[dependabot]

Updates the requirements on pybatfish, pandas, ollama, fastapi and uvicorn to permit the latest version.
Updates pybatfish from 2025.7.7.2423 to 2026.9.17.3748

Release notes

Sourced from pybatfish's releases.

Pybatfish 2026.09.17

What's Changed

• Fix an issue with the requests timeout added in the prior release. Pybatfish would time out and re-upload large snapshots batfish/pybatfish#994

Full Changelog: batfish/pybatfish@v2026.08.19...v2026.09.17

Pybatfish 2026.08.19

What's Changed

• Add request_kwargs, proxies, and timeout to Session for flexible requests configuration by @​dhalperi with @​Copilot and @​cprevot93 in batfish/pybatfish#973
• Add official MCP server for Batfish (beta) by @​dhalperi with @​Copilot in batfish/pybatfish#970
• Azure support description under docs/source/formats.md by @​RP38 in batfish/pybatfish#962
• Small updates to Azure documentation by @​ratulm in batfish/pybatfish#963
• Remove support for Python 3.9 ahead of its EOL by @​dhalperi in batfish/pybatfish#942
• Add Python 3.14 to test matrix and classifiers by @​dhalperi in batfish/pybatfish#947

New Contributors

• @​RP38 made their first contribution in batfish/pybatfish#962
• @​cprevot93 made their first contribution in batfish/pybatfish#970

Full Changelog: batfish/pybatfish@v2025.07.07...v2026.08.19

Commits

• See full diff in compare view

Updates pandas to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 2905718 RLS: 3.0.6
• 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
• f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
• 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
• e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
• b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
• bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
• bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
• c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
• 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
• Additional commits viewable in compare view

Updates ollama to 0.6.3

Release notes

Sourced from ollama's releases.

v0.6.3

What's Changed

• client: widen sync generate think type to accept string levels by @​anxkhn in ollama/ollama-python#697
• fix: handle multiple tool calls in tools examples by @​Krishnachaitanyakc in ollama/ollama-python#634
• types: make Image path extension check case-insensitive by @​anxkhn in ollama/ollama-python#696
• readme: update to use gemma 4 and format by @​ParthSareen in ollama/ollama-python#740
• feat: add System One API support by @​ParthSareen in ollama/ollama-python#749
• Create pylint.yml by @​eoinmcgee1993 in ollama/ollama-python#731
• types/client: relax think type to support model-defined thinking levels by @​arrase in ollama/ollama-python#744

New Contributors

• @​anxkhn made their first contribution in ollama/ollama-python#697
• @​Krishnachaitanyakc made their first contribution in ollama/ollama-python#634
• @​eoinmcgee1993 made their first contribution in ollama/ollama-python#731
• @​arrase made their first contribution in ollama/ollama-python#744

Full Changelog: ollama/ollama-python@v0.6.2...v0.6.3

Commits

• 8785556 types/client: relax think type to support model-defined thinking levels (#744)
• ed18cea feat: add System One API support (#749)
• b28b1e8 readme: update to use gemma 4 and format (#740)
• fa85099 types: make Image path extension check case-insensitive (#696)
• 25b9329 fix: handle multiple tool calls in tools examples (#634)
• 3c5a26a client: widen sync generate think type to accept string levels (#697)
• See full diff in compare view

Updates fastapi to 0.143.2

Release notes

Sourced from fastapi's releases.

0.143.2

Fixes

• 🐛 Fix blocking frontend fallback file checks. PR #16503 by @​tiangolo.

Translations

• 🌐 Update translations for zh-hant (update-outdated). PR #16500 by @​pr-submit[bot].
• 🌐 Update translations for ja (update-outdated). PR #16499 by @​pr-submit[bot].
• 🌐 Update translations for zh (update-outdated). PR #16501 by @​pr-submit[bot].
• 🌐 Update translations for hi (update-outdated). PR #16498 by @​pr-submit[bot].
• 🌐 Update translations for es (update-outdated). PR #16497 by @​pr-submit[bot].
• 🌐 Update translations for fr (update-outdated). PR #16495 by @​pr-submit[bot].
• 🌐 Update translations for ko (update-outdated). PR #16496 by @​pr-submit[bot].
• 🌐 Update translations for de (update-outdated). PR #16493 by @​pr-submit[bot].
• 🌐 Update translations for uk (update-outdated). PR #16494 by @​pr-submit[bot].
• 🌐 Update translations for tr (update-outdated). PR #16490 by @​pr-submit[bot].
• 🌐 Update translations for pt (update-outdated). PR #16491 by @​pr-submit[bot].
• 🌐 Update translations for ru (update-outdated). PR #16492 by @​pr-submit[bot].

Internal

• ⬆ Bump pydantic-ai-slim from 2.49.0 to 2.53.0. PR #16487 by @​dependabot[bot].
• ⬆ Bump werkzeug from 3.1.6 to 3.1.9. PR #16464 by @​dependabot[bot].

Commits

• ba24dc3 🔖 Release version 0.143.2 (#16504)
• 98050ee 📝 Update release notes
• d0282a3 🐛 Fix blocking frontend fallback file checks (#16503)
• db04f5b 📝 Update release notes
• fd0614c 🌐 Update translations for zh-hant (update-outdated) (#16500)
• 0c83cfa 📝 Update release notes
• 6955ff7 🌐 Update translations for ja (update-outdated) (#16499)
• aa1c3ba 📝 Update release notes
• f6f33b2 🌐 Update translations for zh (update-outdated) (#16501)
• 0474a7e 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

[ARSH871-bot]

Holding this one, for the reason requirements.txt gives in its own comment, and recording what I measured so whoever does the coordinated bump starts from evidence. Green CI says nothing either way here: CI has no Batfish, so every test that talks to it skips.

Why it cannot merge as it stands

requirements.txt, directly above the line this PR changes:

This pin matches image batfish/allinone reporting Batfish 2025.07.07.2423. If you pull a newer image, bump this to match.

docker-compose.yml still pins batfish/allinone@sha256:0981755…, and the running container reports 2025.07.07.2423. This PR moves the client to 2026.9.17.3748 and leaves the image where it is. After merging, the comment above the pin would be false, and the compose stack would ship a 2026 client against a 2025 service: the pairing the file says to avoid.

This is the third runtime-group PR carrying this bump. #204 (to 2026.8.19.3660, closed 21 Sep) and #363 (to this same version, closed 5 Oct) were superseded rather than merged, and the other four packages in the group are stuck behind it each time.

What I measured (8 October, this head)

A throwaway virtual environment built from this PR's requirements.txt (pybatfish 2026.09.17.3748, pandas 3.0.6, fastapi 0.142.4, uvicorn 0.54.0, ollama 0.6.3), run against the current 2025 container:

full suite                          1811 passed, 13 skipped, 0 Batfish skips (every real-Batfish test ran)
analyse(rtr-us5-insecure)           5 found + RT-050 could-not-check   (identical to main)
tools/preflight, current installs   Package versions: BROKEN until upgraded (expected for any bump)
new warning                         StarletteDeprecationWarning: using httpx with starlette.testclient
                                    is deprecated; install httpx2   (fastapi 0.142.x)

So the skew did not break anything this suite exercises. That is useful for the bump, but it is not the documented configuration.

Two ways forward (team decision, not taken here)

1. Coordinated bump: move the compose image to a digest that reports 2026.9.17.3748, the pin, and the comment, in one PR, and re-run the full suite against the new container. The measurement above suggests it will go smoothly.
2. Unblock the rest: exclude pybatfish from the runtime group in .github/dependabot.yml, so pandas, ollama, fastapi and uvicorn can merge on their own, and pybatfish moves only alongside the image.

The httpx deprecation needs attention either way when fastapi moves.