Skip to content

chore(deps): bump the python-runtime group across 1 directory with 19 updates - #408

Merged
Abhash-Chakraborty merged 1 commit into
canaryfrom
dependabot/uv/backend/canary/python-runtime-47572568f6
Jul 30, 2026
Merged

chore(deps): bump the python-runtime group across 1 directory with 19 updates#408
Abhash-Chakraborty merged 1 commit into
canaryfrom
dependabot/uv/backend/canary/python-runtime-47572568f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-runtime group with 19 updates in the /backend directory:

Package From To
fastapi 0.135.4 0.140.7
python-multipart 0.0.31 0.0.32
pydantic 2.13.3 2.13.4
sqlalchemy 2.0.49 2.0.51
alembic 1.18.4 1.18.5
pgvector 0.2.4 0.5.0
minio 7.2.3 7.2.20
rq 2.8.0 2.10.0
slowapi 0.1.9 0.1.10
scikit-learn 1.5.0 1.9.0
transformers 5.5.0 5.14.1
ultralytics 8.4.45 8.4.108
onnxruntime 1.23.2 1.28.0
timm 1.0.26 1.0.28
paddlepaddle 3.2.2 3.3.1
paddleocr 3.5.0 3.7.0
onnxruntime-gpu 1.23.2 1.28.0
pytest 9.0.3 9.1.1
pip-audit 2.9.0 2.10.1

Updates fastapi from 0.135.4 to 0.140.7

Release notes

Sourced from fastapi's releases.

0.140.6

Refactors

  • ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #16073 by @​tiangolo.

0.140.5

Refactors

0.140.4

Refactors

0.140.3

Refactors

0.140.2

Refactors

Internal

0.140.1

Refactors

  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #16062 by @​tiangolo.

0.140.0

Refactors

Docs

Internal

... (truncated)

Commits

Updates python-multipart from 0.0.31 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

  • Speed up partial-boundary scanning for CR/LF-dense part data #300.
Commits

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • See full diff in compare view

Updates sqlalchemy from 2.0.49 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

  • [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

    References: #13207

  • [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

    References: #13356

engine

  • [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

    References: #9427

sql

  • [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

    References: #10827

... (truncated)

Commits

Updates alembic from 1.18.4 to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

  • [usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

    References: #1712

  • [usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

    References: #1806

bug

  • [bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

    References: #1258

  • [bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

    References: #1745, #779

  • [bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

Updates pgvector from 0.2.4 to 0.5.0

Changelog

Sourced from pgvector's changelog.

0.5.0 (2026-07-06)

  • Added experimental support for type hints
  • Changed vector and halfvec types to return list for Django, SQLAlchemy, SQLModel, and Peewee
  • Changed vector type to return Vector object for Psycopg 3, Psycopg 2, asyncpg, and pg8000
  • Removed utils package (use top-level pgvector package instead)
  • Removed re-exported classes (use top-level pgvector package instead)
  • Removed dependency on NumPy
  • Dropped support for Python < 3.10
  • Dropped support for SQLAlchemy < 2

0.4.2 (2025-12-04)

  • Added support for Django 6
  • Added support for str objects for bit type with SQLAlchemy

0.4.1 (2025-04-26)

  • Fixed SparseVector constructor for SciPy sparse matrices

0.4.0 (2025-03-15)

  • Added top-level pgvector package
  • Added support for pg8000
  • Added support for bytes to Bit constructor
  • Changed globally option to default to False for Psycopg 2
  • Changed arrays option to default to True for Psycopg 2
  • Fixed equality for Vector, HalfVector, Bit, and SparseVector classes
  • Fixed indices and values methods of SparseVector returning tuple instead of list in some cases
  • Dropped support for Python < 3.9

0.3.6 (2024-10-26)

  • Added arrays option for Psycopg 2

0.3.5 (2024-10-05)

  • Added avg function with type casting to SQLAlchemy
  • Added globally option for Psycopg 2

0.3.4 (2024-09-26)

  • Added schema option for asyncpg

0.3.3 (2024-09-09)

  • Improved support for cursor factories with Psycopg 2

0.3.2 (2024-07-17)

... (truncated)

Commits

Updates minio from 7.2.3 to 7.2.20

Release notes

Sourced from minio's releases.

Bugfix Release 7.2.20

What's Changed

Full Changelog: minio/minio-py@7.2.18...7.2.20

Bugfix release 7.2.19

What's Changed

New Contributors

Full Changelog: minio/minio-py@7.2.18...7.2.19

Bugfix Release 7.2.18

What's Changed

New Contributors

Full Changelog: minio/minio-py@7.2.17...7.2.18

Bugfix Release 7.2.17

What's Changed

Full Changelog: minio/minio-py@7.2.16...7.2.17

Bugfix Release

What's Changed

... (truncated)

Commits

Updates rq from 2.8.0 to 2.10.0

Release notes

Sourced from rq's releases.

v2.10

v2.9.1

v2.9

  • Added json and pickle shorthand aliases for serializers. These can now be used when creating queues/workers and with the --serializer CLI option. Thanks @​selwin!
  • Fixed a bug where SpawnWorker does not use user supplied serializer. Thanks @​selwin!
  • Queue.parse_args() now returns a EnqueueArgs named tuple. Thanks @​libmilos-so!
  • Fixed a race condition that could cause worker keys in Redis to get out of sync when Redis is under load. Thanks @​terencehonles!
  • Enqueueing deferred jobs now removes them from DeferredJobRegistry. Thanks @​selwin!
  • SpawnWorker now uses repr() when reconstructing worker, job and queue identifiers in child processes. Thanks @​selwin!
  • Minor typing and cleanup improvements. Thanks @​selwin and @​rextea!
Changelog

Sourced from rq's changelog.

RQ 2.10.0 (2026-06-20)

RQ 2.9.1 (2026-06-06)

RQ 2.9.0 (2026-05-19)

  • Added json and pickle shorthand aliases for serializers. These can now be used when creating queues/workers and with the --serializer CLI option. Thanks @​selwin!
  • Fixed a bug where SpawnWorker does not use user supplied serializer. Thanks @​selwin!
  • Queue.parse_args() now returns a EnqueueArgs named tuple. Thanks @​libmilos-so!
  • Fixed a race condition that could cause worker keys in Redis to get out of sync when Redis is under load. Thanks @​terencehonles!
  • Enqueueing deferred jobs now removes them from DeferredJobRegistry. Thanks @​selwin!
  • SpawnWorker now uses repr() when reconstructing worker, job and queue identifiers in child processes. Thanks @​selwin!
  • Minor typing and cleanup improvements. Thanks @​selwin and @​rextea!
Commits

Updates slowapi from 0.1.9 to 0.1.10

Release notes

Sourced from slowapi's releases.

v0.1.10

What's Changed

New Contributors

Full Changelog: laurentS/slowapi@v0.1.9...v0.1.10

Changelog

Sourced from slowapi's changelog.

[0.1.10] - 2026-06-13

Changed

  • Added: allow usage of the request object in the except_when function (thanks @​colin99d)
  • Added more test exemption logic (thanks @​colin99)
  • Fix logger warning for Python 3.11 deprecation (thanks @​kevin868)
Commits
  • 75799a3 Update changelog
  • 6f22eab Merge pull request #212 from ecly/release-v0.1.10
  • 5e2b9c1 Merge pull request #238 from laurentS/drop-old-python
  • a83ec72 Update README
  • d1a20b6 Drop python 3.7 and 3.8 from CI checks
  • 8bf8b2e Make exempt_when with request backwards compatible
  • eaf5ba7 Bump version and update changelog
  • a72bcc6 Merge pull request #160 from colin99d/master
  • 42330fc Merge branch 'laurentS:master' into master
  • 91145c0 Fixed mypy error
  • Additional commits viewable in compare view

Updates scikit-learn from 1.5.0 to 1.9.0

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.0

We're happy to announce the 1.9.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_9_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.9.html

This release adds narwhals as a new dependency that will help to improve dataframe interoperability across the project.

This version supports Python versions 3.11 to 3.14.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Release 1.8.0

We're happy to announce the 1.8.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_8_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.8.html

This version supports Python versions 3.11 to 3.14 and features support of free-threaded CPython.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Scikit-learn 1.7.2

We're happy to announce the 1.7.2 release.

This release contains a few bug fixes and is the first version supporting Python 3.14.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.7.html#version-1-7-2

You can upgrade with pip as usual:

</tr></table>

... (truncated)

Commits
  • 77def0e trigger wheel builder [cd build]
  • ee7c0b0 generate changelog
  • 3d7fb04 bump version
  • 8954e7b DOC Release highlights for 1.9 (#34147)
  • 73a3eab Fix: Array-API - avoid failing for numpy fit + predict with sparse or array-l...
  • 8839aae DOC Thread-safety requirement for open_listener message consumer callback (#3...
  • 4d2476a DOC Refactor array API docs page (#34054)
  • f9f812f 🔒 🤖 CI Update lock files for scipy-dev CI build(s) 🔒 🤖 ...
  • d779dc3 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
  • 6a03cf0 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
  • Additional commits viewable in compare view

Updates transformers from 5.5.0 to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

Release v5.14.0

New Model additions

Inkling (fresh from Thinking Machines): 975B total, 41B active

Inkling is a general-purpose multimodal model that accepts text, image and audio inputs and generates text outputs. It is intended for use in English and other languages, and across multiple coding languages. The model is designed to be used by developers building AI- powered applications, including agentic and tool-use systems, coding assistants, chatbots, and retrieval-augmented generation systems, and is suitable for general-purpose conversational use, instruction-following, and other natural language and multimodal tasks. It is released with open weights to support research, fine-tuning and integration into third-party products by downstream developers.

TIPSv2

Links: Documentation

TIPSv2 DPT

Links: Documentation

🚨 Breaking changes

... (truncated)

Commits

Updates ultralytics from 8.4.45 to 8.4.108

Release notes

Sourced from ultralytics's releases.

v8.4.108 - Fix MuSGD crash on non-matrix params like LayerScale (#25447)

🌟 Summary

🛠️ v8.4.108 improves MuSGD stability, inference and tracking efficiency, analytics quality, ONNX compatibility, and documentation usability—without changing model accuracy or architecture.

📊 Key Changes

  • Fixed a MuSGD training crash by @​Y-T-G:

    • MuSGD now applies its Muon-style update only to supported 2D linear weights and 4D convolution filters.
    • LayerScale gains, normalization weights, biases, and other parameters use the existing SGD update path.
    • Prevents AssertionError failures when training models containing parameters such as (C, 1, 1) LayerScale tensors.

  • Improved prediction performance reporting:

    • Predictors now retain per-image preprocessing, inference, and postprocessing times through predictor.speed.
    • Added average processed image area through predictor.pixels.
    • Timing information is reset correctly for each run and supports mixed image sizes.

  • Reduced tracking overhead and preserved device placement:

    • TrackTrack computes motion cues only for detection pairs supported by IoU, reducing unnecessary CPU work, especially in crowded scenes.
    • Removed redundant NumPy array copies in ByteTrack and TrackTrack.
    • Tracked boxes now remain on the same device as the original detections, avoiding unexpected CPU/GPU data splits.

  • Improved ONNX Runtime example compatibility:

    • Corrected image height/width handling during letterbox preprocessing.
    • Added fallback support for models with dynamic input dimensions.

  • Strengthened training and inference analytics:

    • Training events now report final outcomes such as fitness, duration, completed epochs, optimizer, architecture, and dataset information.
    • Multi-GPU runs now record the GPU count instead of a simple distributed-training flag.
    • Invalid modes and tasks are excluded from analytics events.

  • Expanded Ultralytics Platform integration:

    • Model weights for YOLO26, YOLO11, YOLOv8, and supported YOLOv5 variants now link to their corresponding Ultralytics Platform model pages.
    • Huawei Ascend 310B1 and 310B4 targets are now documented as supported on Platform.

  • Improved generated reference documentation:

    • Fixed broken tables for union types such as str | Path.
    • Preserved multi-line return descriptions.
    • Documented inherited constructors correctly.
    • Improved source panels, examples formatting, frontmatter handling, and empty argument tables.

  • Updated documentation links and CI reliability:

    • Replaced unstable ADE20K and Flickr30K links with maintained GitHub sources.
    • Excluded Gitee links from automated checks to avoid false failures caused by bot protection.

🎯 Purpose & Impact

  • ✅ MuSGD users can train a wider range of models reliably, including architectures with LayerScale or other non-matrix parameters.
  • 🚀 Inference and tracking are more efficient, with lower avoidable CPU work and better GPU/CPU device consistency.
  • 📈 Performance measurements and analytics are more useful, making it easier to compare real-world runs across hardware and distributed setups.

... (truncated)

Commits
  • 4d13f65 Fix MuSGD crash on non-matrix params like LayerScale (#25447)
  • fc49aa8 Skip the redundant contiguous copy in RandomFlip (#25462)
  • 13d6faa Record the GPU count instead of a ddp flag (#25463)
  • 1c25657 Reduce TrackTrack CPU and keep tracked boxes on the source device (#25448)
  • 823b81f Only send events for a valid mode and task (#25461)
  • af8707d Document inherited constructors and anchor frontmatter parsing (#25460)
  • 8474878 Update OrangePi Huawei Ascend 310B Platform support (#25459)
  • 5578cc6 Fix Examples captions and hard-wrapped table descriptions (#25458)
  • ea2897b Record training outcomes in the train event (#25456)
  • 3896fce Fix reference truncation, constructor signatures, and empty argument tables (...
  • Additional commits viewable in compare view

Updates onnxruntime from 1.23.2 to 1.28.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
    • CUDA_QUANT_PREPROCESS is off by default (#29687).
  • NPM packages are ...

    Description has been truncated

@dependabot
dependabot Bot requested a review from Abhash-Chakraborty as a code owner July 30, 2026 21:47
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026
@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown

PR Context Summary

Suggested issue links

  • No strong issue match found yet.

Use Fixes #123 or Closes #123 in the PR body when one of the suggestions is the intended issue.
Manual rerun: Actions > PR Context Triage > Run workflow > set pr_number and force_review=true.

@dependabot
chore(deps): bump the python-runtime group across 1 directory with 19…
686e3e3 
… updates

Bumps the python-runtime group with 19 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.135.4` | `0.140.7` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.31` | `0.0.32` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.3` | `2.13.4` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.49` | `2.0.51` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.18.5` |
| [pgvector](https://github.com/pgvector/pgvector-python) | `0.2.4` | `0.5.0` |
| [minio](https://github.com/minio/minio-py) | `7.2.3` | `7.2.20` |
| [rq](https://github.com/rq/rq) | `2.8.0` | `2.10.0` |
| [slowapi](https://github.com/laurents/slowapi) | `0.1.9` | `0.1.10` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.5.0` | `1.9.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.5.0` | `5.14.1` |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.45` | `8.4.108` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.23.2` | `1.28.0` |
| [timm](https://github.com/huggingface/pytorch-image-models) | `1.0.26` | `1.0.28` |
| [paddlepaddle](https://github.com/paddlepaddle/paddle) | `3.2.2` | `3.3.1` |
| [paddleocr](https://github.com/PaddlePaddle/PaddleOCR) | `3.5.0` | `3.7.0` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.23.2` | `1.28.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |
| [pip-audit](https://github.com/pypa/pip-audit) | `2.9.0` | `2.10.1` |



Updates `fastapi` from 0.135.4 to 0.140.7
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.135.4...0.140.7)

Updates `python-multipart` from 0.0.31 to 0.0.32
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.31...0.0.32)

Updates `pydantic` from 2.13.3 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.3...v2.13.4)

Updates `sqlalchemy` from 2.0.49 to 2.0.51
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `alembic` from 1.18.4 to 1.18.5
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `pgvector` from 0.2.4 to 0.5.0
- [Changelog](https://github.com/pgvector/pgvector-python/blob/master/CHANGELOG.md)
- [Commits](pgvector/pgvector-python@v0.2.4...v0.5.0)

Updates `minio` from 7.2.3 to 7.2.20
- [Release notes](https://github.com/minio/minio-py/releases)
- [Commits](minio/minio-py@7.2.3...7.2.20)

Updates `rq` from 2.8.0 to 2.10.0
- [Release notes](https://github.com/rq/rq/releases)
- [Changelog](https://github.com/rq/rq/blob/master/CHANGES.md)
- [Commits](rq/rq@v2.8...v2.10)

Updates `slowapi` from 0.1.9 to 0.1.10
- [Release notes](https://github.com/laurents/slowapi/releases)
- [Changelog](https://github.com/laurentS/slowapi/blob/master/CHANGELOG.md)
- [Commits](laurentS/slowapi@v0.1.9...v0.1.10)

Updates `scikit-learn` from 1.5.0 to 1.9.0
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.5.0...1.9.0)

Updates `transformers` from 5.5.0 to 5.14.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.5.0...v5.14.1)

Updates `ultralytics` from 8.4.45 to 8.4.108
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.45...v8.4.108)

Updates `onnxruntime` from 1.23.2 to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.23.2...v1.28.0)

Updates `timm` from 1.0.26 to 1.0.28
- [Release notes](https://github.com/huggingface/pytorch-image-models/releases)
- [Commits](huggingface/pytorch-image-models@v1.0.26...v1.0.28)

Updates `paddlepaddle` from 3.2.2 to 3.3.1
- [Release notes](https://github.com/paddlepaddle/paddle/releases)
- [Changelog](https://github.com/PaddlePaddle/Paddle/blob/develop/RELEASE.md)
- [Commits](PaddlePaddle/Paddle@v3.2.2...v3.3.1)

Updates `paddleocr` from 3.5.0 to 3.7.0
- [Release notes](https://github.com/PaddlePaddle/PaddleOCR/releases)
- [Commits](PaddlePaddle/PaddleOCR@v3.5.0...v3.7.0)

Updates `onnxruntime-gpu` from 1.23.2 to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.23.2...v1.28.0)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `pip-audit` from 2.9.0 to 2.10.1
- [Release notes](https://github.com/pypa/pip-audit/releases)
- [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md)
- [Commits](pypa/pip-audit@v2.9.0...v2.10.1)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.18.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: fastapi
  dependency-version: 0.140.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: minio
  dependency-version: 7.2.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: onnxruntime
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: onnxruntime-gpu
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: paddleocr
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: paddlepaddle
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pgvector
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pip-audit
  dependency-version: 2.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: rq
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: scikit-learn
  dependency-version: 1.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: slowapi
  dependency-version: 0.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: sqlalchemy
  dependency-version: 2.0.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: timm
  dependency-version: 1.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: ultralytics
  dependency-version: 8.4.108
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/backend/canary/python-runtime-47572568f6 branch from 0362c7b to 686e3e3 Compare July 30, 2026 22:03
@Abhash-Chakraborty

Abhash-Chakraborty commented Jul 30, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with canary! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@Abhash-Chakraborty

Abhash-Chakraborty commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Asked for the rebase because the original head branched off #405 and its lockfile would have rolled redis back to 5.0.1, cryptography to 48.0.1 and pytest-asyncio to 0.23.3 — undoing #407. Confirmed the rebased lock keeps 8.0.1 / 49.0.0 / 1.4.0 and uvicorn at 0.51.0, so nothing regresses.

Verified locally on the rebased head: uv sync --locked clean, ruff check + ruff format --check clean, smoke import OK, 527 passed / 5 skipped — same as baseline.

pgvector 0.2.4 → 0.5.0 got an extra look, because the test DB is SQLite and the Vector columns in media, cluster and face never see Postgres in CI. Exercised the type's serialization directly against the postgresql dialect — Vector(768) bind → result round-trips with dimensionality preserved and values intact. That's the part that actually changed; it holds.

This is also the batch #395 and #405 were both clearing the way for. pgvector 0.2.4 → 0.5.0 and minio 7.2.3 → 7.2.20 have been stuck for months, first behind the pip/uv lockfile problem and then behind ruff.

One caveat, and it isn't this PR's fault. Six of these only install with the cpu/nvidia extras, and backend-check syncs the dev group — so nothing in CI or in my run above executed a line of them:

  • transformers 5.5.0 → 5.14.1
  • ultralytics 8.2.0 → 8.4.108
  • timm 0.9.16 → 1.0.28 (0.x → 1.0)
  • onnxruntime / onnxruntime-gpu 1.23.2 → 1.28.0
  • paddlepaddle 3.2.2 → 3.3.1, paddleocr 3.5.0 → 3.7.0

Same blind spot as #404 and #397. timm crossing 1.0 is the one I'd watch — it's in the captioning/embedding path. The paddle bumps also land under #364, which is changing OCR defaults right now, so that PR is worth a re-run after this merges.

Merging on the strength of what is covered, with those six flagged rather than quietly assumed.

@Abhash-Chakraborty
Abhash-Chakraborty merged commit 13153fa into canary Jul 30, 2026
17 of 18 checks passed
@Abhash-Chakraborty
Abhash-Chakraborty deleted the dependabot/uv/backend/canary/python-runtime-47572568f6 branch July 30, 2026 22:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Abhash-Chakraborty Abhash-Chakraborty Awaiting requested review from Abhash-Chakraborty Abhash-Chakraborty is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Abhash-Chakraborty