8000 build(deps): bump the python-minor group across 1 directory with 15 updates by dependabot[bot] · Pull Request #714 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

build(deps): bump the python-minor group across 1 directory with 15 updates - #714

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/python-minor-be705254ae
Closed

build(deps): bump the python-minor group across 1 directory with 15 updates#714
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/python-minor-be705254ae

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Bumps the python-minor group with 15 updates in the /fastapi_backend directory:

Package From To
starlette 1.8.0 1.10.0
pydantic-settings 2.15.0 2.16.1
pypdf 6.20.1 6.21.2
markdown 3.11.1 3.11.2
laya-mlx 0.4.0 0.5.0
speechbrain 1.1.1 1.1.2
transformers 5.19.0 5.20.2
openshell 0.1.4 0.1.5
ddgs 9.16.0 9.16.1
botocore 1.43.113 1.43.118
extract-msg 0.56.1 0.57.0
ruff 0.17.0 0.17.2
pytest-mock 3.16.0 3.17.0
coverage 7.16.2 7.17.0
mkdocs-material 9.7.7 9.8.0

Updates starlette from 1.8.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0
  • Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
  • The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
  • FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

  • Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
  • starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

  • Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
  • Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
  • WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
  • FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

  • Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
  • Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
  • FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
  • Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

  • Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
  • Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
  • Compare Match members by identity during routing #3665 and #3722.

Deprecated

  • Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

  • Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
  • Keep path parameter values that look like another placeholder in url_path_for() #3725.
  • Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
  • Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
  • Strip only one pair of matching outer quotes from Config env file values #3720.
  • Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
  • Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
  • Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.
Commits
  • 8aa828c Version 1.10.0 (#3728)
  • a85a5c3 Substitute URL path parameters in a single pass (#3725)
  • 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
  • b973efd Build URL-encoded form fields in parser callbacks (#3724)
  • d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
  • fb3e818 Compare remaining Match members by identity in routing (#3722)
  • fc23aa1 Compare Match members by identity in Router.app (#3665)
  • fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
  • 4114432 Default omitted http.response.start headers in middlewares (#3721)
  • 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
  • f651a7a Keep list of dicts CLI values as lists (#1049)
  • ecf7d90 Harden CI (#1044)
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • Additional commits viewable in compare view

Updates pypdf from 6.20.1 to 6.21.2

Release notes

Sourced from pypdf's releases.

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

New Features (ENH)

Bug Fixes (BUG)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.21.2, 2026-10-21

Security (SEC)

  • Avoid repeated full file loads (#4240)
  • Limit size of standard xref table (#4239)

Bug Fixes (BUG)

  • Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • Keep 8-bit DeviceRGB image mode (#4230)
  • Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

Security (SEC)

  • Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

  • Improve performance and limit field work (#4219)
  • Limit stream parsing work (#4218)

New Features (ENH)

  • Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

  • Treat NUL as whitespace in ArrayObject (#4198)
  • Avoid overwriting unread objects in add_form_topname (#4190)
  • Read an indirect page box on a writer page (#4179)

Full Changelog

Commits
  • 37d05f6 REL: 6.21.2
  • 68a0e50 SEC: Avoid repeated full file loads (#4240)
  • a3061e3 SEC: Limit size of standard xref table (#4239)
  • b7eb7b9 BUG: Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • 885e743 ROB: Reject unsupported key lengths in the /Encrypt dictionary (#4226)
  • b68a335 TST: Enable type checking for PageRange tests (#4229)
  • 3f9c7f4 ROB: Reject negative bfrange source ranges in /ToUnicode CMaps (#4225)
  • 85c46ab ROB: Raise PdfReadError for malformed /ObjStm /N and /First headers (#4216)
  • a91817a BUG: Keep 8-bit DeviceRGB image mode (#4230)
  • b32df1d ROB: Validate the /Encrypt dictionary when opening an encrypted file (#4197)
  • Additional commits viewable in compare view

Updates markdown from 3.11.1 to 3.11.2

Release notes

Sourced from markdown's releases.

Release 3.11.2

Fixed

  • Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
  • For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).
Changelog

Sourced from markdown's changelog.

[3.11.2] - 2026-10-19

Fixed

  • Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
  • For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).
Commits
  • b41e0aa Bump version to 3.11.2
  • 934c53e Add checklist of parts to PR template
  • 2249ffd Update AI Policy
  • a27428b Sanitize attribute names in fenced_code and legacy_attrs
  • 90cdcf5 Add fixed category to changelog
  • 97233ef Revert enforcement of CommonMark punctuation rules
  • See full diff in compare view

Updates laya-mlx from 0 8000 .4.0 to 0.5.0

Release notes

Sourced from laya-mlx's releases.

laya-mlx v0.5.0

0.5.0 — upstream v0.4.12 migration

This release aligns applicable host APIs with NandhaKishorM/laya ffc142012af63d015fa19f05f29f9c5ff329a2cc: batch and long-text inference, structured decisions, hooks, calibration, evaluation, Router, HTTP/MCP, and framework/tool integrations. Native execution and explicit unsupported backend boundaries are preserved.

Compatibility changes include upstream Router defaults, validation and output semantics. The LlamaIndex adapter supports the actual current BaseSelector and SingleSelection contracts. See MIGRATION_0_4.md for behavior and dependency details.

The 341-entry API audit and three-checkpoint FP32/FP16 numerical/stability campaign passed. The qualification report records unchanged applicable upstream assertions, real SDK HTTP checks, real optional-framework checks and clean-wheel inference. Package 0.5.0 changes version metadata relative to the recorded 0.4.0 development qualification builds; release gates verify the final distribution separately.

Performance comparisons use upstream PyTorch 2.14, matched FP32 and fixed inputs. MLX wins all 18 P50 comparisons in the final matrix. Core ML's alternating-order confirmation wins all 18 P50/P95/mean-throughput comparisons; the initial four sequential regressions are retained in the report. Core ML adaptive graph and shape caches trade more resident memory for lower warm-call latency. Cold calls, other hardware and arbitrary workloads are outside these finite guarantees.

See QUALIFICATION_0_4_12.md and UPSTREAM_0412_PROGRESS.json for raw evidence and limitations. Original historical benchmark and package receipts remain unchanged.

MLX preserves native precision, compilation, row batch limits and bounded question-prefix caching. Local-only model resolution is supported by Agent and Router; ordinary inference needs no PyTorch or Transformers.

Publication verified on 2026-10-20: GitHub Release and PyPI wheel/sdist hashes match, public wheel source matches the tag, and a public-index reinstall passes all three offline real-model checks. See benchmarks/results/release-v050.json.

Post-release CI runs exposed intermittent failures in the unchanged upstream idle-window timing test. Running host contracts before native model tests in a separate process passed one complete CI, but a subsequent run reproduced the timing failure; isolation has not eliminated it. No runtime, assertion or timeout was changed. Failure diagnostics also run the original upstream idle-window tests for comparison. CI evidence.

The original pinned upstream suite reproduced the same idle-window failure on the same CI runner; all 254 native/integration tests passed. This timing instability remains documented in CI evidence.

Changelog

Sourced from laya-mlx's changelog.

0.5.0 — upstream v0.4.12 migration

This release aligns applicable host APIs with NandhaKishorM/laya ffc142012af63d015fa19f05f29f9c5ff329a2cc: batch and long-text inference, structured decisions, hooks, calibration, evaluation, Router, HTTP/MCP, and framework/tool integrations. Native execution and explicit unsupported backend boundaries are preserved.

Compatibility changes include upstream Router defaults, validation and output semantics. The LlamaIndex adapter supports the actual current BaseSelector and SingleSelection contracts. See MIGRATION_0_4.md for behavior and dependency details.

The 341-entry API audit and three-checkpoint FP32/FP16 numerical/stability campaign passed. The qualification report records unchanged applicable upstream assertions, real SDK HTTP checks, real optional-framework checks and clean-wheel inference. Package 0.5.0 changes version metadata relative to the recorded 0.4.0 development qualification builds; release gates verify the final distribution separately.

Performance comparisons use upstream PyTorch 2.14, matched FP32 and fixed inputs. MLX wins all 18 P50 comparisons in the final matrix. Core ML's alternating-order confirmation wins all 18 P50/P95/mean-throughput comparisons; the initial four sequential regressions are retained in the report. Core ML adaptive graph and shape caches trade more resident memory for lower warm-call latency. Cold calls, other hardware and arbitrary workloads are outside these finite guarantees.

See QUALIFICATION_0_4_12.md and UPSTREAM_0412_PROGRESS.json for raw evidence and limitations. Original historical benchmark and package receipts remain unchanged.

MLX preserves native precision, compilation, row batch limits and bounded question-prefix caching. Local-only model resolution is supported by Agent and Router; ordinary inference needs no PyTorch or Transformers.

Publication verified on 2026-10-20: GitHub Release and PyPI wheel/sdist hashes match, public wheel source matches the tag, and a public-index reinstall passes all three offline real-model checks. See benchmarks/results/release-v050.json.

Post-release CI runs exposed intermittent failures in the unchanged upstream idle-window timing test. Running host contracts before native model tests in a separate process passed one complete CI, but a subsequent run reproduced the timing failure; isolation has not eliminated it. No runtime, assertion or timeout was changed. Failure diagnostics also run the original upstream idle-window tests for comparison. CI evidence.

The original pinned upstream suite reproduced the same idle-window failure on the same CI runner; all 254 native/integration tests passed. This timing instability remains documented in CI evidence.

Commits
  • daf1f89 Record 0.5.0 distribution checks and clarify qualification provenance
  • 048ca6a Port upstream v0.4.12 and prepare laya-mlx 0.5.0
  • See full diff in compare view

Updates speechbrain from 1.1.1 to 1.1.2

Release notes

Sourced from speechbrain's releases.

v1.1.2

Notable changes

  • Minimum version of the torch and torchaudio dependencies are now 2.7.1 for better device management, see #3099 and #3080
  • A regression in training time due to the speed perturb augmentation was fixed (gianfranco) #3100
  • A regression in packaging added several irrelevant modules to the pypi artifacts, this has been fixed (Kayvan Zahiri) #3088

Bug Fixes

  • use parametrizations.weight_norm to silence deprecation warning (li-lizhe) #3087
  • transformer: enforce max_len in make_transformer_src_tgt_masks (Luchang Jiang) #3086
  • Fix fetch() returning a missing path with COPY_SKIP_CACHE and save_filename (sungbin1015) #3093
  • Fix get_all_files dropping files listed after an exclude_and match (sungbin1015) #3101
  • Fix TextEncoder.limited_labelset_from_iterable ignoring n_most_common and min_count (sungbin1015) #3095

Documentation

  • clarify channelwise behavior of CumulativeLayerNorm #3105

New Contributors

Full Changelog: speechbrain/speechbrain@v1.1.1...v1.1.2

Commits
  • c024127 Bump version
  • 9b768a5 docs: clarify channelwise behavior of CumulativeLayerNorm (#3105)
  • dadd2d6 Fix LJSpeech HiFiGAN recipes failing at epoch 2 with ParametrizedConv1d wei...
  • ec3ac37 fix(transformer): enforce max_len in make_transformer_src_tgt_masks (#3086)
  • d2bf7b7 chore: remove the usage of old weight_norm (#3104)
  • 9ef9a34 Fix get_all_files dropping files listed after an exclude_and match (#3101)
  • 3ecd72a fix speed pert perf (#3100)
  • 660b6ff fix: use parametrizations.weight_norm to silence deprecation warning (#3087)
  • 546bfc9 Fix TextEncoder.limited_labelset_from_iterable ignoring n_most_common and min...
  • c3a6a75 Only package speechbrain in the wheel (#3088)
  • Additional commits viewable in compare view

Updates transformers from 5.19.0 to 5.20.2

Release notes

Sourced from transformers's releases.

Patch release v5.20.2

Patch release: v5.20.2

This patch notably solves an issue where some inputs could loose their original type inside prepare_inputs_for_generation in generate, leading to problems with multimodal models. It also fixes some other issues listed on the below commits.

It contains the following commits:

Release v5.20.1

Special surprise including the new model Beam from Reflection AI 🥳

Beam is a token-efficient, frontier-scale model focused on coding and agentic use cases. It is built for teams that want to run a powerful model on their own hardware, infrastructure, or cloud, and customize it to their specific needs.

Links: Documentation

Some real patch fixes

We broke loading models on older torch versions 😢 should be fixed now. But here is the full list of fixes

Full Changelog: huggingface/transformers@v5.20.0...v5.20.1

Release v5.20.0

New Model additions

Muse Spark Open

Muse Spark Open is a multimodal mixture-of-experts model from Meta that takes text, images, audio, and video as input and generates text. It has 816B total parameters (42B active per token) and a context window of up to 1,048,576 tokens shared across modalities. It is trained for agentic coding tasks such as multi-file editing, debugging, and tool use. Checkpoints are available in BF16 and NVFP4 formats.

Links: Documentation | Blog Post

... (truncated)

Commits
  • 18329f1 Release: v5.20.2
  • 2ce3082 Avoid a host-to-device copy in eager_mask (#49684)
  • 62bc6fd Declare the input modalities of the VLMs that report text only (#49677)
  • 30f4e38 Fix zero expert gradients in bfloat16 with expert parallelism and ep_size < f...
  • ce8231f Fix inputs dict casting in generate (#49731)
  • 0ea8779 v5.20.1
  • de4f35f Fix small bug in auto mappings (#49664)
  • 759c538 Make DtensorShardOperation work on torch 2.6 and 2.7 (#49657)
  • c180e2d Fix from_pretrained on torch 2.7: require torch>=2.8 for distributed checkpoi...
  • 10d36aa Fix DeepGEMM Mega MoE under expert parallelism (#49428)
  • Additional commits viewable in compare view

Updates openshell from 0.1.4 to 0.1.5

Release notes

Sourced from openshell's releases.

OpenShell v0.1.5

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.5 sh

Upgrade notes

  • Supervisor OCSF log files are now named openshell-ocsf.YYYY-MM-DD.jsonl instead of .log, so update any collector patterns from openshell-ocsf.*.log to openshell-ocsf.*.jsonl. Old .log files are not migrated and may be cleaned up, so collect any history you need before upgrading. #4263
  • On Kubernetes, sandbox templates that set pod annotations or labels are now rejected unless an operator allowlists those keys with the new allowed_pod_annotations and allowed_pod_labels settings in [openshell.drivers.kubernetes]. This affects direct API or SDK callers that set SandboxTemplate.labels or SandboxTemplate.annotations, including recovery of timed-out sandboxes; the openshell CLI and --label metadata labels are unaffected. #4497
  • The gateway now rejects annotation keys with the reserved internal.openshell.ai/ prefix on CreateSandbox and UpdateConfig. #4626
  • The Go SDK's SandboxInterface.Create() and CreateFromTemplate() now take functional options such as WithLabels(), WithAnnotations(), and WithServiceExposures() instead of a positional labels argument and the removed CreateOptions struct. Update call sites to the new options. #3198
  • External compute drivers that provision openshell-sandbox must update their bootstrap descriptor from outer_fence to provisioning_evidence; drivers that use their own isolation backend are unaffected. This release also publishes the versioned Sandbox Protocol for independently implemented backends. #3898
  • The snap no longer enables the user gateway service for every user; the install script enables it only for the user who ran it. After a direct snap install, or if an older snap revision enabled it globally, run sudo systemctl disable --global snap.openshell.user-gateway.service once and then systemctl --user enable --now snap.openshell.user-gateway.service from the single account that should run the gateway. #4615

Bug fixes

  • Hostname-based network policy is now bound to supervisor-controlled DNS, while sandbox host aliases still require explicit IP validation or a trusted gateway pin. #4602
  • Stopping a MicroVM sandbox no longer discards recent writes, because the guest now flushes its filesystem before shutdown. #4195
  • You can now stop a sandbox stuck in Error after a startup failure and start it again, without deleting it or its persistent workspace. #4231
  • OTLP export with gzip compression or an https:// endpoint no longer fails at startup. #4399
  • Podman deployments can trust a private CA for inspected HTTPS egress with the new additional_ca_bundle setting, without rebuilding the supervisor image. The CA is trusted for all destinations by both the supervisor and the workload. #3996
  • The Helm chart now installs in namespaces that enforce the Restricted Pod Security standard, and the certgen hook security context can be overridden with pkiInitJob.securityContext. #3340
  • GitHub App OAuth token refresh now works, because the gateway asks for a JSON response. #4530
  • A deleted provider that sandboxes still reference no longer blocks gateway startup; the gateway logs a warning instead. #4661
  • In Kubernetes operator workspace mode, labeled workspaces are no longer rejected with PermissionDenied right after gateway startup. #4527
  • Kubernetes PVC mounts can no longer overlap driver-managed runtime and control paths. #4522
  • The sandbox network broker now denies operations when it cannot verify a descriptor, instead of falling back to native handling. #4494
  • VM guest startup is hardened so the packaged sandbox keeps its expected executable identity. #4539
  • Seccomp notification probe failures now report the actual kernel error instead of a generic "notification launcher disappeared" message. #4051
  • e2fsprogs preflight checks no longer fail when Linux briefly reports a newly installed executable as busy. #4315
  • Middleware now sees http and ws for plaintext requests in a tunnel instead of https and wss. #4397
  • L7 OCSF HTTP events now report https for TLS-terminated requests. #4684
  • OCSF events now include the required device.os.type_id, so they validate against the OCSF 1.8 schema. #4677
  • Mutation-lock metrics from the gateway's startup reconciliation are no longer dropped. #4524
  • Updated rustls to 0.23.46 to address RUSTSEC-2026-0346 through RUSTSEC-2026-0349. #4568
  • The RPM-installed Python SDK now imports correctly, and its stubs can be generated with older protoc versions. #4439
  • Builds now honor the PROTOC environment variable, so distribution builds can use their system protobuf compiler. #4441

Features

  • Supervisors can now receive configuration changes pushed over their gateway session by setting config_delivery_mode = "push", so policy and...

    Description has been truncated

@dependabot
build(deps): bump the python-minor group across 1 directory with 15 u…
51ce691 
…pdates

Bumps the python-minor group with 15 updates in the /fastapi_backend directory:

| Package | From | To |
| --- | --- | --- |
| [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.10.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.1` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.20.1` | `6.21.2` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.11.1` | `3.11.2` |
| [laya-mlx](https://github.com/mizorewww/laya-mlx) | `0.4.0` | `0.5.0` |
| [speechbrain](https://github.com/speechbrain/speechbrain) | `1.1.1` | `1.1.2` |
| [transformers](https://github.com/huggingface/transformers) | `5.19.0` | `5.20.2` |
| [openshell](https://github.com/NVIDIA/OpenShell) | `0.1.4` | `0.1.5` |
| [ddgs](https://github.com/deedy5/ddgs) | `9.16.0` | `9.16.1` |
| [botocore](https://github.com/boto/botocore) | `1.43.113` | `1.43.118` |
| [extract-msg](https://github.com/TeamMsgExtractor/msg-extractor) | `0.56.1` | `0.57.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.2` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.16.0` | `3.17.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.7` | `9.8.0` |



Updates `starlette` from 1.8.0 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.8.0...1.10.0)

Updates `pydantic-settings` from 2.15.0 to 2.16.1
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.1)

Updates `pypdf` from 6.20.1 to 6.21.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.20.1...6.21.2)

Updates `markdown` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.11.1...3.11.2)

Updates `laya-mlx` from 0.4.0 to 0.5.0
- [Release notes](https://github.com/mizorewww/laya-mlx/releases)
- [Changelog](https://github.com/mizorewww/laya-mlx/blob/main/docs/RELEASE_0_5_0.md)
- [Commits](mizorewww/laya-mlx@v0.4.0...v0.5.0)

Updates `speechbrain` from 1.1.1 to 1.1.2
- [Release notes](https://github.com/speechbrain/speechbrain/releases)
- [Commits](speechbrain/speechbrain@v1.1.1...v1.1.2)

Updates `transformers` from 5.19.0 to 5.20.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.19.0...v5.20.2)

Updates `openshell` from 0.1.4 to 0.1.5
- [Release notes](https://github.com/NVIDIA/OpenShell/releases)
- [Commits](NVIDIA/OpenShell@v0.1.4...v0.1.5)

Updates `ddgs` from 9.16.0 to 9.16.1
- [Release notes](https://github.com/deedy5/ddgs/releases)
- [Commits](deedy5/ddgs@v9.16.0...v9.16.1)

Updates `botocore` from 1.43.113 to 1.43.118
- [Commits](boto/botocore@1.43.113...1.43.118)

Updates `extract-msg` from 0.56.1 to 0.57.0
- [Release notes](https://github.com/TeamMsgExtractor/msg-extractor/releases)
- [Changelog](https://github.com/TeamMsgExtractor/msg-extractor/blob/master/CHANGELOG.md)
- [Commits](TeamMsgExtractor/msg-extractor@v0.56.1...v0.57.0)

Updates `ruff` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.2)

Updates `pytest-mock` from 3.16.0 to 3.17.0
- [Release notes](https://github.com/pytest-dev/pytest-mock/releases)
- [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-mock@v3.16.0...v3.17.0)

Updates `coverage` from 7.16.2 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.2...7.17.0)

Updates `mkdocs-material` from 9.7.7 to 9.8.0
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.7...9.8.0)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: pydantic-settings
  dependency-version: 2.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: pypdf
  dependency-version: 6.21.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: markdown
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: laya-mlx
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: speechbrain
  dependency-version: 1.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: transformers
  dependency-version: 5.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: openshell
  dependency-version: 0.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: ddgs
  dependency-version: 9.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: botocore
  dependency-version: 1.43.118
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: extract-msg
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: pytest-mock
  dependency-version: 3.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: mkdocs-material
  dependency-version: 9.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026
@dependabot @github
dependabot Bot commented on behalf of github Nov 4, 2026
Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 4, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/fastapi_backend/python-minor-be705254ae branch November 4, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0