build(deps): bump the python-minor group across 1 directory with 25 updates by dependabot[bot] · Pull Request #719 · adeelahmad/lense

dependabot · 2026-11-04T00:54:32Z

Bumps the python-minor group with 25 updates in the /fastapi_backend directory:

Package	From	To
starlette	`1.8.0`	`1.10.0`
pydantic-settings	`2.15.0`	`2.16.2`
pypdf	`6.20.1`	`6.21.4`
markdown	`3.11.1`	`3.11.2`
opentelemetry-api	`1.45.1`	`1.45.2`
opentelemetry-sdk	`1.45.1`	`1.45.2`
opentelemetry-exporter-otlp-proto-http	`1.45.1`	`1.45.2`
funasr	`1.4.16`	`1.4.18`
torch	`2.14.1`	`2.15.0`
torchaudio	`2.11.0`	`2.11.1`
laya-mlx	`0.4.0`	`0.6.0`
speechbrain	`1.1.1`	`1.1.2`
onnxruntime	`1.31.0`	`1.31.1`
transformers	`5.19.0`	`5.22.1`
spacy	`3.8.16`	`3.8.18`
openshell	`0.1.4`	`0.1.6`
ddgs	`9.16.0`	`9.16.1`
botocore	`1.43.113`	`1.43.123`
extract-msg	`0.56.1`	`0.58.1`
ruff	`0.17.0`	`0.17.3`
pytest	`9.1.1`	`9.2.0`
pytest-mock	`3.16.0`	`3.17.0`
mypy	`2.4.0`	`2.4.1`
coverage	`7.16.2`	`7.17.0`
mkdocs-material	`9.7.7`	`9.8.0`

Updates starlette from 1.8.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.
uv pip install starlette==1.10.0
Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.

The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.

FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.

starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.

Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.

WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.

FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.

Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.

FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.

Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.

Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.

Compare Match members by identity during routing #3665 and #3722.

Deprecated

Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.

Keep path parameter values that look like another placeholder in url_path_for() #3725.

Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.

Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.

Strip only one pair of matching outer quotes from Config env file values #3720.

Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.

Report NaN and infinity correctly in FloatConvertor.to_string() #3716.

Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

8aa828c Version 1.10.0 (#3728)
a85a5c3 Substitute URL path parameters in a single pass (#3725)
6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
b973efd Build URL-encoded form fields in parser callbacks (#3724)
d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
fb3e818 Compare remaining Match members by identity in routing (#3722)
fc23aa1 Compare Match members by identity in Router.app (#3665)
fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
4114432 Default omitted http.response.start headers in middlewares (#3721)
1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.

A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Harden CI by @Viicos in pydantic/pydantic-settings#1044

Keep list of dicts CLI values as lists by @hramezani in pydantic/pydantic-settings#1049

Keep fixed-length tuple CLI positionals single-valued by @hramezani in pydantic/pydantic-settings#1069

Prepare release 2.16.1 by @hramezani in pydantic/pydantic-settings#1087

build(deps): bump the python-packages group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.

python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.

Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.

validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.

CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).

JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.

Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.

Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.

AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.

env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.

CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits

94150a0 Prepare release 2.16.2 (#1111)
9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
2d1f924 Fix explicit nested secrets directory precedence (#1093)
e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
e71a53e Decode nested dictionary values with complex union types (#1089)
8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
c50c853 Detect nested Field discriminators in default partial updates (#1076)
9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
4e286e2 Prepare release 2.16.1 (#1087)
Additional commits viewable in compare view

Updates pypdf from 6.20.1 to 6.21.4

Release notes

Sourced from pypdf's releases.

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Limit the number of copied page attributes during flattening (#4290) by @stefan6419846

Detect EOF when reading standard xref table trailer (#4289) by @stefan6419846

Fix loop detection when cloning DictionaryObject (#4288) by @stefan6419846

Documentation (DOC)

Exclude performance issues from security reports (#4280) by @stefan6419846

Full Changelog

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

Use the validated page count after decrypting a document (#4270) by @stefan6419846

Limit total number of cross-reference stream entries (#4269) by @stefan6419846

Avoid excessive error messages (#4265) by @stefan6419846

Performance Improvements (PI)

Read flat page label number trees once for all pages (#4251) by @kholdrex

Collect the named destinations once when resolving links (#4249) by @MartinThoma

Avoid scanning all objects in get_outline_root (#4245) by @kholdrex

Bug Fixes (BUG)

Resolve indirect widths in CID font /W arrays (#4267) by @tim-hilde

Documentation (DOC)

Block incremental writes of encrypted documents (#4246) by @metsw24-max

Developer Experience (DEV)

Update to PyPy 3.12 and pinned requirements (#4244) by @stefan6419846

Maintenance (MAINT)

Revert: Reject unsupported key lengths in the /Encrypt dictionary by @stefan6419846

Full Changelog

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Avoid repeated full file loads (#4240) by @stefan6419846

Limit size of standard xref table (#4239) by @stefan6419846

Bug Fixes (BUG)

Decode UniGB-UTF16 CMaps as UTF-16BE (#4231) by @4444wjt

Keep 8-bit DeviceRGB image mode (#4230) by @DGrutt

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.4, 2026-10-28

Security (SEC)

Limit the number of copied page attributes during flattening (#4290)

Detect EOF when reading standard xref table trailer (#4289)

Fix loop detection when cloning DictionaryObject (#4288)

Documentation (DOC)

Exclude performance issues from security reports (#4280)

Full Changelog

Version 6.21.3, 2026-10-27

Security (SEC)

Use the validated page count after decrypting a document (#4270)

Limit total number of cross-reference stream entries (#4269)

Avoid excessive error messages (#4265)

Performance Improvements (PI)

Read flat page label number trees once for all pages (#4251)

Collect the named destinations once when resolving links (#4249)

Avoid scanning all objects in get_outline_root (#4245)

Bug Fixes (BUG)

Resolve indirect widths in CID font /W arrays (#4267)

Documentation (DOC)

Block incremental writes of encrypted documents (#4246)

Developer Experience (DEV)

Update to PyPy 3.12 and pinned requirements (#4244)

Maintenance (MAINT)

Revert: Reject unsupported key lengths in the /Encrypt dictionary

Full Changelog

Version 6.21.2, 2026-10-21

Security (SEC)

Avoid repeated full file loads (#4240)

Limit size of standard xref table (#4239)

Bug Fixes (BUG)

Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)

Keep 8-bit DeviceRGB image mode (#4230)

Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

... (truncated)

Commits

b2c3fa2 REL: 6.21.4
ea4ac66 SEC: Limit the number of copied page attributes during flattening (#4290)
06593f9 SEC: Detect EOF when reading standard xref table trailer (#4289)
f176db1 SEC: Fix loop detection when cloning DictionaryObject (#4288)
c7d391c PI: Speed up transformation matrix handling for layout mode text extraction (...
b330dcd DEV: Bump actions/setup-python from 7.0.0 to 7.1.0 (#4278)
8901534 DOC: Exclude performance issues from security reports (#4280)
70eab9b PI: Speed up parse_bfchar (#4273)
4ef744f ROB: Skip an embedded file specification that is not a dictionary (#4256)
945216f ROB: Keep the text state when a text state operator has no operand in layout ...
Additional commits viewable in compare view

Updates markdown from 3.11.1 to 3.11.2

Release notes

Sourced from markdown's releases.

Release 3.11.2

Fixed

Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).

For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Changelog

Sourced from markdown's changelog.

[3.11.2] - 2026-10-19

Fixed

Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).

For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Commits

b41e0aa Bump version to 3.11.2
934c53e Add checklist of parts to PR template
2249ffd Update AI Policy
a27428b Sanitize attribute names in fenced_code and legacy_attrs
90cdcf5 Add fixed category to changelog
97233ef Revert enforcement of CommonMark punctuation rules
See full diff in compare view

Updates opentelemetry-api from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates opentelemetry-sdk from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-sdk's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates opentelemetry-exporter-otlp-proto-http from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-exporter-otlp-proto-http's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-exporter-otlp-proto-http's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates funasr from 1.4.16 to 1.4.18

Commits

5315edd Release FunASR 1.4.18 (#3805)
a099136 chore(release): prepare FunASR 1.4.18
8b7ab8a Merge pull request #3804: preserve VAD timestamp token boundaries
7c7e8cf fix: preserve VAD token boundaries for sentence timestamps
e49cdd9 Merge pull request #3803: complete filtered-token timestamp alignment
12916bf fix: reject incomplete token timestamp alignment
712e1d0 fix(postprocess): keep word timestamps aligned after filtered tokens
dd00b0e fix: preserve scripts in fuzzy hotword correction (#3798)
19e33ba Release FunASR 1.4.17 (#3770)
27fe30a ci: pin browser tests to Playwright-supported Ubuntu 24.04
Additional commits viewable in compare view

Updates torch from 2.14.1 to 2.15.0

Release notes

Sourced from torch's releases.

PyTorch 2.15.0 Release Notes

Highlights

Backwards Incompatible Changes

Deprecations

New Features

Improvements

Bug fixes

Performance

Documentation

Security

Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Python Frontend

import torch can no longer be re-executed in the same process, including via importlib.reload(torch) (#194654)

importlib.reload(torch) and del sys.modules["torch"] + re-import now raise, as does retrying import torch after it failed. Re-running the module body was already unsafe in exactly the same way as the retry, so the new check does not distinguish the two. Normal use is unaffected: a successful import leaves torch in sys.modules so the body never re-runs, and re-entrant imports from a backend extension during autoload still short-circuit on sys.modules without reaching the check.

Version 2.14:
import importlib
import torch
importlib.reload(torch)
RuntimeError: Only a single TORCH_LIBRARY can be used to register the namespace triton; ...
(re-importing after a failed import torch failed with similarly misleading errors or could segfault)
Version 2.15:
import importlib
import torch
importlib.reload(torch)
</tr></table>

... (truncated)

Commits

31a77fc [release/2.15] Keep ruff targeting Python 3.10 until the 3.10 code is removed...
d0f2af8 [release/2.15] Raise the minimum Python to 3.11 in the package metadata (#202...
30c000d [release/2.15] Revert "[inductor] Prefetch Inductor cache keys at torch.compi...
4893744 [release/2.15] [c10d][nccl2] Make endCoalescing cover all ops in the window (...
469a3f4 [release/2.15][Windows] Remove the zlibwapi.dll install (#201873) (#201880)
e581e2d [release/2.15] [c10d][nccl2] Do not treat zero-sized output tensors as aliase...
ef10301 [release/2.15] Update xpu commit to revert kernel refactor introduced correct...
a3f1751 [inductor] Fix the prologue zero-mask analysis on low-precision rounding cast...
e47ff36 Ship top_level.txt in wheel dist-info (#201435)
5dc0495 Skip vectorized gather and scatter_add kernel for short rows (#201426)
Additional commits viewable in compare view

Updates torchaudio from 2.11.0 to 2.11.1

Release notes

Sourced from torchaudio's releases.

TorchAudio 2.11.1

This is a minor release with no new feature. It's compatible with PyTorch 2.11 and later.

Improvements

[packaging] Build a single py3-none wheel per platform, covering all supported CPython versions including free-threaded builds (#4224, #4234) [packaging] Declare the torch>=2.11 dependency in the wheel metadata. It was previously unset (#4225) [packaging] Add the Python 3.15 classifier and python_requires>=3.10 to the wheel metadata (#4240, #4224)

[Documentation] #4212 [Code quality] #4229, #4231, #4230, #4232, #4184, #4179

Bug Fixes

[CUDA] Only raise an error when torch and torchaudio were built with different CUDA major versions. Minor version mismatches are now allowed (#4226)

Commits

455331b [release/2.11.1] Add the Python 3.15 classifier to the wheel metadata (#4241)
26f10f6 Prepare for 2.11.1 release (#4236)
239dad8 [2.11.1] Cherry-pick: Build a single py3-none wheel per arch x accelerator va...
5f24fbb Build the docs on an OSDC runner (#4232)
45eaed8 Move the Linux test jobs to OSDC runners (#4230)
7a0abb4 Build the Linux wheels on OSDC runners (#4231)
245ccb4 Point the abi3 artifact pattern at 3.11 and fail loudly when it matches nothi...
b85c99c Build a single abi3 wheel instead of one per Python version (#4224)
c3d51c3 dont error on CUDA mismatch for minor version (#4226)
9c4849a set torch dep to torch>=2.11 (#4225)
Additional commits viewable in compare view

Updates laya-mlx from 0.4.0 to 0.6.0

Release notes

Sourced from laya-mlx's releases.

laya-mlx v0.6.0

What's Changed

feat: port upstream Laya v0.4.17 behavior to MLX by @Omicron0314 in mizorewww/laya-mlx#25

Fix typed batch grouping and hook timeout serialization by @JurhoRr in mizorewww/laya-mlx#26

New Contributors

@Omicron0314 made their first contribution in mizorewww/laya-mlx#25

@JurhoRr made their first contribution in mizorewww/laya-mlx#26

Full Changelog: mizorewww/laya-mlx@v0.5.0...v0.6.0

laya-mlx v0.5.0

0.5.0 — upstream v0.4.12 migration

This release aligns applicable host APIs with NandhaKishorM/laya ffc142012af63d015fa19f05f29f9c5ff329a2cc: batch and long-text inference, structured decisions, hooks, calibration, evaluation, Router, HTTP/MCP, and framework/tool integrations. Native execution and explicit unsupported backend boundaries are preserved.

Compatibility changes include upstream Router defaults, validation and output semantics. The LlamaIndex adapter supports the actual current BaseSelector and SingleSelection contracts. See MIGRATION_0_4.md for behavior and dependency details.

The 341-entry API audit and three-checkpoint FP32/FP16 numerical/stability campaign passed. The qualification report records unchanged applicable upstream assertions, real SDK HTTP checks, real optional-framework checks and clean-wheel inference. Package 0.5.0 changes version metadata relative to the recorded 0.4.0 development qualification builds; release gates verify the final distribution separately.

Performance comparisons use upstream PyTorch 2.14, matched FP32 and fixed inputs. MLX wins all 18 P50 comparisons in the final matrix. Core ML's alternating-order confirmation wins all 18 P50/P95/mean-throughput comparisons; the initial four sequential regressions are retained in the report. Core ML adaptive graph and shape caches trade more resident memory for lower warm-call latency. Cold calls, other hardware and arbitrary workloads are outside these finite guarantees.

See QUALIFICATION_0_4_12.md and UPSTREAM_0412_PROGRESS.json for raw evidence and limitations. Original historical benchmark and package receipts remain unchanged.

MLX preserves native precision, compilation, row batch limits and bounded question-prefix caching. Local-only model resolution is supported by Agent and Router; ordinary inference needs no PyTorch or Transformers.

Publication verified on 2026-10-20: GitHub Release and PyPI wheel/sdist hashes match, public wheel source matches the tag, and a public-index re 7438 install passe...
Description has been truncated

…pdates Bumps the python-minor group with 25 updates in the /fastapi_backend directory: | Package | From | To | | --- | --- | --- | | [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.10.0` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.2` | | [pypdf](https://github.com/py-pdf/pypdf) | `6.20.1` | `6.21.4` | | [markdown](https://github.com/Python-Markdown/markdown) | `3.11.1` | `3.11.2` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [funasr](https://github.com/modelscope/FunASR) | `1.4.16` | `1.4.18` | | [torch](https://github.com/pytorch/pytorch) | `2.14.1` | `2.15.0` | | [torchaudio](https://github.com/pytorch/audio) | `2.11.0` | `2.11.1` | | [laya-mlx](https://github.com/mizorewww/laya-mlx) | `0.4.0` | `0.6.0` | | [speechbrain](https://github.com/speechbrain/speechbrain) | `1.1.1` | `1.1.2` | | [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.31.0` | `1.31.1` | | [transformers](https://github.com/huggingface/transformers) | `5.19.0` | `5.22.1` | | [spacy](https://github.com/explosion/spaCy) | `3.8.16` | `3.8.18` | | [openshell](https://github.com/NVIDIA/OpenShell) | `0.1.4` | `0.1.6` | | [ddgs](https://github.com/deedy5/ddgs) | `9.16.0` | `9.16.1` | | [botocore](https://github.com/boto/botocore) | `1.43.113` | `1.43.123` | | [extract-msg](https://github.com/TeamMsgExtractor/msg-extractor) | `0.56.1` | `0.58.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.3` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` | | [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.16.0` | `3.17.0` | | [mypy](https://github.com/python/mypy) | `2.4.0` | `2.4.1` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` | | [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.7` | `9.8.0` | Updates `starlette` from 1.8.0 to 1.10.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.8.0...1.10.0) Updates `pydantic-settings` from 2.15.0 to 2.16.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.2) Updates `pypdf` from 6.20.1 to 6.21.4 - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.20.1...6.21.4) Updates `markdown` from 3.11.1 to 3.11.2 - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.11.1...3.11.2) Updates `opentelemetry-api` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `opentelemetry-sdk` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `opentelemetry-exporter-otlp-proto-http` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `funasr` from 1.4.16 to 1.4.18 - [Release notes](https://github.com/modelscope/FunASR/releases) - [Commits](modelscope/FunASR@v1.4.16...v1.4.18) Updates `torch` from 2.14.1 to 2.15.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.14.1...v2.15.0) Updates `torchaudio` from 2.11.0 to 2.11.1 - [Release notes](https://github.com/pytorch/audio/releases) - [Commits](pytorch/audio@v2.11.0...v2.11.1) Updates `laya-mlx` from 0.4.0 to 0 9798 .6.0 - [Release notes](https://github.com/mizorewww/laya-mlx/releases) - [Changelog](https://github.com/mizorewww/laya-mlx/blob/main/CHANGELOG.md) - [Commits](mizorewww/laya-mlx@v0.4.0...v0.6.0) Updates `speechbrain` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/speechbrain/speechbrain/releases) - [Commits](speechbrain/speechbrain@v1.1.1...v1.1.2) Updates `onnxruntime` from 1.31.0 to 1.31.1 - [Release notes](https://github.com/microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](microsoft/onnxruntime@v1.31.0...v1.31.1) Updates `transformers` from 5.19.0 to 5.22.1 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v5.19.0...v5.22.1) Updates `spacy` from 3.8.16 to 3.8.18 - [Release notes](https://github.com/explosion/spaCy/releases) - [Changelog](https://github.com/explosion/spaCy/blob/master/RELEASE_NOTES.md) - [Commits](explosion/spaCy@release-v3.8.16...release-v3.8.18) Updates `openshell` from 0.1.4 to 0.1.6 - [Release notes](https://github.com/NVIDIA/OpenShell/releases) - [Commits](NVIDIA/OpenShell@v0.1.4...v0.1.6) Updates `ddgs` from 9.16.0 to 9.16.1 - [Release notes](https://github.com/deedy5/ddgs/releases) - [Commits](deedy5/ddgs@v9.16.0...v9.16.1) Updates `botocore` from 1.43.113 to 1.43.123 - [Commits](boto/botocore@1.43.113...1.43.123) Updates `extract-msg` from 0.56.1 to 0.58.1 - [Release notes](https://github.com/TeamMsgExtractor/msg-extractor/releases) - [Changelog](https://github.com/TeamMsgExtractor/msg-extractor/blob/master/CHANGELOG.md) - [Commits](TeamMsgExtractor/msg-extractor@v0.56.1...v0.58.1) Updates `ruff` from 0.17.0 to 0.17.3 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.17.0...0.17.3) Updates `pytest` from 9.1.1 to 9.2.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.1...9.2.0) Updates `pytest-mock` from 3.16.0 to 3.17.0 - [Release notes](https://github.com/pytest-dev/pytest-mock/releases) - [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest-mock@v3.16.0...v3.17.0) Updates `mypy` from 2.4.0 to 2.4.1 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.4.0...v2.4.1) Updates `coverage` from 7.16.2 to 7.17.0 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.2...7.17.0) Updates `mkdocs-material` from 9.7.7 to 9.8.0 - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](squidfunk/mkdocs-material@9.7.7...9.8.0) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pydantic-settings dependency-version: 2.16.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pypdf dependency-version: 6.21.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: markdown dependency-version: 3.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-api dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-sdk dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-exporter-otlp-proto-http dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: funasr dependency-version: 1.4.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: torch dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: torchaudio dependency-version: 2.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: laya-mlx dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: speechbrain dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: onnxruntime dependency-version: 1.31.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: transformers dependency-version: 5.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: spacy dependency-version: 3.8.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: openshell dependency-version: 0.1.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: ddgs dependency-version: 9.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: botocore dependency-version: 1.43.123 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: extract-msg dependency-version: 0.58.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: ruff dependency-version: 0.17.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: pytest dependency-version: 9.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pytest-mock dependency-version: 3.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: mypy dependency-version: 2.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: coverage dependency-version: 7.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: mkdocs-material dependency-version: 9.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-05T07:58:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 4, 2026

dependabot Bot closed this Nov 5, 2026

dependabot Bot deleted the dependabot/uv/fastapi_backend/python-minor-011cb43b44 branch November 5, 2026 07:58

Navigation Menu

Repository navigation

build(deps): bump the python-minor group across 1 directory with 25 updates - #719

build(deps): bump the python-minor group across 1 directory with 25 updates#719
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/python-minor-011cb43b44

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

Uh oh!

Version 1.10.0

📝 Leaner URL-encoded form parsing

⚠️ Behaviour changes

🧭 Routing and URL generation

🛡️ Middleware, responses and config

Version 1.9.0

Changed

Fixed

1.10.0 (October 24, 2026)

Changed

Deprecated

Fixed

1.9.0 (October 18, 2026)

Changed

Fixed

v2.16.1

Highlights

Bug fixes

What's Changed

v2.16.0

Highlights

Breaking changes and behavior changes

New features

Bug fixes

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Documentation (DOC)

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

Performance Improvements (PI)

Bug Fixes (BUG)

Documentation (DOC)

Developer Experience (DEV)

Maintenance (MAINT)

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

Version 6.21.4, 2026-10-28

Security (SEC)

Documentation (DOC)

Version 6.21.3, 2026-10-27

Security (SEC)

Performance Improvements (PI)

Bug Fixes (BUG)

Documentation (DOC)

Developer Experience (DEV)

Maintenance (MAINT)

Version 6.21.2, 2026-10-21

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Release 3.11.2

Fixed

[3.11.2] - 2026-10-19

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

PyTorch 2.15.0 Release Notes

Highlights

`import torch` can no longer be re-executed in the same process, including via `importlib.reload(torch)` (#194654)