Skip to content

build(deps): bump the python group with 85 updates - #4294

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/python-31da9d5df7
Open

build(deps): bump the python group with 85 updates#4294
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/python-31da9d5df7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 85 updates:

Package From To
pin-pink 4.3.0 4.4.0
reactivex 4.1.0 5.1.0
pydantic 2.12.5 2.13.5
python-dotenv 1.2.2 1.2.3
packaging 25.0 26.3
plum-dispatch 2.5.7 2.10.1
gitpython 3.1.52 3.1.62
structlog 25.5.0 26.1.0
opencv-contrib-python 4.13.0.92 5.0.0.93
open3d 0.19.0 0.20.0
pydantic-settings 2.12.0 2.15.0
textual 3.7.1 8.2.8
terminaltexteffects 0.12.2 0.15.0
typer 0.23.1 0.27.2
ipython 8.38.0 8.39.0
plotext 5.3.2 6.1.0
numba 0.63.1 0.67.0
llvmlite 0.46.0 0.49.0
rerun-sdk 0.32.0 0.38.1
protobuf 6.33.5 7.36.2
cryptography 46.0.5 50.0.1
websocket-client 1.9.0 1.9.2
ipykernel 7.2.0 7.3.0
open-clip-torch 3.2.0 3.3.0
gdown 6.0.0 6.4.0
tensorboard 2.20.0 2.21.0
portal 3.7.4 3.8.1
bosdyn-client 5.1.4 5.2.0
bosdyn-api 5.1.4 5.2.0
bosdyn-core 5.1.4 5.2.0
pyarrow 23.0.0 25.0.1
langchain-core 1.3.3 1.6.3
langchain-openai 1.1.6 1.6.2
langchain-huggingface 1.2.0 1.2.2
langchain-ollama 1.0.1 1.1.0
ollama 0.6.1 0.6.2
openai 2.21.0 3.15.0
sounddevice 0.5.5 0.5.6
fastapi 0.129.0 0.141.1
python-socketio 5.16.1 5.17.0
python-multipart 0.0.27 0.0.32
sse-starlette 3.2.0 3.4.11
uvicorn 0.40.0 0.53.0
soundfile 0.13.1 0.14.0
timm 1.0.24 1.0.29
pillow 12.2.0 12.3.0
lap 0.5.12 0.5.13
transformers[torch] 4.53.3 5.17.0
moondream 0.2.0 2.3.0
omegaconf 2.3.0 2.3.1
hydra-core 1.3.2 1.3.7
unitree-webrtc-connect 2.1.2 2.2.0
cyclonedds 0.10.5 11.0.1
mcap 1.3.1 1.4.0
piper-sdk 0.6.1 0.6.2
xarm-python-sdk 1.17.3 1.18.4
roboplan 0.6.0 0.6.1
matplotlib 3.10.8 3.10.9
cupy-cuda12x 13.6.0 14.2.0
mujoco 3.10.0 3.13.0
gtsam-extended 4.3a1.post1 4.3a2.post202608240418
aiortc 1.14.0 1.15.0
aiohttp 3.14.1 3.14.3
reportlab 4.5.0 5.0.1
manifold3d 3.5.1 3.5.3
coacd 1.0.11 1.0.14
usd-core 26.5 26.8
ruff 0.14.3 0.16.8
pytest 8.3.5 9.1.1
pytest-mock 3.15.0 3.15.1
pytest-env 1.1.5 1.7.1
pytest-rerunfailures 16.4 16.7
coverage 7.13.4 7.16.1
pre-commit 4.2.0 4.6.2
py-spy 0.4.1 0.4.2
maturin 1.13.3 1.15.0
python-lsp-server[all] 1.14.0 1.15.0
python-lsp-ruff 2.3.0 2.3.4
playwright 1.61.0 1.63.0
mypy 1.19.0 2.3.1
types-pyyaml 6.0.12.20250915 6.0.12.20260906
types-reportlab 4.5.0.20260509 5.0.0.20260911
types-requests 2.32.4.20260107 2.33.0.20260906
pybind11 3.0.4 3.1.0
optuna 4.9.0 5.0.0

Updates pin-pink from 4.3.0 to 4.4.0

Release notes

Sourced from pin-pink's releases.

v4.4.0

This release allows custom boundaries in velocity limits, allowing bounds on joints that can't have a limit from their URDF model (such as continuous joints).

Added

  • Limit: Allow custom boundaries in VelocityLimit
  • docs: Document assumption that we start from a feasible configuration
Changelog

Sourced from pin-pink's changelog.

[4.4.0] - 2026-09-09

Added

  • Limit: Allow custom boundaries in VelocityLimit
  • docs: Document assumption that we start from a feasible configuration
Commits
  • c14d0ae Release v4.4.0
  • 5c89057 doc: Add context to configuration limit
  • 7df4f5a Update link to CBF note
  • bfd30c7 lint: Apply pylint recos in FrameTask
  • e71a42b lint: Fix pylint recos in ManipulabilityTask
  • a7ac5aa pixi: Group linting tasks, add format task
  • 771c0e0 lint: Fix two pylint errors
  • f568e80 Update type of velocity_limit attribute
  • 232c9c0 minor: Removed comes before Fixed in Keep a Changelog
  • 3b60614 Update the changelog
  • Additional commits viewable in compare view

Updates reactivex from 4.1.0 to 5.1.0

Release notes

Sourced from reactivex's releases.

v5.1.0

See CHANGELOG.md for details.

v5.0.0

See CHANGELOG.md for details.

v5.0.0rc2

See CHANGELOG.md for details.

v5.0.0a2

What's Changed

Full Changelog: ReactiveX/RxPY@v5.0.0a1...v5.0.0a2

v5.0.0a1

What's Changed

New Contributors

Full Changelog: ReactiveX/RxPY@v4.1.0...v5.0.0a1

Changelog

Sourced from reactivex's changelog.

5.1.0 - 2026-07-27

🚀 Features

  • (operators) Add tap as an alias for do_action (#804) (95c54ac3)

🐞 Bug Fixes

  • (gtk) Call gi.require_version before importing gi.repository (#749) (2b9e3f33)
  • (operators) Accept concurrent.futures.Future wherever futures are accepted (#806) (19da6ac1)
  • (scheduler) Use wall clock time for now() in event loop schedulers (#809) (361951c7)

View changes on Github

5.0.0 - 2026-07-20

🐞 Bug Fixes

  • (scripts) Keep uv.lock in sync and scope the version sed to [project] (#802) (10ccc0a3)

View changes on Github

5.0.0-rc.2 - 2026-07-20

🐞 Bug Fixes

  • (operators) Reset retry budget per subscription to fix retry+repeat (#765) (c3f19d5e)

View changes on Github

5.0.0-rc.1 - 2026-04-20

View changes on Github

  • Typing: Added Action and StartableFactory to reactivex.typing.__all__, making them part of the explicit public API surface.
  • Docs: Added missing docstring to on_error_resume_next operator.
  • Operators: Fixed scheduler forwarding in pairwise, to_marbles, and delay_with_mapper (subscription-delay path). These operators now pass the scheduler argument through to source.subscribe(...) and, in the case of delay_with_mapper, to the subscription-delay observable, consistent with all other pipeable operators. Closes #480 (partial — the operators listed in the issue that were not yet fixed).
  • CI: Skip tests/test_scheduler/test_mainloop/test_tkinterscheduler.py on PyPy (all platforms). The module creates a Tk root at import time; PyPy's _tkinter finalizer calls threading.notify_all during interpreter shutdown and aborts the xdist worker, failing whichever unrelated test was running. Previously guarded only on macOS+PyPy.
  • Fix: reactivex.timer(duetime, period) now correctly resets the initial delay on each resubscription (e.g. via repeat()). Previously `nonlocal

... (truncated)

Commits
  • bbfecfb chore: release reactivex@5.1.0 (#805)
  • b286407 docs: correct and expand the GIL free-threading note (#811)
  • 93a4f04 docs: explain how to parallelize work within a single stream (#810)
  • 2271867 Revise GIL section for Python 3.13 updates (#742)
  • 361951c fix(scheduler): use wall clock time for now() in event loop schedulers (#809)
  • b809222 docs: read version from pyproject instead of git tags (#808)
  • 19e8080 ci(deps): bump the github-actions group with 2 updates (#807)
  • dd9b8ec refactor(combine-latest): simplify logic by removing redundant loops … (#736)
  • 19da6ac fix(operators): accept concurrent.futures.Future wherever futures are accepte...
  • 2b9e3f3 fix(gtk): call gi.require_version before importing gi.repository (#749)
  • Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates packaging from 25.0 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates plum-dispatch from 2.5.7 to 2.10.1

Release notes

Sourced from plum-dispatch's releases.

v2.10.1

v2.10.0

v2.9.0

  • Support union aliases in Python 3.14 and later (@​nstarman).

v2.8.0

Starting this release, Plum will be available on PyPI as both plum-dispatch and plum.

v2.7.1

  • Add faithful keyword to ModuleType.

v2.7.0

Note: All imports should now go through plum directly! That is, not plum.signature.Signature, but plum.Signature. Please do open an issue if this release breaks something that shouldn't break.

Changes:

v2.6.1

This release features numerous very helpful contributions and improvements by @​nstarman!

  • Use dependency groups (#195).
  • Treat typing_extensions as standard library and make more use of it (#226 and #232).
  • Complete deprecation cycles (#230 and #236).
  • Turn various arguments into positional-only (#229).
  • Remove unnecessary path manipulation (#233).
  • Rework tests with a dispatch fixture (#234).
  • Avoid using a deprecated NumPy module (#231).
  • Drops support for Python 3.9 (#228).
  • Import exports from methods.py (#237).
  • Fixes an incorrect overload (#238).
  • Use nox for testing (#235 and #240).

#228 also fixes an important bug to do with the handling of unions (CC @​davidwyld).

v2.6.0

... (truncated)

Commits
  • c835c8c fix(mypyc): keep Function weak-referenceable on the compiled wheels (#319)
  • 192f2ed Build macOS arm64 mypyc wheels (#320)
  • ca6c5be perf(type): memoise the wrapper used by signature comparison (#301)
  • c44e0cf fix: Any must not collide with concrete types under beartype>=0.23 (#296)
  • 15dcdbe build(mypyc): make _BoundFunction native too (#289)
  • 89fdeec build(deps): bump tornado from 6.5.7 to 6.5.8 (#299)
  • b345a24 build(mypyc): compile _function natively for faster dispatch (#288) (#288)
  • d6bb8a0 build(deps): bump cryptography from 48.0.1 to 50.0.0 (#294)
  • 6840ebb build(mypyc): compile _type via a guarded mypyc_attr shim (#287)
  • 55c8653 Simplify code a little
  • Additional commits viewable in compare view

Updates gitpython from 3.1.52 to 3.1.62

Release notes

Sourced from gitpython's releases.

3.1.62

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

3.1.60 Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

3.1.59 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

... (truncated)

Commits
  • db47516 prepare new release
  • 10ec385 get better commit messages from agents
  • b754897 test: cover subdirectory discovery and pathspec commands in bare-repo worktre...
  • 9ebf8b6 Merge pull request #2227 from nkbeast/fix-config-backslash-continuation
  • a15f791 fix: parse joined config values as a whole
  • 60dd946 fix: ignore continuation markers in config comments
  • 075a664 fix: join backslash line continuations when reading config values
  • 62d1e2f Merge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...
  • 23d0e92 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
  • 8a14adc Merge pull request #2225 from gitpython-developers/submodule-path-hardening
  • Additional commits viewable in compare view

Updates structlog from...

Description has been truncated

@dependabot
build(deps): bump the python group with 85 updates
a242d7c 
---
updated-dependencies:
- dependency-name: pin-pink
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: reactivex
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: plum-dispatch
  dependency-version: 2.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gitpython
  dependency-version: 3.1.62
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: structlog
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: opencv-contrib-python
  dependency-version: 5.0.0.93
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: open3d
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: textual
  dependency-version: 8.2.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: terminaltexteffects
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ipython
  dependency-version: 8.39.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: plotext
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: numba
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: llvmlite
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: rerun-sdk
  dependency-version: 0.38.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ipykernel
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: open-clip-torch
  dependency-version: 3.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gdown
  dependency-version: 6.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: tensorboard
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: portal
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-client
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-api
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: bosdyn-core
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pyarrow
  dependency-version: 25.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: langchain-core
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain-openai
  dependency-version: 1.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain-huggingface
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: langchain-ollama
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ollama
  dependency-version: 0.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: openai
  dependency-version: 3.15.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: sounddevice
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-socketio
  dependency-version: 5.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-multipart
  dependency-version: 0.0.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: sse-starlette
  dependency-version: 3.4.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: soundfile
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: timm
  dependency-version: 1.0.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: lap
  dependency-version: 0.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: transformers[torch]
  dependency-version: 5.17.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: moondream
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: omegaconf
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: hydra-core
  dependency-version: 1.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: unitree-webrtc-connect
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: cyclonedds
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: mcap
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: piper-sdk
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: xarm-python-sdk
  dependency-version: 1.18.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: roboplan
  dependency-version: 0.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: matplotlib
  dependency-version: 3.10.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: cupy-cuda12x
  dependency-version: 14.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: mujoco
  dependency-version: 3.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: gtsam-extended
  dependency-version: 4.3a2.post202608240418
  dependency-type: direct:production
  dependency-group: python
- dependency-name: aiortc
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: manifold3d
  dependency-version: 3.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: coacd
  dependency-version: 1.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: usd-core
  dependency-version: '26.8'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pytest-mock
  dependency-version: 3.15.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pytest-env
  dependency-version: 1.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest-rerunfailures
  dependency-version: '16.7'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: coverage
  dependency-version: 7.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: py-spy
  dependency-version: 0.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: maturin
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-lsp-server[all]
  dependency-version: 1.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-lsp-ruff
  dependency-version: 2.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: types-reportlab
  dependency-version: 5.0.0.20260911
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: types-requests
  dependency-version: 2.33.0.20260906
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pybind11
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: optuna
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 25, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 25, 2026
@github-actions github-actions Bot added backport:skip Skip creating a backport to any release branches first-time-contributor PR opened by an author who had not previously committed to this repository labels Sep 25, 2026
@codecov

codecov Bot commented Sep 25, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

@greptile-apps

greptile-apps Bot commented Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

RetriggerConfidence Score: 4/5

[High risk] Bumps 85 Python dependencies across the project.

Do not merge until Florence-2 loads with the selected Transformers version. The Ruff and OpenCV comment issues do not independently block merging.

Findings

  1. P1 Florence-2 fails to load ▶
  2. P2 Ruff fixes differ ▶
  3. P2 OpenCV comment is outdated ▶

Summary

This dependency update selects a Transformers version that prevents Florence-2 from loading, so that failure must be fixed before merging. It also leaves Ruff's autofix and pre-commit versions inconsistent and the OpenCV constraint comment outdated.

Reviews (1) · Last reviewed commit: "build(deps): bump the python group with ..."

greptile-apps[bot]
greptile-apps Bot reviewed Sep 25, 2026
View reviewed changes
Comment thread pyproject.toml
"Pillow",
"lap>=0.5.12",
"transformers[torch]>=4.53.0,<4.54",
"transformers[torch]>=4.53.0,<5.18",

@greptile-apps greptile-apps Bot Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Florence-2 fails to load

The perception dependency range admits Transformers 5.17.0, which the test dependencies pin. With that version, the existing loader fails while constructing the Microsoft Florence-2 checkpoint configuration, before captioning can begin. The same loader and checkpoint load with Transformers 4.53.3. Keep a compatible version or update and validate the loader before merging.

Knowledge Base Used: Perception pipeline

Artifacts

Executable Florence-2 loader reproduction

  • This script executes the checked-in loader method against Microsoft's checkpoint with either dependency environment, enabling the side-by-side result.

Florence-2 load with Transformers 4.53.3

  • The recorded command in /home/user/repo exited 0 and loaded the model on CPU, establishing the prior-version behavior.

Florence-2 load with Transformers 5.17.0

  • The recorded command in /home/user/repo exited 1 at the remote configuration’s forced_bos_token_id access, demonstrating the candidate-version failure.

View artifacts

T-Rex Ran code and verified through T-Rex

Comment thread pyproject.toml
[dependency-groups]
# For autofix.yml
autofix = ["ruff==0.14.3"]
autofix = ["ruff==0.16.8"]

@greptile-apps greptile-apps Bot Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Ruff fixes differ

Autofix now uses Ruff 0.16.8, while the pre-commit hooks remain on 0.14.3. On the same input, the older hook accepts duplicate __all__ entries that the newer autofix removes. This non-blocking mismatch means local checks and autofix can apply different fixes, causing avoidable churn.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Ruff version comparison command script

  • The executed script applies each pinned Ruff version to identical Python input under the repository configuration, making the comparison repeatable.

Pre-commit Ruff 0.14.3 run

  • The executed hook-version commands leave duplicate `__all__` entries unchanged and pass, showing the older fix behavior.

Autofix Ruff 0.16.8 run

  • The executed autofix-version commands remove one duplicate `__all__` entry, showing the differing fix behavior.

Ruff rule diagnosis and tracked-file check

  • The executed checks identify RUF068 in 0.16.8 but not 0.14.3 and confirm that validation left tracked files unchanged.

View artifacts

T-Rex Ran code and verified through T-Rex

Comment thread pyproject.toml
# trackers (perception/drone) are contrib-only. <5 defers the OpenCV 5
# major bump. See also the opencv-python entry in override-dependencies.
"opencv-contrib-python>=4.8,<5",
"opencv-contrib-python>=4.8,<6",

@greptile-apps greptile-apps Bot Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 OpenCV comment is outdated

The new <6 constraint permits OpenCV 5, and the lockfile selects opencv-contrib-python==5.0.0.93, but the adjacent comment still says the constraint defers that major upgrade. This non-blocking documentation error could mislead future dependency changes; update the comment to reflect the selected version.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Authored OpenCV constraint and lock query

  • The executed Python script parses each revision's project and lock TOML and checks the selected version against the constraint.

Before PR: OpenCV contrib 4.13 lock resolution

  • Running the query against `HEAD^` showed a `<5` constraint, a 4.13.0.92 lock selection, and exclusion of OpenCV 5.

After PR: OpenCV contrib 5.0 lock resolution

  • Running the same query against `HEAD` showed a `<6` constraint, a 5.0.0.93 lock selection, and the separate plain-OpenCV override.

Locked core-install plan selecting OpenCV contrib 5

  • An offline `uv sync` dry run resolved the lock and reported that it would install `opencv-contrib-python==5.0.0.93`.

View artifacts

T-Rex Ran code and verified through T-Rex

@greptile-apps

greptile-apps Bot commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

  • P1 Transformers 5.17.0 breaks loading Microsoft's Florence-2 checkpoint ▶

    • Bug
      • The same repository loader and microsoft/Florence-2-base checkpoint load under the prior 4.53.3 pin but fail under the new 5.17.0 pin, before captioning can begin.
    • Cause
      • dimos/models/vl/florence.py:52 selects AutoModelForCausalLM. Its inherited loader at dimos/models/base.py:186 calls from_pretrained with trust_remote_code=True. During configuration construction, the checkpoint’s remote configuration_florence2.py:265 accesses self.forced_bos_token_id, which is absent under Transformers 5.17.0. The candidate introduces that version at pyproject.toml:247 and pins it at line 392.
    • Fix
      • Retain a Transformers version compatible with the checkpoint, or migrate and validate the loader against a Florence-2 checkpoint and model implementation compatible with Transformers 5.17.0.

  • P1 Root dependency admits and locks OpenCV contrib 5 despite the stated major-version deferral ▶

    • Bug
      • The changed constraint permits OpenCV 5, and uv.lock resolves the core dependency to opencv-contrib-python==5.0.0.93; the locked install plan includes that version. This changes the intended 4.x major-version boundary.
    • Cause
      • pyproject.toml:132 raises the upper bound from <5 to <6. The adjacent comment still states that <5 defers OpenCV 5. The override for opencv-python applies to a different distribution.
    • Fix
      • If deferring OpenCV 5 remains intentional, restore <5 and regenerate the lockfile; otherwise explicitly approve the major upgrade and update the comment.

  • P2 Autofix and pre-commit use different Ruff fix sets ▶

    • Bug
      • The autofix workflow can modify Python code that the pre-commit Ruff hook considers clean. For duplicate __all__ entries, the hook’s 0.14.3 check passes, while autofix’s 0.16.8 check removes an entry. This creates inconsistent local and CI fixes; it does not establish a formatting difference.
    • Cause
      • pyproject.toml:381 pins autofix to Ruff 0.16.8, but .pre-commit-config.yaml:31 still pins its Ruff hooks to 0.14.3.
    • Fix
      • Update the pre-commit Ruff hook revision to v0.16.8 so the hooks and autofix use the same version.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leshy leshy Awaiting requested review from leshy leshy is a code owner
@paul-nechifor paul-nechifor Awaiting requested review from paul-nechifor paul-nechifor is a code owner
@spomichter spomichter Awaiting requested review from spomichter spomichter is a code owner
@mustafab0 mustafab0 Awaiting requested review from mustafab0 mustafab0 is a code owner
@Dreamsorcerer Dreamsorcerer Awaiting requested review from Dreamsorcerer Dreamsorcerer is a code owner
@aclauer aclauer Awaiting requested review from aclauer aclauer is a code owner
@bogwi bogwi Awaiting requested review from bogwi bogwi is a code owner
@jeff-hykin jeff-hykin Awaiting requested review from jeff-hykin jeff-hykin is a code owner
@TomCC7 TomCC7 Awaiting requested review from TomCC7 TomCC7 is a code owner
1 more reviewer
@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

backport:skip Skip creating a backport to any release branches dependencies Pull requests that update a dependency file first-time-contributor PR opened by an author who had not previously committed to this repository python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants