [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
• [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
• [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
• [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
• [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
• [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
• [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
• [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
• [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
• [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
• [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
• [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
• [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
• [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
• [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
• [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
• [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
• [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
• [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
• [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
• [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or

... (truncated)

Commits

• 16f88cb Release 4.67.0
• 5049c83 Update NEWS.rst [skip ci]
• fdfd15f Merge pull request #4314 from xiehuanyi/fix/hashdict-inplace-union-20261014
• 87ee7d3 Merge pull request #4312 from xiehuanyi/fix/roundingpen-offcurve-none-20261014
• e6e65d3 [dictTools] Reject in-place union on hashdict
• 10cfefe Merge pull request #4310 from xiehuanyi/fix/writezipfs-idempotent-close-20261014
• 06157e4 Merge pull request #4300 from CAOShurong/codex/3751-missing-fvar
• 2940a2e Merge pull request #4298 from xiehuanyi/fix-xml-reader-failure-cleanup
• 821805d Merge pull request #4306 from xiehuanyi/fix/tag-notimplemented-comparison-202...
• 85538d6 [roundingPen] Preserve all-off-curve quadratic sentinel
• Additional commits viewable in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates pycparser from 3.11 to 3.12

Release notes

Sourced from pycparser's releases.

release_v3.12

What's Changed

• Emit one type definition for declarators that share it by @​Cherith1222 in eliben/pycparser#621
• raise ParseError for _Atomic applied to array or function type by @​arfa-21 in eliben/pycparser#623
• Fix code generation for the _Pragma operator by @​hulkbig in eliben/pycparser#625
• Parse GNU statement expressions as primary expressions by @​hulkbig in eliben/pycparser#628
• Fix shared type declarations in switch cases by @​hulkbig in eliben/pycparser#630
• raise ParseError for typedef in a parameter declaration by @​arfa-21 in eliben/pycparser#631
• Scope for loop init declarations to the loop by @​arfa-21 in eliben/pycparser#634

Full Changelog: eliben/pycparser@release_v3.11...release_v3.12

Commits

• 3ec766b Tweak build
• 1771cbf Prepare to release 3.12
• 51715bf Add documentation on using methods of ast node
• 878c289 Support va_arg properly
• 840fe55 Add some Linux kernel headers to benchmark
• 8fd2299 Add ArrayDesignator AST node to distinguish array indices in designators
• aa32af5 Fix crashes in generator with empty case bodies
• f29e8ef Regression test for #215
• a74aa74 Support form feed and vertical tabs as whitespace
• 02380d0 Comment fixes
• Additional commits viewable in compare view

Updates reportlab from 5.0.1 to 5.1.0

Updates sqlalchemy from 2.1.4 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

• 1840c9d Version 1.9.0 (#3676)
• 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
• 414af4f Remove unmaintained packages from the third-party packages page (#3674)
• d4df01a Add adminsite to the third-party packages (#3654)
• 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
• a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
• 6b11cd7 Honor streaming responses in TestClient (#3491)
• b7901fb Use byte length for typed memoryview response bodies (#3622)
• 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
• See full diff in compare view

Updates pymongo from 4.18.3 to 4.19.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.19.0

Release notes: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52147

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.19.0 (2026/10/14)

PyMongo 4.19 brings a number of changes including:

.. warning:: PyMongo 4.19 drops support for Python 3.9 and 3.10 and removes PyPy support: Python 3.11+ is now required.

• Added support for Python 3.15.
• Dropped support for Python 3.9 and 3.10.
• Removed support for PyPy.
• Removed the deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVIEW members (PYTHON-6009_).
• Added support for running the synchronous and asynchronous clients in subinterpreters, including inside concurrent.futures.InterpreterPoolExecutor (Python 3.14+). Only in subinterpreters, which do not allow daemon threads, the synchronous client's monitor threads now start as non-daemon threads and are stopped and joined when the interpreter is torn down. Monitor threads in the main interpreter remain daemon threads and shutdown behavior is unchanged. Note that because these threads are non-daemon, a subinterpreter may block on teardown until any in-flight monitor work completes.
• Added support for routing Key Management Service (KMS) requests for Client-Side Field Level Encryption and Queryable Encryption through an HTTP proxy, using the new kms_connect_callback option on :class:~pymongo.encryption_options.AutoEncryptionOpts, :class:~pymongo.encryption.ClientEncryption, and :class:~pymongo.asynchronous.encryption.AsyncClientEncryption. The callback opens the connection and the driver performs the KMS TLS handshake over it, so verification still targets the KMS host rather than the proxy. For an ordinary HTTP proxy, pass :class:~pymongo.encryption_options.HTTPProxyKMSConnect or :class:~pymongo.encryption_options.AsyncHTTPProxyKMSConnect instead of writing a callback. Both helpers accept custom CONNECT headers, e.g. Proxy-Authorization for proxies that require authentication.
• Added the srv_host_validator keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient, an alternative to srvAllowedHostsSuffix for deployments whose acceptable SRV hosts cannot be expressed as a single suffix. The callback is invoked once per SRV-returned host and must return a boolean: True to accept the host and False to reject it. During initial DNS discovery a non-boolean return raises an error; during SRV polling it is treated as a rejection. It is mutually exclusive with srvAllowedHostsSuffix and, because it takes a callable, cannot be set in a connection string. See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
• srvAllowedHostsSuffix may now be set to a single label reserved for private or special use, such as localhost, test, or internal.

... (truncated)

Commits

• a58b4f4 Prep 4.19 Release (#3122)
• 3242611 PYTHON-6147 Add CSFLE HTTP proxy KMS connect helpers (#3101)
• b5a7f26 PYTHON-6009 Remove deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVI...
• f3f19df PYTHON-6170 [BF] AWS ECS test container cannot install uv (#3120)
• a740cdf PYTHON-6063 Remove PyPy support (#3119)
• ed74401 PYTHON-6138 followup -- Drop Python 3.9 and 3.10 Support (#3118)
• e0b11bf PYTHON-6163 Pure-Python decode_all silently accepts 1-byte invalid BSON (#3117)
• b5a36cc PYTHON-6111 C extension accepts BSON documents where element data overlaps th...
• 1f64ecd PYTHON-6158 Clean up version-gated code paths (#3112)
• 0cc64d6 PYTHON-6161 Fix mod_wsgi CI: run apt-get update before install (#3115)
• Additional commits viewable in compare view

Updates sentence-transformers from 6.1.0 to 6.2.0

Release notes

Sourced from sentence-transformers's releases.

v6.2.0 - Model merging, faster loading, and distributed evaluation

This release adds model merging for all four model types, reduces redundant Hub requests when loading models, and distributes evaluator inference across DDP ranks. It also includes lower-memory training losses, more flexible multi-vector compression, and fixes throughout inference, training, and evaluation.

Install this version with

# Inference only, use one of:
pip install sentence-transformers==6.2.0
pip install sentence-transformers[openvino]==6.2.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.2.0
pip install sentence-transformers[audio]==6.2.0
pip install sentence-transformers[video]==6.2.0
Training + Inference
pip install sentence-transformers[train]==6.2.0
pip install sentence-transformers[merge]==6.2.0
Or combine as needed:
pip install sentence-transformers[train,image]==6.2.0

Model merging for all four model types (#3776)

Combine compatible fine-tuned checkpoints without another training run using SentenceTransformer.merge, SparseEncoder.merge, CrossEncoder.merge, or MultiVectorEncoder.merge. The integration uses Arcee AI's mergekit and supports well over a dozen methods such as Linear, SLERP, TIES, and DARE.

Install the merge extra with pip install "sentence-transformers[merge]". For example, take a weighted average of two compatible MiniLM models:

from sentence_transformers import SentenceTransformer
models = [
"sentence-transformers/all-MiniLM-L6-v2",
"sentence-transformers/multi-qa-MiniLM-L6-cos-v1",
]
merged = SentenceTransformer.merge(
models,
method="linear",
parameters={"weight": [0.6, 0.4]},
)
merged.save_pretrained("merged-MiniLM-L6")
embeddings = merged.encode(["Combining compatible model weights."])

Or interpolate between the same inputs with SLERP:

</tr></table> 

... (truncated)

Commits

• 0b6937d Release v6.2.0
• 45682ed Update documentation announcement for v6.2 (#4243)
• aed573b Forward gradient checkpointing options to Transformers (#4241)
• c7adf47 Skip bfloat16 transformer head tests on affected Windows runners (#4242)
• 1b4b624 Fix blank rows in CrossEncoder and RRF evaluator CSVs on Windows (#4077)
• ea5435c Treat a string positive or negative as one document in RerankingEvaluator (#4...
• 3a5232b Follow only duplicate pairs in the paraphrase mining transitive closure (#4120)
• 7d64d3b Keep the RRF fusion order the same from run to run (#4067)
• 67f11a3 Evaluate the main similarity function in TripletEvaluator (#4088)
• fd6b188 Accept a string main_score_function in NanoBEIREvaluator (#4034)
• Additional commits viewable in compare view

Updates streamlit from 1.66.0 to 1.66.1

Release notes

Sourced from streamlit's releases.

1.66.1

Full Changelog: streamlit/streamlit@1.66.0...1.66.1

Commits

• ca6718b [chore] Update map and pydeck snapshots from 1.66.1 CI
• 1359d6e [fix] Use canonical timezone names in Python unit tests (#17567)
• 7526d1b [chore] Allow Pillow 13 (#17589)

[github-actions]

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2146/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.