build(deps): bump the python-minor group across 1 directory with 25 updates by dependabot[bot] · Pull Request #724 · adeelahmad/lense

dependabot · 2026-11-05T08:00:14Z

Bumps the python-minor group with 25 updates in the /fastapi_backend directory:

Package	From	To
starlette	`1.8.0`	`1.10.0`
pydantic-settings	`2.15.0`	`2.16.2`
markdown	`3.11.1`	`3.11.2`
opentelemetry-api	`1.45.1`	`1.45.2`
opentelemetry-sdk	`1.45.1`	`1.45.2`
opentelemetry-exporter-otlp-proto-http	`1.45.1`	`1.45.2`
funasr	`1.4.16`	`1.4.19`
torch	`2.14.1`	`2.15.0`
torchaudio	`2.11.0`	`2.11.1`
laya-mlx	`0.4.0`	`0.6.0`
speechbrain	`1.1.1`	`1.1.2`
onnxruntime	`1.31.0`	`1.31.1`
transformers	`5.19.0`	`5.22.1`
spacy	`3.8.16`	`3.8.18`
openshell	`0.1.4`	`0.1.6`
ddgs	`9.16.0`	`9.16.1`
botocore	`1.43.113`	`1.43.123`
extract-msg	`0.56.1`	`0.58.1`
paramiko	`5.0.0`	`5.1.0`
ruff	`0.17.0`	`0.17.3`
pytest	`9.1.1`	`9.2.0`
pytest-mock	`3.16.0`	`3.17.0`
mypy	`2.4.0`	`2.4.1`
coverage	`7.16.2`	`7.17.0`
mkdocs-material	`9.7.7`	`9.8.0`

Updates starlette from 1.8.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.
uv pip install starlette==1.10.0
Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.

The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.

FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.

starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.

Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.

WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.

FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.

Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.

FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.

Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.

Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.

Compare Match members by identity during routing #3665 and #3722.

Deprecated

Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.

Keep path parameter values that look like another placeholder in url_path_for() #3725.

Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.

Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.

Strip only one pair of matching outer quotes from Config env file values #3720.

Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.

Report NaN and infinity correctly in FloatConvertor.to_string() #3716.

Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

8aa828c Version 1.10.0 (#3728)
a85a5c3 Substitute URL path parameters in a single pass (#3725)
6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
b973efd Build URL-encoded form fields in parser callbacks (#3724)
d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
fb3e818 Compare remaining Match members by identity in routing (#3722)
fc23aa1 Compare Match members by identity in Router.app (#3665)
fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
4114432 Default omitted http.response.start headers in middlewares (#3721)
1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.

A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Harden CI by @Viicos in pydantic/pydantic-settings#1044

Keep list of dicts CLI values as lists by @hramezani in pydantic/pydantic-settings#1049

Keep fixed-length tuple CLI positionals single-valued by @hramezani in pydantic/pydantic-settings#1069

Prepare release 2.16.1 by @hramezani in pydantic/pydantic-settings#1087

build(deps): bump the python-packages group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.

python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.

Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.

validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.

CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).

JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.

Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.

Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.

AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.

env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.

CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits

94150a0 Prepare release 2.16.2 (#1111)
9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
2d1f924 Fix explicit nested secrets directory precedence (#1093)
e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
e71a53e Decode nested dictionary values with complex union types (#1089)
8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
c50c853 Detect nested Field discriminators in default partial updates (#1076)
9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
4e286e2 Prepare release 2.16.1 (#1087)
Additional commits viewable in compare view

Updates markdown from 3.11.1 to 3.11.2

Release notes

Sourced from markdown's releases.

Release 3.11.2

Fixed

Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).

For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Changelog

Sourced from markdown's changelog.

[3.11.2] - 2026-10-19

Fixed

Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).

For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Commits

b41e0aa Bump version to 3.11.2
934c53e Add checklist of parts to PR template
2249ffd Update AI Policy
a27428b Sanitize attribute names in fenced_code and legacy_attrs
90cdcf5 Add fixed category to changelog
97233ef Revert enforcement of CommonMark punctuation rules
See full diff in compare view

Updates opentelemetry-api from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates opentelemetry-sdk from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-sdk's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates opentelemetry-exporter-otlp-proto-http from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-exporter-otlp-proto-http's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-exporter-otlp-proto-http's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
See full diff in compare view

Updates funasr from 1.4.16 to 1.4.19

Commits

3473641 Release FunASR 1.4.19 (#3811)
7e6e16c chore(release): prepare FunASR 1.4.19
3808562 fix(realtime): validate and forward vLLM HF overrides (#3810)
73ae515 fix(realtime): validate and forward vLLM HF overrides
a367557 fix(auto): integrate configurable automatic speaker cap (#3809)
07799cd fix(auto): integrate configurable automatic speaker cap
8dfa6ed fix(onnx): integrate empty split-final result handling (#3808)
643e817 fix(onnx): integrate empty split-final result handling
e867d28 fix(onnx): preserve zero-length streaming overlap cache (#3790)
0afd566 ci: exercise Paraformer empty-token batch regressions (#3807)
Additional commits viewable in compare view

Updates torch from 2.14.1 to 2.15.0

Release notes

Sourced from torch's releases.

PyTorch 2.15.0 Release Notes

Highlights

Backwards Incompatible Changes

Deprecations

New Features

Improvements

Bug fixes

Performance

Documentation

Security

Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Python Frontend

import torch can no longer be re-executed in the same process, including via importlib.reload(torch) (#194654)

importlib.reload(torch) and del sys.modules["torch"] + re-import now raise, as does retrying import torch after it failed. Re-running the module body was already unsafe in exactly the same way as the retry, so the new check does not distinguish the two. Normal use is unaffected: a successful import leaves torch in sys.modules so the body never re-runs, and re-entrant imports from a backend extension during autoload still short-circuit on sys.modules without reaching the check.

Version 2.14:
import importlib
import torch
importlib.reload(torch)
RuntimeError: Only a single TORCH_LIBRARY can be used to register the namespace triton; ...
(re-importing after a failed import torch failed with similarly misleading errors or could segfault)
Version 2.15:
import importlib
import torch
importlib.reload(torch)
</tr></table>

... (truncated)

Commits

31a77fc [release/2.15] Keep ruff targeting Python 3.10 until the 3.10 code is removed...
d0f2af8 [release/2.15] Raise the minimum Python to 3.11 in the package metadata (#202...
30c000d [release/2.15] Revert "[inductor] Prefetch Inductor cache keys at torch.compi...
4893744 [release/2.15] [c10d][nccl2] Make endCoalescing cover all ops in the window (...
469a3f4 [release/2.15][Windows] Remove the zlibwapi.dll install (#201873) (#201880)
e581e2d [release/2.15] [c10d][nccl2] Do not treat zero-sized output tensors as aliase...
ef10301 [release/2.15] Update xpu commit to revert kernel refactor introduced correct...
a3f1751 [inductor] Fix the prologue zero-mask analysis on low-precision rounding cast...
e47ff36 Ship top_level.txt in wheel dist-info (#201435)
5dc0495 Skip vectorized gather and scatter_add kernel for short rows (#201426)
Additional commits viewable in compare view

Updates torchaudio from 2.11.0 to 2.11.1

Release notes

Sourced from torchaudio's releases.

TorchAudio 2.11.1

This is a minor release with no new feature. It's compatible with PyTorch 2.11 and later.

Improvements

[packaging] Build a single py3-none wheel per platform, covering all supported CPython versions including free-threaded builds (#4224, #4234) [packaging] Declare the torch>=2.11 dependency in the wheel metadata. It was previously unset (#4225) [packaging] Add the Python 3.15 classifier and python_requires>=3.10 to the wheel metadata (#4240, #4224)

[Documentation] #4212 [Code quality] #4229, #4231, #4230, #4232, #4184, #4179

Bug Fixes

[CUDA] Only raise an error when torch and torchaudio were built with different CUDA major versions. Minor version mismatches are now allowed (#4226)

Commits

455331b [release/2.11.1] Add the Python 3.15 classifier to the wheel metadata (#4241)
26f10f6 Prepare for 2.11.1 release (#4236)
239dad8 [2.11.1] Cherry-pick: Build a single py3-none wheel per arch x accelerator va...
5f24fbb Build the docs on an OSDC runner (#4232)
45eaed8 Move the Linux test jobs to OSDC runners (#4230)
7a0abb4 Build the Linux wheels on OSDC runners (#4231)
245ccb4 Point the abi3 artifact pattern at 3.11 and fail loudly when it matches nothi...
b85c99c Build a single abi3 wheel instead of one per Python version (#4224)
c3d51c3 dont error on CUDA mismatch for minor version (#4226)
9c4849a set torch dep to torch>=2.11 (#4225)
Additional commits viewable in compare view

Updates laya-mlx from 0.4.0 to 0.6.0

Release notes

Sourced from laya-mlx's releases.

laya-mlx v0.6.0

What's Changed

feat: port upstream Laya v0.4.17 behavior to MLX by @Omicron0314 in mizorewww/laya-mlx#25

Fix typed batch grouping and hook timeout serialization by @JurhoRr in mizorewww/laya-mlx#26

New Contributors

@Omicron0314 made their first contribution in mizorewww/laya-mlx#25

@JurhoRr made their first contribution in mizorewww/laya-mlx#26

Full Changelog: mizorewww/laya-mlx@v0.5.0...v0.6.0

laya-mlx v0.5.0

0.5.0 — upstream v0.4.12 migration

This release aligns applicable host APIs with NandhaKishorM/laya ffc142012af63d015fa19f05f29f9c5ff329a2cc: batch and long-text inference, structured decisions, hooks, calibration, evaluation, Router, HTTP/MCP, and framework/tool integrations. Native execution and explicit unsupported backend boundaries are preserved.

Compatibility changes include upstream Router defaults, validation and output semantics. The LlamaIndex adapter supports the actual current BaseSelector and SingleSelection contracts. See MIGRATION_0_4.md for behavior and dependency details.

The 341-entry API audit and three-checkpoint FP32/FP16 numerical/stability campaign passed. The qualification report records unchanged applicable upstream assertions, real SDK HTTP checks, real optional-framework checks and clean-wheel inference. Package 0.5.0 changes version metadata relative to the recorded 0.4.0 development qualification builds; release gates verify the final distribution separately.

Performance comparisons use upstream PyTorch 2.14, matched FP32 and fixed inputs. MLX wins all 18 P50 comparisons in the final matrix. Core ML's alternating-order confirmation wins all 18 P50/P95/mean-throughput comparisons; the initial four sequential regressions are retained in the report. Core ML adaptive graph and shape caches trade more resident memory for lower warm-call latency. Cold calls, other hardware and arbitrary workloads are outside these finite guarantees.

See QUALIFICATION_0_4_12.md and UPSTREAM_0412_PROGRESS.json for raw evidence and limitations. Original historical benchmark and package receipts remain unchanged.

MLX preserves native precision, compilation, row batch limits and bounded question-prefix caching. Local-only model resolution is supported by Agent and Router; ordinary inference needs no PyTorch or Transformers.

Publication verified on 2026-10-20: GitHub Release and PyPI wheel/sdist hashes match, public wheel source matches the tag, and a public-index reinstall passes all three offline real-model checks. See benchmarks/results/release-v050.json.

Post-release CI runs exposed intermittent failures in the unchanged upstream idle-window timing test. Running host contracts before native model tests in a separate process passed one complete CI, but a subsequent run reproduced the timing failure; isolation has not eliminated it. No runtime, assertion or timeout was changed. Failure diagnostics also run the original upstream idle-window tests for comparison. CI evidence.

The original pinned upstream suite reproduced the same idle-window failure on the same CI runner; all 254 native/integration tests passed. This timing instability remains documented in CI evidence.

Changelog

Sourced from laya-mlx's changelog.

0.6.0 — 2026-10-29

Follows upstream v0.4.17 (fe9a6c35). Migration record.

Language routing: detect_language(..., explain=True) reports why a language was chosen; updated Unicode script lookup and English/Vietnamese detection fixes.

Long documents: answer attribution survives end hooks that reorder results; missing answers raise, and replaced or edited answers carry no misleading window attribution.

Stricter validation (may raise where 0.5.0 accepted input): reliability calibration precision, malformed integration responses, evaluation cardinality and metric checks, confidence overflow and digest paths.

HTTP and CLI: request-body deadlines, batch token budgets, configurable remote User-Agent, BOM-aware input files; the CLI reports read/encoding/JSON errors before loading a model.

Fix: predict_batch no longer groups integer or boolean keys with their string equivalents (1 vs "1"), which returned the wrong key types for later requests.

Fix: with hooks_concurrent=False, a timed-out hook keeps the serialization lock until it exits, and a hook whose deadline passes while waiting is never called.

Linux host-only CI job; the real-checkpoint validation harness targets v0.4.17.

Validation: 63/63 fixtures for all three checkpoints in FP32 and FP16 against the v0.4.17 reference, 100 stable calls each. Performance figures were not re-measured for this release.

0.5.0 — 2026-10-20

Follows upstream v0.4.12 (ffc14201). Release notes · migration · qualification.

Batch and long-text inference, structured decisions, hooks, calibration, evaluation, HTTP/MCP serving and LangChain/LlamaIndex/CrewAI/Agno integrations.

Router() keeps two models resident by default (max_loaded=1 restores the old limit).

Scalar choice labels are accepted; invalid requests use upstream error types and messages.

Commits

2159c6c ci: run parallel-layout native tests in their own process
751d01e docs: use descriptive criteria in the Quick start
a477ce4 Release 0.6.0
9e99267 docs: restructure README into a user-facing funnel
9f26cb2 Merge pull request #26 from JurhoRr/fix/batch-key-types-hook-serialization
eecb429 Merge main into fix/batch-key-types-hook-serialization
04a32b9 Merge pull request #25 from Omicron0314/port/upstream-v0.4.17
f12eff8 benchmarks: pin reference upstream to v0.4.17
354ab90 Fix typed batch grouping and hook timeout serialization
54e3277 docs: record successful Linux and macOS migration CI
Additional commits viewable in compare view

Updates speechbrain from 1.1.1 to 1.1.2

Release notes

Sourced from speechbrain's releases.

v1.1.2

Notable changes

Minimum version of the torch and torchaudio dependencies are now 2.7.1 for better device management, see #3099 and #3080

A regression in training time due to the speed perturb augmentation was fixed (gianfranco) #3100

A regression in packaging added several irrelevant modules to the pypi artifacts, this has been fixed (Kayvan Zahiri) #3088

Bug Fixes

use parametrizations.weight_norm to silence deprecation warning (li-lizhe) #3087

transformer: enforce max_len in make_transformer_src_tgt_masks (Luchang Jiang) #3086

Fix fetch() returning a missing path with COPY_SKIP_CACHE and save_filename (sungbin1015) #3093

Fix get_all_files dropping files listed after an exclude_and match (sungbin1015) #3101

Fix TextEncoder.limited_labelset_from_iterable ignoring n_most_common and min_count (sungbin1015) #3095

Documentation

clarify channelwise behavior of CumulativeLayerNorm #3105

New Contributors

@li-lizhe made their first contribution in speechbrain/speechbrain#3080

@sungbin1015 made their first contribution in speechbrain/speechbrain#3093

@Kayvan-Zahiri made their first contribution in speechbrain/speechbrain#3088

@FinalSunFlower made their first contribution in speechbrain/speechbrain#3086

@j45856021-dev made their first contribution in speechbrain/speechbrain#3105

Full Changelog: speechbrain/speechbrain@v1.1.1...v1.1.2

Commits

c024127 Bump version
9b768a5 docs: clarify channelwise behavior of CumulativeLayerNorm (#3105)
dadd2d6 Fix LJSpeech HiFiGAN recipes failing at epoch 2 with ParametrizedConv1d wei...
ec3ac37 fix(transformer): enforce max_len in make_transformer_src_tgt_masks (#3086)
d2bf7b7 chore: remove the usage of old weight_norm (

…pdates Bumps the python-minor group with 25 updates in the /fastapi_backend directory: | Package | From | To | | --- | --- | --- | | [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.10.0` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.2` | | [markdown](https://github.com/Python-Markdown/markdown) | `3.11.1` | `3.11.2` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.45.1` | `1.45.2` | | [funasr](https://github.com/modelscope/FunASR) | `1.4.16` | `1.4.19` | | [torch](https://github.com/pytorch/pytorch) | `2.14.1` | `2.15.0` | | [torchaudio](https://github.com/pytorch/audio) | `2.11.0` | `2.11.1` | | [laya-mlx](https://github.com/mizorewww/laya-mlx) | `0.4.0` | `0.6.0` | | [speechbrain](https://github.com/speechbrain/speechbrain) | `1.1.1` | `1.1.2` | | [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.31.0` | `1.31.1` | | [transformers](https://github.com/huggingface/transformers) | `5.19.0` | `5.22.1` | | [spacy](https://github.com/explosion/spaCy) | `3.8.16` | `3.8.18` | | [openshell](https://github.com/NVIDIA/OpenShell) | `0.1.4` | `0.1.6` | | [ddgs](https://github.com/deedy5/ddgs) | `9.16.0` | `9.16.1` | | [botocore](https://github.com/boto/botocore) | `1.43.113` | `1.43.123` | | [extract-msg](https://github.com/TeamMsgExtractor/msg-extractor) | `0.56.1` | `0.58.1` | | [paramiko](https://github.com/paramiko/paramiko) | `5.0.0` | `5.1.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.3` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` | | [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.16.0` | `3.17.0` | | [mypy](https://github.com/python/mypy) | `2.4.0` | `2.4.1` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` | | [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.7` | `9.8.0` | Updates `starlette` from 1.8.0 to 1.10.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.8.0...1.10.0) Updates `pydantic-settings` from 2.15.0 to 2.16.2 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.2) Updates `markdown` from 3.11.1 to 3.11.2 - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.11.1...3.11.2) Updates `opentelemetry-api` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `opentelemetry-sdk` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `opentelemetry-exporter-otlp-proto-http` from 1.45.1 to 1.45.2 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) Updates `funasr` from 1.4.16 to 1.4.19 - [Release notes](https://github.com/modelscope/FunASR/releases) - [Commits](modelscope/FunASR@v1.4.16...v1.4.19) Updates `torch` from 2.14.1 to 2.15.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.14.1...v2.15.0) Updates `torchaudio` from 2.11.0 to 2.11.1 - [Release notes](https://github.com/pytorch/audio/releases) - [Commits](pytorch/audio@v2.11.0...v2.11.1) Updates `laya-mlx` from 0.4.0 to 0.6.0 - [Release notes](https://github.com/mizorewww/laya-mlx/releases) - [Changelog](https://github.com/mizorewww/laya-mlx/blob/main/CHANGELOG.md) - [Commits](mizorewww/laya-mlx@v0.4.0...v0.6.0) Updates `speechbrain` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/speechbrain/speechbrain/releases) - [Commits](speechbrain/speechbrain@v1.1.1...v1.1.2) Updates `onnxruntime` from 1.31.0 to 1.31.1 - [Release notes](https://github.com/microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](microsoft/onnxruntime@v1.31.0...v1.31.1) Updates `transformers` from 5.19.0 to 5.22.1 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v5.19.0...v5.22.1) Updates `spacy` from 3.8.16 to 3.8.18 - [Release notes](https://github.com/explosion/spaCy/releases) - [Changelog](https://github.com/explosion/spaCy/blob/master/RELEASE_NOTES.md) - [Commits](explosion/spaCy@release-v3.8.16...release-v3.8.18) Updates `openshell` from 0.1.4 to 0.1.6 - [Release notes](https://github.com/NVIDIA/OpenShell/releases) - [Commits](NVIDIA/OpenShell@v0.1.4...v0.1.6) Updates `ddgs` from 9.16.0 to 9.16.1 - [Release notes](https://github.com/deedy5/ddgs/releases) - [Commits](deedy5/ddgs@v9.16.0...v9.16.1) Updates `botocore` from 1.43.113 to 1.43.123 - [Commits](boto/botocore@1.43.113...1.43.123) Updates `extract-msg` from 0.56.1 to 0.58.1 - [Release notes](https://github.com/TeamMsgExtractor/msg-extractor/releases) - [Changelog](https://github.com/TeamMsgExtractor/msg-extractor/blob/master/CHANGELOG.md) - [Commits](TeamMsgExtractor/msg-extractor@v0.56.1...v0.58.1) Updates `paramiko` from 5.0.0 to 5.1.0 - [Commits](paramiko/paramiko@5.0.0...5.1.0) Updates `ruff` from 0.17.0 to 0.17.3 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.17.0...0.17.3) Updates `pytest` from 9.1.1 to 9.2.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.1...9.2.0) Updates `pytest-mock` from 3. 8BD0 16.0 to 3.17.0 - [Release notes](https://github.com/pytest-dev/pytest-mock/releases) - [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest-mock@v3.16.0...v3.17.0) Updates `mypy` from 2.4.0 to 2.4.1 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.4.0...v2.4.1) Updates `coverage` from 7.16.2 to 7.17.0 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.2...7.17.0) Updates `mkdocs-material` from 9.7.7 to 9.8.0 - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](squidfunk/mkdocs-material@9.7.7...9.8.0) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pydantic-settings dependency-version: 2.16.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: markdown dependency-version: 3.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-api dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-sdk dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: opentelemetry-exporter-otlp-proto-http dependency-version: 1.45.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: funasr dependency-version: 1.4.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: torch dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: torchaudio dependency-version: 2.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: laya-mlx dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: speechbrain dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: onnxruntime dependency-version: 1.31.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: transformers dependency-version: 5.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: spacy dependency-version: 3.8.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: openshell dependency-version: 0.1.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: ddgs dependency-version: 9.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: botocore dependency-version: 1.43.123 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: extract-msg dependency-version: 0.58.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: paramiko dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: ruff dependency-version: 0.17.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: pytest dependency-version: 9.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: pytest-mock dependency-version: 3.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: mypy dependency-version: 2.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor - dependency-name: coverage dependency-version: 7.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: mkdocs-material dependency-version: 9.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 5, 2026

Navigation Menu

Repository navigation

build(deps): bump the python-minor group across 1 directory with 25 updates - #724

build(deps): bump the python-minor group across 1 directory with 25 updates#724
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/python-minor-9fadb89113

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

Version 1.10.0

📝 Leaner URL-encoded form parsing

⚠️ Behaviour changes

🧭 Routing and URL generation

🛡️ Middleware, responses and config

Version 1.9.0

Changed

Fixed

1.10.0 (October 24, 2026)

Changed

Deprecated

Fixed

1.9.0 (October 18, 2026)

Changed

Fixed

v2.16.1

Highlights

Bug fixes

What's Changed

v2.16.0

Highlights

Breaking changes and behavior changes

New features

Bug fixes

Release 3.11.2

Fixed

[3.11.2] - 2026-10-19

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

Version 1.45.2/0.66b2

Added

Fixed

Version 1.45.2/0.66b2 (2026-10-29)

Added

Fixed

PyTorch 2.15.0 Release Notes

Highlights

Backwards Incompatible Changes

Python Frontend

import torch can no longer be re-executed in the same process, including via importlib.reload(torch) (#194654)

TorchAudio 2.11.1

Improvements

Bug Fixes

laya-mlx v0.6.0

What's Changed

New Contributors

laya-mlx v0.5.0

0.5.0 — upstream v0.4.12 migration

0.6.0 — 2026-10-29

0.5.0 — 2026-10-20

v1.1.2

Notable changes

Bug Fixes

Documentation

New Contributors

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`import torch` can no longer be re-executed in the same process, including via `importlib.reload(torch)` (#194654)