chore(deps): bump the python-compatible group across 1 directory with 6 updates by dependabot[bot] · Pull Request #156 · huggingface/Repo2RLEnv

dependabot · 2026-09-22T11:00:58Z

Bumps the python-compatible group with 6 updates in the / directory:

Package	From	To
anyio	`4.14.2`	`4.15.1`
huggingface-hub	`1.30.0`	`1.31.0`
litellm	`1.100.0`	`1.101.0`
daytona	`0.211.2`	`0.214.0`
harbor	`0.22.0`	`0.23.0`
ruff	`0.16.6`	`0.16.7`

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

follow_symlinks on exists() (Python 3.12+)

follow_symlinks on is_dir() (Python 3.13+)

follow_symlinks on is_file() (Python 3.13+)

follow_symlinks on owner() (Python 3.13+)

follow_symlinks on group() (Python 3.13+)

newline on read_text() (Python 3.13+)

(#1286, #1293; PR by @jaideeppyne)

Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @Graeme22)

Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @EmmanuelNiyonshuti)

Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @Vizonex)

Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @nightcityblade)

Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @davidbrochart)

Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @gschaffner)

Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @EmmanuelNiyonshuti)

Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @c-tonneslan)

Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @Graeme22)

Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @gschaffner)

Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @tapetersen)

Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @Sanjays2402)

Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @alloutflo)

Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @matthewfeickert)

Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @hansu650)

Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @zelinewang)

... (truncated)

Commits

ffcd154 Bumped up the version
0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
9283662 Bumped up the version
d137692 Improved the instructions for AI agents
033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
b825c3b Fixed pyproject.toml changes not triggering the test suite
9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
b05fe6d Fixed wrong type in move_on_after (#1297)
44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
Additional commits viewable in compare view

Updates huggingface-hub from 1.30.0 to 1.31.0

Release notes

Sourced from huggingface-hub's releases.

[v1.31.0] Custom labels for Sandboxes, More resilient downloads and more

🏷️ Custom labels for Sandboxes

Dedicated sandboxes now accept custom labels, attached to the underlying Job. This is useful for cost attribution, bookkeeping, or finding and reconnecting to the sandboxes created by a given controller run. Labels use the same -l / --label KEY=VALUE syntax as hf jobs run. They are merged with the labels the SDK uses internally, and invalid or reserved labels are rejected before a billable Job is started. Pool-based sandboxes are unchanged: custom labels are only accepted for dedicated sandboxes.
>>> from huggingface_hub import Sandbox
>>> sandbox = Sandbox.create(image="python:3.12", labels={"controller-run": "run-42"})
hf sandbox create --label controller-run=run-42 --label team=data-infra
[Sandbox] Support custom Job labels by @Wauplin in #4824

📥 More resilient downloads

A batch of fixes makes downloads more robust to unusual server responses, network hiccups and concurrent usage:

A timeout while waiting for the response headers of a streamed download is now retried and resumed like a body read failure, instead of escaping http_get() while retries remain.

Regular HTTP downloads no longer fail when the HEAD response has no Content-Length. The file size is validated against the GET response when available.

snapshot_download now writes the refs/ cache file atomically, reusing the logic already used by hf_hub_download. This fixes a long-standing race when many concurrent snapshot_download calls target the same repo (seen in vLLM / llm-compressor).

hf download --dry-run --local-dir ... no longer copies files from the Hub cache into the destination. On large files and slow disks this looked like a hang and could leave an incomplete file behind.

[Download] Share retry handling for stream entry and body failures by @Wauplin in #4826

[Download] Tolerate missing HEAD Content-Length by @Wauplin in #4805

[Download] Write cache ref file atomically in snapshot_download by @Wauplin in #4829

[Download] Prevent cached file copies during local-dir dry runs by @wakamex in #4817

🔌 httpx re-exported for library integrators

huggingface_hub now re-exports the HTTP library it uses as huggingface_hub.utils.httpx. Libraries built on top of huggingface_hub that need httpx types or exceptions (typically to catch errors) should import it from there rather than importing httpx directly. v1.x is built on httpx, and v2.x will move to its successor httpx2, so importing through huggingface_hub.utils keeps your code compatible with both. This is only for types and exceptions: to make requests to the Hub, keep using get_session().
from huggingface_hub.utils import httpx
try:
...
except httpx.HTTPError:
...
📚 Documentation: Utilities — The httpx module

[httpx migration] Expose httpx as a huggingface_hub submodule by @Wauplin in #4803

🔒 Security

HfFileSystem.get() now validates remote filenames before writing anything locally. A server-side filename such as folder/..\..\outside.txt could previously escape the destination directory on Windows during a recursive download. The same check already protected hf_hub_download, snapshot_download and bucket sync. Unsafe filenames now raise ValueError on all platforms, including when downloading to an explicitly named file or a file object.

... (truncated)

Commits

495b17c Release: v1.31.0
0f50db0 Release: v1.31.0.rc1
d592df8 Revert "[Jobs] Add network groups to hf jobs run (#4833)"
3c08b69 Release: v1.31.0.rc0
f148666 [CLI] Fix truncated command descriptions in the CLI reference (#4849)
c4f076c (LFS)Fix SliceFileObj.iter yielding only the first 4MB chunk (#4844)
22fe960 Fix dotenv parser truncating unquoted values containing '#' (#4842)
6cae778 [Jobs] Add network groups to hf jobs run (#4833)
063b37b [CLI] Raise explicit error for shell-script extensions on Windows (#4846)
b9c14d9 [Download] Write cache ref file atomically in snapshot_download (#4829)
Additional commits viewable in compare view

Updates litellm from 1.100.0 to 1.101.0

Release notes

Sourced from litellm's releases.

v1.101.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.101.0
Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.101.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.101.0
Expected output:
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
What's Changed

fix(proxy): emit timing headers and overhead for /v1/messages and /v1/responses by @yucheng-berri in BerriAI/litellm#38840

fix(tests): derive the no-cache-read-rate savings baseline from the model map by @tin-berri in BerriAI/litellm#38863

chore(typing): clear Any seams across 47 files, ratchet basedpyright ceilings -3,302 by @mateo-berri in BerriAI/litellm#37778

chore(typing): clear 1.2k basedpyright Any errors across 16 hotspot files by @mateo-berri in BerriAI/litellm#36722

feat(bedrock): honor streaming buffer/sampling config for unbuffered post_call scans by @mateo-berri in BerriAI/litellm#38722

feat(cli): set ENABLE_TOOL_SEARCH=true for lite claude by @mateo-berri in BerriAI/litellm#38942

fix(proxy): deliver budget alerts on webhook-only alerting and accept ALERTING_WEBHOOK_URL by @devin-ai-integration[bot] in BerriAI/litellm#38441

docs(claude.md): require tests to check behavior, not code structure by @ryan-crabbe-berri in BerriAI/litellm#38772

chore(newrelic): cover static default_team_settings per-team routing by @yucheng-berri in BerriAI/litellm#38857

fix: update stale source URLs and deprecation dates in model cost map by @devin-ai-integration[bot] in BerriAI/litellm#38801

feat(ci): close duplicate issues after a 3-day grace period by @mubashir1osmani in BerriAI/litellm#38381

docs(proxy): clarify spend semantics on /v2/user/info and /user/daily/activity by @devin-ai-integration[bot] in BerriAI/litellm#38883

fix(guardrails): configure Prompt Security file timeout policy by @davida-ps in BerriAI/litellm#38083

fix(bedrock): stop duplicating Converse config blocks inside inferenceConfig by @mateo-berri in BerriAI/litellm#38993

fix(guardrails): exclude images from HiddenLayer v1 scans by @Ashton-Sidhu in BerriAI/litellm#29210

... (truncated)

Commits

18243cd Merge pull request #40886 from BerriAI/litellm_backport_redis_chaos_rc_1_101_0
abfb2cf test(load): backport Redis chaos qualification to rc/1.101.0 (#40482)
c1a834b fix(caching): backport Redis breaker recovery guards to rc/1.101.0 (#40624)
ca4a613 fix(redis): backport quiet breaker refusals to rc/1.101.0 (#40620)
c324a2b perf(proxy): backport pipelined spend counters to rc/1.101.0 (#40371)
912a3f8 Merge pull request #40346 from BerriAI/litellm_backport_40335_rc_1_101_0
bcddffc fix(otel): backport auth spans and callback merge to rc/1.101.0
f0b6d66 Merge pull request #40325 from BerriAI/litellm_backport_37667_rc_1_101_0
f41fc71 Merge pull request #40324 from BerriAI/litellm_backport_40312_rc_1_101_0
b6e73cc feat(team): backport team admin callbacks to rc/1.101.0
Additional commits viewable in compare view

Updates daytona from 0.211.2 to 0.214.0

Updates harbor from 0.22.0 to 0.23.0

Commits

See full diff in compare view

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

[ruff] Add rule for default values on method receivers (RUF077) (#26700)

[ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

Alternate nested quotes inside format spec interpolations (#28259)

[flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)

[flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)

[pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

Correct D211 and D203 rule conflict diagnostic (#28444)

Recognize slice and frozendict generics (#28477)

Stop defining __cached__ for Python 3.15 (#28476)

[pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

Reuse parser name lookups when interning (#28399)

Speed up inherited configuration resolution (#28299)

Documentation

Fix line-length path in --config example (#28392)

Remove the "Who’s Using Ruff?" list (#28455)

Other changes

Embed archive checksums in the shell installer (#28281)

Contributors

@The-Compiler

@mdiniz97

@zsol

@gorewilliams

@RafaelJohn9

@qatcod

@zanieb

@MichaReiser

@ntBre

@charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

[ruff] Add rule for default values on method receivers (RUF077) (#26700)

[ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

Alternate nested quotes inside format spec interpolations (#28259)

[flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)

[flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)

[pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

Correct D211 and D203 rule conflict diagnostic (#28444)

Recognize slice and frozendict generics (#28477)

Stop defining __cached__ for Python 3.15 (#28476)

[pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

Reuse parser name lookups when interning (#28399)

Speed up inherited configuration resolution (#28299)

Documentation

Fix line-length path in --config example (#28392)

Remove the "Who’s Using Ruff?" list (#28455)

Other changes

Embed archive checksums in the shell installer (#28281)

Contributors

@The-Compiler

@mdiniz97

@zsol

@gorewilliams

@RafaelJohn9

@qatcod

@zanieb

@MichaReiser

@ntBre

@charliermarsh

@nightt5879

... (truncated)

Commits

b5dba86 Bump version to 0.16.7 (#28496)
5992d05 Install rustfmt before linting releases (#28495)
1713a1f ensure prepare release changes pass prek (#28488)
18cdbb4 use scoped token for release workflow (#28484)
c3813a5 add a workflow for preparing releases (#28486)
00948c0 Remove the "Who’s Using Ruff?" list (#28455)
86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
609e184 Stop defining __cached__ for Python 3.15 (#28476)
859ff2f [ty] Track symlinked directory status in listings (#28482)
77f6538 Use paid GitHub-hosted runners for Linux (#28478)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 6 updates Bumps the python-compatible group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` | | [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.30.0` | `1.31.0` | | [litellm](https://github.com/BerriAI/litellm) | `1.100.0` | `1.101.0` | | daytona | `0.211.2` | `0.214.0` | | [harbor](https://github.com/harbor-framework/harbor-cookbook) | `0.22.0` | `0.23.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.7` | Updates `anyio` from 4.14.2 to 4.15.1 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.15.1) Updates `huggingface-hub` from 1.30.0 to 1.31.0 - [Release notes](https://github.com/huggingface/huggingface_hub/releases) - [Commits](huggingface/huggingface_hub@v1.30.0...v1.31.0) Updates `litellm` from 1.100.0 to 1.101.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](BerriAI/litellm@v1.100.0...v1.101.0) Updates `daytona` from 0.211.2 to 0.214.0 Updates `harbor` from 0.22.0 to 0.23.0 - [Commits](https://github.com/harbor-framework/harbor-cookbook/commits) Updates `ruff` from 0.16.6 to 0.16.7 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.6...0.16.7) --- updated-dependencies: - dependency-name: anyio dependency-version: 4.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: huggingface-hub dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: litellm dependency-version: 1.101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: daytona dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: harbor dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-compatible - dependency-name: ruff dependency-version: 0.16.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-compatible ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 22, 2026

Navigation Menu

chore(deps): bump the python-compatible group across 1 directory with 6 updates - #156

chore(deps): bump the python-compatible group across 1 directory with 6 updates#156
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-compatible-56aba356c8

dependabot Bot commented on behalf of github Sep 22, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 22, 2026

4.15.1

4.15.0

[v1.31.0] Custom labels for Sandboxes, More resilient downloads and more

🏷️ Custom labels for Sandboxes

📥 More resilient downloads

🔌 httpx re-exported for library integrators

🔒 Security

v1.101.0

Verify Docker Image Signature

What's Changed

0.16.7

Release Notes

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

0.16.7

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

🔌 `httpx` re-exported for library integrators