chore(deps):(deps): bump the uv group with 15 updates by dependabot[bot] · Pull Request #6405 · daggerstuff/pixelated

dependabot · 2026-10-27T03:22:21Z

Bumps the uv group with 15 updates:

Package	From	To
pandas	`2.3.3`	`3.1.0`
wandb	`0.28.1`	`0.31.0`
huggingface-hub	`2.2.0`	`1.33.0`
fastmcp	`3.4.11`	`4.1.3`
protobuf	`6.33.6`	`7.36.2`
fastapi	`0.141.1`	`0.162.0`
opentelemetry-api	`1.37.0`	`1.45.1`
opentelemetry-sdk	`1.37.0`	`1.45.1`
opentelemetry-instrumentation-fastapi	`0.58b0`	`0.66b1`
opentelemetry-exporter-otlp-proto-http	`1.37.0`	`1.45.1`
semgrep	`1.182.1`	`1.79.0`
anthropic	`2.1.0`	`2.3.0`
nemoguardrails	`0.22.0`	`0.24.1`
hypothesis	`6.170.8`	`6.170.9`
pip-audit	`2.10.1`	`2.9.0`

Updates pandas from 2.3.3 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

New DataFrame.select() and updated DataFrame.filter() method

Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:
python -m pip install --upgrade pandas
Or from conda-forge
conda install -c conda-forge pandas
Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:
python -m pip install --upgrade --pre pandas==3.1.0rc0
Or from conda-forge
conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0
Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:
python -m pip install --upgrade pandas==3.0.*

... (truncated)

Commits

c6f4676 RLS: 3.1.0
dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
Additional commits viewable in compare view

Updates wandb from 0.28.1 to 0.31.0

Release notes

Sourced from wandb's releases.

v0.31.0

What's Changed

Notable Changes

The default API endpoint is now CoreWeave Forge at https://api.forge.coreweave.com, and run links point to https://forge.coreweave.com/wandb. Existing API keys stored for api.wandb.ai keep working without logging in again.

Added

Python 3.15 is now supported (@dmitryduev in wandb/wandb#13167)

wandb.init(resume="must") now works for offline runs. wandb sync fails if there is no run to resume (@geoffhardy in wandb/wandb#12666)

wandb sweep-scheduler [entity/project/]sweep_id runs a sweep's search locally with Optuna or Ax as the optimizer, configured in a scheduler block of the sweep config. wandb sweep prints the command for sweeps that set one (@kmikowicz-wandb in wandb/wandb#12900)

wandb agent --max-consecutive-failed-runs N shuts the agent down once N runs in a row have failed (@nathancy-wandb in wandb/wandb#12821)

wandb sync warns when a run was logged with a newer version of wandb than the one syncing it (@timoffex in wandb/wandb#12808)

W&B LEET TUI:

wandb leet inspect --summary prints a run's state, latest metric values, config and last console lines from its local .wandb file, a quick way for a script or a coding agent to check on a run. --json prints the records, or the summary, as JSON, and --follow keeps printing records as a running run writes them (@dmitryduev in wandb/wandb#12951, wandb/wandb#12952)

l links the console logs to the charts in the single-run view: with the logs pane focused, the charts show a crosshair at the time the selected line was logged, and inspecting a chart with the mouse selects the console line logged nearest to that point. l again unlinks (@dmitryduev in wandb/wandb#12737)

ctrl+a selects every run matching the runs filter, and x deselects all runs except the pinned one (@dmitryduev in wandb/wandb#12904)

Selected and pinned runs are remembered per wandb directory and selected again the next time you open it. The newest run is selected as well if it started since the last session (@dmitryduev in wandb/wandb#12887)

The CPU Core (%) chart opens as a heatmap with one row per core; y switches it back to lines (@dmitryduev in wandb/wandb#13014)

wandb leet symon, the live system monitor:

Shows the utilization of every CPU core, the CPU temperature and swap usage on Linux, and the hostname, uptime and load average in its header (@dmitryduev in wandb/wandb#13012, wandb/wandb#13015)

Charts network and disk throughput in bytes per second instead of totals, and opens with the CPU, memory, network and disk charts ahead of the rest (@dmitryduev in wandb/wandb#13013, wandb/wandb#13014)

Has a sidebar with the machine's chip, cores, memory and GPUs, live meters for CPU, memory, swap, disk and GPU use, and the processes using the most CPU. t sorts the processes by memory, f filters them by name or PID, Tab moves between the process list and the charts, and [ hides the sidebar. The sidebar can be resized by dragging its border, and 0 restores the default width (@dmitryduev in wandb/wandb#13016, wandb/wandb#13017, wandb/wandb#13018, wandb/wandb#13021)

New system metrics:

PCIe throughput (gpu.N.pcieTxBytes, gpu.N.pcieRxBytes) for NVIDIA GPUs older than Hopper (@dmitryduev in wandb/wandb#12989)

Each GPU's cumulative energy consumption in joules as gpu.N.energyJoules, for NVIDIA and AMD GPUs (@dmitryduev in wandb/wandb#12991)

proc.cpu.throttledPercent, the percentage of CPU scheduler periods in which the container's CPU limit throttled the run (@dmitryduev in wandb/wandb#13001)

proc.memory.oomKills, how many processes in the run's container the out-of-memory killer has killed since the run started (@dmitryduev in wandb/wandb#13002)

network.tcpRetransmits, the number of TCP segments retransmitted since the run started (@dmitryduev in wandb/wandb#13003)

The CPU and memory used by W&B's own background processes, as wandb.cpu and wandb.memory.rssMB. They are off by default; turn them on with the x_stats_self_usage setting (@dmitryduev in wandb/wandb#13004, wandb/wandb#13038)

Run metadata now records the CPU model and, for each NVIDIA GPU, its PCI bus ID and, on Linux, its NUMA node (@dmitryduev in wandb/wandb#13005, wandb/wandb#13157)

Changed

The default W&B server is now CoreWeave Forge at https://api.forge.coreweave.com. Run, project, sweep and login links point to https://forge.coreweave.com/wandb, also when base_url is set to https://api.wandb.ai or https://forge.coreweave.com/api/wandb. Existing API keys stored for api.wandb.ai keep working without logging in again (@dmitryduev in wandb/wandb#13077)

The helper process that collects system metrics is now wandb-symon instead of wandb-xpu (@dmitryduev in wandb/wandb#13165)

import wandb and the wandb CLI start about twice as fast (@dmitryduev in wandb/wandb#13144, wandb/wandb#13145, wandb/wandb#13146, wandb/wandb#13147, wandb/wandb#13148)

The wandb package is smaller: wandb-core shrank by about a third, from 52 MB to 35 MB on Linux x86_64, and the parquet reader and the system metrics helper by more than half (@dmitryduev in wandb/wandb#12921, wandb/wandb#12922, wandb/wandb#12923, wandb/wandb#12924, wandb/wandb#12937, wandb/wandb#12939)

Runs write their data to the local .wandb file at least every 15 seconds, so wandb leet shows recent data sooner for runs that log infrequently (@dmitryduev in wandb/wandb#12742)

The cpu system metric reports the monitored process's CPU utilization over the sampling interval instead of its average since the process started (@dmitryduev in wandb/wandb#13101)

NVIDIA GPM system metrics such as gpu.N.smActive and gpu.N.dramActive are now averaged over the whole interval between samples instead of a 200 ms window (@dmitryduev in wandb/wandb#12987)

AMD GPU system metrics are read through the ROCm SMI library (librocm_smi64.so) instead of running the rocm-smi tool on every sample. Readings a GPU does not provide are left out instead of reported as 0 (@dmitryduev in wandb/wandb#12990)

OpenMetrics and DCGM exporter endpoints are scraped once per sampling interval for all runs on the machine instead of once per run, and all runs use the same openmetrics.<endpoint>.<metric>.<index> index for the same metric labels (@dmitryduev in wandb/wandb#13103)

Removed

Removed the undocumented wandb.set_trace(). Use Python's built-in breakpoint() instead (@dmitryduev in wandb/wandb#12985)

Fixed

... (truncated)

Changelog

Sourced from wandb's changelog.

[0.31.0] - 2026-10-16

Notable Changes

The default W&B server is now CoreWeave Forge at https://api.forge.coreweave.com, and run links point to https://forge.coreweave.com/wandb. Existing API keys stored for api.wandb.ai keep working without logging in again.

Added

Python 3.15 is now supported (@dmitryduev in wandb/wandb#13167)

wandb.init(resume="must") now works for offline runs. wandb sync fails if there is no run to resume (@geoffhardy in wandb/wandb#12666)

wandb sweep-scheduler [entity/project/]sweep_id runs a sweep's search locally with Optuna or Ax as the optimizer, configured in a scheduler block of the sweep config. wandb sweep prints the command for sweeps that set one (@kmikowicz-wandb in wandb/wandb#12900)

wandb agent --max-consecutive-failed-runs N shuts the agent down once N runs in a row have failed (@nathancy-wandb in wandb/wandb#12821)

wandb sync warns when a run was logged with a newer version of wandb than the one syncing it (@timoffex in wandb/wandb#12808)

W&B LEET TUI:

wandb leet inspect --summary prints a run's state, latest metric values, config and last console lines from its local .wandb file, a quick way for a script or a coding agent to check on a run. --json prints the records, or the summary, as JSON, and --follow keeps printing records as a running run writes them (@dmitryduev in wandb/wandb#12951, wandb/wandb#12952)

l links the console logs to the charts in the single-run view: with the logs pane focused, the charts show a crosshair at the time the selected line was logged, and inspecting a chart with the mouse selects the console line logged nearest to that point. l again unlinks (@dmitryduev in wandb/wandb#12737)

ctrl+a selects every run matching the runs filter, and x deselects all runs except the pinned one (@dmitryduev in wandb/wandb#12904)

Selected and pinned runs are remembered per wandb directory and selected again the next time you open it. The newest run is selected as well if it started since the last session (@dmitryduev in wandb/wandb#12887)

The CPU Core (%) chart opens as a heatmap with one row per core; y switches it back to lines (@dmitryduev in wandb/wandb#13014)

wandb leet symon, the live system monitor:

Shows the utilization of every CPU core, the CPU temperature and swap usage on Linux, and the hostname, uptime and load average in its header (@dmitryduev in wandb/wandb#13012, wandb/wandb#13015)

Charts network and disk throughput in bytes per second instead of totals, and opens with the CPU, memory, network and disk charts ahead of the rest (@dmitryduev in wandb/wandb#13013, wandb/wandb#13014)

Has a sidebar with the machine's chip, cores, memory and GPUs, live meters for CPU, memory, swap, disk and GPU use, and the processes using the most CPU. t sorts the processes by memory, f filters them by name or PID, Tab moves between the process list and the charts, and [ hides the sidebar. The sidebar can be resized by dragging its border, and 0 restores the default width (@dmitryduev in wandb/wandb#13016, wandb/wandb#13017, wandb/wandb#13018, wandb/wandb#13021)

New system metrics:

PCIe throughput (gpu.N.pcieTxBytes, gpu.N.pcieRxBytes) for NVIDIA GPUs older than Hopper (@dmitryduev in wandb/wandb#12989)

Each GPU's cumulative energy consumption in joules as gpu.N.energyJoules, for NVIDIA and AMD GPUs (@dmitryduev in wandb/wandb#12991)

proc.cpu.throttledPercent, the percentage of CPU scheduler periods in which the container's CPU limit throttled the run (@dmitryduev in wandb/wandb#13001)

proc.memory.oomKills, how many processes in the run's container the out-of-memory killer has killed since the run started (@dmitryduev in wandb/wandb#13002)

network.tcpRetransmits, the number of TCP segments retransmitted since the run started (@dmitryduev in wandb/wandb#13003)

The CPU and memory used by W&B's own background processes, as wandb.cpu and wandb.memory.rssMB. They are off by default; turn them on with the x_stats_self_usage setting (@dmitryduev in wandb/wandb#13004, wandb/wandb#13038)

Run metadata now records the CPU model and, for each NVIDIA GPU, its PCI bus ID and, on Linux, its NUMA node (@dmitryduev in wandb/wandb#13005, wandb/wandb#13157)

Changed

The default W&B server is now CoreWeave Forge at https://api.forge.coreweave.com. Run, project, sweep and login links point to https://forge.coreweave.com/wandb, also when base_url is set to https://api.wandb.ai or https://forge.coreweave.com/api/wandb. Existing API keys stored for api.wandb.ai keep working without logging in again (@dmitryduev in wandb/wandb#13077)

The helper process that collects system metrics is now wandb-symon instead of wandb-xpu (@dmitryduev in wandb/wandb#13165)

import wandb and the wandb CLI start about twice as fast (@dmitryduev in wandb/wandb#13144, wandb/wandb#13145, wandb/wandb#13146, wandb/wandb#13147, wandb/wandb#13148)

The wandb package is smaller: wandb-core shrank by about a third, from 52 MB to 35 MB on Linux x86_64, and the parquet reader and the system metrics helper by more than half (@dmitryduev in wandb/wandb#12921, wandb/wandb#12922, wandb/wandb#12923, wandb/wandb#12924, wandb/wandb#12937, wandb/wandb#12939)

Runs write their data to the local .wandb file at least every 15 seconds, so wandb leet shows recent data sooner for runs that log infrequently (@dmitryduev in wandb/wandb#12742)

The cpu system metric reports the monitored process's CPU utilization over the sampling interval instead of its average since the process started (@dmitryduev in wandb/wandb#13101)

NVIDIA GPM system metrics such as gpu.N.smActive and gpu.N.dramActive are now averaged over the whole interval between samples instead of a 200 ms window (@dmitryduev in wandb/wandb#12987)

AMD GPU system metrics are read through the ROCm SMI library (librocm_smi64.so) instead of running the rocm-smi tool on every sample. Readings a GPU does not provide are left out instead of reported as 0 (@dmitryduev in wandb/wandb#12990)

OpenMetrics and DCGM exporter endpoints are scraped once per sampling interval for all runs on the machine instead of once per run, and all runs use the same openmetrics.<endpoint>.<metric>.<index> index for the same metric labels (@dmitryduev in wandb/wandb#13103)

Removed

Removed the undocumented wandb.set_trace(). Use Python's built-in breakpoint() instead (@dmitryduev in wandb/wandb#12985)

Fixed

... (truncated)

Commits

15f8cbc Bump version and update CHANGELOG for release 0.31.0
43f5b38 chore: clean up changelog for 0.31.0 release (#13182)
e34448a chore(deps): update go dependencies (#13181)
6386f39 chore(deps): update github actions (version updates) (#13180)
445b90b chore(sdk): make the console log filestream writer tests order-independent (#...
b279234 chore(sdk): let pytest see PROCESSOR_ARCHITECTURE on Windows (#13175)
c74a4d1 chore(sdk): default EvalTable back to the Weave backend (#13172)
940d059 refactor(sdk): rename wandb-xpu to wandb-symon (#13165)
3294377 refactor(sdk): remove the system monitor's own sampling loop (#13158)
ee63025 feat(sdk): read the host details wandb leet symon shows from wandb-xpu (#13157)
Additional commits viewable in compare view

Updates huggingface-hub from 2.2.0 to 1.33.0

Commits

9eeace5 Release: v1.33.0
4805a13 Release: v1.33.0.rc1
1a4db76 Release: v1.33.0.rc0
ac3ed2f [Xet] Show Validating progress during shard finalization (#4478)
b904b94 Apply the repo_id length limit to the namespace as well (#4988)
1e0c305 Send PrivateLink config under privateService in create_inference_endpoint (#4...
da5e244 Scope GITHUB_TOKEN permissions per job (#4982)
7532272 Fix HfFileSystem.get_file with a bare local filename (#4981)
0f88f32 [Download] Extend tmp .incomplete path on Windows when too long (#4978)
ce69fdb [Buckets] Raise when a batch reports failed operations (#4954)
Additional commits viewable in compare view

Updates fastmcp from 3.4.11 to 4.1.3

Release notes

Sourced from fastmcp's releases.

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

What's Changed

Security 🔒

Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @zzstoatzz in PrefectHQ/fastmcp#5945.

Enhancements ✨

Chart public backlog counts and closure outcomes by @zzstoatzz in PrefectHQ/fastmcp#5942

Fixes 🐞

Default the upstream token auth method to none without a client secret by @asasemahmed in PrefectHQ/fastmcp#5879

fix: preserve empty session visibility selections by @himanshuchawla0807-gif in PrefectHQ/fastmcp#5944

test(mount): make unreachable proxy failures deterministic by @CharlesYXW and @ch-z-hc in PrefectHQ/fastmcp#5584

fix(tools): materialize generator transform_fn results in TransformedTool.run by @BlueX888 and @nandanadileep in PrefectHQ/fastmcp#5672

Honor per-server MCP config timeouts by @atty57, @phnmn, and @CRYPTONIKAV in PrefectHQ/fastmcp#5758

fix: don't classify a tool body's own TimeoutError as the tool timeout by @Wilson0511 in PrefectHQ/fastmcp#5940

Documentation 📚

Add v4.1.3 changelog entries by @zzstoatzz in PrefectHQ/fastmcp#5948

New Contributors

@phnmn made their first contribution in PrefectHQ/fastmcp#5758

@CRYPTONIKAV made their first contribution in PrefectHQ/fastmcp#5758

@himanshuchawla0807-gif made their first contribution in PrefectHQ/fastmcp#5944

@CharlesYXW made their first contribution in PrefectHQ/fastmcp#5584

@atty57 made their first contribution in PrefectHQ/fastmcp#5758

@Wilson0511 made their first contribution in PrefectHQ/fastmcp#5940

Full Changelog: PrefectHQ/fastmcp@v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

Authorize transformed components and prevent denied-resource template fallback by @zzstoatzz and @rishid in PrefectHQ/fastmcp#5933

Bind OAuth client credentials to a configured issuer, including cached-token renewal, by @zzstoatzz and @LHMisme420 in PrefectHQ/fastmcp#5933

Enhancements ✨

Add SEP-2640 Skills extension foundation by @strawgate in PrefectHQ/fastmcp#5057

Write down triage and merge norms in docs/development by @zzstoatzz in PrefectHQ/fastmcp#5872

Add experimental Skills discovery to SkillsDirectoryProvider by @zzstoatzz in PrefectHQ/fastmcp#5704

Fixes 🐞

Do not require websockets for the OAuth callback server by @asasemahmed in PrefectHQ/fastmcp#5693

Keep fastmcp.json resolvable when deployment.cwd changes the working directory by @asasemahmed in PrefectHQ/fastmcp#5700

Fix ctx.log() failing when extra contains LogRecord attribute names by @asasemahmed in PrefectHQ/fastmcp#5688

Use a monotonic clock in the rate limiters by @asasemahmed in PrefectHQ/fastmcp#5689

Escape server metadata in the fastmcp inspect text summary by @asasemahmed in PrefectHQ/fastmcp#5701

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.4: Token Gesture

Generated CLIs now preserve remote transports, empty arrays, and parameters whose names collide with their own helpers; mounted servers honor session visibility and mounted_components_raise_on_load_error, a stale client context no longer closes a newer session, and OAuth provider wrappers accept identity assertions. Tasks accept a redis-py credential provider that returns current credentials for each new connection (streaming providers such as redis-entraid's are rejected until Docket can refresh them safely), Redis 8.1.0 is excluded, and custom KeyringStore users must now install py-key-value-aio[keyring] explicitly. Thanks to our 16 contributors, including 9 first-time contributors.

Enhancements ✨

Add server authoring guidance through the docs site by @zzstoatzz in #5703

Support rotating Redis credentials for tasks by @zzstoatzz and @nazarii-plebanskyi-rf in #5970

fix(client): forward max_sse_event_size through StreamableHttpTransport by @PrathmeshPawar2110 in #6016

Add a downstream smoke for Redis credential providers by @zzstoatzz in #6044

Security 🔒

Bump certifi to 2026.10.19 by @jakekaplan in #5989

Let configured proxy headers replace forwarded ones regardless of case by @leopranzl in #5972

Fixes 🐞

Fix maintained skill discovery on the docs site by @zzstoatzz in #5954

Publish regular skill files for Mintlify discovery by @zzstoatzz in #5956

Serialize HTTP and SSE transports in generate-cli by @asasemahmed in #5891

fix(cli): preserve empty arrays in generated commands by @dailyun in #5961

Fix session visibility lookups through mounted servers by @HootRock and @leopranzl in #5966

Fix generated CLI JSON parameter name collisions by @Vittuu in #5959

Escape server text in the fastmcp call elicitation prompt by @asasemahmed in #5909

Map common audio extensions when Audio is given a path by @asasemahmed in #5919

Drop clamped log records the logger is not enabled for by @asasemahmed in #5915

Omit the output schema when an OpenAPI success response has no body by @asasemahmed in #5913

Create the MCP config file on install when it is missing or empty by @asasemahmed in #5887

Preserve credential providers when cloning task extensions by @zzstoatzz and @nazarii-plebanskyi-rf in #5984

Exclude Redis 8.1.0 to preserve task reconnection by @zzstoatzz and @nazarii-plebanskyi-rf in #5985

Remove unused keyring dependency by @zzstoatzz and @tom42-otera in #5987

Fix static checks broken by ty 0.0.89 and pydantic 2.14 by @zzstoatzz in #6001

Run dev inspector servers over stdio and stop mapping the deployment port to the proxy by @asasemahmed in #6029

fix(json-schema): apply a Draft-4 boolean exclusive bound to its sibling by @kbkb628 in #5234

Strip a URL scheme from a Clerk domain by @asasemahmed in #5921

Fix generate-cli commands for tools with a json parameter by @andreivince in #6032

Honor mounted_components_raise_on_load_error in AggregateProvider by @asasemahmed in #6026

Reject streaming credential providers in TasksExtension by @zzstoatzz in #6043

fix(client): keep stale contexts from closing newer sessions by @mikamikasuki in #6018

fix(auth): expose identity assertions on OAuth provider wrappers by @computeaholic and @jonaseck2 in #6006

Measure blocking duration with perf_counter in transform_fn generator test by @Lokeshrao69 in #6014

Docs 📚

Clarify request state across mounted servers by @HootRock and @leopranzl in #5967

Pass mcp_path through the remote OAuth custom routes example by @asasemahmed in #5925

... (truncated)

Commits

aa13708 docs: add v4.1.3 changelog entries (#5948)
ec1a8e0 fix: require patched certifi trust stores (#5945)
bfe314f Preserve tool-body timeout errors (#5940)
8f0d481 Honor per-server MCP config timeouts (#5758)
b918dd9 fix(tools): materialize generator transform_fn results in TransformedTool.run...
0b1a6ba test(mount): make unreachable proxy failures deterministic (#5584)
5910eb2 fix: preserve empty session visibility selections (#5944)
ceb465a Default upstream token auth method to none without a client secret (#5879)
75ee327 Chart public backlog counts and closure outcomes (#5942)
0f4674e docs: add v4.1.2 changelog entries (#5936)
Additional commits viewable in compare view

Updates protobuf from 6.33.6 to 7.36.2

Updates fastapi from 0.141.1 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

🐛 Restore default handling for omitted boolean form fields. PR #16605 by @tiangolo.

0.161.1

Fixes

🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @tiangolo.

0.161.0

Features

✨ Add support for combining unions of form models. PR #16596 by @tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @tiangolo.

Internal

⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @dependabot[bot].

0.159.1

Features

✨ Add support for optional unions of form models. PR #16586 by @tiangolo.

0.159.0

Features

✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @tiangolo.

0.158.2

Features

✨ Add support for optional form models. PR #16582 by @tiangolo.

0.158.1

... (truncated)

Commits

7a0a3f0 🔖 Release version 0.162.0 (#16606)
b56f7c6 📝 Update release notes
f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
69ddc2b 🔖 Release version 0.161.1 (#16599)
0cafa07 📝 Update release notes
f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
80c8742 🔖 Release version 0.161.0 (#16597)
b105209 📝 Update release notes
e42ac0a ✨ Add support for combining unions of form models (#16596)
addd077 🔖 Release version 0.160.0 (#16595)
Additional commits viewable in compare view

Updates opentelemetry-api from 1.37.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)

opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)

opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)

opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Version 1.45.0/0.66b0

Added

opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)

infra: add renovate (

Bumps the uv group with 15 updates: | Package | From | To | | --- | --- | --- | | [pandas](https://github.com/pandas-dev/pandas) | `2.3.3` | `3.1.0` | | [wandb](https://github.com/wandb/wandb) | `0.28.1` | `0.31.0` | | [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `2.2.0` | `1.33.0` | | [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.11` | `4.1.3` | | [protobuf](https://developers.google.com/protocol-buffers/) | `6.33.6` | `7.36.2` | | [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.162.0` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` | | [opentelemetry-instrumentation-fastapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.58b0` | `0.66b1` | | [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.37.0` | `1.45.1` | | [semgrep](https://github.com/semgrep/semgrep) | `1.182.1` | `1.79.0` | | [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `2.1.0` | `2.3.0` | | [nemoguardrails](https://github.com/NVIDIA-NeMo/Guardrails) | `0.22.0` | `0.24.1` | | [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.8` | `6.170.9` | | [pip-audit](https://github.com/pypa/pip-audit) | `2.10.1` | `2.9.0` | Updates `pandas` from 2.3.3 to 3.1.0 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](pandas-dev/pandas@v2.3.3...v3.1.0) Updates `wandb` from 0.28.1 to 0.31.0 - [Release notes](https://github.com/wandb/wandb/releases) - [Changelog](https://github.com/wandb/wandb/blob/main/CHANGELOG.md) - [Commits](wandb/wandb@v0.28.1...v0.31.0) Updates `huggingface-hub` from 2.2.0 to 1.33.0 - [Release notes](https://github.com/huggingface/huggingface_hub/releases) - [Commits](huggingface/huggingface_hub@v2.2.0...v1.33.0) Updates `fastmcp` from 3.4.11 to 4.1.3 - [Release notes](https://github.com/PrefectHQ/fastmcp/releases) - [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx) - [Commits](PrefectHQ/fastmcp@v3.4.11...v4.1.3) Updates `protobuf` from 6.33.6 to 7.36.2 Updates `fastapi` from 0.141.1 to 0.162.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.141.1...0.162.0) Updates `opentelemetry-api` from 1.37.0 to 1.45.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1) Updates `opentelemetry-sdk` from 1.37.0 to 1.45.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1) Updates `opentelemetry-instrumentation-fastapi` from 0.58b0 to 0.66b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-exporter-otlp-proto-http` from 1.37.0 to 1.45.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.37.0...v1.45.1) Updates `semgrep` from 1.182.1 to 1.79.0 - [Release notes](https://github.com/semgrep/semgrep/releases) - [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md) - [Commits](https://github.com/semgrep/semgrep/commits/v1.79.0) Updates `anthropic` from 2.1.0 to 2.3.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-python@v2.1.0...v2.3.0) Updates `nemoguardrails` from 0.22.0 to 0.24.1 - [Release notes](https://github.com/NVIDIA-NeMo/Guardrails/releases) - [Changelog](https://github.com/NVIDIA-NeMo/Guardrails/blob/develop/CHANGELOG.md) - [Commits](NVIDIA-NeMo/Guardrails@v0.22.0...v0.24.1) Updates `hypothesis` from 6.170.8 to 6.170.9 - [Release notes](https://github.com/HypothesisWorks/hypothesis/releases) - [Commits](HypothesisWorks/hypothesis@v6.170.8...v6.170.9) Updates `pip-audit` from 2.10.1 to 2.9.0 - [Release notes](https://github.com/pypa/pip-audit/releases) - [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md) - [Commits](pypa/pip-audit@v2.10.1...v2.9.0) --- updated-dependencies: - dependency-name: pandas dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: uv - dependency-name: wandb dependency-version: 0.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: huggingface-hub dependency-version: 1.33.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: uv - dependency-name: fastmcp dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: uv - dependency-name: protobuf dependency-version: 7.36.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: uv - dependency-name: fastapi dependency-version: 0.162.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: opentelemetry-api dependency-version: 1.45.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: opentelemetry-sdk dependency-version: 1.45.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: opentelemetry-instrumentation-fastapi dependency-version: 0.66b1 dependency-type: direct:production dependency-group: uv - dependency-name: opentelemetry-exporter-otlp-proto-http dependency-version: 1.45.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: semgrep dependency-version: 1.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: anthropic dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: nemoguardrails dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: hypothesis dependency-version: 6.170.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv - dependency-name: pip-audit dependency-version: 2.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-27T03:22:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 27, 2026 3:22am UTC

github-actions · 2026-10-27T03:23:24Z

px Advisor Review

Risk: unknown

No summary available

No findings.

dependabot Bot requested a review from daggerstuff as a code owner October 27, 2026 03:22

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 27, 2026

dependabot Bot added the uv Python uv dependency updates label Oct 27, 2026

Navigation Menu

Repository navigation

chore(deps):(deps): bump the uv group with 15 updates - #6405

chore(deps):(deps): bump the uv group with 15 updates#6405
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/uv/uv-f86867cc1f

dependabot Bot commented on behalf of github Oct 27, 2026

Uh oh!

vercel Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 27, 2026

pandas 3.1.0

pandas 3.1.0rc0

pandas 3.0.6

v0.31.0

What's Changed

Notable Changes

Added

Changed

Removed

Fixed

[0.31.0] - 2026-10-16

Notable Changes

Added

Changed

Removed

Fixed

v4.1.3: Root Awakening

What's Changed

Security 🔒

Enhancements ✨

Fixes 🐞

Documentation 📚

New Contributors

v4.1.2: License to Deny

What's Changed

Security 🔒

Enhancements ✨

Fixes 🐞

title: "Changelog" icon: "list-check" rss: true tag: NEW

Enhancements ✨

Security 🔒

Fixes 🐞

Docs 📚

0.162.0

Breaking Changes

0.161.1

Fixes

0.161.0

Features

0.160.0

Breaking Changes

Internal

0.159.1

Features

0.159.0

Features

0.158.2

Features

0.158.1

Version 1.45.1/0.66b1

Fixed

Version 1.45.0/0.66b0

Added

Uh oh!

vercel Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 27, 2026

px Advisor Review

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Oct 27, 2026 •

edited

Loading