Skip to content

chore(deps)(deps): bump the python-versions group across 1 directory with 27 updates - #1055

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-28a635900d
Open

chore(deps)(deps): bump the python-versions group across 1 directory with 27 updates#1055
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-28a635900d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-versions group with 25 updates in the / directory:

Package From To
huggingface-hub 1.20.1 1.26.0
poethepoet 0.46.0 0.48.0
pypi-attestations 0.0.29 0.0.30
jupytext 1.19.4 1.19.5
scipy-stubs 1.17.1.5 1.18.0.1
ipython 9.14.1 9.16.1
matplotlib 3.11.0 3.11.1
pydata-sphinx-theme 0.19.0 0.20.0
sphinx-autodoc-typehints 3.11.0 3.13.2
sphinxcontrib-mermaid 2.0.2 2.1.0
apache-airflow 3.2.2 3.3.0
dagster 1.13.10 1.13.17
plotly 6.8.0 6.9.0
tqdm 4.68.3 4.70.0
s3fs 2026.6.0 2026.7.0
numpy 2.4.6 2.5.1
onnxruntime 1.27.0 1.28.0
nvidia-cudnn-cu12 9.23.2.1 9.24.0.43
onnxruntime-gpu 1.27.0 1.28.0
holidays 0.99 0.102
mlflow-skinny 3.14.0 3.15.1
scipy 1.17.1 1.18.0
lightgbm 4.6.0 4.7.0
xgboost 3.3.0 3.4.0
xgboost-cpu 3.3.0 3.4.0

Updates huggingface-hub from 1.20.1 to 1.26.0

Release notes

Sourced from huggingface-hub's releases.

[v1.26.0] Resolve revisions only once, security hardening, and resource groups for Jobs & Collections

📌 Pin a revision once with resolve_revision

Libraries that download many files one by one (config, weights, tokenizer, processor, ...) had to resolve revision="main" into a commit hash on every call — costing one HTTP request per file and risking two calls landing on two different commits if the repo is updated in between. The new HfApi.resolve_revision resolves the revision once and returns a ResolvedRevision: a str subclass whose value stays the user-facing revision (so error messages keep saying "main") while its .resolved attribute holds the commit hash. Download helpers (hf_hub_download, snapshot_download, get_cached_repo_tree) detect it and use the commit hash directly, guaranteeing every file comes from the same commit. The mapping is also written to the refs/ folder of the cache, so later runs in offline mode transparently fall back to the cached value.

>>> from huggingface_hub import resolve_revision, hf_hub_download
>>> revision = resolve_revision("openai-community/gpt2")
>>> revision
ResolvedRevision(initial=None, resolved='607a30d783dfa663caf39e06633721c8d4cfcd7e')
>>> revision == "main"  # readable error messages
True
>>> config = hf_hub_download("openai-community/gpt2", "config.json", revision=revision)
>>> weights = hf_hub_download("openai-community/gpt2", "model.safetensors", revision=revision)

📚 Documentation: Manage the cache — Pin a revision (advanced)

  • [Download] Add HfApi.resolve_revision and ResolvedRevision by @​Wauplin in #4604

🔒 Security hardening for downloads and sandboxes

This release ships two security fixes. First, downloading or uploading to a --local-dir now rejects absolute, drive-relative, root-relative, UNC and ..-traversal filenames on all platforms, interpreting each name under both POSIX and Windows rules (refs CVE-2026-15717). Previously only a Windows-only ..\ check existed, so a malicious repo could write files outside the target directory on Windows clients — and even leak a NetNTLMv2 hash via UNC paths. Legitimate repo filenames never contain such segments, so real downloads are unaffected; note that exotic names like folder/..\..\..\file, previously tolerated on Linux, are now rejected everywhere. Second, Sandbox.create no longer injects your HF token into the job environment to download the sbx-server binary: the bucket is public, so the bootstrap now downloads it anonymously and no HF credential ever lands in the sandbox unless you explicitly opt in with forward_hf_token=True.

  • [Download] Reject absolute/UNC/traversal filenames on local_dir & cache paths by @​Wauplin in #4540
  • [Sandbox] Don't send the HF token to sandbox jobs by @​Wauplin in #4583

🗂️ Resource groups for Jobs and Collections

Organization resource groups are now supported across the client. For collections, create_collection accepts an optional resource_group_id, and the new update_collection_resource_group method wraps the dedicated Hub endpoint to assign a collection to a resource group afterwards (passing None removes it). For Jobs, run_job, run_uv_job and create_scheduled_job accept a resource_group_id parameter, mirrored by a --resource-group-id option on the hf jobs run, hf jobs uv run and hf jobs scheduled run commands. Beyond access control within an organization, resource groups are also used for cost attribution and per-group spending limits.

hf jobs run --resource-group-id <group-id> python:3.12 python train.py

📚 Documentation: Collections reference, CLI reference

📊 Job names, front and center in the CLI

Job names are now much easier to work with from the terminal. hf jobs ls (and hf jobs scheduled ls) display a dedicated NAME column, and a new --name filter acts as a shortcut for --label name=NAME. The name is also surfaced as a top-level field in hf jobs inspect and in command results, instead of only living inside labels — where it remains for compatibility.

$ hf jobs ls -a --name training-v2
JOB_ID      NAME         IMAGE/SPACE COMMAND      CREATED      STATUS    RUNTIME
----------- ------------ ----------- ------------ ------------ --------- -------
6a60b190... training-v2  python:3.12 python -c... 2026-07-2... COMPLETED 0s

... (truncated)

Commits
  • c998254 Release: v1.26.0
  • 8a89097 Release: v1.26.0.rc2
  • ac1c66b Release: v1.26.0.rc1
  • 9c594e6 Release: v1.26.0.rc0
  • 5af012a [Core] Fix tilde expansion in CommitOperationAdd (#4612)
  • da90367 [CLI] Don't crash when stdout can't encode non-ASCII output (#4610)
  • a782edf [Download] Add HfApi.resolve_revision and ResolvedRevision (#4604)
  • 59df95f Reject token=False in create_inference_endpoint_from_catalog (#4605)
  • a1028f8 [Safetensors] Fix truncated header on 100kb boundary (#4603)
  • bbdef5b [Download] Reject redacted Xet hashes from tree cache (#4595)
  • Additional commits viewable in compare view

Updates poethepoet from 0.46.0 to 0.48.0

Release notes

Sourced from poethepoet's releases.

0.48.0

Enhancements

Full Changelog: nat-n/poethepoet@v0.47.1...v0.48.0

0.47.1

Fixes

Full Changelog: nat-n/poethepoet@v0.47.0...v0.47.1

0.47.0

Enhancements

Fixes

AI Agent Skill 🤖

Install the skill via one of the following methods:

  1. Via a built in poe task (similar to how shell completions are installed):
poe _install_skill                          # auto-detects .claude/.codex/.pi/.agents and prompts
poe _install_skill ~/.claude/skills         # explicit path (substitute your agent's dir)
poe _install_skill <skills-dir> --upgrade   # non-interactive upgrade (skips if same/newer)
  1. From github via npx skills
npx skills add https://github.com/nat-n/poethepoet/tree/v0.46.0/poethepoet/skills/poethepoet

Full Changelog: nat-n/poethepoet@v0.46.0...v0.47.0

Commits
  • e4d032c Bump version to 0.48.0
  • e7a31be feat: Add uses_env task option for loading variables from a task's output (...
  • 1fb4f8d Bump version to 0.47.1
  • 88efc0a chore: regenerate JSON Schema
  • b151b09 fix(args): restore default for absent multiple positional args (#409)
  • d2f9c11 fix: schema generation for strict validation
  • 9231083 Bump version to 0.47.0
  • 994d8ed docs(skill): improve and document SKILL.md based on feedback (#404)
  • 0478c10 fix(args): support all three CLI styles for multi-value args (#402)
  • 8dc4399 feat: respect the FORCE_COLOR environment variable (#403)
  • Additional commits viewable in compare view

Updates pypi-attestations from 0.0.29 to 0.0.30

Release notes

Sourced from pypi-attestations's releases.

v0.0.30

What's Changed

New Contributors

Full Changelog: pypi/pypi-attestations@v0.0.29...v0.0.30

Changelog

Sourced from pypi-attestations's changelog.

[0.0.30]

Added

  • Support for CircleCI attestations (#166). This is work aligned with adding CircleCI as a Trusted Publisher in pypi. (#19349)

Changed

  • Updated the minimum supported sigstore dependency to 4.5.
Commits
  • 845bfac Update min sigstore version to 4.5.0 (#199)
  • 7de43dd build(deps): bump the actions group with 2 updates (#198)
  • 74b2380 build(deps): bump actions/checkout in the actions group (#197)
  • 10a08b3 build(deps): bump zizmorcore/zizmor-action in the actions group (#196)
  • 401c0a1 build(deps): bump actions/attest-build-provenance in the actions group (#195)
  • d9d2400 build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 in the actions gro...
  • c7c7685 build(deps): bump zizmorcore/zizmor-action in the actions group (#193)
  • dada8e6 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions group (...
  • 1ec1381 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (...
  • bec4c17 build(deps): bump zizmorcore/zizmor-action in the actions group (#189)
  • Additional commits viewable in compare view

Updates sigstore from 4.3.0 to 4.5.0

Release notes

Sourced from sigstore's releases.

v4.5.0

What's Changed

Full Changelog: sigstore/sigstore-python@v4.4.0...v4.5.0

v4.4.0

What's Changed

Changed

  • sigstore no longer limits the upper-bound of cryptography in order to be less disruptive to downstream integrators. (#1811)

Fixed

  • Fixed generation of invalid CSRs when the identity is not ASCII (for example a GitHub Actions sub claim containing a non-ASCII environment name). The CSR subject is unused by Fulcio, so it is now omitted entirely (#1507)

New Contributors

Full Changelog: sigstore/sigstore-python@v4.3.0...v4.4.0

Changelog

Sourced from sigstore's changelog.

[4.5.0]

Fixed

  • Signing reuses a valid cached certificate before checking whether the OIDC identity token has expired. (#1838)
  • A malformed checkpoint in a bundle's inclusion proof now raises VerificationError during verification, instead of leaking a raw ValueError or binascii.Error (#1826)

[4.4.0]

Changed

  • sigstore no longer limits the upper-bound of cryptography in order to be less disruptive to downstream integrators. (#1811)

Fixed

  • Fixed generation of invalid CSRs when the identity is not ASCII (for example a GitHub Actions sub claim containing a non-ASCII environment name). The CSR subject is unused by Fulcio, so it is now omitted entirely (#1507)
Commits
  • 181074f Prepare 4.5 release (#1841)
  • 85f1bfa build(deps): bump the actions group across 1 directory with 5 updates (#1843)
  • a087e06 build(deps): bump platformdirs from 4.10.0 to 4.10.1 (#1842)
  • 96991da build(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#1840)
  • e43c4fa build(deps): bump pyasn1 from 0.6.3 to 0.6.4 (#1831)
  • c079a63 build(deps): bump pillow from 12.2.0 to 12.3.0 (#1836)
  • 586442f build(deps-dev): bump ruff from 0.15.20 to 0.15.22 (#1837)
  • efa023f build(deps): bump requests from 2.34.0 to 2.34.2 (#1801)
  • aa3c7a3 Return cached cert first when signing (#1838)
  • 8b26c92 build(deps-dev): bump mypy from 2.1.0 to 2.3.0 (#1834)
  • Additional commits viewable in compare view

Updates jupytext from 1.19.4 to 1.19.5

Release notes

Sourced from jupytext's releases.

Version 1.19.5

Changed

  • Harden the github action (#1569). Thanks to Peyton Murray for this PR
  • The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
  • zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
  • Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

  • Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
  • Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

  • marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!
Changelog

Sourced from jupytext's changelog.

1.19.5 (2026-07-21)

Changed

  • Harden the github action (#1569). Thanks to Peyton Murray for this PR
  • The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
  • zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
  • Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

  • Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
  • Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

  • marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!
Commits
  • 3132c6c Version 1.19.5
  • d8d4d14 build(deps): bump axios from 1.16.0 to 1.18.1 in /jupyterlab in the jupytext-...
  • 1a6fde9 build(deps): bump the actions-dependencies group with 3 updates
  • 0068463 build(deps): bump astro
  • 58c1eb9 build(deps): bump the jupytext-extension-dependencies group across 2 director...
  • af6134e Migrate to jupyter-builder for building frontend extension (#1590)
  • bb0de16 build(deps): bump the actions-dependencies group across 1 directory with 8 up...
  • 555b4c2 avoid quadratic backtracking in help/bash magic regex
  • f24a3b7 reuse secure temp files in marimo_py_to_notebook
  • d53e2f1 Require zizmor and precommit on ci (#1594)
  • Additional commits viewable in compare view

Updates scipy-stubs from 1.17.1.5 to 1.18.0.1

Release notes

Sourced from scipy-stubs's releases.

v1.18.0.1

This scipy-stubs release fixes many bugs and comes with several improvements. It targets SciPy 1.18.0 and supports Python 3.12-3.14, NumPy 2.0-2.7, and optype 0.15-0.19.

What's Changed

⏬ SciPy 1.18 Changes

✨ Improvements

🐛 Fixes

... (truncated)

Commits
  • 2dc1cf2 🔖 scipy-stubs 1.18.0.1
  • 5739cd0 Merge pull request #1982 from scipy:update-project-metadata-description
  • bb96f4c 💬 update project metadata description
  • 54b75cf Merge pull request #1981 from scipy:bump-optype
  • a3b7d6e ⬆️ increase optype lower bound from 0.14 to 0.15
  • c35220e Merge pull request #1980 from scipy:bump-dev-deps
  • dcc2983 🙈 add # ty: ignore for an inevitable LSP error
  • 0f12f90 🩹 work around new ty false positives for the optype JustFloat types.
  • f560300 ⬆️ upgrade development dependencies
  • 108f737 Merge pull request #1979 from scipy:gh-1829
  • Additional commits viewable in compare view

Updates ipython from 9.14.1 to 9.16.1

Commits

Updates matplotlib from 3.11.0 to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

  • Fix tight layout of multiple subplots with sharey=True
  • Fix NoNorm cursor formatting for uint8 images
  • Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
  • Fix clipped Axis labels on 3D plots with tight layout
  • Fix inverted Axis on 3D plots
  • Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
  • Fix missing glyphs when subsetting Type 1 fonts in PDF
  • Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits
  • 3c1757a REL: v3.11.1
  • 792c6b5 DOC: Prepare for 3.11.1
  • aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
  • d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
  • 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
  • 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
  • c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
  • 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
  • a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
  • 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
  • Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.19.0 to 0.20.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.20.0

What's Changed

🔴 Breaking

Fixes

Internal tooling

Dependencies

New Contributors

Full Changelog: pydata/pydata-sphinx-theme@v0.19.0...v0.20.0

Commits

Updates sphinx-autodoc-typehints from 3.11.0 to 3.13.2

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.2

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.1...3.13.2

3.13.1

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.0...3.13.1

3.13.0

What's Changed

@dependabot
chore(deps)(deps): bump the python-versions group across 1 directory …
301502f 
…with 27 updates

Bumps the python-versions group with 25 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.20.1` | `1.26.0` |
| [poethepoet](https://github.com/nat-n/poethepoet) | `0.46.0` | `0.48.0` |
| [pypi-attestations](https://github.com/pypi/pypi-attestations) | `0.0.29` | `0.0.30` |
| [jupytext](https://github.com/jupytext/jupytext) | `1.19.4` | `1.19.5` |
| [scipy-stubs](https://github.com/scipy/scipy-stubs) | `1.17.1.5` | `1.18.0.1` |
| [ipython](https://github.com/ipython/ipython) | `9.14.1` | `9.16.1` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` |
| [pydata-sphinx-theme](https://github.com/pydata/pydata-sphinx-theme) | `0.19.0` | `0.20.0` |
| [sphinx-autodoc-typehints](https://github.com/tox-dev/sphinx-autodoc-typehints) | `3.11.0` | `3.13.2` |
| [sphinxcontrib-mermaid](https://github.com/mgaitan/sphinxcontrib-mermaid) | `2.0.2` | `2.1.0` |
| [apache-airflow](https://github.com/apache/airflow) | `3.2.2` | `3.3.0` |
| [dagster](https://github.com/dagster-io/dagster) | `1.13.10` | `1.13.17` |
| [plotly](https://github.com/plotly/plotly.py) | `6.8.0` | `6.9.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.3` | `4.70.0` |
| [s3fs](https://github.com/fsspec/s3fs) | `2026.6.0` | `2026.7.0` |
| [numpy](https://github.com/numpy/numpy) | `2.4.6` | `2.5.1` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.27.0` | `1.28.0` |
| [nvidia-cudnn-cu12](https://developer.nvidia.com/cuda-zone) | `9.23.2.1` | `9.24.0.43` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.27.0` | `1.28.0` |
| [holidays](https://github.com/vacanza/holidays) | `0.99` | `0.102` |
| [mlflow-skinny](https://github.com/mlflow/mlflow) | `3.14.0` | `3.15.1` |
| [scipy](https://github.com/scipy/scipy) | `1.17.1` | `1.18.0` |
| [lightgbm](https://github.com/lightgbm-org/LightGBM) | `4.6.0` | `4.7.0` |
| [xgboost](https://github.com/dmlc/xgboost) | `3.3.0` | `3.4.0` |
| [xgboost-cpu](https://github.com/dmlc/xgboost) | `3.3.0` | `3.4.0` |



Updates `huggingface-hub` from 1.20.1 to 1.26.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.20.1...v1.26.0)

Updates `poethepoet` from 0.46.0 to 0.48.0
- [Release notes](https://github.com/nat-n/poethepoet/releases)
- [Commits](nat-n/poethepoet@v0.46.0...v0.48.0)

Updates `pypi-attestations` from 0.0.29 to 0.0.30
- [Release notes](https://github.com/pypi/pypi-attestations/releases)
- [Changelog](https://github.com/pypi/pypi-attestations/blob/main/CHANGELOG.md)
- [Commits](pypi/pypi-attestations@v0.0.29...v0.0.30)

Updates `sigstore` from 4.3.0 to 4.5.0
- [Release notes](https://github.com/sigstore/sigstore-python/releases)
- [Changelog](https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/sigstore-python@v4.3.0...v4.5.0)

Updates `jupytext` from 1.19.4 to 1.19.5
- [Release notes](https://github.com/jupytext/jupytext/releases)
- [Changelog](https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md)
- [Commits](jupytext/jupytext@v1.19.4...v1.19.5)

Updates `scipy-stubs` from 1.17.1.5 to 1.18.0.1
- [Release notes](https://github.com/scipy/scipy-stubs/releases)
- [Commits](scipy/scipy-stubs@v1.17.1.5...v1.18.0.1)

Updates `ipython` from 9.14.1 to 9.16.1
- [Release notes](https://github.com/ipython/ipython/releases)
- [Commits](ipython/ipython@9.14.1...9.16.1)

Updates `matplotlib` from 3.11.0 to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1)

Updates `pydata-sphinx-theme` from 0.19.0 to 0.20.0
- [Release notes](https://github.com/pydata/pydata-sphinx-theme/releases)
- [Changelog](https://github.com/pydata/pydata-sphinx-theme/blob/main/RELEASE.md)
- [Commits](pydata/pydata-sphinx-theme@v0.19.0...v0.20.0)

Updates `sphinx-autodoc-typehints` from 3.11.0 to 3.13.2
- [Release notes](https://github.com/tox-dev/sphinx-autodoc-typehints/releases)
- [Commits](tox-dev/sphinx-autodoc-typehints@3.11.0...3.13.2)

Updates `sphinxcontrib-mermaid` from 2.0.2 to 2.1.0
- [Changelog](https://github.com/mgaitan/sphinxcontrib-mermaid/blob/master/CHANGELOG.md)
- [Commits](mgaitan/sphinxcontrib-mermaid@2.0.2...2.1.0)

Updates `apache-airflow` from 3.2.2 to 3.3.0
- [Release notes](https://github.com/apache/airflow/releases)
- [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst)
- [Commits](apache/airflow@3.2.2...3.3.0)

Updates `dagster` from 1.13.10 to 1.13.17
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.10...1.13.17)

Updates `dagster-webserver` from 1.13.10 to 1.13.17
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.10...1.13.17)

Updates `plotly` from 6.8.0 to 6.9.0
- [Release notes](https://github.com/plotly/plotly.py/releases)
- [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md)
- [Commits](plotly/plotly.py@v6.8.0...v6.9.0)

Updates `tqdm` from 4.68.3 to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.3...v4.70.0)

Updates `s3fs` from 2026.6.0 to 2026.7.0
- [Changelog](https://github.com/fsspec/s3fs/blob/main/release-procedure.md)
- [Commits](https://github.com/fsspec/s3fs/commits/2026.7.0)

Updates `numpy` from 2.4.6 to 2.5.1
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.1)

Updates `onnxruntime` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.27.0...v1.28.0)

Updates `nvidia-cudnn-cu12` from 9.23.2.1 to 9.24.0.43

Updates `onnxruntime-gpu` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.27.0...v1.28.0)

Updates `holidays` from 0.99 to 0.102
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.99...v0.102)

Updates `mlflow-skinny` from 3.14.0 to 3.15.1
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.14.0...v3.15.1)

Updates `scipy` from 1.17.1 to 1.18.0
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.17.1...v1.18.0)

Updates `lightgbm` from 4.6.0 to 4.7.0
- [Release notes](https://github.com/lightgbm-org/LightGBM/releases)
- [Commits](lightgbm-org/LightGBM@v4.6.0...v4.7.0)

Updates `xgboost` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.3.0...v3.4.0)

Updates `xgboost-cpu` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.3.0...v3.4.0)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: poethepoet
  dependency-version: 0.48.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pypi-attestations
  dependency-version: 0.0.30
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: sigstore
  dependency-version: 4.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: jupytext
  dependency-version: 1.19.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: scipy-stubs
  dependency-version: 1.18.0.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: ipython
  dependency-version: 9.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pydata-sphinx-theme
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-autodoc-typehints
  dependency-version: 3.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinxcontrib-mermaid
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: apache-airflow
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: dagster
  dependency-version: 1.13.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster-webserver
  dependency-version: 1.13.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: plotly
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: s3fs
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: numpy
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: onnxruntime
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: nvidia-cudnn-cu12
  dependency-version: 9.24.0.43
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: onnxruntime-gpu
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: holidays
  dependency-version: '0.102'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: mlflow-skinny
  dependency-version: 3.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: lightgbm
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: xgboost
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: xgboost-cpu
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 10, 2026
@dependabot
dependabot Bot requested a review from a team August 10, 2026 04:49
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 10, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 10, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants