chore(deps):(deps): bump the uv group across 1 directory with 7 updates by dependabot[bot] · Pull Request #6390 · daggerstuff/pixelated

dependabot · 2026-10-26T03:16:41Z

Bumps the uv group with 7 updates in the /apps/web/src/lib/ai/multimodal-bias-detection/python-service directory:

Package	From	To
fastapi	`0.143.3`	`0.161.1`
pydantic-settings	`2.16.0`	`2.16.1`
transformers	`5.20.1`	`5.20.2`
sqlalchemy	`2.1.5`	`2.1.6`
alembic	`1.20.0`	`1.20.1`
pandas	`3.0.6`	`3.1.0`
starlette	`1.8.0`	`1.9.0`

Updates fastapi from 0.143.3 to 0.161.1

Release notes

Sourced from fastapi's releases.

0.161.1

Fixes

🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @tiangolo.

0.161.0

Features

✨ Add support for combining unions of form models. PR #16596 by @tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @tiangolo.

Internal

⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @dependabot[bot].

0.159.1

Features

✨ Add support for optional unions of form models. PR #16586 by @tiangolo.

0.159.0

Features

✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @tiangolo.

0.158.2

Features

✨ Add support for optional form models. PR #16582 by @tiangolo.

0.158.1

Fixes

🐛 Preserve form media types in OpenAPI. PR #16579 by @tiangolo.

0.158.0

Features

✨ Add support for combining form models. PR #16577 by @tiangolo.

0.157.0

Features

... (truncated)

Commits

69ddc2b 🔖 Release version 0.161.1 (#16599)
0cafa07 📝 Update release notes
f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
80c8742 🔖 Release version 0.161.0 (#16597)
b105209 📝 Update release notes
e42ac0a ✨ Add support for combining unions of form models (#16596)
addd077 🔖 Release version 0.160.0 (#16595)
352a4ed 📝 Update release notes
91a335c 🐛 Apply each parameter model's extra configuration to sibling fields (#16594)
ce6ee83 📝 Update release notes
Additional commits viewable in compare view

Updates pydantic-settings from 2.16.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.

A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Harden CI by @Viicos in pydantic/pydantic-settings#1044

Keep list of dicts CLI values as lists by @hramezani in pydantic/pydantic-settings#1049

Keep fixed-length tuple CLI positionals single-valued by @hramezani in pydantic/pydantic-settings#1069

Prepare release 2.16.1 by @hramezani in pydantic/pydantic-settings#1087

build(deps): bump the python-packages group with 3 updates by @dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

Commits

4e286e2 Prepare release 2.16.1 (#1087)
993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
f651a7a Keep list of dicts CLI values as lists (#1049)
ecf7d90 Harden CI (#1044)
See full diff in compare view

Updates transformers from 5.20.1 to 5.20.2

Release notes

Sourced from transformers's releases.

Patch release v5.20.2

Patch release: v5.20.2

This patch notably solves an issue where some inputs could loose their original type inside prepare_inputs_for_generation in generate, leading to problems with multimodal models. It also fixes some other issues listed on the below commits.

It contains the following commits:

Fix inputs dict casting in generate (#49731) by @Cyrilvallez

Fix zero expert gradients in bfloat16 with expert parallelism and ep_size < fsdp_size (#49688) by @qgallouedec

Declare the input modalities of the VLMs that report text only (#49677) by @qgallouedec

Avoid a host-to-device copy in eager_mask (#49684) by @hmellor

Commits

18329f1 Release: v5.20.2
2ce3082 Avoid a host-to-device copy in eager_mask (#49684)
62bc6fd Declare the input modalities of the VLMs that report text only (#49677)
30f4e38 Fix zero expert gradients in bfloat16 with expert parallelism and ep_size < f...
ce8231f Fix inputs dict casting in generate (#49731)
See full diff in compare view

Updates sqlalchemy from 2.1.5 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

[orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

This change is also backported to: 2.0.56

References: #13711

[orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

References: #13701

[orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

References: #13709

orm extensions

[bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

This change is also backported to: 2.0.56

References: #13680

... (truncated)

Commits

See full diff in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

[bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

References: #1085

[bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

References: #1360

[bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

References: #1462

[bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

[bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

See full diff in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

New DataFrame.select() and updated DataFrame.filter() method

Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:
python -m pip install --upgrade pandas
Or from conda-forge
conda install -c conda-forge pandas
Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:
python -m pip install --upgrade --pre pandas==3.1.0rc0
Or from conda-forge
conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0
Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

c6f4676 RLS: 3.1.0
dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
Additional commits viewable in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.

Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.

Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.

Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.

Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

1840c9d Version 1.9.0 (#3676)
750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
414af4f Remove unmaintained packages from the third-party packages page (#3674)
d4df01a Add adminsite to the third-party packages (#3654)
1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
6b11cd7 Honor streaming responses in TestClient (#3491)
b7901fb Use byte length for typed memoryview response bodies (#3622)
3214cd0 Escape path delimiters and leading // when building URLs (#3671)
See full diff in compare view

vercel · 2026-10-26T03:16:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 26, 2026 6:43am UTC

dependabot · 2026-10-26T03:16:47Z

Labels

The following labels could not be found: uv. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-10-26T03:17:38Z

px Advisor Review

Risk: unknown

No summary available

No findings.

github-actions · 2026-10-26T03:20:39Z

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

lhr-1792984745765
lhr-1792984757537
lhr-1792984768830
lhr-1792984779594
lhr-1792984790264
lhr-1792984800953
lhr-1792984811567
lhr-1792984822195
lhr-1792984832806

Reports are also available as workflow artifacts

daggerstuff · 2026-10-26T05:57:33Z

@dependabot rebase

github-actions · 2026-10-26T06:38:57Z

px Advisor Review

Risk: unknown

No summary available

No findings.

github-actions · 2026-10-26T06:39:25Z

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

lhr-1792996665997
lhr-1792996678651
lhr-1792996690720
lhr-1792996702164
lhr-1792996713397
lhr-1792996724644
lhr-1792996735922
lhr-1792996747185
lhr-1792996758449

Reports are also available as workflow artifacts

Bumps the uv group with 7 updates in the /apps/web/src/lib/ai/multimodal-bias-detection/python-service directory: | Package | From | To | | --- | --- | --- | | [fastapi](https://github.com/fastapi/fastapi) | `0.143.3` | `0.161.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.16.0` | `2.16.1` | | [transformers](https://github.com/huggingface/transformers) | `5.20.1` | `5.20.2` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.5` | `2.1.6` | | [alembic](https://github.com/sqlalchemy/alembic) | `1.20.0` | `1.20.1` | | [pandas](https://github.com/pandas-dev/pandas) | `3.0.6` | `3.1.0` | | [starlette](https://github.com/Kludex/starlette) | `1.8.0` | `1.9.0` | Updates `fastapi` from 0.143.3 to 0.161.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.143.3...0.161.1) Updates `pydantic-settings` from 2.16.0 to 2.16.1 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.16.0...v2.16.1) Updates `transformers` from 5.20.1 to 5.20.2 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v5.20.1...v5.20.2) Updates `sqlalchemy` from 2.1.5 to 2.1.6 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `alembic` from 1.20.0 to 1.20.1 - [Release notes](https://github.com/sqlalchemy/alembic/releases) - [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/alembic/commits) Updates `pandas` from 3.0.6 to 3.1.0 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](pandas-dev/pandas@v3.0.6...v3.1.0) Updates `starlette` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.8.0...1.9.0) --- updated-dependencies: - dependency-name: alembic dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv - dependency-name: fastapi dependency-version: 0.161.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: pandas dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: pydantic-settings dependency-version: 2.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv - dependency-name: sqlalchemy dependency-version: 2.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: transformers dependency-version: 5.20.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-26T06:45:28Z

px Advisor Review

Risk: unknown

No summary available

No findings.

github-actions · 2026-10-26T06:47:43Z

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

lhr-1792997163540
lhr-1792997176501
lhr-1792997188732
lhr-1792997200100
lhr-1792997211364
lhr-1792997222658
lhr-1792997233951
lhr-1792997245302
lhr-1792997256631

Reports are also available as workflow artifacts

dependabot Bot requested a review from daggerstuff as a code owner October 26, 2026 03:16

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026

dependabot Bot added the python Pull requests that update python code label Oct 26, 2026

dependabot Bot force-pushed the dependabot/uv/apps/web/src/lib/ai/multimodal-bias-detection/python-service/uv-6442be3c64 branch from 740c981 to 0149a88 Compare October 26, 2026 06:34

dependabot Bot force-pushed the dependabot/uv/apps/web/src/lib/ai/multimodal-bias-detection/python-service/uv-6442be3c64 branch from 0149a88 to 7c12330 Compare October 26, 2026 06:43

daggerstuff merged commit b50053f into staging Oct 26, 2026
40 of 42 checks passed

daggerstuff deleted the dependabot/uv/apps/web/src/lib/ai/multimodal-bias-detection/python-service/uv-6442be3c64 branch October 26, 2026 06:58

Navigation Menu

Repository navigation

chore(deps):(deps): bump the uv group across 1 directory with 7 updates - #6390

chore(deps):(deps): bump the uv group across 1 directory with 7 updates#6390
daggerstuff merged 1 commit into
stagingfrom
dependabot/uv/apps/web/src/lib/ai/multimodal-bias-detection/python-service/uv-6442be3c64

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

daggerstuff commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.161.1

Fixes

0.161.0

Features

0.160.0

Breaking Changes

Internal

0.159.1

Features

0.159.0

Features

0.158.2

Features

0.158.1

Fixes

0.158.0

Features

0.157.0

Features

v2.16.1

Highlights

Bug fixes

What's Changed

Patch release v5.20.2

Patch release: v5.20.2

2.1.6

orm

orm extensions

1.20.1

bug

pandas 3.1.0

pandas 3.1.0rc0

Version 1.9.0

Changed

Fixed

1.9.0 (October 18, 2026)

Changed

Fixed

Uh oh!

vercel Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Labels

Uh oh!

github-actions Bot commented Oct 26, 2026

px Advisor Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Lighthouse CI Results

Reports

Uh oh!

daggerstuff commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

px Advisor Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Lighthouse CI Results

Reports

Uh oh!

github-actions Bot commented Oct 26, 2026

px Advisor Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Lighthouse CI Results

Reports

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

vercel Bot commented Oct 26, 2026 •

edited

Loading