Skip to content

chore(deps)(deps): bump the python-versions group across 1 directory with 16 updates - #1076

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-9447007768
Open

chore(deps)(deps): bump the python-versions group across 1 directory with 16 updates#1076
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-9447007768

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-versions group with 15 updates in the / directory:

Package From To
huggingface-hub 1.27.0 1.29.0
scipy-stubs 1.18.0.1 1.18.1.0
ipython 9.16.1 9.17.0
pydata-sphinx-theme 0.20.0 0.21.0
sphinx-autodoc-typehints 3.13.2 3.13.4
dagster 1.13.18 1.13.20
pydantic 2.13.4 2.13.5
onnxruntime 1.28.0 1.29.0
nvidia-cudnn-cu12 9.24.0.43 9.25.1.1
onnxruntime-gpu 1.28.0 1.29.0
holidays 0.102 0.103
mlflow-skinny 3.15.1 3.15.2
scipy 1.18.0 1.18.1
xgboost 3.4.0 3.4.1
xgboost-cpu 3.4.0 3.4.1

Updates huggingface-hub from 1.27.0 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

  • [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
  • Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

🖥️ CLI

... (truncated)

Commits
  • 4237d95 Release: v1.29.0
  • dd44abc Release: v1.29.0.rc1
  • 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
  • b1bf950 Release: v1.29.0.rc0
  • 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
  • c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
  • 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
  • 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
  • 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
  • c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
  • Additional commits viewable in compare view

Updates scipy-stubs from 1.18.0.1 to 1.18.1.0

Release notes

Sourced from scipy-stubs's releases.

v1.18.1.0

This scipy-stubs release comes with many improvements and even more fixes. It targets SciPy 1.18.1 and supports Python 3.12–3.15, NumPy 2.0–2.7, and optype 0.15–0.19.

🏆 Release Highlights

  • ✨ 105 improvements
  • 🐛 129 fixes
  • ✅ 100% test coverage
  • 🏷️ linalg.blas & linalg.lapack complete type coverage

What's Changed

⏬ SciPy Changes

✨ Improvements

... (truncated)

Commits
  • 844c24a 🔖 scipy-stubs 1.18.1.0
  • 6d3c811 Merge pull request #2302 from scipy:remove-update_dprint-workflow
  • fb4c765 ⚰️ remove broken update_dprint workflow
  • 19b2cb9 Merge pull request #2301 from scipy/bump-dev-deps
  • 7fbe7a2 ⬆️ update development dependencies
  • bd8ad95 Merge pull request #2300 from scipy:scipy-1.18.1
  • 52ce801 👽️ version: update version literals
  • 93cf36f 👽️ interpolate: update __class_getitem__ classmethods
  • c7cf199 📌 SciPy 1.18.1
  • 968e187 Merge pull request #2299 from scipy:stats.linregress/propagate-f32
  • Additional commits viewable in compare view

Updates ipython from 9.16.1 to 9.17.0

Commits
  • 3278f6f release 9.17.0
  • 40cfb95 Update what's new for 9.17
  • 2ed42ae Fix RST formatting in display_functions.py
  • a487a06 change emojis
  • 7f0ee55 Declare IPython's built-in magics lazily
  • ee02392 Only run the psutil-free kitty detection test where /proc exists
  • af386cf Annotate _find_dunder and put measured numbers in the whatsnew
  • b7509b6 Add a whatsnew entry for the second startup pass
  • a42fdc0 Defer mimetypes, locale, glob and runpy to their use sites
  • cab037e Detect the kitty graphics protocol without importing psutil
  • Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.20.0 to 0.21.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.21.0

What's Changed

Breaking

None.

Fixes

Improvements

Dependencies

New Contributors

Full Changelog: pydata/pydata-sphinx-theme@v0.20.0...v0.21.0

Commits
  • a52f5c9 Bump 0.20.0 -> 0.21.0 (#2472)
  • dc10572 Prevent "Back to Top" button from being cropped on firefox/android (#2442)
  • a9f2040 Bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#2468)
  • fe3f573 Bump py-cov-action/python-coverage-comment-action from 4.1 to 4.3 (#2467)
  • 3e15d01 fix: don't share sidebars between pages with non-flat output URIs (#2469)
  • c90610d fix: correct typo in source (#2459)
  • 051ac2c Avoid redundant processing when collapse_navigation=False (#2449)
  • ca91fce refactor: drop user-select rule superseded by Sphinx's basic.css (#2464)
  • 2a63b5c Bump js-yaml from 4.2.0 to 4.3.1 (#2463)
  • cbb254b Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#2460)
  • Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.13.2 to 3.13.4

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.4

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.3...3.13.4

3.13.3

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.2...3.13.3

Commits
  • 7853f2e 🧪 test(docstring): pin what a nested handler restores (#759)
  • a708030 🐛 fix(resolver): bind only what a guarded statement defines (#760)
  • f6ca3fd 🐛 fix(parser): stop shadowing intersphinx roles in the type role (#761)
  • 02dd58f 🐛 fix(docstring): survive a re-entrant docstring handler (#758)
  • 3f6d334 🐛 fix(resolver): accept guarded code the interpreter rejects (#757)
  • d98ed0b 🐛 fix(parser): stop shadowing intersphinx roles in the rtype probe (#756)
  • c4b99d0 🔧 chore: batch dependency updates weekly on Tuesday (#755)
  • ce9abe3 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#754)
  • a032f12 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#752)
  • 3528bac [pre-commit.ci] pre-commit autoupdate (#749)
  • Additional commits viewable in compare view

Updates dagster from 1.13.18 to 1.13.20

Release notes

Sourced from dagster's releases.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster's changelog.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 728c047 1.13.20
  • cbad617 1.13.20 changelog (#26540)
  • de1c658 [rest-resources] support python 3.10 list[<type>] import resolution (#26523)
  • f08ff1a [app-managed-components][3/n] view and edit the repo binding from the code lo...
  • b611753 [app-managed-components] mock the git-backed gate in the component dialog tes...
  • 933db15 [app-managed-components][2/n] gate the authoring entry point on a repo bindin...
  • 5602898 [app-managed-components] Tell users the authoring form opens a pull request (...
  • a0686ab FE wiring for ability to wipe and delete partitions simultaneously (#26365)
  • dab616f Add a section for recent searches to our syntax typeaheads [UI-4] (#26363)
  • 0684508 [ui-core] Update Google kind tags with new icons (#33882)
  • Additional commits viewable in compare view

Updates dagster-webserver from 1.13.18 to 1.13.20

Release notes

Sourced from dagster-webserver's releases.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster-webserver's changelog.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 728c047 1.13.20
  • cbad617 1.13.20 changelog (#26540)
  • de1c658 [rest-resources] support python 3.10 list[<type>] import resolution (#26523)
  • f08ff1a [app-managed-components][3/n] view and edit the repo binding from the code lo...
  • b611753 [app-managed-components] mock the git-backed gate in the component dialog tes...
  • 933db15 [app-managed-components][2/n] gate the authoring entry point on a repo bindin...
  • 5602898 [app-managed-components] Tell users the authoring form opens a pull request (...
  • a0686ab FE wiring for ability to wipe and delete partitions simultaneously (#26365)
  • dab616f Add a section for recent searches to our syntax typeaheads [UI-4] (#26363)
  • 0684508 [ui-core] Update Google kind tags with new icons (#33882)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates onnxruntime from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits
  • 2e2543f [CUDA] Update cuda archs in packaging pipelines (#31992)
  • 9b174a4 [CUDA] Add GatedAdd contrib operator (#31835)
  • a29da16 Validate SkipLayerNorm prepacked lengths (#31676)
  • 831fa2f Validate whisper beginning_timestamp_token_id bounds (#31636)
  • 3cee186 Handle RNN activation parameters safely (#31675)
  • 37d79e3 Harden CUDA fp16 transpose index math against int overflow (#31644)
  • 45bdd4c Validate QLinearConv bias size against output channels (#31684)
  • f5de4c3 Fix TfIdfVectorizer weight indexing semantics (#31649)
  • d3abafc Validate FeatureVectorizer batch sizes (#31671)
  • 1441b36 [WebGPU] Add MRotaryEmbedding support (Description has been truncated

@dependabot
chore(deps)(deps): bump the python-versions group across 1 directory …
06b6537 
…with 16 updates

Bumps the python-versions group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.27.0` | `1.29.0` |
| [scipy-stubs](https://github.com/scipy/scipy-stubs) | `1.18.0.1` | `1.18.1.0` |
| [ipython](https://github.com/ipython/ipython) | `9.16.1` | `9.17.0` |
| [pydata-sphinx-theme](https://github.com/pydata/pydata-sphinx-theme) | `0.20.0` | `0.21.0` |
| [sphinx-autodoc-typehints](https://github.com/tox-dev/sphinx-autodoc-typehints) | `3.13.2` | `3.13.4` |
| [dagster](https://github.com/dagster-io/dagster) | `1.13.18` | `1.13.20` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [nvidia-cudnn-cu12](https://developer.nvidia.com/cuda-zone) | `9.24.0.43` | `9.25.1.1` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [holidays](https://github.com/vacanza/holidays) | `0.102` | `0.103` |
| [mlflow-skinny](https://github.com/mlflow/mlflow) | `3.15.1` | `3.15.2` |
| [scipy](https://github.com/scipy/scipy) | `1.18.0` | `1.18.1` |
| [xgboost](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |
| [xgboost-cpu](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |



Updates `huggingface-hub` from 1.27.0 to 1.29.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.27.0...v1.29.0)

Updates `scipy-stubs` from 1.18.0.1 to 1.18.1.0
- [Release notes](https://github.com/scipy/scipy-stubs/releases)
- [Commits](scipy/scipy-stubs@v1.18.0.1...v1.18.1.0)

Updates `ipython` from 9.16.1 to 9.17.0
- [Release notes](https://github.com/ipython/ipython/releases)
- [Commits](ipython/ipython@9.16.1...9.17.0)

Updates `pydata-sphinx-theme` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/pydata/pydata-sphinx-theme/releases)
- [Changelog](https://github.com/pydata/pydata-sphinx-theme/blob/main/RELEASE.md)
- [Commits](pydata/pydata-sphinx-theme@v0.20.0...v0.21.0)

Updates `sphinx-autodoc-typehints` from 3.13.2 to 3.13.4
- [Release notes](https://github.com/tox-dev/sphinx-autodoc-typehints/releases)
- [Commits](tox-dev/sphinx-autodoc-typehints@3.13.2...3.13.4)

Updates `dagster` from 1.13.18 to 1.13.20
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.20)

Updates `dagster-webserver` from 1.13.18 to 1.13.20
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.20)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `onnxruntime` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `nvidia-cudnn-cu12` from 9.24.0.43 to 9.25.1.1

Updates `onnxruntime-gpu` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `holidays` from 0.102 to 0.103
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.102...v0.103)

Updates `mlflow-skinny` from 3.15.1 to 3.15.2
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.15.1...v3.15.2)

Updates `scipy` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

Updates `xgboost` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

Updates `xgboost-cpu` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy-stubs
  dependency-version: 1.18.1.0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: ipython
  dependency-version: 9.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pydata-sphinx-theme
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-autodoc-typehints
  dependency-version: 3.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster
  dependency-version: 1.13.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster-webserver
  dependency-version: 1.13.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: onnxruntime
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: nvidia-cudnn-cu12
  dependency-version: 9.25.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: onnxruntime-gpu
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: holidays
  dependency-version: '0.103'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: mlflow-skinny
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost-cpu
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 3, 2026
@dependabot
dependabot Bot requested a review from a team September 3, 2026 04:33
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 3, 2026
@sonarqubecloud

sonarqubecloud Bot commented Sep 3, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants