Skip to content

chore(deps): bump the uv group across 1 directory with 20 updates - #62

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-c51dea76ed
Open

chore(deps): bump the uv group across 1 directory with 20 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-c51dea76ed

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the uv group with 20 updates in the / directory:

Package From To
pytorch-lightning 2.0 2.6.1
mlflow 3.8.1 3.11.1
transformers 4.57.6 5.5.0
jupyterlab 4.5.2 4.5.10
aiohttp 3.13.2 3.14.1
bleach 6.3.0 6.4.0
cryptography 46.0.3 48.0.1
gitpython 3.1.45 3.1.54
idna 3.11 3.15
jupyter-server 2.17.0 2.20.0
mistune 3.2.0 3.3.0
msgpack 1.1.2 1.2.1
pillow 12.0.0 12.3.0
pip 23.3 26.1.2
pyasn1 0.6.2 0.6.4
setuptools 80.9.0 83.0.0
soupsieve 2.8 2.8.4
starlette 0.50.0 1.3.1
tornado 6.5.2 6.5.7
urllib3 2.6.0 2.7.0

Updates pytorch-lightning from 2.0 to 2.6.1

Release notes

Sourced from pytorch-lightning's releases.

Lightning v2.6.1

Changes in 2.6.1

PyTorch Lightning

  • Added method chaining support to LightningModule.freeze() and LightningModule.unfreeze() by returning self (#21469)
  • Added litlogger integration(#21430)
  • Deprecated to_torchscript method due to deprecation of TorchScript in PyTorch (#21397)
  • Removed support for Python 3.9 due to end-of-life status (#21398)
  • Fixed save_hyperparameters(ignore=...) behavior so subclass ignore rules override base class rules (#21490)
  • Fixed LightningDataModule.load_from_checkpoint to restore the datamodule subclass and hyperparameters (#21478)
  • Fixed ModelParallelStrategy single-file checkpointing when torch.compile wraps the model so optimizer states no longer raise KeyError during save (#21357)
  • Sanitize profiler filenames when saving to avoid crashes due to invalid characters (#21395)
  • Fixed StochasticWeightAveraging with infinite epochs (#21396)
  • Fixed _generate_seed_sequence_sampling function not producing unique seeds (#21399)
  • Fixed ThroughputMonitor callback emitting warnings too frequently (#21453)

Lightning Fabric

  • Exposed weights_only argument for loading checkpoints in Fabric.load() and Fabric.load_raw() (#21470)
  • Fixed DistributedSamplerWrapper not forwarding set_epoch to the underlying sampler (#21454)
  • Fixed DDP notebook CUDA fork check to allow passive initialization when CUDA is not actively used (#21402)

... (truncated)

Commits
  • 655a3a9 bump(deps): bump litlogger version to >=0.1.7 (#21517)
  • 300c05a Prepare release 2.6.1 (#21516)
  • dc16bc5 build(deps): update setuptools requirement from <80.9.1 to <80.10.3 in /requi...
  • 6ee3800 build(deps): update torchvision requirement from <0.25.0,>=0.16.0 to >=0.16.0...
  • 6478f8e Fix save_hyperparameters ignore precedence in subclasses (#21490)
  • 2712587 CI: fix doctest failure from PyTorch LeafSpec FutureWarning (#21502)
  • ae1dc6f fix(link-check): resolve broken URLs (#21493)
  • f0b1c52 fix(fabric): forward set_epoch to underlying sampler in DistributedSamplerWra...
  • bddc253 Fix warning frequency in throughput monitor callback (#21453)
  • 2f4b58a build(deps): update numpy requirement from <2.3.5,>2.1.0 to >2.1.0,<2.4.2 in ...
  • Additional commits viewable in compare view

Updates mlflow from 3.8.1 to 3.11.1

Release notes

Sourced from mlflow's releases.

v3.11.1

MLflow 3.11.1 includes several major features and improvements.

Major New Features:

  • 🔍 Automatic Issue Identification: Automatically identify quality issues in your agent with AI! Use the new "Detect Issues" button in the traces table to analyze selected traces and surface potential problems across categories like correctness, safety, and performance. Issues are linked directly to traces for easy investigation and debugging. Docs (#21431, #21204, #21165, #21163, #21161, @​smoorjani, @​serena-ruan)
  • 💰 Gateway Budget Alerts & Limits: Control your AI Gateway spending with configurable budget policies! Set spending limits by time window (daily, weekly, or monthly), receive alerts before hitting limits, and prevent runaway costs with automatic request blocking. The new budget management UI lets you track spending, configure webhooks for notifications, and monitor violations across all your gateway endpoints. Docs (#21116, #21534, #21569, #21473, #21108, @​TomeHirata, @​copilot-swe-agent)
  • 📊 Trace Graph View: Visualize complex trace hierarchies with an interactive graph view! Navigate multi-level trace structures, understand parent-child relationships at a glance, and debug complex systems more effectively with a visual representation of your trace topology. Docs (#20607, @​joelrobin18)
  • 🌐 Native OpenTelemetry GenAI Convention Support: MLflow now natively supports the OpenTelemetry GenAI Semantic Conventions for trace export! When exporting traces via OTLP with MLFLOW_ENABLE_OTEL_GENAI_SEMCONV enabled, MLflow automatically translates them to follow the OTel GenAI semantic conventions, enabling seamless integration with OTel-compatible observability platforms while preserving GenAI-specific metadata. Docs (#21494, #21495, @​B-Step62)
  • 🔧 OpenCode Tracing Integration: Debug smarter with OpenCode CLI integration! Track and analyze code execution flows directly from your development workflow, making it easier to identify performance bottlenecks and trace issues back to specific code paths. Docs (#20133, @​joelrobin18)
  • ⚡ Native UV Support for Model Dependencies: Automatic dependency inference now supports UV! MLflow automatically detects UV projects and captures exact, locked dependencies from your lockfile when logging models, ensuring reproducible environments. Docs (#20344, #20935, @​debu-sinha)
  • 🔒 Pickle-Free Model Serialization: Enhance security with pickle-free model formats! MLflow now supports safer model serialization using torch.export and skops formats, with improved controls when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. Comprehensive documentation guides you through migrating existing models to pickle-free formats for production deployments. Docs (#21404, #21188, #20774, @​WeichenXu123)

Breaking Changes:

  • ⚠️ TypeScript SDK Package Renaming: The MLflow TypeScript SDK packages have been renamed to use npm organization scoping. If you're using the TypeScript SDK, update your package.json dependencies and import statements: mlflow-tracing → @mlflow/core, mlflow-openai → @mlflow/openai, mlflow-anthropic → @mlflow/anthropic, mlflow-gemini → @mlflow/gemini. All packages are now at version 0.2.0. (#20792, @​B-Step62)
  • Remove MLFLOW_ENABLE_INCREMENTAL_SPAN_EXPORT environment variable (#22182, @​PattaraS)
  • Remove litellm and gepa from genai extras (#22059, @​TomeHirata)
  • Block / and : in Registered Model names (#21458, @​Bhuvan-08)

Features:

... (truncated)

Changelog

Sourced from mlflow's changelog.

3.11.1 (2026-04-07)

MLflow 3.11.1 includes several major features and improvements.

Major New Features:

  • 🔍 Automatic Issue Identification: Automatically identify quality issues in your agent with AI! Use the new "Detect Issues" button in the traces table to analyze selected traces and surface potential problems across categories like correctness, safety, and performance. Issues are linked directly to traces for easy investigation and debugging. Docs (#21431, #21204, #21165, #21163, #21161, @​smoorjani, @​serena-ruan)
  • 💰 Gateway Budget Alerts & Limits: Control your AI Gateway spending with configurable budget policies! Set spending limits by time window (daily, weekly, or monthly), receive alerts before hitting limits, and prevent runaway costs with automatic request blocking. The new budget management UI lets you track spending, configure webhooks for notifications, and monitor violations across all your gateway endpoints. Docs (#21116, #21534, #21569, #21473, #21108, @​TomeHirata, @​copilot-swe-agent)
  • 📊 Trace Graph View: Visualize complex trace hierarchies with an interactive graph view! Navigate multi-level trace structures, understand parent-child relationships at a glance, and debug complex systems more effectively with a visual representation of your trace topology. Docs (#20607, @​joelrobin18)
  • 🌐 Native OpenTelemetry GenAI Convention Support: MLflow now natively supports the OpenTelemetry GenAI Semantic Conventions for trace export! When exporting traces via OTLP with MLFLOW_ENABLE_OTEL_GENAI_SEMCONV enabled, MLflow automatically translates them to follow the OTel GenAI semantic conventions, enabling seamless integration with OTel-compatible observability platforms while preserving GenAI-specific metadata. Docs (#21494, #21495, @​B-Step62)
  • 🔧 OpenCode Tracing Integration: Debug smarter with OpenCode CLI integration! Track and analyze code execution flows directly from your development workflow, making it easier to identify performance bottlenecks and trace issues back to specific code paths. Docs (#20133, @​joelrobin18)
  • ⚡ Native UV Support for Model Dependencies: Automatic dependency inference now supports UV! MLflow automatically detects UV projects and captures exact, locked dependencies from your lockfile when logging models, ensuring reproducible environments. Docs (#20344, #20935, @​debu-sinha)
  • 🔒 Pickle-Free Model Serialization: Enhance security with pickle-free model formats! MLflow now supports safer model serialization using torch.export and skops formats, with improved controls when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. Comprehensive documentation guides you through migrating existing models to pickle-free formats for production deployments. Docs (#21404, #21188, #20774, @​WeichenXu123)

Breaking Changes:

  • ⚠️ TypeScript SDK Package Renaming: The MLflow TypeScript SDK packages have been renamed to use npm organization scoping. If you're using the TypeScript SDK, update your package.json dependencies and import statements: mlflow-tracing → @mlflow/core, mlflow-openai → @mlflow/openai, mlflow-anthropic → @mlflow/anthropic, mlflow-gemini → @mlflow/gemini. All packages are now at version 0.2.0. (#20792, @​B-Step62)
  • Remove MLFLOW_ENABLE_INCREMENTAL_SPAN_EXPORT environment variable (#22182, @​PattaraS)
  • Remove litellm and gepa from genai extras (#22059, @​TomeHirata)
  • Block / and : in Registered Model names (#21458, @​Bhuvan-08)

Features:

... (truncated)

Commits
  • 09179c6 Bump version to 3.11.1 (#22400)
  • 38d75c2 Fix DatabricksProvider to use OpenAI-compatible endpoint URLs (#22393)
  • 0734e56 fix
  • 46a2d4d fix
  • 7a6b01b format
  • 8b71fa7 Fix _lookup_model_info all-provider scan causing network latency (#22369)
  • deaffc1 Update model catalog CI workflow to use update_model_catalog.py (#22261)
  • 1b87ff3 Add aiohttp as a core dependency of mlflow (#22189)
  • 7f08e88 Normalize get_provider_name() to align with `model_prices_and_context_windo...
  • bd3114b Move LLM calling utilities to mlflow/genai/utils/llm_utils.py (#22234)
  • Additional commits viewable in compare view

Updates transformers from 4.57.6 to 5.5.0

Release notes

Sourced from transformers's releases.

Release v5.5.0

New Model additions

Gemma4

Gemma 4 is a multimodal model with pretrained and instruction-tuned variants, available in 1B, 13B, and 27B parameters. The architecture is mostly the same as the previous Gemma versions. The key differences are a vision processor that can output images of fixed token budget and a spatial 2D RoPE to encode vision-specific information across height and width axis.

You can find all the original Gemma 4 checkpoints under the Gemma 4 release.

The key difference from previous Gemma releases is the new design to process images of different sizes using a fixed-budget number of tokens. Unlike many models that squash every image into a fixed square (like 224×224), Gemma 4 keeps the image's natural aspect ratio while making it the right size. There a a couple constraints to follow:

  • The total number of pixels must fit within a patch budget
  • Both height and width must be divisible by 48 (= patch size 16 × pooling kernel 3)

[!IMPORTANT] Gemma 4 does not apply the standard ImageNet mean/std normalization that many other vision models use. The model's own patch embedding layer handles the final scaling internally (shifting values to the [-1, 1] range).

The number of "soft tokens" (aka vision tokens) an image processor can produce is configurable. The supported options are outlined below and the default is 280 soft tokens per image.

Soft Tokens Patches (before pooling) Approx. Image Area
70 630 ~161K pixels
140 1,260 ~323K pixels
280 2,520 ~645K pixels
560 5,040 ~1.3M pixels
1,120 10,080 ~2.6M pixels

To encode positional information for each patch in the image, Gemma 4 uses a learned 2D position embedding table. The position table stores up to 10,240 positions per axis, which allows the model to handle very large images. Each position is a learned vector of the same dimensions as the patch embedding. The 2D RoPE which Gemma 4 uses independently rotate half the attention head dimensions for the x-axis and the other half for the y-axis. This allows the model to understand spatial relationships like "above," "below," "left of," and "right of."

NomicBERT

NomicBERT is a BERT-inspired encoder model that applies Rotary Position Embeddings (RoPE) to create reproducible long context text embeddings. It is the first fully reproducible, open-source text embedding model with 8192 context length that outperforms both OpenAI Ada-002 and OpenAI text-embedding-3-small on short-context MTEB and long context LoCo benchmarks. The model generates dense vector embeddings for various tasks including search, clustering, and classification using specific instruction prefixes.

Links: Documentation | Paper

MusicFlamingo

Music Flamingo is a fully open large audio–language model designed for robust understanding and reasoning over music. It builds upon the Audio Flamingo 3 architecture by including Rotary Time Embeddings (RoTE), which injects temporal position information to enable the model to handle audio sequences up to 20 minutes. The model features a unified audio encoder across speech, sound, and music with special sound boundary tokens for improved audio sequence modeling.

Links: Documentation | Paper

... (truncated)

Commits
  • c1c3424 update
  • 20bff68 update release workflow
  • 8956441 v5.5.0
  • 5135e5e casually dropping the most capable open weights on the planet (#45192)
  • a594e09 Internalise the NomicBERT model (#43067)
  • 4932e97 Fix resized LM head weights being overwritten by post_init (#45079)
  • 57e8413 [Qwen3.5 MoE] Add _tp_plan to ForConditionalGeneration (#45124)
  • b10552e Fix TypeError: 'NoneType' object is not iterable in GenerationMixin.generate ...
  • 423f2a3 fix(models): Fix dtype mismatch in SwitchTransformers and TimmWrapperModel (#...
  • ade7a05 Generalize gemma vision mask to videos (#45185)
  • Additional commits viewable in compare view

Updates jupyterlab from 4.5.2 to 4.5.10

Commits
  • af5f5b3 [ci skip] Publish 4.5.10
  • be9303f Backport of security patches to 4.5.x branch (#19186)
  • a555fe1 Reconfigure 4.5.x branch (4.6.x is new stable) (#19060)
  • 8d8cb6d Backport PR #19029 on branch 4.5.x (Split external link checks and only run i...
  • dd65403 [ci skip] Publish 4.5.9
  • 2693672 Backport PR #18992: Fix hidden cells after moving collapsed headings (#19016)
  • 360c176 Backport PR #18998 on branch 4.5.x (Fix toolbar popup row clipping in Safari)...
  • e9db010 Fix jupyter labextension build crash on webpack ≥ 5.107 (#19021)
  • 3b8428c Backport PR #19013 on branch 4.5.x (Forbid relative URLs in extensionmanager)...
  • 3c84a84 Backport PR #19003 on branch 4.5.x (Fix XSS in extension manager's `homepage_...
  • Additional commits viewable in compare view

Updates aiohttp from 3.13.2 to 3.14.1

Changelog

Sourced from aiohttp's changelog.

3.14.1 (2026-06-07)

Bug fixes

  • Fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the connector while a DNS resolution was in-flight could raise :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError -- by :user:goingforstudying-ctrl.

    Related issues and pull requests on GitHub: :issue:12497.

  • Fixed CancelledError not closing a connection -- by :user:aiolibsbot.

    Related issues and pull requests on GitHub: :issue:12795.

  • Tightened up some websocket parser checks -- by :user:Dreamsorcerer.

    Related issues and pull requests on GitHub: :issue:12817.

  • Fixed :class:~aiohttp.CookieJar dropping the host-only flag of cookies when persisted with :meth:~aiohttp.CookieJar.save and reloaded with :meth:~aiohttp.CookieJar.load, so a cookie set without a Domain attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:~aiohttp.CookieJar.load now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:~aiohttp.CookieJar.update_cookies, so a cookie for an IP-address host is dropped when loaded into a jar created without unsafe=True -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:12824.

  • Scoped :class:~aiohttp.DigestAuthMiddleware credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 domain directive -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:12825.

  • Fixed the C HTTP parser not enforcing max_line_size on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising LineTooLong. The accumulated length is now checked, matching the pure-Python parser -- by :user:bdraco.

    Related issues and pull requests on GitHub:

... (truncated)

Commits
  • 9c35d03 Release v3.14.1 (#12864)
  • 38b956c [PR #12861/59684b5c backport][3.14] Revert "Drop list compression (#12857)" (...
  • 8f31009 [PR #12857/69dff14d backport][3.14] Drop list compression (#12858)
  • dfdfa9d [PR #12830/93a2b1c3 backport][3.14] Bound pipelined request queue per connect...
  • 0e9cedd [PR #12827/ccf218ab backport][3.14] Numeric ipv4 resolver bypass (#12849)
  • a762eda [PR #12831/1ac92dae backport][3.14] Payload close on disconnect (#12843)
  • a329a7a [PR #12824/60b85e98 backport][3.14] Preserve host-only cookie scope across Co...
  • 4f7480e [PR #12828/13b635d7 backport][3.14] Bounded unread compressed drain (#12845)
  • 5ab61bb [PR #12826/36df6c13 backport][3.14] Enforce max_line_size on fragmented reque...
  • 3912667 [3.14] Add test that env proxy auth is scoped to the redirect-selected proxy ...
  • Additional commits viewable in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates cryptography from 46.0.3 to 48.0.1

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.

.. _v48-0-0:


48.0.0 - 2026-05-04

  • BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

  • BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

  • Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

    • Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24


* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table>

... (truncated)

Commits

Updates gitpython from 3.1.45 to 3.1.54

Release notes

Sourced from gitpython's releases.

3.1.54 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.53...3.1.54

3.1.53 - Security

What's Changed

@dependabot
chore(deps): bump the uv group across 1 directory with 20 updates
a935a65 
Bumps the uv group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.0` | `2.6.1` |
| [mlflow](https://github.com/mlflow/mlflow) | `3.8.1` | `3.11.1` |
| [transformers](https://github.com/huggingface/transformers) | `4.57.6` | `5.5.0` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.5.2` | `4.5.10` |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.2` | `3.14.1` |
| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |
| [cryptography](https://github.com/pyca/cryptography) | `46.0.3` | `48.0.1` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.45` | `3.1.54` |
| [idna](https://github.com/kjd/idna) | `3.11` | `3.15` |
| [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `2.17.0` | `2.20.0` |
| [mistune](https://github.com/lepture/mistune) | `3.2.0` | `3.3.0` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.1.2` | `1.2.1` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.3.0` |
| [pip](https://github.com/pypa/pip) | `23.3` | `26.1.2` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.2` | `0.6.4` |
| [setuptools](https://github.com/pypa/setuptools) | `80.9.0` | `83.0.0` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8` | `2.8.4` |
| [starlette](https://github.com/Kludex/starlette) | `0.50.0` | `1.3.1` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.2` | `6.5.7` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.6.0` | `2.7.0` |



Updates `pytorch-lightning` from 2.0 to 2.6.1
- [Release notes](https://github.com/Lightning-AI/pytorch-lightning/releases)
- [Commits](Lightning-AI/pytorch-lightning@2.0.0...2.6.1)

Updates `mlflow` from 3.8.1 to 3.11.1
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.8.1...v3.11.1)

Updates `transformers` from 4.57.6 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.57.6...v5.5.0)

Updates `jupyterlab` from 4.5.2 to 4.5.10
- [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md)
- [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.5.2...@jupyterlab/lsp@4.5.10)

Updates `aiohttp` from 3.13.2 to 3.14.1
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.13.2...v3.14.1)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `cryptography` from 46.0.3 to 48.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.3...48.0.1)

Updates `gitpython` from 3.1.45 to 3.1.54
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.45...3.1.54)

Updates `idna` from 3.11 to 3.15
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.11...v3.15)

Updates `jupyter-server` from 2.17.0 to 2.20.0
- [Release notes](https://github.com/jupyter-server/jupyter_server/releases)
- [Changelog](https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md)
- [Commits](jupyter-server/jupyter_server@v2.17.0...v2.20.0)

Updates `mistune` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/lepture/mistune/releases)
- [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst)
- [Commits](lepture/mistune@v3.2.0...v3.3.0)

Updates `msgpack` from 1.1.2 to 1.2.1
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.1.2...v1.2.1)

Updates `pillow` from 12.0.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.0.0...12.3.0)

Updates `pip` from 23.3 to 26.1.2
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@23.3...26.1.2)

Updates `pyasn1` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.2...v0.6.4)

Updates `setuptools` from 80.9.0 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v80.9.0...v83.0.0)

Updates `soupsieve` from 2.8 to 2.8.4
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](facelessuser/soupsieve@2.8...2.8.4)

Updates `starlette` from 0.50.0 to 1.3.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...1.3.1)

Updates `tornado` from 6.5.2 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.2...v6.5.7)

Updates `urllib3` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.0...2.7.0)

---
updated-dependencies:
- dependency-name: pytorch-lightning
  dependency-version: 2.6.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: mlflow
  dependency-version: 3.11.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: jupyterlab
  dependency-version: 4.5.10
  dependency-type: direct:development
  dependency-group: uv
- dependency-name: aiohttp
  dependency-version: 3.14.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: gitpython
  dependency-version: 3.1.54
  dependency-type: indirect
  dependency-group: uv
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: indirect
  dependency-group: uv
- dependency-name: jupyter-server
  dependency-version: 2.20.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mistune
  dependency-version: 3.3.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: msgpack
  dependency-version: 1.2.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pip
  dependency-version: 26.1.2
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: soupsieve
  dependency-version: 2.8.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants