chore(deps): bump the api-deps group in /apps/api with 17 updates

[dependabot]

Updates the requirements on fastapi, uvicorn, sqlalchemy, psycopg, pgvector, httpx, apscheduler, sse-starlette, pydantic-settings, fastembed, umap-learn, scikit-learn, numpy, pytest, pytest-asyncio, ruff and setuptools to permit the latest version.
Updates fastapi to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

• 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

Commits

• 866b7a3 🔖 Release version 0.139.2 (#16014)
• 7b3effe 📝 Update release notes
• 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
• c48e67b 🔖 Release version 0.139.1 (#16012)
• 2acc4fb 📝 Update release notes
• eb75fd0 🐛 Fix frontend fallback support for doted paths like /users/john.doe (#16011)
• 9b8410b 📝 Update release notes
• e24d44c 📝 Fix topic repository list not being displayed and skip_users not being ap...
• 93b78f8 📝 Update release notes
• b959b44 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in Kludex/uvicorn#3025
• Remove colorama from the standard extra by @​Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

• Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)
• Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)
• Default --ws auto to websockets-sansio when websockets is installed (#2985)
• Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)
• Build a fresh asgi scope dict per request (#2977)
• Cache the asgi scope sub-dict per connection (#2976)
• Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
• Memoize trusted host checks in ProxyHeadersMiddleware (#2970)
• Replace click.style with an internal ANSI style helper (#2981)

Deprecated

• Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

• Bump httptools minimum version to 0.8.0 (#2962)
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

... (truncated)

Commits

• e4d0b05 Version 0.51.0 (#3028)
• 944e43d Remove colorama from the standard extra (#3027)
• 2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
• a1b570c Version 0.50.2 (#3022)
• 83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
• b4d0116 Version 0.50.1 (#3020)
• 2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
• 1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
• 837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
• 21d2c16 Version 0.50.0 (#3013)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates psycopg to 3.3.4

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.5 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Current release

Psycopg 3.3.4 ^^^^^^^^^^^^^

• Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).
• Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).
• Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

• Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).
• Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

Psycopg 3.3.2 ^^^^^^^^^^^^^

Fix race condition in adapters at startup (:ticket:[#1230](https://github.com/psycopg/psycopg/issues/1230)).

... (truncated)

Commits

• 83f1103 chore: bump psycopg_pool package version to 3.3.1
• 1828770 chore: bump psycopg package version to 3.3.4
• 8be14bb Merge pull request #1301 from oliverhaas/fix/sync-pool-open-race
• aee0bf2 fix(pool): fix race in the construction of the sync ConnectionPool lock
• bc4d303 chore(deps): bump the actions group across 1 directory with 4 updates
• 785379f fix: retain statusmessage after executemany with returning=False
• 8882a73 perf: do less if X in Y: return Y[X] for cache-like patterns
• 2f78539 Merge pull request #1299 from dvarrazzo/fix-camel-enum
• 37ef1dc test: skip test on crdb depending on precise regtype behaviour
• 7f2f1d1 fix: fix client-side representation of enums requiring quotes
• Additional commits viewable in compare view

Updates pgvector to 0.5.0

Changelog

Sourced from pgvector's changelog.

0.5.0 (2026-07-06)

• Added experimental support for type hints
• Changed vector and halfvec types to return list for Django, SQLAlchemy, SQLModel, and Peewee
• Changed vector type to return Vector object for Psycopg 3, Psycopg 2, asyncpg, and pg8000
• Removed utils package (use top-level pgvector package instead)
• Removed re-exported classes (use top-level pgvector package instead)
• Removed dependency on NumPy
• Dropped support for Python < 3.10
• Dropped support for SQLAlchemy < 2

0.4.2 (2025-12-04)

• Added support for Django 6
• Added support for str objects for bit type with SQLAlchemy

0.4.1 (2025-04-26)

• Fixed SparseVector constructor for SciPy sparse matrices

0.4.0 (2025-03-15)

• Added top-level pgvector package
• Added support for pg8000
• Added support for bytes to Bit constructor
• Changed globally option to default to False for Psycopg 2
• Changed arrays option to default to True for Psycopg 2
• Fixed equality for Vector, HalfVector, Bit, and SparseVector classes
• Fixed indices and values methods of SparseVector returning tuple instead of list in some cases
• Dropped support for Python < 3.9

0.3.6 (2024-10-26)

• Added arrays option for Psycopg 2

0.3.5 (2024-10-05)

• Added avg function with type casting to SQLAlchemy
• Added globally option for Psycopg 2

0.3.4 (2024-09-26)

• Added schema option for asyncpg

0.3.3 (2024-09-09)

• Improved support for cursor factories with Psycopg 2

0.3.2 (2024-07-17)

... (truncated)

Commits

• 60739df Version bump to 0.5.0 [skip ci]
• a810f27 Updated example [skip ci]
• 45b054c Updated example [skip ci]
• efa1442 Updated examples [skip ci]
• 780cc73 Updated example [skip ci]
• 9f0d6b9 Updated examples [skip ci]
• f6e113e Updated example [skip ci]
• dc68770 Updated readme [skip ci]
• 0c18e0a Addressed todo
• 28191fc Removed todo [skip ci]
• Additional commits viewable in compare view

Updates httpx to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

0.27.0 (21st February, 2024)

... (truncated)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates apscheduler to 3.11.3

Release notes

Sourced from apscheduler's releases.

3.11.3

• Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#1103)
• Fixed imported jobs missing their scheduler and job store links (#1119)

Commits

• 4308ec9 Added the release version
• ff68780 Added a note about weekday numbers in CronTrigger.from_crontab()
• 36936e9 Updated actions
• c0ff7e4 Fixed Pyside6 tests failing on Python 3.9 and 3.8
• 1b782c9 Fixed fixture coreapp not found
• dc3dde4 Test against PySide6 on all Python versions
• 18a6f6b Fixed imported jobs missing their scheduler and job store links
• 1693db4 Fix interval jobs stalling across DST spring-forward with ZoneInfo (#1114)
• 0636bf4 Added Python 3.14 to the test matrix
• 3eb3de8 Fixed bad use of pytest.raises()
• Additional commits viewable in compare view

Updates sse-starlette to 3.4.5

Release notes

Sourced from sse-starlette's releases.

v3.4.5

What's Changed

• chore(deps): bump ujson from 5.12.0 to 5.12.1 by @​dependabot[bot] in sysid/sse-starlette#187
• chore(deps): bump idna from 3.11 to 3.15 by @​dependabot[bot] in sysid/sse-starlette#188
• chore(deps): bump actions/download-artifact from 4 to 8 by @​dependabot[bot] in sysid/sse-starlette#190
• chore(deps): bump starlette from 0.50.0 to 1.0.1 by @​dependabot[bot] in sysid/sse-starlette#193
• chore(deps): bump twisted from 25.5.0 to 26.4.0rc2 by @​dependabot[bot] in sysid/sse-starlette#194
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 by @​dependabot[bot] in sysid/sse-starlette#196
• chore(deps): bump msgpack from 1.1.2 to 1.2.1 by @​dependabot[bot] in sysid/sse-starlette#197
• chore(deps): bump ujson from 5.12.1 to 5.13.0 by @​dependabot[bot] in sysid/sse-starlette#198
• fix: test selection by @​sysid in sysid/sse-starlette#199
• chore(deps): bump starlette from 1.0.1 to 1.3.1 by @​dependabot[bot] in sysid/sse-starlette#195

Full Changelog: sysid/sse-starlette@v3.4.4...v3.4.5

Commits

• d45e482 Bump version to 3.4.5
• 32fbde5 Merge pull request #195 from sysid/dependabot/uv/starlette-1.3.1
• eba4008 Merge pull request #199 from sysid/fix/test-selection
• 8685f2f fix: test selection
• 66c734a Merge pull request #198 from sysid/dependabot/uv/ujson-5.13.0
• fb928d3 Merge pull request #197 from sysid/dependabot/uv/msgpack-1.2.1
• cf620f4 Merge pull request #196 from sysid/dependabot/uv/cryptography-48.0.1
• 4a7cd51 chore(deps): bump ujson from 5.12.1 to 5.13.0
• 6069864 chore(deps): bump msgpack from 1.1.2 to 1.2.1
• 9485e2b chore(deps): bump cryptography from 46.0.7 to 48.0.1
• Additional commits viewable in compare view

Updates pydantic-settings to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

• Prevent NestedSecretsSettingsSource from following symlinks outside secrets_dir by @​hramezani in pydantic/pydantic-settings#889
• Prepare release 2.14.2 by @​hramezani in pydantic/pydantic-settings#890

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

Commits

• d703bd7 Prepare release 2.14.2 (#890)
• e95c30b Prepare release 2.14.1 (#859)
• 0c87345 Fix field named cls conflicting with classmethod parameter (#858)
• 7bd0072 Bump the python-packages group with 2 updates (#856)
• b03e573 Bump the github-actions group with 3 updates (#853)
• eaa3b43 Bump the python-packages group with 5 updates (#854)
• 9f95615 Bump the python-packages group with 4 updates (#850)
• 8916bee Prepare release 2.14.0 (#848)
• 39e551c Fix CLI descriptions lost under python -OO by falling back to `json_schema_...
• 9ed7f48 Bump the python-packages group with 4 updates (#847)
• Additional commits viewable in compare view

Updates fastembed to 0.8.0

Release notes

Sourced from fastembed's releases.

v0.8.0

Changelog

Features 🏎️

• #537 - use cuda if available, instead of requiring explicit cuda=True
• #588 - add colmodernvbert by @​kacperlukawski @​joein

Fixes 🔧

• #534 - update colbert description by @​joein
• #611 - fix onnxruntime and pillow versions for better 3.14 support and avoiding security issues caused by pillow
• #614 - respect HF_HUB_OFFLINE env by @​amasolov

Deprecations

• #574 - drop python3.9 by @​joein

Thanks to everyone who contributed to this release @​joein @​amasolov @​kacperlukawski

Commits

• 6fa442b bump version to 0.8.0
• 52ebfba fix: respect HF_HUB_OFFLINE in download_model to avoid network calls (#614)
• ea55268 fix: fix onnxruntime 1.24, uncap pillow (#611)
• 800f388 Model: ModernVBERT/colmodernvbert (#588)
• 020d535 Update logo and favicon (#589)
• 685fd9b new: use cuda if available (#537)
• b304a2a new: drop python3.9, replace optional and union with | (#574)
• c715416 fix: update colbert description (#534)
• 428381c bump version to v0.7.4
• 3511b08 fix: numpy dropped 3.10 as of 2.3.0 (#585)
• Additional commits viewable in compare view

Updates umap-learn to 0.5.12

Release notes

Sourced from umap-learn's releases.

release-0.5.12

What's Changed

• Remove nomic atlas reference from plotting.rst by @​cakiki in lmcinnes/umap#1238
• [MINOR] Update README.rst by @​cakiki in lmcinnes/umap#1241
• Remove more atlas references / fix doc build warnings by @​cakiki in lmcinnes/umap#1243
• Fix for #1180 and #1200 - NaN loss on Parametric UMAP retraining. by @​jacobgolding in lmcinnes/umap#1244
• Edit distance fixes + fast short ascii method (Myers) by @​jh83775 in lmcinnes/umap#1247
• Fixing gradients in some metrics by @​jh83775 in lmcinnes/umap#1248
• Update parametric_umap.py by @​M4rk0st0j in lmcinnes/umap#1249
• Issue 1216 by @​lmcinnes in lmcinnes/umap#1250

New Contributors

• @​M4rk0st0j made their first contribution in lmcinnes/umap#1249

Full Changelog: lmcinnes/umap@release-0.5.11...release-0.5.12

Changelog

Sourced from umap-learn's changelog.

Release Notes

Some notes on new features in various releases

What's new in 0.5

• ParametricUMAP learns embeddings with neural networks.
• AlignedUMAP can align multiple embeddings using relations between datasets.
• DensMAP can preserve local density information in embeddings.
• UMAP now depends on PyNNDescent, but has faster more parallel performance as a result.
• UMAP now supports an update method to add new data and retrain.
• Various performance improvements and bug fixes.
• Additional plotting support, including text searching in interactive plots.
• Support for "maximal distances" in neighbor graphs.

What's new in 0.4

• Inverse transform method. Generate points in the original space corresponding to points in embedded space. (Thanks to Joseph Courtney)
• Different embedding spaces. Support for embedding to a variety of different spaces other than Euclidean. (Thanks to Joseph Courtney)
• New metrics, including Hellinger distance for sparse count data.
• New discrete/label metrics, including hierarchical categories, counts, ordinal data, and string edit distance.
• Support for parallelism in neighbor search and layout optimization. (Thanks to Tom White)
• Support for alternative methods to handling duplicated data samples. (Thanks to John Healy)
• New plotting methods for fast and easy plots.
• Initial support for dataframe embedding -- still experimental, but worth trying.
• Support for transform methods with sparse data.
• Multithreading support when no random seed is set.

What's new in 0.3

• Supervised and semi-supervised dimension reduction. Support for using labels or partial labels for dimension reduction.
• Transform method. Support for adding new unseen points to an existing embedding.
• Performance improvements.

What's new in 0.2

• A new layout algorithm that handles large datasets (more) correctly.
• Performance improvements.

Commits

• cdb0eeb Merge pull request #1250 from lmcinnes/issue_1216
• f30d372 version bump
• 6927806 Just remove fastmath
• 7a7bc24 Merge pull request #1249 from M4rk0st0j/master
• 1642ec6 Merge pull request #1248 from jh83775/grad-fix
• e45dc6d Update parametric_umap.py
• dc05089 guard hellinger_grad against tiny negatives
• afd16c8 formatting
• 31e484d add tests for softmax_hellinger
• 6d7be7d fix hellinger output type; add softmax_hellinger
• Additional commits viewable in compare view

Updates scikit-learn to 1.9.0

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.0

We're happy to announce the 1.9.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_9_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.9.html

This release adds narwhals as a new dependency that will help to improve dataframe interoperability across the project.

This version supports Python versions 3.11 to 3.14.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Commits

• 77def0e trigger wheel builder [cd build]
• ee7c0b0 generate changelog
• 3d7fb04 bump version
• 8954e7b DOC Release highlights for 1.9 (#34147)
• 73a3eab Fix: Array-API - avoid failing for numpy fit + predict with sparse or array-l...
• 8839aae DOC Thread-safety requirement for open_listener message consumer callback (#3...
• 4d2476a DOC Refactor array API docs page (#34054)
• f9f812f 🔒 🤖 CI Update lock files for scipy-dev CI build(s) 🔒 🤖 ...
• d779dc3 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
• 6a03cf0 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
• Additional commits viewable in compare view

Updates numpy to 2.5.1

Release notes

Sourced from numpy's releases.

v2.5.1 (July 4, 2026)

NumPy 2.5.1 Release Notes

The NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0 release. The most noticeable is the fix is to the numpy datetime cython API which should allow downstream to support NumPy versions older than 2.5. Preparation for Python 3.15 continues along with typing improvements.

This release supports Python versions 3.12-3.14

Changes

• The minimum supported GCC version has been updated from 9.3.0 to 10.3.0

  (gh-31843)

Contributors

A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Adhyan Gupta +
• Ankit Ahlawat
• Charles Harris
• Iason Krommydas
• Joren Hammudoglu
• Kumar Aditya
• Nathan Goldbaum
• Sebastian Berg
• Ties Jan Hefting +
• Vineet Kumar

Pull requests merged

A total of 20 pull requests were merged for this release.

• #31707: MAINT: Prepare 2.5.x for further development
• #31721: CI: fix new cython-lint errors (#31711)
• #31723: MAINT: Update meson to match main
• #31729: TST: use setup-sde instead of curl to get SDE binaries (#31727)
• #31829: BUG: Relax finfo to be easier accessible for all user dtypes...
• #31831: TYP: Fix flatiter.__next__ return type for object_ and...
• #31832: BUG: avoid deadlocks using NpyString API (#31682)
• #31833: BUG: fix out array leak in reduceat and accumulate when dtype...
• #31835: BUG: fix numpy datetime cython APIs to be compatible with older...
• #31836: TYP: Fix incorrect dtype inference of asarray([]) (#31732)
• #31837: TYP: Fix np.ma.masked_array 2.5.0 regression
• #31838: FIX: Refactor error handling in array_setstate to prevent typecode...
• #31839: TST: xfail multithreaded BLAS test more generously
• #31840: MAINT: Rename subroutine for crackfortran tests

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the requirements/*_requirements.txt files to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits

• 5e1d03f Merge pull request #31863 from charris/prepare-2.5.1
• ad0b66b REL: Prepare for the NumPy 2.5.1 release.
• 9df8516 Merge pull request #31858 from charris/backport-31688
• 4dee265 Merge pull request #31857 from charris/backport-31775
• dc8d553 Merge pull request #31856 from charris/backport-31846
• 67cb4a8 fix:Signed integer overflow in datetime.c (#31688)
• baa2589 TST: Clean up imports, formatting, and assertions
• 2fe5ba4 TEST: Refactor tests to use np.testing.assert_raises_regex per review
• bb46581 MAINT: Remove deprecated Python recursion fix
• 8f34214 MAINT: Move SeedSequence recursion guard to C-layer and add tests
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no l...

  Description has been truncated

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.