Skip to content

⬆️ Bump the uv-dependencies group with 13 updates#183

Merged
fmigneault merged 1 commit into
mainfrom
dependabot/uv/uv-dependencies-6b62791c00
May 9, 2026
Merged

⬆️ Bump the uv-dependencies group with 13 updates#183
fmigneault merged 1 commit into
mainfrom
dependabot/uv/uv-dependencies-6b62791c00

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 8, 2026

Bumps the uv-dependencies group with 13 updates:

Package From To
pydantic 2.13.3 2.13.4
pydantic-core 2.46.3 2.46.4
setuptools 81.0.0 82.0.1
mypy 1.20.2 2.0.0
types-python-dateutil 2.9.0.20260408 2.9.0.20260508
types-pyyaml 6.0.12.20260408 6.0.12.20260508
urllib3 2.6.3 2.7.0
authlib 1.7.1 1.7.2
cuda-bindings 12.9.6 12.9.4
hf-xet 1.5.0rc0 1.5.0
librt 0.9.0 0.10.0
nvidia-cuda-nvrtc-cu12 12.6.85 12.6.77
nvidia-nccl-cu12 2.28.9 2.27.5

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • See full diff in compare view

Updates pydantic-core from 2.46.3 to 2.46.4

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • See full diff in compare view

Updates setuptools from 81.0.0 to 82.0.1

Changelog

Sourced from setuptools's changelog.

v82.0.1

Bugfixes

  • Fix the loading of launcher manifest.xml file. (#5047)
  • Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

  • Add advice about how to improve predictability when installing sdists. (#5168)

Misc

v82.0.0

Deprecations and Removals

  • pkg_resources has been removed from Setuptools. Most common uses of pkg_resources have been superseded by the importlib.resources <https://docs.python.org/3/library/importlib.resources.html>_ and importlib.metadata <https://docs.python.org/3/library/importlib.metadata.html>_ projects. Projects and environments relying on pkg_resources for namespace packages or other behavior should depend on older versions of setuptools. (#3085)
Commits
  • 5a13876 Bump version: 82.0.0 → 82.0.1
  • 51ab8f1 Avoid using (deprecated) 'json.version' in tests (#5194)
  • f9c37b2 Docs/CI: Fix intersphinx references (#5195)
  • 8173db2 Docs: Fix intersphinx references
  • 09bafbc Fix past tense on newsfragment
  • 461ea56 Add news fragment
  • c4ffe53 Avoid using (deprecated) 'json.version' in tests
  • 749258b Cleanup pkg_resources dependencies and configuration (#5175)
  • 2019c16 Parse ext-module.define-macros from pyproject.toml as list of tuples (#5169)
  • b809c86 Sync setuptools schema with validate-pyproject (#5157)
  • Additional commits viewable in compare view

Updates mypy from 1.20.2 to 2.0.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.0

We’ve just uploaded mypy 2.0.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. There are also changes to options and defaults. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Enable --local-partial-types by Default

This flag affects the inference of types based on assignments in other scopes. For now, explicitly disabling this continues to be supported, but this support will be removed in the future as the legacy behaviour is hard to support with other current and future features in mypy, like the daemon or the new implementation of flexible redefinitions.

Contributed by Ivan Levkivskyi, Jukka Lehtosalo, Shantanu in PR 21163.

Enable --strict-bytes by Default

Per PEP 688, mypy no longer treats bytearray and memoryview values as assignable to the bytes type.

Contributed by Shantanu in PR 18371.

New Behavior for --allow-redefinition

The --allow-redefinition flag now behaves like --allow-redefinition-new in mypy 1.20 and earlier. The new behavior is generally more flexible. For example, you can have different types for a variable in different blocks:

# mypy: allow-redefinition
def foo(cond: bool) -> None:
if cond:
for x in ["a", "b"]:
# Type of "x" is "str" here
...
else:
for x in [1, 2]:
# Type of "x" is "int" here
...

... (truncated)

Commits

Updates types-python-dateutil from 2.9.0.20260408 to 2.9.0.20260508

Commits

Updates types-pyyaml from 6.0.12.20260408 to 6.0.12.20260508

Commits

Updates urllib3 from 2.6.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @​Cycloctane)
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @​kimkou2024)

    See GHSA-mf9v-mfxr-j63j for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @​christos-spearbit)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)
  • Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)
  • Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)
  • Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)
  • Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)
  • Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)
  • Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)
Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

    See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)
  • Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)
  • Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

Updates authlib from 1.7.1 to 1.7.2

Release notes

Sourced from authlib's releases.

v1.7.2

What's Changed

Full Changelog: authlib/authlib@v1.7.1...v1.7.2

Commits
  • a0b76fa chore: bump to 1.7.2
  • c85c7f2 Merge pull request #884 from azmeuk/852-rfc7523-key-import
  • a3b2add Merge pull request #873 from azmeuk/bcp47
  • f2578ea fix: Import RSAKey in auth.py for additional key support
  • b57182c fix: fallback support RSAKey when client_secret is text
  • 4e75902 Merge branch 'main' into 852-rfc7523-key-import
  • 5eb4a86 Merge pull request #887 from azmeuk/883-alg
  • 5633f37 fix: allow non-recommended algorithms in ClientSecretJWT and PrivateKeyJWT
  • 4c8e7b3 Merge pull request #886 from azmeuk/885-readme
  • 23b333e docs: fix the readme links
  • Additional commits viewable in compare view

Updates cuda-bindings from 12.9.6 to 12.9.4

Commits

Updates hf-xet from 1.5.0rc0 to 1.5.0

Release notes

Sourced from hf-xet's releases.

[hf-xet v1.5.0] Session based API

Replaces the old upload_files / download_files / hash_files Python functions with a new object-oriented API that exposes XetSession and its child objects directly as PyO3 classes. This gives Python callers full control over session lifecycle, connection pooling, and progress reporting.

The previous module-level functions are kept under hf_xet/src/legacy/ and remain importable as from hf_xet import upload_files etc., but now emit DeprecationWarning.

New Python API

import hf_xet
Optional: create a custom config (immutable; use .with_config() to derive updates)
config = hf_xet.XetConfig().with_config("data.max_concurrent_file_ingestion", 8)
Create session; config is optional (defaults to XetConfig() with HF_XET_* env overrides)
session = hf_xet.XetSession(config=config)
Upload — multiple files, bytes, and streaming within one commit
with session.new_upload_commit(
endpoint="https://cas.xethub.hf.co",
token="jwt", token_expiry_unix_secs=9999999999,
token_refresh_url="https://…/xet-write-token/main",
token_refresh_headers={"Authorization": "Bearer hf_…"},
) as commit:
h1 = commit.start_upload_file("/path/to/model.bin")
h2 = commit.start_upload_file("/path/to/tokenizer.json", sha256="f2358d9a…")
h3 = commit.start_upload_bytes(b"...", name="config.json")
with commit.start_upload_stream(name=&quot;big.bin&quot;) as stream:
for chunk in produce_chunks():
    stream.write(chunk)

on normal exit: wait_to_finish() is called automatically
on exception:   abort() is called automatically
SHA-256 sentinels
commit.start_upload_file("/path/to/model.bin", sha256=hf_xet.COMPUTE_SHA256)  # default
commit.start_upload_file("/path/to/model.bin", sha256=hf_xet.SKIP_SHA256)     # skip
Progress callback — receives (GroupProgressReport, dict[UniqueID, ItemProgressReport])
def on_progress(group, items):
bar.n = group.total_bytes_completed
bar.refresh()
with session.new_upload_commit(
token_refresh_url="https://…/xet-write-token/main",
token_refresh_headers={"Authorization": "Bearer hf_…"},
progress_callback=on_progress,
progress_interval_ms=100,
) as commit:
commit.start_upload_file("/path/to/model.bin")
</tr></table>

... (truncated)

Commits

Updates librt from 0.9.0 to 0.10.0

Commits

Updates nvidia-cuda-nvrtc-cu12 from 12.6.85 to 12.6.77

Updates nvidia-nccl-cu12 from 2.28.9 to 2.27.5

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆️ Bump the uv-dependencies group with 13 updates
d01b65e 
Bumps the uv-dependencies group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.3` | `2.13.4` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.3` | `2.46.4` |
| [setuptools](https://github.com/pypa/setuptools) | `81.0.0` | `82.0.1` |
| [mypy](https://github.com/python/mypy) | `1.20.2` | `2.0.0` |
| [types-python-dateutil](https://github.com/python/typeshed) | `2.9.0.20260408` | `2.9.0.20260508` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260408` | `6.0.12.20260508` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |
| [authlib](https://github.com/authlib/authlib) | `1.7.1` | `1.7.2` |
| [cuda-bindings](https://github.com/NVIDIA/cuda-python) | `12.9.6` | `12.9.4` |
| [hf-xet](https://github.com/huggingface/xet-core) | `1.5.0rc0` | `1.5.0` |
| [librt](https://github.com/mypyc/librt) | `0.9.0` | `0.10.0` |
| [nvidia-cuda-nvrtc-cu12](https://developer.nvidia.com/cuda-zone) | `12.6.85` | `12.6.77` |
| [nvidia-nccl-cu12](https://developer.nvidia.com/cuda-zone) | `2.28.9` | `2.27.5` |


Updates `pydantic` from 2.13.3 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.3...v2.13.4)

Updates `pydantic-core` from 2.46.3 to 2.46.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.46.3...core-v2.46.4)

Updates `setuptools` from 81.0.0 to 82.0.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v81.0.0...v82.0.1)

Updates `mypy` from 1.20.2 to 2.0.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.2...v2.0.0)

Updates `types-python-dateutil` from 2.9.0.20260408 to 2.9.0.20260508
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pyyaml` from 6.0.12.20260408 to 6.0.12.20260508
- [Commits](https://github.com/python/typeshed/commits)

Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

Updates `authlib` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@1.7.1...v1.7.2)

Updates `cuda-bindings` from 12.9.6 to 12.9.4
- [Release notes](https://github.com/NVIDIA/cuda-python/releases)
- [Commits](NVIDIA/cuda-python@v12.9.6...v12.9.4)

Updates `hf-xet` from 1.5.0rc0 to 1.5.0
- [Release notes](https://github.com/huggingface/xet-core/releases)
- [Commits](https://github.com/huggingface/xet-core/commits/1.5.0)

Updates `librt` from 0.9.0 to 0.10.0
- [Commits](mypyc/librt@v0.9.0...v0.10.0)

Updates `nvidia-cuda-nvrtc-cu12` from 12.6.85 to 12.6.77

Updates `nvidia-nccl-cu12` from 2.28.9 to 2.27.5

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: pydantic-core
  dependency-version: 2.46.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: setuptools
  dependency-version: 82.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: uv-dependencies
- dependency-name: mypy
  dependency-version: 2.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: uv-dependencies
- dependency-name: types-python-dateutil
  dependency-version: 2.9.0.20260508
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260508
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-dependencies
- dependency-name: authlib
  dependency-version: 1.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: cuda-bindings
  dependency-version: 12.9.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: hf-xet
  dependency-version: 1.5.0
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: librt
  dependency-version: 0.10.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv-dependencies
- dependency-name: nvidia-cuda-nvrtc-cu12
  dependency-version: 12.6.77
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv-dependencies
- dependency-name: nvidia-nccl-cu12
  dependency-version: 2.27.5
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 8, 2026
@fmigneault fmigneault merged commit 13b9711 into main May 9, 2026
8 checks passed
@fmigneault fmigneault deleted the dependabot/uv/uv-dependencies-6b62791c00 branch May 9, 2026 03:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fmigneault fmigneault fmigneault approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fmigneault