Skip to content

chore(deps): bump the maintenance group with 19 updates - #417

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/maintenance-d287d0e760
Open

chore(deps): bump the maintenance group with 19 updates#417
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/maintenance-d287d0e760

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the maintenance group with 19 updates:

Package From To
tokenizers 0.23.1 0.23.2
numpy 2.4.6 2.5.3
onnxruntime-gpu 1.28.0 1.29.0
nvidia-cudnn-cu13 9.24.0.43 9.25.1.1
mcp 2.1.0 2.2.0
qwen3-embed 1.12.0 1.12.1
build 1.5.0 1.6.0
ruff 0.16.0 0.16.6
mypy 2.3.0 2.3.1
types-pyyaml 6.0.12.20260724 6.0.12.20260906
pre-commit 4.6.1 4.6.2
click 8.4.2 8.5.0
cryptography 50.0.0 50.0.1
filelock 3.32.4 3.32.5
mcp-types 2.1.0 2.2.0
mmh3 5.2.1 5.3.0
protobuf 7.36.0 7.36.1
pydantic-core 2.46.5 2.48.0
sse-starlette 3.4.8 3.4.11

Updates tokenizers from 0.23.1 to 0.23.2

Release notes

Sourced from tokenizers's releases.

v0.23.2

This is the last v0 release, we are moving to v1!!

More details coming soon 👀

What's Changed

New Contributors

Full Changelog: huggingface/tokenizers@v0.23.1...v0.23.2

Commits
  • 88a4498 add lock
  • e4ea65f real release
  • 7c5964b add lock
  • bc405ad push rc0
  • d582781 Add a ParityBpeTrainer example and list it in the trainers API docs (#2217)
  • 447890f fix(python): pin the ruff rule set so a ruff release can't redden main (#2292)
  • 68b3ab7 chore(node): take node security alerts from 33 to 0 (#2287)
  • 74ef81f ci: pin every action to one SHA, drop stale audit suppressions (#2291)
  • b26727f chore(node): drop 8 unused devDependencies (#2286)
  • 7c7cfd8 chore: remove stale examples (kills 50% of dependabot traffic) (#2285)
  • Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

  • Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

    (gh-32296)

  • MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

    (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Iason Krommydas
  • James Davies +
  • Joren Hammudoglu
  • Maanas Arora
  • Matti Picus
  • Nathan Goldbaum
  • Shikhar Goel +
  • Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

  • #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits
  • dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
  • edcac6a REL: Prepare for the NumPy 2.5.3 release
  • fd4d908 Merge pull request #32509 from charris/backport-32496
  • 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
  • 294956e Merge pull request #32506 from charris/backport-32503
  • 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
  • 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
  • 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
  • 8972f70 Merge pull request #32478 from charris/backport-32466
  • ab1b589 Merge pull request #32477 from charris/backport-32423
  • Additional commits viewable in compare view

Updates onnxruntime-gpu from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime-gpu's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates nvidia-cudnn-cu13 from 9.24.0.43 to 9.25.1.1

Updates mcp from 2.1.0 to 2.2.0

Release notes

Sourced from mcp's releases.

v2.2.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

A few defaults changed in this release. If you run a server or client on 2.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3397)

  • Client("https://..."), streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else is not followed: the call fails with MCPError and the session stays usable (an SSE connect fails with httpx2.HTTPStatusError). If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx2.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • The OAuth providers apply the same rule to their own requests.

Idle Streamable HTTP sessions now expire (legacy <=2025-11-25 spec( (#3395)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's Client does) are not affected. Neither are stateless servers or 2026-07-28 connections.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: mcp.run(transport="streamable-http", session_idle_timeout=None, max_sessions=None) (also on streamable_http_app() and run_streamable_http_async()).

The OAuth client checks the authorization server's issuer on the legacy path too (#3398)

  • For servers without protected resource metadata, authorization server metadata whose issuer isn't the server's own origin is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch. The protected-resource-metadata path has done this since 2.0.
  • A 403 that isn't an insufficient_scope challenge is returned to the caller instead of retried.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new MCPDeprecationWarnings (#3435, #3447)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL; 3.0 will require it.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False; 3.0 defaults it to True.
  • Both keep working as before in 2.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3447).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3398).
  • session_idle_timeout= and max_sessions= on the Streamable HTTP server entry points (#3395).

Fixes

  • A client DELETE frees its session immediately, and a refused opening request no longer leaves a session behind (#2455, #3228, #3300).
  • $refs in a tool's outputSchema resolve within that schema only; an unresolvable one surfaces as RuntimeError: Invalid schema for tool ... (#3394).

Known gaps

The tasks extension (SEP-2663), DPoP (SEP-1932) and the jwt-bearer grant are not implemented yet; https://github.com/modelcontextprotocol/python-sdk/blob/main/ROADMAP.md tracks them.

What's Changed

... (truncated)

Commits
  • 9972c21 Replace RootModel wrappers with type aliases and TypeAdapter validation (#3470)
  • fd66270 docs: refresh translations, and translate pages in parallel (#3458)
  • 08a3bc8 docs: ask for AI disclosure on comments too (#3459)
  • 7bb486a docs: stop presenting the in-memory client as the way to connect (#3443)
  • 0c91368 Add AuthSettings.validate_token_resource to check a bearer token's resource (...
  • 9771e6b Keep following a relative redirect when the endpoint URL carries userinfo (#3...
  • a925e55 Bump the locked versions of eight dev and test dependencies (#3449)
  • e8b9486 Bump pymdown-extensions from 11.0 to 11.0.1 (#3285)
  • c6762e8 Follow redirects only within the MCP endpoint's origin (#3397)
  • 5fd3abc Skip automatic docs previews for fork PRs and drop the setup-uv retry steps (...
  • Additional commits viewable in compare view

Updates qwen3-embed from 1.12.0 to 1.12.1

Release notes

Sourced from qwen3-embed's releases.

v1.12.1 (2026-07-05)

This release is published under the Apache-2.0 License.

Detailed Changes: v1.12.1-beta.1...v1.12.1

v1.12.1-beta.1 (2026-07-05)

This release is published under the Apache-2.0 License.

Bug Fixes

  • Fast-path scalar sigmoid with math.exp for batch size 1 (53744a1)

  • Sum integer attention mask before float cast in mean pooling (6702cd4)

  • Validate GCS download host via parsed.hostname to prevent SSRF (8d1c946)

  • deps: Lock file maintenance (b751f96)

  • deps: Update non-major dependencies (28697e2)

Detailed Changes: v1.12.0...v1.12.1-beta.1

Changelog

Sourced from qwen3-embed's changelog.

v1.12.1 (2026-07-05)

v1.12.1-beta.1 (2026-07-05)

Bug Fixes

  • Fast-path scalar sigmoid with math.exp for batch size 1 (53744a1)

  • Sum integer attention mask before float cast in mean pooling (6702cd4)

  • Validate GCS download host via parsed.hostname to prevent SSRF (8d1c946)

  • deps: Lock file maintenance (b751f96)

  • deps: Update non-major dependencies (28697e2)

Commits
  • f1d272a chore(release): v1.12.1
  • b24aef7 chore(release): v1.12.1-beta.1
  • 28697e2 fix(deps): update non-major dependencies
  • b751f96 fix(deps): lock file maintenance
  • 6702cd4 fix: sum integer attention mask before float cast in mean pooling
  • 53744a1 fix: fast-path scalar sigmoid with math.exp for batch size 1
  • 8d1c946 fix: validate GCS download host via parsed.hostname to prevent SSRF
  • See full diff in compare view

Updates build from 1.5.0 to 1.6.0

Release notes

Sourced from build's releases.

1.6.0

What's Changed

New Contributors

Full Changelog: pypa/build@1.5.1...1.6.0

1.5.1

What's Changed

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

  • Drain verbose subprocess output inline instead of using a ThreadPoolExecutor, which silently swallowed logging errors - by :user:henryiii (:issue:1098)
  • Reject a file passed as --env-dir with a clear error instead of a raw FileExistsError - by :user:henryiii (:issue:1100)
  • Emit CLI warnings to stderr instead of stdout, so they no longer corrupt --metadata JSON output on stdout - by :user:ymyzk (:issue:1111)
  • Fix the Windows symlink support probe always returning False due to a stale object interpolated into the destination path - by :user:henryiii (:issue:1118)
  • Fix metadata_path's build-backend fallback returning a nonexistent dist-info path for wheels with a build tag - by :user:henryiii (:issue:1119)
  • Write pip/uv requirements and constraints files with \n instead of os.linesep, avoiding doubled \r\r\n line endings on Windows - by :user:henryiii (:issue:1120)
  • Batch of small robustness fixes: correct macOS release parsing for the minimum pip version, avoid sharing the mutable default build-system table between builders, keep the original error when isolated-environment setup fails early, and raise BuildException for an invalid wheel - by :user:henryiii (:issue:1121)
  • Decide color support independently for stdout and stderr instead of only checking stdout.isatty(), so redirecting one stream no longer disables or leaks ANSI colors on the other - by :user:henryiii (:issue:1123)
  • Pass --dependency-constraints-txt files through to the installer unmodified instead of re-parsing them into a deduplicated set of lines, fixing a case where a hashed requirement (e.g. from pip-compile --generate-hashes) could have its --hash continuation line separated from its requirement line and silently dropped, depending on the interpreter's hash seed - by :user:manfred-kaiser (:issue:1140)

... (truncated)

Commits
  • 7ac9efe chore: prepare for 1.6.0
  • e57e2bf 👷 ci: use app token for releases (#1169)
  • 66438ab pre-commit: bump repositories (#1167)
  • 4ed9658 build(deps): bump the github-actions group with 3 updates (#1166)
  • c76707f 🔧 chore: batch dependency updates weekly on Tuesday (#1165)
  • b317437 Drop a few PyPy-specific test skips (#1164)
  • 561f331 pre-commit: bump repositories (#1163)
  • 9456281 refactor: drop redundant exc_info parameter from backend exception wrapper ...
  • 3e7a445 Use stdlib importlib.metadata for typing (#1162)
  • 9a2e1e9 tests: download integration sources once per run (#1157)
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Summary by CodeRabbit

  • Chores
    • Updated supported NumPy versions for semantic search, reranking, and GPU installation profiles.
    • Refreshed pinned package versions and integrity hashes for the Power Suite GUI and web runtime environments.
    • Updated compatibility versions for several runtime components, including Click, Cryptography, Filelock, MCP packages, Protobuf, Pydantic Core, SSE-Starlette, and Tokenizers.

@dependabot
chore(deps): bump the maintenance group with 19 updates
49d8895 
Bumps the maintenance group with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [tokenizers](https://github.com/huggingface/tokenizers) | `0.23.1` | `0.23.2` |
| [numpy](https://github.com/numpy/numpy) | `2.4.6` | `2.5.3` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [nvidia-cudnn-cu13](https://developer.nvidia.com/cuda-zone) | `9.24.0.43` | `9.25.1.1` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `2.1.0` | `2.2.0` |
| [qwen3-embed](https://github.com/n24q02m/qwen3-embed) | `1.12.0` | `1.12.1` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.6` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260724` | `6.0.12.20260906` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.4` | `3.32.5` |
| [mcp-types](https://github.com/modelcontextprotocol/python-sdk) | `2.1.0` | `2.2.0` |
| [mmh3](https://github.com/hajimes/mmh3) | `5.2.1` | `5.3.0` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.36.0` | `7.36.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.48.0` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.8` | `3.4.11` |


Updates `tokenizers` from 0.23.1 to 0.23.2
- [Release notes](https://github.com/huggingface/tokenizers/releases)
- [Changelog](https://github.com/huggingface/tokenizers/blob/main/RELEASE.md)
- [Commits](huggingface/tokenizers@v0.23.1...v0.23.2)

Updates `numpy` from 2.4.6 to 2.5.3
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.3)

Updates `onnxruntime-gpu` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `nvidia-cudnn-cu13` from 9.24.0.43 to 9.25.1.1

Updates `mcp` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.0...v2.2.0)

Updates `qwen3-embed` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/n24q02m/qwen3-embed/releases)
- [Changelog](https://github.com/n24q02m/qwen3-embed/blob/main/CHANGELOG.md)
- [Commits](n24q02m/qwen3-embed@v1.12.0...v1.12.1)

Updates `build` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.0)

Updates `ruff` from 0.16.0 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.6)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `types-pyyaml` from 6.0.12.20260724 to 6.0.12.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `filelock` from 3.32.4 to 3.32.5
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.4...3.32.5)

Updates `mcp-types` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.0...v2.2.0)

Updates `mmh3` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/hajimes/mmh3/releases)
- [Changelog](https://github.com/hajimes/mmh3/blob/master/CHANGELOG.md)
- [Commits](hajimes/mmh3@v5.2.1...v5.3.0)

Updates `protobuf` from 7.36.0 to 7.36.1
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pydantic-core` from 2.46.5 to 2.48.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.46.5...core-v2.48.0)

Updates `sse-starlette` from 3.4.8 to 3.4.11
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.4.8...v3.4.11)

---
updated-dependencies:
- dependency-name: tokenizers
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: numpy
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: onnxruntime-gpu
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: nvidia-cudnn-cu13
  dependency-version: 9.25.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: mcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: qwen3-embed
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: filelock
  dependency-version: 3.32.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: mcp-types
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: mmh3
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: protobuf
  dependency-version: 7.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
- dependency-name: pydantic-core
  dependency-version: 2.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maintenance
- dependency-name: sse-starlette
  dependency-version: 3.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maintenance
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 11, 2026
@coderabbitai

coderabbitai Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: 4e03ac9f-d5ad-4136-9cf3-32dd12c394bf

📥 Commits

Reviewing files that changed from the base of the PR and between dde1e13 and 49d8895.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • pyproject.toml
  • release/power-suite-3.7.1-gui-0.7.7.constraints.txt
  • release/web-runtime.requirements.txt

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

Walkthrough

The pull request expands NumPy compatibility and refreshes pinned dependency versions and hashes in release requirement files.

Changes

Dependency updates

Layer / File(s) Summary
NumPy compatibility constraints
pyproject.toml		 The semantic, rerank, and gpu profiles allow NumPy versions below 2.6.
Release dependency pins
release/power-suite-3.7.1-gui-0.7.7.constraints.txt, release/web-runtime.requirements.txt		 Release files update package pins for Click, Cryptography, Filelock, MCP packages, MMH3, NumPy, Protobuf, Pydantic Core, SSE-Starlette, and Tokenizers. The web-runtime file also updates the corresponding hashes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: weby-homelab

Merge Risk: ⚪ Minimal · up to 49d88

The updated NumPy pin remains within the changed optional dependency bounds, and no actionable merge risk was identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: updating 19 dependencies in the maintenance group. It is concise and directly related to the pull request objectives.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/uv/maintenance-d287d0e760

Comment @coderabbitai help to get the list of available commands.

@weby-homelab weby-homelab mentioned this pull request Sep 13, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants