Skip to content

chore(deps): bump the uv group with 7 updates - #267

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-f99a92fbf2
Open

chore(deps): bump the uv group with 7 updates#267
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-f99a92fbf2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 7 updates:

Package From To
json-repair 0.63.3 0.63.4
pydantic 2.13.4 2.13.5
pypdf 6.16.1 6.16.2
transformers 5.15.1 5.16.1
ruff 0.16.4 0.16.5
prek 0.4.14 0.5.0
ty 0.0.74 0.0.75

Updates json-repair from 0.63.3 to 0.63.4

Release notes

Sourced from json-repair's releases.

Release 0.63.4

Fixed

  • Fix #220 preserve leading quotes when a later valid delimiter closes the string

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Commits
  • 41737bc Fix #220 preserve leading quotes when a later valid delimiter closes the string
  • 014707d Fix some CI that got broken after updating the actions
  • 7eb2cab Merge pull request #216 from mangiucugna/dependabot/github_actions/pypa/gh-ac...
  • b936bca Merge pull request #215 from mangiucugna/dependabot/github_actions/astral-sh/...
  • f6b7bf4 Merge branch 'main' into dependabot/github_actions/pypa/gh-action-pypi-publis...
  • be5274e Merge pull request #217 from mangiucugna/dependabot/github_actions/astral-sh/...
  • bf7076e Merge branch 'main' into dependabot/github_actions/astral-sh/setup-uv-37802ad...
  • d82f61e Merge pull request #218 from mangiucugna/dependabot/github_actions/actions/se...
  • ab20874 Merge pull request #219 from mangiucugna/dependabot/github_actions/actions/ch...
  • 13e869e Bump actions/checkout from 7.0.0 to 7.0.1
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates pypdf from 6.16.1 to 6.16.2

Release notes

Sourced from pypdf's releases.

Version 6.16.2, 2026-08-23

What's new

Bug Fixes (BUG)

Robustness (ROB)

  • Improve RC4 fallback when cryptography can't provide it (#3853) by @​msylw

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.16.2, 2026-08-23

Bug Fixes (BUG)

  • Make remove_from_tree() work on outline items (#3939)
  • Be more lenient about space width in layout mode text extraction (#3992)
  • Do not scale the text leading by the font size (#3987)
  • Update annotation appearance stream matrix on page transform (#3968)
  • Allow repeated page references (#3959)

Robustness (ROB)

  • Improve RC4 fallback when cryptography can't provide it (#3853)

Full Changelog

Commits
  • 1da0987 REL: 6.16.2
  • f6853cc BUG: Make remove_from_tree() work on outline items (#3939)
  • c6d38af BUG: Type character widths as float (#3996)
  • 882b3b2 STY: Type the XMP stream as StreamObject rather than ContentStream (#3995)
  • 4c8f707 STY: Accept any sequence of fit arguments in Fit (#3990)
  • 2450321 STY: Accept any sequence as the annotation border (#3991)
  • 2dcab8d MAINT: Skip test_appearance_stream_rtl when RTL support is unavailable (#3993)
  • 412975a BUG: Be more lenient about space width in layout mode text extraction (#3992)
  • ddbfea9 BUG: Interpolate the reader in the reset_translation error message (#3981)
  • c646ef2 ROB: Improve RC4 fallback when cryptography can't provide it (#3853)
  • Additional commits viewable in compare view

Updates transformers from 5.15.1 to 5.16.1

Release notes

Sourced from transformers's releases.

Release v5.16.1

This is a special release as we include GLM! (and a few small fixes)

GLM-5.3-Flash

GLM-5.3-Flash, the first natively multimodal model in the GLM-5 series. With 320B total parameters and just 18B active parameters, it outperforms GLM-5.2 across benchmarks and real-world workloads at one-tenth the price, while approaching Claude Opus 4.8 on coding and agentic benchmarks.

GLM-5.3-Flash starts from a newly trained base model, with its architecture and training recipe redesigned around capability and efficiency. For the first time in the GLM series, we introduce a hybrid architecture combining sparse and linear attention, sharply reducing long-context serving costs while preserving precise long-context capabilities. The model also adopts Manifold-Constrained Hyper-Connections (mHC) to further improve scaling efficiency. Together with our latest 30T-token multimodal pre-training corpus, these changes enable GLM-5.3-Flash to deliver more intelligence with less compute.

Links: Documentation

Small patch fixes

Mainly BC behavior for TP and pinning a hf kernel for security reasons 🤗

Full Changelog: huggingface/transformers@v5.16.0...v5.16.1

Release: v5.16.0

Release v5.16.0

New Model additions

Qwen4-Exp

Qwen4-Exp builds on Qwen3.5's hybrid text and multimodal architecture with three key components: GatedResidual (GR), Qwen Sparse Attention (QSA), and Per-Layer Embedding (PLE).

GR is a Qwen-developed residual architecture that combines Hyper-Connection with GatedNorm. It mixes multiple residual streams with fine-grained elementwise gating before each attention and Mixture-of-Experts (MoE) block, then controls how much of the block output is injected back into each stream.

QSA uses multiple query heads to score compressed key blocks, selects the most relevant contiguous token blocks, and keeps the incomplete trailing block uncompressed. This block-level selection reduces indexing overhead and improves memory locality for long sequences. Combined with Gated DeltaNet, QSA makes Qwen4-Exp the first hybrid architecture to integrate linear and sparse attention, substantially improving inference efficiency for long-context workloads.

PLE enriches selected decoder layers with layer-specific lexical features derived from hashed token n-grams and a dilated depthwise convolution.

Links: Documentation

GraniteSpeech5

... (truncated)

Commits

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Updates prek from 0.4.14 to 0.5.0

Release notes

Sourced from prek's releases.

0.5.0

Release Notes

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

  • Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
  • PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
  • The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
  • prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.0

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

  • Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
  • PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
  • The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
  • prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

Enhancements

... (truncated)

Commits

Updates ty from 0.0.74 to 0.0.75

Release notes

Sourced from ty's releases.

0.0.75

Release Notes

Released on 2026-08-26.

Preview features

  • Initialize PEP 723 script environments in the CLI (#27544)
  • Refresh PEP 723 script environments in watch mode (#27617)
  • Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

  • Specialize Self bounds of inherited methods (#27990)

LSP server

  • Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

  • Fix documented Python package build command (#4384)
  • Link untyped-call tracking issue in migration guide (#4382)

Library support

  • Resolve imported pytest fixture exposures (#27539)
  • Resolve installed core pytest fixture providers (#27770)
  • Resolve pytest fixtures through conftest (#27540)

Diagnostics

  • Add more autofixes (#28029)
  • Add a dedicated missing-slot diagnostic (#28039)
  • Explain missing storage for declared slotted attributes (#27969)
  • Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

  • Account for known subclasses in equality inference (#28005)
  • Expand ParamSpec signatures inferred from bound receivers (#28020)
  • Fix Self binding in ParamSpec protocols (#28016)
  • Fix TypedDict variance inference (#28052)
  • Fix unsound narrowing through branch-assigned conditions (#28006)
  • Ignore inconsistent binding decorators on overloads (#28036)
  • Infer yield from send/return types from the iterator returned by __iter__ (#27987)
  • Infer tuple type parameters from union arguments (#28062)
  • Infer variance through nonrecursive protocol references (#28065)
  • Preserve bounds of non-literal metaclasses (#28046)
  • Preserve correlated generic-call inference (#28043)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.75

Released on 2026-08-26.

Preview features

  • Initialize PEP 723 script environments in the CLI (#27544)
  • Refresh PEP 723 script environments in watch mode (#27617)
  • Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

  • Specialize Self bounds of inherited methods (#27990)

LSP server

  • Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

  • Fix documented Python package build command (#4384)
  • Link untyped-call tracking issue in migration guide (#4382)

Library support

  • Resolve imported pytest fixture exposures (#27539)
  • Resolve installed core pytest fixture providers (#27770)
  • Resolve pytest fixtures through conftest (#27540)

Diagnostics

  • Add more autofixes (#28029)
  • Add a dedicated missing-slot diagnostic (#28039)
  • Explain missing storage for declared slotted attributes (#27969)
  • Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

  • Account for known subclasses in equality inference (#28005)
  • Expand ParamSpec signatures inferred from bound receivers (#28020)
  • Fix Self binding in ParamSpec protocols (#28016)
  • Fix TypedDict variance inference (#28052)
  • Fix unsound narrowing through branch-assigned conditions (#28006)
  • Ignore inconsistent binding decorators on overloads (#28036)
  • Infer yield from send/return types from the iterator returned by __iter__ (#27987)
  • Infer tuple type parameters from union arguments (#28062)
  • Infer variance through nonrecursive protocol references (#28065)
  • Preserve bounds of non-literal metaclasses (#28046)
  • Preserve correlated generic-call inference (#28043)
  • Preserve invariant materialization constraints (#28047)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the uv group with 7 updates
9ead09e 
Bumps the uv group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [json-repair](https://github.com/mangiucugna/json_repair) | `0.63.3` | `0.63.4` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.16.1` | `6.16.2` |
| [transformers](https://github.com/huggingface/transformers) | `5.15.1` | `5.16.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.5` |
| [prek](https://github.com/j178/prek) | `0.4.14` | `0.5.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.74` | `0.0.75` |


Updates `json-repair` from 0.63.3 to 0.63.4
- [Release notes](https://github.com/mangiucugna/json_repair/releases)
- [Commits](mangiucugna/json_repair@v0.63.3...v0.63.4)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `pypdf` from 6.16.1 to 6.16.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.16.1...6.16.2)

Updates `transformers` from 5.15.1 to 5.16.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.15.1...v5.16.1)

Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `prek` from 0.4.14 to 0.5.0
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.14...v0.5.0)

Updates `ty` from 0.0.74 to 0.0.75
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.74...0.0.75)

---
updated-dependencies:
- dependency-name: json-repair
  dependency-version: 0.63.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: pypdf
  dependency-version: 6.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: transformers
  dependency-version: 5.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: prek
  dependency-version: 0.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: ty
  dependency-version: 0.0.75
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@WH-2099 WH-2099

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@WH-2099