Skip to content

chore(deps)(deps): bump the python-versions group across 1 directory with 9 updates - #1071

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-c3a5a0a090
Closed

chore(deps)(deps): bump the python-versions group across 1 directory with 9 updates#1071
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-c3a5a0a090

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-versions group with 8 updates in the / directory:

Package From To
huggingface-hub 1.27.0 1.28.0
dagster 1.13.18 1.13.19
onnxruntime 1.28.0 1.29.0
onnxruntime-gpu 1.28.0 1.29.0
holidays 0.102 0.103
scipy 1.18.0 1.18.1
xgboost 3.4.0 3.4.1
xgboost-cpu 3.4.0 3.4.1

Updates huggingface-hub from 1.27.0 to 1.28.0

Release notes

Sourced from huggingface-hub's releases.

[v1.28.0] Hardware discovery and managed engine images for Inference Endpoints and more

🔎 Discover deployable hardware with hf endpoints hardware

Deploying an Inference Endpoint requires five hardware flags (--vendor, --region, --accelerator, --instance-type, --instance-size) whose valid values depend on each other, and until now there was no way to learn them from the CLI. The new hf endpoints hardware command lists the valid combinations along with the price per replica per hour and your namespace's accelerator quota, filtered by default to the hardware you can deploy on right now. The same data is available in the SDK via list_inference_endpoints_hardware(), which flattens the API response into InferenceEndpointHardware objects you can filter programmatically.

>>> hf endpoints hardware --vendor aws --region eu-west-1
VENDOR REGION    ACCELERATOR INSTANCE_TYPE INSTANCE_SIZE MEMORY_GB GPU_MEMORY_GB PRICE_PER_HOUR QUOTA STATUS
------ --------- ----------- ------------- ------------- --------- ------------- -------------- ----- ---------
aws    eu-west-1 cpu         intel-spr     x1                  2.0                        0.033 0/60  available
aws    eu-west-1 cpu         intel-spr     x2                  4.0                        0.067 0/60  available
aws    eu-west-1 gpu         nvidia-a10g   x1                 30.0            24            1.0 0/16  available
aws    eu-west-1 gpu         nvidia-t4     x1                 15.0            16            0.5 1/30  available

🚀 Managed engine images and multi-accelerator parallelism for Inference Endpoints

custom_image now accepts the engine-specific container types supported by the API: key the dictionary with the engine name (vLLM, sGLang, tgi, tei, llamacpp, hfServe, ...) instead of leaving it flat, and each engine takes the usual container fields plus its own tuning options. Any dict without a top-level url is forwarded to the API untouched, so engines added to the API later will work without upgrading huggingface_hub, and update_inference_endpoint now handles the same payload shapes as create_inference_endpoint. On the CLI, hf endpoints deploy and hf endpoints update gain --engine, --tensor-parallel-size and --data-parallel-size, and update also accepts --custom-image, --health-route and --port. This matters because vLLM and SGLang default to a single accelerator while an endpoint is allocated every accelerator of its instance — the API now rejects that misconfiguration, and these flags are how you set things right.

$ hf endpoints deploy gpt-oss-120b-vllm --repo openai/gpt-oss-120b --framework custom \
    --accelerator gpu --instance-size x8 --instance-type nvidia-h200 --region us-east-1 --vendor aws \
    --engine vllm --custom-image vllm/vllm-openai:v0.23.0 --tensor-parallel-size 8
Retune a running endpoint
$ hf endpoints update gpt-oss-120b-vllm --tensor-parallel-size 4 --data-parallel-size 2

💔 Breaking change: huggingface_hub.constants.INFERENCE_ENDPOINT_IMAGE_KEYS is removed. It was never exported at the package root nor documented, but code reading it directly will now get an AttributeError.

  • [Inference Endpoints] Support managed engine images in custom_image by @​hanouticelina in #4671
  • [CLI] Add --tensor-parallel-size / --data-parallel-size to hf endpoints deploy and update by @​moon-bot-app[bot] in #4661

🤖 Inference

  • [Inference Providers] deepinfra: add text-to-speech support by @​ovuruska in #4559
  • [Inference Providers] deepinfra: add feature-extraction support by @​ovuruska in #4656

🖥️ CLI

🐛 Bug and typo fixes

... (truncated)

Commits
  • b2da2d4 Release: v1.28.0
  • a718e44 Release: v1.28.0.rc0
  • 7105c3d [CLI] Add --tensor-parallel-size / --data-parallel-size to `hf endpoints depl...
  • a3d9d8a [Inference Endpoints] Omit model.task instead of sending null on create (#4...
  • 909b162 [Inference Endpoints] Add hf endpoints hardware to list available instances...
  • 5ac9711 Do not use a redirect's Content-Length as file size in get_hf_file_metadata (...
  • 99aba55 [Docs] Normalize malformed docstring parameter entries (#4623)
  • 2e6c67d [Inference Providers] deepinfra: add feature-extraction (embeddings) support ...
  • 7a522f0 docs: remove obsolete Repository guide references (#4679)
  • aa40a65 [Download] Fix ResolvedRevision string value after pickle/copy (#4692)
  • Additional commits viewable in compare view

Updates dagster from 1.13.18 to 1.13.19

Release notes

Sourced from dagster's releases.

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster's changelog.

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 1071cbb 1.13.19
  • b5784a4 Changelog 1.13.19
  • 6cfa330 [app-managed-components] Gate the git-backed UI authoring path on the feature...
  • 8e2159e [ui-components][git-backed][17/n] Support component-state refresh for fast pr...
  • b24e521 Add DagsterLogo and DagsterIcon design system components (#26394)
  • a706ddb Update billing-page.png (#26369)
  • 06a5c49 Changelog 1.13.18 (#26390)
  • b9931e9 Add expand/collapse all toggle to automation condition table UI-12 (#26355)
  • 365ab19 [dagster-ui] Abort sensor tick apply on dynamic partition permission errors (...
  • 70e4958 Remove docs group specifics from CODEOWNERS (#26382)
  • Additional commits viewable in compare view

Updates dagster-webserver from 1.13.18 to 1.13.19

Release notes

Sourced from dagster-webserver's releases.

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster-webserver's changelog.

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 1071cbb 1.13.19
  • b5784a4 Changelog 1.13.19
  • 6cfa330 [app-managed-components] Gate the git-backed UI authoring path on the feature...
  • 8e2159e [ui-components][git-backed][17/n] Support component-state refresh for fast pr...
  • b24e521 Add DagsterLogo and DagsterIcon design system components (#26394)
  • a706ddb Update billing-page.png (#26369)
  • 06a5c49 Changelog 1.13.18 (#26390)
  • b9931e9 Add expand/collapse all toggle to automation condition table UI-12 (#26355)
  • 365ab19 [dagster-ui] Abort sensor tick apply on dynamic partition permission errors (...
  • 70e4958 Remove docs group specifics from CODEOWNERS (#26382)
  • Additional commits viewable in compare view

Updates onnxruntime from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates onnxruntime-gpu from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime-gpu's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates holidays from 0.102 to 0.103

Release notes

Sourced from holidays's releases.

v0.103

Version 0.103

Released August 17, 2026

New Contributors:

Full Changelog: vacanza/holidays@v0.102...v0.103

Changelog

Sourced from holidays's changelog.

Version 0.103

Released August 17, 2026

Commits

Updates scipy from 1.18.0 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

  • Name (commits)
  • Wasim Akram (2) +
  • Jake Bowhay (1)
  • Michael Bratsch (1)
  • Dietrich Brunn (1)
  • Evgeni Burovski (1)
  • Aadya Chinubhai (1)
  • Lucas Colley (3)
  • Tekin Ertekin (1) +
  • Fuyugithub (2) +
  • Ralf Gommers (11)
  • Joren Hammudoglu (1)
  • Ijtihed Kilani (1) +
  • Andrew Nelson (2)
  • Ilhan Polat (1)
  • Tyler Reddy (39)
  • romao05 (1) +
  • Michael Simacek (1) +
  • Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits
  • e4e854e REL: SciPy 1.18.1 rel commit
  • 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
  • 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
  • 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
  • a717e28 DOC: PR 25884 revisions
  • bb489c0 DOC: PR 25884 revisions
  • 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
  • 095fe56 DOC, BLD: PR 25884 revisions
  • e66ea64 DOC: update minimum GCC version in toolchain roadmap
  • c021653 TST: tolerance bumps and skips on 32-bit platforms
  • Additional commits viewable in compare view

Updates xgboost from 3.4.0 to 3.4.1

Release notes

Sourced from xgboost's releases.

3.4.1 Patch Release

What's Changed

  • [jvm] Fix batch predict for SparseVector features (#12347)
  • Fix model slicing with category container. (#12462)

Full Changelog: dmlc/xgboost@v3.4.0...v3.4.1

Additional artifacts

You can verify the downloaded packages by running the following command on your Unix shell:

echo "<hash> <artifact>" | shasum -a 256 --check
34a5cb99a67bb98b44f204767eeeae642b65a86b2ecfca60082e4d74fd4d169a  xgboost-src-3.4.1.tar.gz
2514d394f989d6e990e67898d7f5e530c7c1867222c497ea454ffc18a31cb096  xgboost_r_gpu_linux.tar.gz

Experimental binary packages for R with CUDA enabled

Source tarball

Commits

Updates xgboost-cpu from 3.4.0 to 3.4.1

Release notes

Sourced from xgboost-cpu's releases.

3.4.1 Patch Release

What's Changed

  • [jvm] Fix batch predict for SparseVector features (#12347)
  • Fix model slicing with category container. (#12462)

Full Changelog: dmlc/xgboost@v3.4.0...v3.4.1

Additional artifacts

You can verify the downloaded packages by running the following command on your Unix shell:

echo "<hash> <artifact>" | shasum -a 256 --check
34a5cb99a67bb98b44f204767eeeae642b65a86b2ecfca60082e4d74fd4d169a  xgboost-src-3.4.1.tar.gz
2514d394f989d6e990e67898d7f5e530c7c1867222c497ea454ffc18a31cb096  xgboost_r_gpu_linux.tar.gz

Experimental binary packages for R with CUDA enabled

Source tarball

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the python-versions group across 1 directory …
7e69145 
…with 9 updates

Bumps the python-versions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.27.0` | `1.28.0` |
| [dagster](https://github.com/dagster-io/dagster) | `1.13.18` | `1.13.19` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [holidays](https://github.com/vacanza/holidays) | `0.102` | `0.103` |
| [scipy](https://github.com/scipy/scipy) | `1.18.0` | `1.18.1` |
| [xgboost](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |
| [xgboost-cpu](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |



Updates `huggingface-hub` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.27.0...v1.28.0)

Updates `dagster` from 1.13.18 to 1.13.19
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.19)

Updates `dagster-webserver` from 1.13.18 to 1.13.19
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.19)

Updates `onnxruntime` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `onnxruntime-gpu` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `holidays` from 0.102 to 0.103
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.102...v0.103)

Updates `scipy` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

Updates `xgboost` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

Updates `xgboost-cpu` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: dagster
  dependency-version: 1.13.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster-webserver
  dependency-version: 1.13.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: onnxruntime
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: onnxruntime-gpu
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: holidays
  dependency-version: '0.103'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost-cpu
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from a team August 24, 2026 04:39
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Aug 24, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 24, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 25, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-versions-c3a5a0a090 branch August 25, 2026 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants