Skip to content

chore(deps):(deps): bump the uv group with 11 updates - #6442

Merged
daggerstuff merged 1 commit into
stagingfrom
dependabot/uv/uv-0b3ac28e25
Oct 30, 2026
Merged

chore(deps):(deps): bump the uv group with 11 updates#6442
daggerstuff merged 1 commit into
stagingfrom
dependabot/uv/uv-0b3ac28e25

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 11 updates:

Package From To
spacy 3.8.16 3.8.18
huggingface-hub 1.33.0 2.3.0
transformers 5.20.2 5.21.0
openai 3.37.0 3.39.0
fastmcp 4.1.3 4.1.4
boto3 1.43.118 1.43.119
semgrep 1.79.0 1.182.1
nemoguardrails 0.24.1 0.22.0
ruff 0.17.2 0.17.3
hypothesis 6.170.11 6.170.12
pip-audit 2.9.0 2.10.1

Updates spacy from 3.8.16 to 3.8.18

Commits
  • 4331199 Set version to v3.8.18
  • 2b5f28d Fix spacy.CharEmbed.v1 registration and require Python 3.10
  • f0b029c Drop pip-based before-build step from cibuildwheel config
  • cdeae95 Require weasel>=1.0.1 and confection>=1.3.4
  • 14436a0 Exclude preshed 3.0.14
  • c33f6e6 Support Python 3.15, release v3.8.17
  • 6d51b88 Merge pull request #14054 from explosion/deps/spacy-transformers-2.0
  • a261327 Allow spacy-transformers v1.4.x and v2.0.x in transformers extra
  • c2dabfc Fix memory leak when adding an existing morph from a dict (#14041)
  • See full diff in compare view

Updates huggingface-hub from 1.33.0 to 2.3.0

Release notes

Sourced from huggingface-hub's releases.

[v2.3.0] Bucket live-follow, faster HfFileSystem listings and more

🔄 Keep Bucket listings fresh with live_follow=True

HfFileSystem caches directory listings, so files added to a Bucket by another process did not show up until you called invalidate_cache(). With live_follow=True, HfFileSystem opens one background connection per listed Bucket to receive its file changes from the Hub. When a change arrives, it removes the cached listings it affects.

>>> from huggingface_hub import HfFileSystem
>>> hffs = HfFileSystem(live_follow=True)
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # starts following that bucket
>>> # ... another process uploads a file to the bucket ...
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # refreshed as changes arrive
['buckets/my-username/my-bucket/data/train.csv', 'buckets/my-username/my-bucket/data/new-file.csv']

It also works through fsspec with fsspec.filesystem("hf", live_follow=True), and through the storage_options argument of libraries such as pandas and pyarrow. The option is off by default because it keeps a connection open for each followed Bucket. It only affects listings and metadata (ls, info, exists, glob, ...), because reading a file always fetches its content from the Hub. It is not available for model, dataset and Space repos: use refresh=True to see a new commit.

🚀 HfFileSystem lists large repos in parallel

Recursive listings such as find and glob used to be slow on large repos. The Hub returns a repo's file tree 1000 entries at a time, and each page can only be requested after the previous one has arrived. Listing datasets/allenai/objaverse (~800k files) took ~800 requests in a row, about 13 minutes.

HfFileSystem now splits recursive listings by sub-directory and lists them in parallel, with almost the same number of requests. A sub-tree that fits in a single page is never split. maxdepth is now applied during the listing, so the Hub only returns the levels you ask for.

datasets/allenai/objaverse before after
find(), 798,924 files 801 requests, 776 s 807 requests, 19.7 s
find(maxdepth=2), 328 entries 801 requests, 776 s 6 requests, 1.5 s 
>>> from huggingface_hub import hffs
>>> files = hffs.glob("datasets/allenai/objaverse/**/*.glb", maxdepth=3)

The new max_workers argument of HfFileSystem sets the number of concurrent requests. It defaults to 16. Set it to 1 to list sequentially like before.

📎 Attach images and videos to discussions and PRs

The new HfApi.upload_attachment(path) uploads an image, video or audio file and returns its URL, which you can embed in a discussion, PR description or comment. Before, this required calling an undocumented Hub endpoint by hand.

>>> from huggingface_hub import HfApi
>>> api = HfApi()
>>> url = api.upload_attachment("screenshot.png")
>>> api.comment_discussion("username/repo-name", 5, f"Here is the fix:\n\n![screenshot](https://github.com/huggingface/huggingface_hub/blob/HEAD/{url})")

... (truncated)

Commits
  • 587e09a Release: v2.3.0
  • ac4a5f0 Release: v2.3.0.rc1
  • 64e9850 [HfFileSystem] Fix glob crash when the parent listing is outdated (#5237)
  • b1066db Release: v2.3.0.rc0
  • 0c7fd06 [HfApi] Support gated repos hiding requester username/email (#5047)
  • c629fa3 [Jobs] Fix hf jobs run losing logs and ignoring Ctrl+C (#5162)
  • 7858680 [HfFileSystem] List large repos in parallel (#5153)
  • 75fbd6d fix(kernels): allow uploads and commits to kernel repos (#5233)
  • e1f595d [CLI] Show the Job's scheduling status in hf jobs run (#5163)
  • d03a05c Bump the actions group with 3 updates (#5228)
  • Additional commits viewable in compare view

Updates transformers from 5.20.2 to 5.21.0

Release notes

Sourced from transformers's releases.

Release: v5.21.0

Release v5.21.0

New Model additions

MiniCPM-OCR

MiniCPM-OCR is a document-understanding model from OpenBMB's MiniCPM-V family. It keeps the MiniCPM-V 4.6 architecture, which pairs a SigLIP vision encoder and a window-attention merger with a Qwen3.5 language model. It is specialized for reading text-dense images such as scanned pages, screenshots, receipts and tables.

Links: Documentation | Paper

Flint

Flint is Recursive's mixture-of-experts language model. Compared to a standard SwiGLU MoE transformer such as Qwen3-MoE, it uses hybrid attention (sliding-window attention with rotary embeddings over the current token and the previous 512 tokens in most layers, and full attention without positional encoding in the remaining layers). It also has learned attention sinks, as in GPT-OSS, with per-head RMS-normalized queries and keys. Each sparse layer routes a token to 6 of 256 experts by sigmoid score and adds an ungated shared expert, and the first two layers are dense.

Links: Documentation

UltraVBert

UltraVBert extends ModernVBert by pairing the UltraBERT text encoder with a SigLIP vision encoder for visual document understanding and retrieval. Its image processor splits each page into 512-pixel tiles plus a global view. The connector merges each 4 x 4 block of vision patches into one token, so a tile becomes 64 image tokens, and RMS-normalizes them to the scale of UltraBERT's token embeddings. The max_image_tiles setting (27 by default) caps the number of tiles per page.

Links: Documentation

Gradium Phonon TTS

Gradium Phonon TTS is Gradium's family of on-device text-to-speech models, trained with the Pocket TTS recipe. A causal transformer reads a voice prompt and the text, then emits one continuous 32-dimensional audio latent per step at 12.5 Hz through a one-step flow head, and an end-of-speech head decides when the utterance ends. The latents are decoded to 24 kHz audio by a Pocket TTS audio tokenizer. Unlike Pocket TTS, voice conditioning uses 512-dimensional latents from a separate, unreleased speaker codec, so voices come as precomputed latents and cannot be cloned from a recording.

Links: Documentation

Pocket TTS

Pocket TTS is Kyutai's 100M-parameter text-to-speech model, built as a Continuous Audio Language Model that runs faster than real time on CPU. A causal transformer emits one continuous audio latent per frame (12.5 Hz) through a one-step flow head, and an end-of-speech head decides when to stop. A Mimi-based audio tokenizer encodes voice prompts and decodes the generated latents to 24 kHz audio. Two flow heads are released, Lagrangian self-distillation (default) and drifting, and voices can be cloned from a recording, passed as precomputed latents, or loaded from cached KV states.

Links: Documentation | [Paper](https://huggingface.co/papers/2509.06926 (the Continuous Audio Language Models paper, arXiv 2509.06926). It is the only paper the documentation links, and it describes the architecture family Pocket TTS belongs to. The docs do not cite a separate Pocket TTS technical report.) | [Blog Post](NONE. The documentation links no official blog post. It points only to the original code repository at https://github.com/kyutai-labs/pocket-tts.)

Pocket TTS Audio Tokenizer

The Pocket TTS audio tokenizer is the codec used by Pocket TTS. It has Mimi's architecture (SEANet convolutions plus a small causal transformer on each side), but its residual vector quantizer is replaced by a continuous 32-dimensional bottleneck, the VAE-GAN from Continuous Audio Language Models. It converts 24 kHz audio into latents at 12.5 Hz and decodes them back to audio. It serves as the audio_tokenizer of PocketTTSProcessor, encoding voice prompts and decoding generated latents, and its encoder and decoder can also be loaded on their own.

Links: Documentation | Paper

... (truncated)

Commits
  • dded62b Release: v5.21
  • 6c5f8f4 [Fix] Fix CSM codebook embedding tying (#49197)
  • b41ca9c [FA] Fix FA with static cache (#49998)
  • 2e12b32 [tests_fetcher] fix missing .as_posix() in preprocessor_patterns path keys (#...
  • fadef79 fix(ci): skip bot suggestion if a maintainer already posted run-slow: (#49992)
  • d0103c9 [loading] Allow Renaming and Converter to work on the sume subkeys (#49928)
  • 7725fb8 [Fix] Fix NUMA and cpuset detection in CB (#49980)
  • 2711ad2 [Refactor] Make CB utils depend on no CB import (#49968)
  • c9b377c Composite transparency in shared RGB conversion and image processors (#49079)
  • b3d3a61 fix: prevent empty frame sampling for short videos (#49908)
  • Additional commits viewable in compare view

Updates openai from 3.37.0 to 3.39.0

Release notes

Sourced from openai's releases.

v3.39.0

3.39.0 (2026-10-26)

Features

v3.38.0

3.38.0 (2026-10-25)

Features

  • api: add delegation controls and prompt cache lifetimes (#4169) (43045fc)
  • api: expand Live Decision item and question types (#4175) (5d72315)

Bug Fixes

  • agents: clarify result schema warnings (#4165) (cfa0a79)
  • format API status errors using the server message (#4161) (6ce5f05)
  • preserve fallback parsing for PEP 604 unions (#4160) (05dfea0)
  • responses: resolve function arguments within their namespace (#4166) (81792ff)
  • responses: validate tool namespaces before runner dispatch (#4167) (56a55f2)

Chores

  • api: preserve client and resource compatibility (#4157) (56f33a1)
  • enforce zero custom code in generated Python files (#4168) (d622f28)
Changelog

Sourced from openai's changelog.

3.39.0 (2026-10-26)

Features

3.38.0 (2026-10-25)

Features

  • api: add delegation controls and prompt cache lifetimes (#4169) (43045fc)
  • api: expand Live Decision item and question types (#4175) (5d72315)

Bug Fixes

  • agents: clarify result schema warnings (#4165) (cfa0a79)
  • format API status errors using the server message (#4161) (6ce5f05)
  • preserve fallback parsing for PEP 604 unions (#4160) (05dfea0)
  • responses: resolve function arguments within their namespace (#4166) (81792ff)
  • responses: validate tool namespaces before runner dispatch (#4167) (56a55f2)

Chores

  • api: preserve client and resource compatibility (#4157) (56f33a1)
  • enforce zero custom code in generated Python files (#4168) (d622f28)
Commits
  • f97798b release: 3.39.0 (#4181)
  • e8beb1a feat(api): add gpt-6.1-terra model identifier (#4180)
  • c22202e test: remove duplicate client tests and fix base URL coverage (#4170)
  • 9f8d65b test(agents): avoid repeating every stream delta (#4171)
  • 86ace15 test: batch fractional transcript deadline cases (#4173)
  • a93b62c release: 3.38.0 (#4162)
  • 5d72315 feat(api): expand Live Decision item and question types (#4175)
  • 718aee9 Use UTF-8 when reading Bedrock test fixtures (#3530)
  • 43045fc feat(api): add delegation controls and prompt cache lifetimes (#4169)
  • d622f28 chore: enforce zero custom code in generated Python files (#4168)
  • Additional commits viewable in compare view

Updates fastmcp from 4.1.3 to 4.1.4

Release notes

Sourced from fastmcp's releases.

v4.1.4: Token Gesture

Generated CLIs now preserve remote transports, empty arrays, and parameters whose names collide with their own helpers; mounted servers honor session visibility and mounted_components_raise_on_load_error, a stale client context no longer closes a newer session, and OAuth provider wrappers accept identity assertions. Tasks accept a redis-py credential provider that returns current credentials for each new connection (streaming providers such as redis-entraid's are rejected until Docket can refresh them safely), Redis 8.1.0 is excluded, and custom KeyringStore users must now install py-key-value-aio[keyring] explicitly. Thanks to our 16 contributors, including 9 first-time contributors.

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

Docs 📚

New Contributors

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.2.0a1: Skill Issue

FastMCP 4.2's first alpha brings code-defined skills, discovery through mounted and proxied servers, and verified downloads into one workflow. Build a Skill in Python or load one from a folder or package, publish it through SkillCatalogProvider, and let clients discover its metadata or download and export its files. Proxy discovery is opt-in with skills=True. Skills support remains experimental; this prerelease is intended for integration testing. It also includes lazy, shared Prefab renderer resources and backend-addressing fixes. Migration: Skill now represents file contents; the wire metadata model is named MCPSkill. Whole-skill downloads require a standard SKILL.md with a name matching its URI and a description. Exports with overwrite=True replace the installed folder, including locally added files. Ordinary resource providers still support their existing document formats. Thanks to our 8 contributors, including 3 first-time contributors.

Breaking Changes ⚠️

  • Make Skill a storage-neutral object with folders as one loader by @​zzstoatzz in #6065

Enhancements ✨

Security 🔒

Fixes 🐞

Docs 📚

New Contributors

... (truncated)

Commits
  • 26bf908 docs: add v4.1.4 changelog entries (#6046)
  • d720db2 Measure blocking duration with perf_counter in transform_fn generator test (#...
  • d4af9a8 Add a downstream smoke for Redis credential providers (#6044)
  • eeb6e93 fix(client): forward max_sse_event_size through StreamableHttpTransport (#6016)
  • 4f40ac0 fix(auth): expose identity assertions on OAuth provider wrappers (#6006)
  • de37675 fix(client): keep stale contexts from closing newer sessions (#6018)
  • cb11052 Reject streaming credential providers in TasksExtension (#6043)
  • 4c7cf2b Honor mounted_components_raise_on_load_error in AggregateProvider (#6026)
  • 2ae660a Fix generate-cli commands for tools with a json parameter (#6032)
  • a9a41eb Strip a URL scheme from a Clerk domain (#5921)
  • Additional commits viewable in compare view

Updates boto3 from 1.43.118 to 1.43.119

Commits
  • e745502 Merge branch 'release-1.43.119'
  • 8bcc7ba Bumping version to 1.43.119
  • 2f0da9c Add changelog entries from botocore
  • 41e4d29 Bump certifi from 2024.7.4 to 2026.10.19 (#4863)
  • c0c0756 Merge branch 'release-1.43.118' into develop
  • See full diff in compare view

Updates semgrep from 1.79.0 to 1.182.1

Release notes

Sourced from semgrep's releases.

Release v1.182.0

1.182.0 - 2026-10-20

### Added

  • Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

  • c-sharp-pro grammar update (v0.23.1):

    • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
    • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

    (c-sharp-pro-v0.23.1)

  • hcl grammar update (v1.2.0):

    • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
    • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
    • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

    (hcl-v1.2.0)

  • lua grammar update (v0.5.0):

    • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
    • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
    • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
    • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
    • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

    (lua-v0.5.0)

### Fixed

  • Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
  • Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

  • Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

Release v1.181.0

1.181.0 - 2026-10-14

### Changed

  • semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)
  • Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)
  • pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)
  • go grammar update (v0.23.4):

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.182.1 - 2026-10-22

### Fixed

  • Update certificate trust in Semgrep and its container images to address the eMudhra certificate authority compromise. Disable curl-based telemetry on macOS and Windows; default telemetry and scanning remain available. (INCID-521)

1.182.0 - 2026-10-20

### Added

  • Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

  • c-sharp-pro grammar update (v0.23.1):

    • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
    • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

    (c-sharp-pro-v0.23.1)

  • hcl grammar update (v1.2.0):

    • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
    • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
    • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

    (hcl-v1.2.0)

  • lua grammar update (v0.5.0):

    • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
    • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
    • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
    • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
    • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

    (lua-v0.5.0)

### Fixed

  • Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
  • Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

  • Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

1.181.1 - 2026-10-22

... (truncated)

Commits

Updates nemoguardrails from 0.24.1 to 0.22.0

Changelog

Sourced from nemoguardrails's changelog.

[0.24.1] - 2026-09-16

🐛 Bug Fixes

  • (benchmark) Correct Locust concurrency measurements and sweeps (#2323)
  • (content-safety) Parse Nemotron 3.5 responses (#2370)
  • (server) Return overload response for IORails admission shedding (#2334)
  • (rails) Load config.py for combined configurations (#2371)

[0.24.0] - 2026-08-25

🚀 Features

  • (library) Add F5 Guardrails integration (#2105)
  • (server) Add /v1/health and /healthz health-check endpoints (#2169)
  • (actions) Add the engine-neutral RailOutcome allow, block, and transform contract (#2150)
  • (iorails) Add message checks (#2059)
  • (iorails) Support model-level default_headers and default_query fields for inference requests (#2296, #2220)
  • (self-check) Run multiple self-check rails with per-rail namespaced task prompts (#1874, #2175)
  • (rails) Add the typed rail manifest contract (#2157)
  • (iorails) [breaking] Return GenerationResponse when GenerationOptions are provided for non-streaming inference. Pass message lists with messages= instead of positionally (#2178)
  • (iorails) Add support for all actions without Colang runtime dependency (#2241, #2246, #2253, #2261, #2264, #2288)
  • (http) Add the canonical outbound HTTP client and request lifecycle (#2209, #2210)
  • (llm) Add shared model telemetry and an instrumented model decorator (#2214)
  • (http) Add outbound client tracing and metrics (

@dependabot
chore(deps):(deps): bump the uv group with 11 updates
7bdf58e 
Bumps the uv group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [spacy](https://github.com/explosion/spaCy) | `3.8.16` | `3.8.18` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.33.0` | `2.3.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.20.2` | `5.21.0` |
| [openai](https://github.com/openai/openai-python) | `3.37.0` | `3.39.0` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `4.1.3` | `4.1.4` |
| [boto3](https://github.com/boto/boto3) | `1.43.118` | `1.43.119` |
| [semgrep](https://github.com/semgrep/semgrep) | `1.79.0` | `1.182.1` |
| [nemoguardrails](https://github.com/NVIDIA-NeMo/Guardrails) | `0.24.1` | `0.22.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.2` | `0.17.3` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.11` | `6.170.12` |
| [pip-audit](https://github.com/pypa/pip-audit) | `2.9.0` | `2.10.1` |


Updates `spacy` from 3.8.16 to 3.8.18
- [Release notes](https://github.com/explosion/spaCy/releases)
- [Changelog](https://github.com/explosion/spaCy/blob/master/RELEASE_NOTES.md)
- [Commits](explosion/spaCy@release-v3.8.16...release-v3.8.18)

Updates `huggingface-hub` from 1.33.0 to 2.3.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.33.0...v2.3.0)

Updates `transformers` from 5.20.2 to 5.21.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.20.2...v5.21)

Updates `openai` from 3.37.0 to 3.39.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v3.37.0...v3.39.0)

Updates `fastmcp` from 4.1.3 to 4.1.4
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.1.3...v4.1.4)

Updates `boto3` from 1.43.118 to 1.43.119
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.118...1.43.119)

Updates `semgrep` from 1.79.0 to 1.182.1
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/semgrep/semgrep/commits)

Updates `nemoguardrails` from 0.24.1 to 0.22.0
- [Release notes](https://github.com/NVIDIA-NeMo/Guardrails/releases)
- [Changelog](https://github.com/NVIDIA-NeMo/Guardrails/blob/develop/CHANGELOG.md)
- [Commits](NVIDIA-NeMo/Guardrails@v0.24.1...v0.22.0)

Updates `ruff` from 0.17.2 to 0.17.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.2...0.17.3)

Updates `hypothesis` from 6.170.11 to 6.170.12
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.170.11...v6.170.12)

Updates `pip-audit` from 2.9.0 to 2.10.1
- [Release notes](https://github.com/pypa/pip-audit/releases)
- [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md)
- [Commits](pypa/pip-audit@v2.9.0...v2.10.1)

---
updated-dependencies:
- dependency-name: spacy
  dependency-version: 3.8.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: huggingface-hub
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: uv
- dependency-name: transformers
  dependency-version: 5.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: openai
  dependency-version: 3.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: fastmcp
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: boto3
  dependency-version: 1.43.119
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: semgrep
  dependency-version: 1.182.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: nemoguardrails
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: hypothesis
  dependency-version: 6.170.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: pip-audit
  dependency-version: 2.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <[email protected]>
@vercel

vercel Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pixelated Ignored Ignored Preview Oct 30, 2026 3:30am UTC

Request Review

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@dependabot
dependabot Bot requested a review from daggerstuff as a code owner October 30, 2026 03:30
@dependabot dependabot Bot added python Pull requests that update python code uv Python uv dependency updates labels Oct 30, 2026
@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@daggerstuff
daggerstuff merged commit c62ec5b into staging Oct 30, 2026
28 of 32 checks passed
@daggerstuff
daggerstuff deleted the dependabot/uv/uv-0b3ac28e25 branch October 30, 2026 03:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daggerstuff daggerstuff Awaiting requested review from daggerstuff daggerstuff is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code uv Python uv dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@daggerstuff