Skip to content

deps: Bump the dependencies group across 1 directory with 8 updates - #109

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dependencies-7f1d8ea6c4
Closed

deps: Bump the dependencies group across 1 directory with 8 updates#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dependencies-7f1d8ea6c4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 8 updates in the / directory:

Package From To
numpy 2.5.3 2.5.4
typer 0.27.2 0.27.3
typesafe-sdk 0.7.2 0.7.4
anthropic 1.8.0 1.13.0
torch 2.14.0 2.14.1
transformers 5.17.0 5.19.0
ruff 0.16.9 0.17.0
mypy 2.3.1 2.4.0

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates typesafe-sdk from 0.7.2 to 0.7.4

Release notes

Sourced from typesafe-sdk's releases.

v0.7.4 (2026-10-09)

Bug fixes

  • serialize non-finite numbers as strings instead of invalid JSON tokens

v0.7.3 (2026-10-09)

Bug fixes

  • prevent async client crashes during concurrent TLS connections with truststore<=0.10.4
  • add more request validation checks

Documentation

  • add a new Performance section with tips for high-concurrency usage

Performance

  • update the default settings to keep all pooled connections alive for 30 seconds
Changelog

Sourced from typesafe-sdk's changelog.

v0.7.4 (2026-10-09)

Bug fixes

  • serialize non-finite numbers as strings instead of invalid JSON tokens

v0.7.3 (2026-10-09)

Bug fixes

  • prevent async client crashes during concurrent TLS connections with truststore<=0.10.4
  • add more request validation checks

Documentation

  • add a new Performance section with tips for high-concurrency usage

Performance

  • update the default settings to keep all pooled connections alive for 30 seconds
Commits

Updates anthropic from 1.8.0 to 1.13.0

Release notes

Sourced from anthropic's releases.

v1.13.0

Features

  • api: add types for the Chat and Cowork unified analytics metrics
  • api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

  • internal: name the default API version header value

v1.12.1

Chores

  • ci: check that pull requests update the changelog
  • docs: note that listing Claude Console spend limits is in early access
  • internal: match the package version in uv.lock

v1.12.0

1.12.0 (2026-10-07)

Full Changelog: v1.11.0...v1.12.0

Features

  • api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (f6346e6)
  • api: add disabled to thinking types in model capabilities (78d815d)
  • api: add display_name to RBAC roles and deprecate name (f63f99c)
  • api: add include_default parameter to list workspaces (5d4b37b)
  • api: add lifecycle stage fields and filter to /v1/models (0c96c02)
  • api: add line to model objects (a85c649)
  • api: add url_sources to the Managed Agents web_fetch tool config (78d815d)
  • api: add web search and code execution support to model capabilities (78d815d)

Bug Fixes

  • api: send the beta header by default when listing spend limits (e2690b4)
  • client: send empty strings in query params and multipart forms (80e69f1)
  • tools: keep a local edit made after a memory upload whose response was lost (#990) (78d815d)

Chores

  • client: track whether the client timeout was set explicitly (36a223f)
  • docs: correct example groups in rate limit list description (71fcf2f)
  • docs: describe a federation rule's target by its type (78d815d)
  • docs: fix example IDs in sessions, agents and vault credentials (78d815d)
  • docs: update Managed Agents multiagent and thread descriptions (78d815d)
  • docs: update the activity summaries endpoint description (d9bd4bf)

... (truncated)

Changelog

Sourced from anthropic's changelog.

1.13.0 (2026-10-09)

Features

  • api: add types for the Chat and Cowork unified analytics metrics
  • api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

  • internal: name the default API version header value

1.12.1 (2026-10-08)

Chores

  • ci: check that pull requests update the changelog
  • docs: note that listing Claude Console spend limits is in early access
  • internal: match the package version in uv.lock

1.12.0 (2026-10-07)

Full Changelog: v1.11.0...v1.12.0

Features

  • api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (f6346e6)
  • api: add disabled to thinking types in model capabilities (78d815d)
  • api: add display_name to RBAC roles and deprecate name (f63f99c)
  • api: add include_default parameter to list workspaces (5d4b37b)
  • api: add lifecycle stage fields and filter to /v1/models (0c96c02)
  • api: add line to model objects (a85c649)
  • api: add url_sources to the Managed Agents web_fetch tool config (78d815d)
  • api: add web search and code execution support to model capabilities (78d815d)

Bug Fixes

  • api: send the beta header by default when listing spend limits (e2690b4)
  • client: send empty strings in query params and multipart forms (80e69f1)
  • tools: keep a local edit made after a memory upload whose response was lost (#990) (78d815d)

Chores

  • client: track whether the client timeout was set explicitly (36a223f)
  • docs: correct example groups in rate limit list description (71fcf2f)
  • docs: describe a federation rule's target by its type (78d815d)
  • docs: fix example IDs in sessions, agents and vault credentials (78d815d)
  • docs: update Managed Agents multiagent and thread descriptions (78d815d)

... (truncated)

Commits
  • b4b7916 release: 1.13.0
  • 92bd307 Merge pull request #1007 from anthropics/synced/published
  • e80192f feat(api): add workflows, multiagent configuration and thread status filterin...
  • ae2b53d codegen metadata
  • 444c449 codegen metadata
  • 2abb479 codegen metadata
  • 4250339 codegen metadata
  • 9992c35 codegen metadata
  • 5fe6a75 chore(internal): name the default API version header value
  • bf97cda feat(api): declare error codes on the Skills operations
  • Additional commits viewable in compare view

Updates torch from 2.14.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

  • Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
  • Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
  • Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
    • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
    • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

  • Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
  • Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872
Commits
  • 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
  • 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
  • 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
  • e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
  • 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
  • See full diff in compare view

Updates transformers from 5.17.0 to 5.19.0

Release notes

Sourced from transformers's releases.

Release v5.19.0

New Model additions

EmbeddingGemma2

EmbeddingGemma 2 is a multimodal embedding model from Google built on the Gemma 4 architecture. It encodes text, images, audio, and video, individually or combined in one input, into a shared 768-dimensional vector space for cross-modal retrieval, semantic similarity, clustering, and classification. It uses Matryoshka Representation Learning, so embeddings can be truncated to 512, 256, or 128 dimensions. It also offers configurable visual and video token budgets, and unused vision or audio towers can be disabled at load time to save memory.

Links: Documentation

Breaking changes

All MoE models whose routers compute logits now return them when output_router_logits=True, following the Qwen3-MoE pattern (a router_logits recorder on the base model, MoeModelOutputWithPast from the backbone, and a MoE causal LM output from the head), so code that relied on the previous outputs or their absence should read the router logits from these output classes.

Owlv2ForObjectDetection.embed_image_query now selects the query box with the highest objectness score, as in the original OWLv2 notebook, instead of the OWL-ViT heuristic, so image-guided query embeddings and detections may differ from earlier releases.

The "paged|" prefix for SDPA and flash attention implementations is deprecated, so users should set the regular attention implementation (e.g. sdpa or flash_attention_2) for continuous batching instead of paged|sdpa or paged|flash_attention_2.

  • 🚨 Attention 🚨 Deprecate "paged|" prefix for SDPA and flash (#49112) by @​remi-or

The regular flash and SDPA attention functions (flash_attention.py, sdpa_attention.py) now support continuous batching directly, and "paged|..." implementations for these are redirected to them, while eager still requires the "paged|eager" prefix.

In continuous batching, the cache update for the index-based and block-table paths is now fused into a single call, which slightly changes the cache update function's behavior and affects any custom code that calls the separate update paths.

Continuous batching internals changed in preparation for removing "paged": `max

Parallelization

Expert parallelism gains a token-dispatch implementation, selected via the new ep_dispatch_experts plan rule and now the default for Qwen3 MoE and Mellum, which removes the requirement that EP size equal TP size. The Trainer was also adapted to work with expert parallelism, and the docs now note that PEFT adapters support tensor parallelism. A CI-related fix for pipeline-parallel chart2table inference was also included.

Cache

... (truncated)

Commits

Updates ruff from 0.16.9 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the dependencies group across 1 directory with 8 updates
be00615 
Bumps the dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` |
| [typer](https://github.com/fastapi/typer) | `0.27.2` | `0.27.3` |
| [typesafe-sdk](https://github.com/typesafe-ai/typesafe-sdk-python) | `0.7.2` | `0.7.4` |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `1.8.0` | `1.13.0` |
| [torch](https://github.com/pytorch/pytorch) | `2.14.0` | `2.14.1` |
| [transformers](https://github.com/huggingface/transformers) | `5.17.0` | `5.19.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.9` | `0.17.0` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |



Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `typer` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `typesafe-sdk` from 0.7.2 to 0.7.4
- [Release notes](https://github.com/typesafe-ai/typesafe-sdk-python/releases)
- [Changelog](https://github.com/typesafe-ai/typesafe-sdk-python/blob/main/docs/changelog.md)
- [Commits](typesafe-ai/typesafe-sdk-python@v0.7.2...v0.7.4)

Updates `anthropic` from 1.8.0 to 1.13.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v1.8.0...v1.13.0)

Updates `torch` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.14.0...v2.14.1)

Updates `transformers` from 5.17.0 to 5.19.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.17.0...v5.19.0)

Updates `ruff` from 0.16.9 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.17.0)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

---
updated-dependencies:
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typesafe-sdk
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: anthropic
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: torch
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: transformers
  dependency-version: 5.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 18, 2026
@socket-security

socket-security Bot commented Oct 18, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednumpy@​2.5.3 ⏵ 2.5.475 +110010010070
Updatedtorch@​2.14.0 ⏵ 2.14.17310010010070
Updatedmypy@​2.3.1 ⏵ 2.4.075 +1100100100100
Updatedtransformers@​5.17.0 ⏵ 5.19.077 +1100100100100
Updatedanthropic@​1.8.0 ⏵ 1.13.085 -1100100100100
Updatedtyper@​0.27.2 ⏵ 0.27.397 +1100100100100
Updatedruff@​0.16.9 ⏵ 0.17.0100100100100100
Updatedtypesafe-sdk@​0.7.2 ⏵ 0.7.4100 +1100100100100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 8, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/dependencies-7f1d8ea6c4 branch November 8, 2026 13:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants