Skip to content

build(deps): bump the python group with 102 updates - #4797

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/python-9e68fc9dc7
Open

dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/python-9e68fc9dc7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the python group with 102 updates:

Package From To
matplotlib 3.10.8 3.10.9
pin-pink 4.3.0 4.4.0
reactivex 4.1.0 5.1.0
pydantic 2.12.5 2.14.1
pydantic-core 2.41.5 2.50.1
python-dotenv 1.2.2 1.2.4
packaging 25.0 26.3
requests 2.32.5 2.34.2
attrs 25.4.0 26.1.0
filelock 3.23.0 4.1.0
lazy-loader 0.5 0.6
plum-dispatch 2.5.7 2.10.1
gitpython 3.1.52 3.2.1
structlog 25.5.0 26.1.0
opencv-contrib-python 4.13.0.92 5.0.0.93
open3d 0.19.0 0.20.0
pydantic-settings 2.12.0 2.15.0
textual 3.7.1 8.2.8
terminaltexteffects 0.12.2 0.15.0
typer 0.23.1 0.27.3
ipython 8.38.0 8.39.0
plotext 5.3.2 6.1.0
numba 0.63.1 0.68.0
llvmlite 0.46.0 0.50.0
rerun-sdk 0.32.0 0.39.0
dimos-viewer 0.32.0a2 0.32.0a3
toolz 1.1.0 1.2.0
protobuf 6.33.5 7.36.2
cryptography 46.0.5 50.0.2
websocket-client 1.9.0 1.9.2
websockets 16.0 16.1.1
ipykernel 7.2.0 7.3.0
gdown 6.0.0 6.4.2
tensorboard 2.20.0 2.21.0
portal 3.7.4 3.8.1
bosdyn-client 5.1.4 5.2.0
bosdyn-api 5.1.4 5.2.0
bosdyn-core 5.1.4 5.2.0
mcap 1.3.1 1.5.0
pyarrow 23.0.0 25.0.1
langchain-core 1.3.3 1.6.11
langchain-openai 1.1.6 1.7.2
langchain-huggingface 1.2.0 1.2.3
langchain-ollama 1.0.1 1.1.0
ollama 0.6.1 0.6.3
openai 2.21.0 3.31.0
sounddevice 0.5.5 0.5.6
fastapi 0.129.0 0.143.2
python-socketio 5.16.1 5.17.0
python-multipart 0.0.27 0.0.32
sse-starlette 3.2.0 3.5.0
starlette 0.52.1 1.7.0
uvicorn 0.40.0 0.54.0
watchfiles 1.2.0 1.3.0
soundfile 0.13.1 0.14.0
timm 1.0.24 1.0.30
pillow 12.2.0 12.3.0
lap 0.5.12 0.5.13
transformers[torch] 4.53.3 5.20.0
huggingface-hub 0.36.2 1.33.0
moondream 0.2.0 2.6.1
omegaconf 2.3.0 2.4.0
hydra-core 1.3.2 1.4.0rc1
tokenizers 0.21.4 0.23.3
unitree-webrtc-connect 2.1.2 2.2.0
cyclonedds 0.10.5 11.0.1
piper-sdk 0.6.1 0.6.2
xarm-python-sdk 1.17.3 1.18.4
cupy-cuda12x 13.6.0 14.2.0
warp-lang 1.13.0 1.18.0
mujoco 3.10.0 3.16.0
gtsam-extended 4.3a1.post1 4.3a2.post202608240418
pymavlink 2.4.49 2.4.50
aiortc 1.14.0 1.15.0
aiohttp 3.14.1 3.14.5
av 16.1.0 17.1.0
reportlab 4.5.0 5.0.1
manifold3d 3.5.1 3.5.4
coacd 1.0.11 1.0.14
usd-core 26.5 26.8
ruff 0.14.3 0.17.1
build 1.5.0 1.6.1
pytest 8.3.5 9.1.1
pytest-mock 3.15.0 3.16.0
pytest-env 1.1.5 1.7.1
pytest-rerunfailures 16.4 16.7
coverage 7.13.4 7.16.2
click 8.3.1 8.5.0
tqdm 4.67.3 4.70.1
traitlets 5.14.3 5.16.1
pre-commit 4.2.0 4.6.2
py-spy 0.4.1 0.4.2
maturin 1.13.3 1.15.0
python-lsp-server[all] 1.14.0 1.15.0
python-lsp-ruff 2.3.0 2.3.4
playwright 1.61.0 1.64.0
mypy 1.19.0 2.4.0
types-pyyaml 6.0.12.20250915 6.0.12.20260906
types-reportlab 4.5.0.20260509 5.0.0.20261008
types-requests 2.32.4.20260107 2.33.0.20261006
pybind11 3.0.4 3.1.0
optuna 4.9.0 5.0.0

Updates matplotlib from 3.10.8 to 3.10.9

Release notes

Sourced from matplotlib's releases.

v3.10.9

This is a micro release of the v3.10.x series. Highlights of this release include:

  • Various minor bug and doc fixes
  • Security hardening validation of cyclers - Removing eval usage
  • Security hardening in Latex and PS calls - Removing shell escapes
Commits
  • dd8d78b REL: v3.10.9
  • 2fb1891 REL: Release prep v3.10.9
  • d0e923a Merge branch 'v3.10.8-doc' into v3.10.x
  • 1637932 Merge pull request #31558 from meeseeksmachine/auto-backport-of-pr-31556-on-v...
  • a83faac Backport PR #31556: FIX: Inverted PyErr_Occurred check in enum type caster (_...
  • a4f57ab Merge pull request #31545 from ksunden/backport-of-pr-31282-on-v3.10.x
  • 063288d Merge pull request #31544 from ksunden/backport-of-pr-31248-on-v3.10.x
  • b2ed196 Backport PR #31248: SEC: Remove eval() from validate_cycler
  • acc6024 Merge pull request #31282 from scottshambaugh/tex_no_shell
  • e3fb541 Merge pull request #31078 from meeseeksmachine/auto-backport-of-pr-31075-on-v...
  • Additional commits viewable in compare view

Updates pin-pink from 4.3.0 to 4.4.0

Release notes

Sourced from pin-pink's releases.

v4.4.0

This release allows custom boundaries in velocity limits, allowing bounds on joints that can't have a limit from their URDF model (such as continuous joints).

Added

  • Limit: Allow custom boundaries in VelocityLimit
  • docs: Document assumption that we start from a feasible configuration
Changelog

Sourced from pin-pink's changelog.

[4.4.0] - 2026-09-09

Added

  • Limit: Allow custom boundaries in VelocityLimit
  • docs: Document assumption that we start from a feasible configuration
Commits
  • c14d0ae Release v4.4.0
  • 5c89057 doc: Add context to configuration limit
  • 7df4f5a Update link to CBF note
  • bfd30c7 lint: Apply pylint recos in FrameTask
  • e71a42b lint: Fix pylint recos in ManipulabilityTask
  • a7ac5aa pixi: Group linting tasks, add format task
  • 771c0e0 lint: Fix two pylint errors
  • f568e80 Update type of velocity_limit attribute
  • 232c9c0 minor: Removed comes before Fixed in Keep a Changelog
  • 3b60614 Update the changelog
  • Additional commits viewable in compare view

Updates reactivex from 4.1.0 to 5.1.0

Release notes

Sourced from reactivex's releases.

v5.1.0

See CHANGELOG.md for details.

v5.0.0

See CHANGELOG.md for details.

v5.0.0rc2

See CHANGELOG.md for details.

v5.0.0a2

What's Changed

Full Changelog: ReactiveX/RxPY@v5.0.0a1...v5.0.0a2

v5.0.0a1

What's Changed

New Contributors

Full Changelog: ReactiveX/RxPY@v4.1.0...v5.0.0a1

Changelog

Sourced from reactivex's changelog.

5.1.0 - 2026-07-27

🚀 Features

  • (operators) Add tap as an alias for do_action (#804) (95c54ac3)

🐞 Bug Fixes

  • (gtk) Call gi.require_version before importing gi.repository (#749) (2b9e3f33)
  • (operators) Accept concurrent.futures.Future wherever futures are accepted (#806) (19da6ac1)
  • (scheduler) Use wall clock time for now() in event loop schedulers (#809) (361951c7)

View changes on Github

5.0.0 - 2026-07-20

🐞 Bug Fixes

  • (scripts) Keep uv.lock in sync and scope the version sed to [project] (#802) (10ccc0a3)

View changes on Github

5.0.0-rc.2 - 2026-07-20

🐞 Bug Fixes

  • (operators) Reset retry budget per subscription to fix retry+repeat (#765) (c3f19d5e)

View changes on Github

5.0.0-rc.1 - 2026-04-20

View changes on Github

  • Typing: Added Action and StartableFactory to reactivex.typing.__all__, making them part of the explicit public API surface.
  • Docs: Added missing docstring to on_error_resume_next operator.
  • Operators: Fixed scheduler forwarding in pairwise, to_marbles, and delay_with_mapper (subscription-delay path). These operators now pass the scheduler argument through to source.subscribe(...) and, in the case of delay_with_mapper, to the subscription-delay observable, consistent with all other pipeable operators. Closes #480 (partial — the operators listed in the issue that were not yet fixed).
  • CI: Skip tests/test_scheduler/test_mainloop/test_tkinterscheduler.py on PyPy (all platforms). The module creates a Tk root at import time; PyPy's _tkinter finalizer calls threading.notify_all during interpreter shutdown and aborts the xdist worker, failing whichever unrelated test was running. Previously guarded only on macOS+PyPy.
  • Fix: reactivex.timer(duetime, period) now correctly resets the initial delay on each resubscription (e.g. via repeat()). Previously `nonlocal

... (truncated)

Commits
  • bbfecfb chore: release reactivex@5.1.0 (#805)
  • b286407 docs: correct and expand the GIL free-threading note (#811)
  • 93a4f04 docs: explain how to parallelize work within a single stream (#810)
  • 2271867 Revise GIL section for Python 3.13 updates (#742)
  • 361951c fix(scheduler): use wall clock time for now() in event loop schedulers (#809)
  • b809222 docs: read version from pyproject instead of git tags (#808)
  • 19e8080 ci(deps): bump the github-actions group with 2 updates (#807)
  • dd9b8ec refactor(combine-latest): simplify logic by removing redundant loops … (#736)
  • 19da6ac fix(operators): accept concurrent.futures.Future wherever futures are accepte...
  • 2b9e3f3 fix(gtk): call gi.require_version before importing gi.repository (#749)
  • Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pydantic-core from 2.41.5 to 2.50.1

Commits

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • Additional commits viewable in compare view

Updates packaging from 25.0 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:
  • Add a public :class:~packaging.ranges.VersionRange API and
    :meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    representing the versions a specifier set accepts as an interval set that
    supports intersection, union, difference, complement, set relations,
    membership tests, and filtering.
    :meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    (:pull:1267, :pull:1270, :pull:1298)
  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
  • Add a limit argument to parse_tag() for compressed tag sets.
    (:issue:1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    source distributions over wheels for selected packages. (:pull:1334)
  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    tags for a Python version without touching the running platform.
    (:pull:1346)
  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    (:pull:1157)
  • Prefer native linux_* platform tags over manylinux and musllinux
    tags on Linux. (:issue:160)

Fixes for versions and specifiers:

  • Raise InvalidVersion instead of TypeError when Version is given a
    non-string. (:pull:1319)
  • Raise InvalidVersion for non-string pre-release letters passed to
    Version.from_parts. (:pull:1241)
  • Fix an AttributeError when hashing internally trimmed versions.
    (:pull:1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    intersections. (:pull:1257)

Fixes for requirements and markers:

  • Make Requirement.__hash__ consistent with __eq__ for
    trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    sets and dicts. (:pull:1232)
    </tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need t...

    Description has been truncated

---
updated-dependencies:
- dependency-name: matplotlib
  dependency-version: 3.10.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pin-pink
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: reactivex
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pydantic-core
  dependency-version: 2.50.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: attrs
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: filelock
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: lazy-loader
  dependency-version: '0.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: plum-dispatch
  dependency-version: 2.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gitpython
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: structlog
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: opencv-contrib-python
  dependency-version: 5.0.0.93
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: open3d
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: textual
  dependency-version: 8.2.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: terminaltexteffects
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ipython
  dependency-version: 8.39.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: plotext
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: numba
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: llvmlite
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: rerun-sdk
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: dimos-viewer
  dependency-version: 0.32.0a3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: toolz
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ipykernel
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gdown
  dependency-version: 6.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: tensorboard
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: portal
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-client
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-api
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-core
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mcap
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pyarrow
  dependency-version: 25.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: langchain-core
  dependency-version: 1.6.11
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain-openai
  dependency-version: 1.7.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain-huggingface
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: langchain-ollama
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ollama
  dependency-version: 0.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: openai
  dependency-version: 3.31.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: sounddevice
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: fastapi
  dependency-version: 0.143.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-socketio
  dependency-version: 5.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: sse-starlette
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: soundfile
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: timm
  dependency-version: 1.0.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: lap
  dependency-version: 0.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: transformers[torch]
  dependency-version: 5.20.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: huggingface-hub
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: moondream
  dependency-version: 2.6.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: omegaconf
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: hydra-core
  dependency-version: 1.4.0rc1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: tokenizers
  dependency-version: 0.23.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: unitree-webrtc-connect
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: cyclonedds
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: piper-sdk
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: xarm-python-sdk
  dependency-version: 1.18.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: cupy-cuda12x
  dependency-version: 14.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: warp-lang
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mujoco
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gtsam-extended
  dependency-version: 4.3a2.post202608240418
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pymavlink
  dependency-version: 2.4.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: aiortc
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: av
  dependency-version: 17.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: manifold3d
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: coacd
  dependency-version: 1.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: usd-core
  dependency-version: '26.8'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pytest-mock
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest-env
  dependency-version: 1.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest-rerunfailures
  dependency-version: '16.7'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: traitlets
  dependency-version: 5.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: py-spy
  dependency-version: 0.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: maturin
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-lsp-server[all]
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-lsp-ruff
  dependency-version: 2.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: playwright
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: types-reportlab
  dependency-version: 5.0.0.20261008
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: types-requests
  dependency-version: 2.33.0.20261006
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pybind11
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: optuna
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026
@dependabot
dependabot Bot requested a review from TomCC7 as a code owner October 23, 2026 06:19
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Oct 23, 2026
@github-actions github-actions Bot added first-time-contributor PR opened by an author who had not previously committed to this repository backport:skip Skip creating a backport to any release branches labels Oct 23, 2026
@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

@greptile-apps

greptile-apps Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 4/5

[Medium impact] The updates reach dimos runtime users, optional feature users, and its development workflows.

Do not merge until the terminal plotting regression is fixed. The Ruff mismatch and outdated OpenCV comment are non-blocking.

Findings

  1. P1 Terminal plots stop working ▶
  2. P2 Ruff versions disagree ▶
  3. P2 OpenCV explanation contradicts bound ▶

Summary

Updates Python dependencies and refreshes uv.lock, including several major-version upgrades.

  • dimos now resolves refreshed Python packages across runtime and development groups.

The terminal plotting regression blocks merging as written.

Reviews (1) · Last reviewed commit: "build(deps): bump the python group with ..." · Reviewed by Greptile

Comment thread pyproject.toml
"ipython",
"rich>=14.3", # cli/dtop.py, cli/shell.py, memory/utils
"plotext==5.3.2",
"plotext==6.1.0",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Terminal plots stop working

plotext==6.1.0 removes the module-level API used by dimos/cli/plot.py. Both Plot.build() and bar() immediately call plt.clf() and now raise AttributeError instead of rendering a chart. The occupancy benchmark's results chart fails through the same helper. These calls work with the previous plotext==5.3.2 pin. Keep version 5 until the helpers are migrated to the new figure API; this regression needs to be fixed before merging.

Artifacts

Executable terminal plotting probe

  • Executed this same probe against both dependency versions to exercise real helpers and the occupancy chart expression, isolating the regression.

Executed comparison and capture commands

  • Ran this driver to capture both probe executions and numbered repository source, preserving commands and exit codes.

Terminal charts with base plotext 5.3.2

  • Ran the probe with isolated plotext 5.3.2 and captured three rendered charts with exit 0, showing the helpers work before the upgrade.

Terminal chart failures with head plotext 6.1.0

  • Ran the identical probe with the prepared head environment and captured three missing-clf tracebacks with exit 1, confirming the regression.

Dependency change and exact helper source ranges

  • Captured commit hashes, the dependency diff, numbered helper and caller source, and a clean tracked diff, tying the runtime failures to the unchanged calls.

View artifacts

TREX Ran code and verified through TREX

Comment thread pyproject.toml
[dependency-groups]
# For autofix.yml
autofix = ["ruff==0.14.3"]
autofix = ["ruff==0.17.1"]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Ruff versions disagree

The new ruff==0.17.1 pins leave .pre-commit-config.yaml on v0.14.3. Autofix therefore uses a different formatter from the pre-commit hooks run by CI. A function-body blank line preserved and accepted by 0.17.1 is rejected by 0.14.3, so autofix output can still require formatting changes in CI. This is a non-blocking workflow inconsistency; update the pre-commit revision alongside both dependency groups.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Complete executable Ruff validation script

  • The uploaded Python harness derives the pins and executes the same fixture through both formatting paths, making the comparison reproducible.

Ruff pins and workflow source citations

  • Executed source inspection captures the parent/current Ruff pins, numbered workflow references, and clean tracked diff, confirming the mismatch without modifying tracked files.

Formatting agreement before the Ruff upgrade

  • Executed Ruff 0.14.3 through both paths on the same fixture, showing that the previous versions agree.

Old CI formatter rejects new autofix output

  • Executed Ruff 0.17.1 autofix output through Ruff 0.14.3, showing an exit-1 formatting check and removal of the preserved blank line.

View artifacts

TREX Ran code and verified through TREX

Comment thread pyproject.toml
# trackers (perception/drone) are contrib-only. <5 defers the OpenCV 5
# major bump. See also the opencv-python entry in override-dependencies.
"opencv-contrib-python>=4.8,<5",
"opencv-contrib-python>=4.8,<6",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 OpenCV explanation contradicts bound

Changing this bound to <6 makes the adjacent explanation false: it still says <5 defers OpenCV 5, but uv.lock now selects 5.0.0.93. This is a non-blocking documentation mismatch that can mislead maintainers about the supported dependency range. Update the comment to describe the intended bound.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Executed OpenCV comment consistency script

  • The same authored script parsed both revisions and checked the comment, manifest bound, and locked version without importing OpenCV, isolating the documentation mismatch.

Consistency assertion before the PR

  • Ran the assertion against the parent manifest and lock, showing that the <5 comment and bound agreed with locked version 4.13.0.92.

Consistency assertion with the PR

  • Ran the identical assertion against the PR and read installed metadata, showing that the unchanged <5 comment contradicts the <6 bound and version 5.0.0.93.

Tracked files unchanged after validation

  • Ran git diff --exit-code HEAD -- after validation and captured exit 0, confirming no tracked modifications.

View artifacts

TREX Ran code and verified through TREX

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

This branch was successfully deployed

1 active deployment
cachix — e46944f3 Deployed Oct 23, 2026 by autofix-ci[bot] via cachix-build-macos #14092
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip Skip creating a backport to any release branches dependencies Pull requests that update a dependency file first-time-contributor PR opened by an author who had not previously committed to this repository python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants