Build(deps): Bump the python group across 3 directories with 63 updates

[dependabot]

Bumps the python group with 47 updates in the /backend directory:

Package	From	To
asyncpg	0.30.0	0.31.0
cryptography	50.0.0	50.0.1
faiss-cpu	1.12.0	1.15.0
fastapi	0.136.3	0.141.1
fastmcp	3.2.0	3.4.7
google-cloud-storage	2.19.0	3.13.1
huggingface-hub	1.10.2	1.29.0
langchain	1.3.14	1.3.18
langchain-classic	1.0.7	1.0.8
langchain-community	0.4.1	0.4.2
langchain-google-genai	4.2.1	4.3.7
langchain-google-vertexai	3.2.3	3.2.4
langchain-huggingface	1.2.1	1.2.2
langchain-mcp-adapters	0.1.11	0.3.2
langchain-ollama	1.0.1	1.1.0
langgraph-checkpoint	4.1.1	4.2.0
langsmith	0.8.18	0.11.2
markdown	3.8.2	3.10.3
myst-parser	4.0.1	5.1.0
openai	1.100.2	3.5.0
psycopg2-binary	2.9.11	2.9.12
pydantic	2.12.3	2.13.4
pygments	2.20.0	2.21.0
pypdf	6.16.1	6.16.2
rich	14.2.0	15.0.0
sentence-transformers	5.4.1	6.0.0
transformers	5.10.1	5.16.1
sphinx	8.1.3	9.1.0
sphinx-autobuild	2024.10.3	2025.8.25
sphinx-book-theme	1.1.4	1.4.0
sphinx-external-toc	1.0.1	1.1.0
sphinxcontrib-mermaid	1.0.0	2.1.0
sqlalchemy	2.0.44	2.0.52
starlette	1.3.1	1.6.0
tenacity	9.1.2	9.1.4
beautifulsoup4	4.12.3	4.15.0
mypy	1.18.2	2.3.1
pre-commit	3.7.1	4.6.2
pytest	9.0.3	9.1.1
pytest-asyncio	1.3.0	1.4.0
pytest-cov	5.0.0	7.1.0
pytest-html	4.1.1	4.2.0
ruff	0.5.1	0.16.5
types-beautifulsoup4	4.12.0.20240511	4.12.0.20250516
types-markdown	3.6.0.20240316	3.10.2.20260712
types-requests	2.32.0.20240622	2.33.0.20260712
types-tqdm	4.66.0.20240417	4.70.0.20260827

Bumps the python group with 22 updates in the /evaluation directory:

Package	From	To
langchain-google-vertexai	3.2.3	3.2.4
langsmith	0.8.18	0.11.2
pydantic	2.10.4	2.13.4
pygments	2.20.0	2.21.0
mypy	1.10.1	2.3.1
ruff	0.5.1	0.16.5
types-requests	2.32.0.20250602	2.33.0.20260712
types-tqdm	4.67.0.20241221	4.70.0.20260827
google-api-python-client	2.151.0	2.199.0
google-auth	2.48.0	2.57.0
google-auth-httplib2	0.2.0	0.4.2
google-auth-oauthlib	1.2.0	1.4.1
gitpython	3.1.54	3.1.61
gspread	6.1.2	6.2.1
python-dotenv	1.2.2	1.2.3
requests	2.33.0	2.34.2
streamlit	1.56.0	1.62.0
deepeval	3.0.0	4.2.0
asyncio	3.4.3	4.0.0
tqdm	4.67.1	4.70.0
plotly	5.24.1	7.0.0
google-api-python-client-stubs	1.28.0	1.40.0

Bumps the python group with 1 update in the /frontend/mock-flask-api directory: flask-cors.

Updates asyncpg from 0.30.0 to 0.31.0

Release notes

Sourced from asyncpg's releases.

v0.31.0

Enable Python 3.14 with experimental subinterpreter/freethreading support.

Improvements

• Add Python 3.14 support, experimental subinterpreter/freethreading support (#1279) (by @​elprans in 9e42642b)

• Avoid performing type introspection on known types (#1243) (by @​elprans in 5c9986c4)

• Make prepare() not use named statements by default when cache is disabled (#1245) (by @​elprans in 5b14653e)

• Implement connection service file functionality (#1223) (by @​AndrewJackson2020 in 1d63bb15)

Fixes

• Fix multi port connection string issue (#1222) (by @​AndrewJackson2020 in 01c0db7b)

• Avoid leaking connections if _can_use_connection fails (#1269) (by @​yuliy-openai in e94302d2)

Other

• Drop support for EOL Python 3.8 (#1281) (by @​elprans in 6c2c4904)

Commits

• 71775a6 asyncpg v0.31.0
• 508cae6 Test on PostgreSQL 18 (#1290)
• e534e5f Bump cibuildwheel
• 07fe512 Bump pgproto
• 648b35f Bump Cython to 3.2.1 (#1288)
• 9e42642 Add Python 3.14 support, experimental subinterpreter/freethreading support (#...
• 6fe1c49 Move development deps away from extras and into dependency groups (#1280)
• 7a54816 Fix a couple of missed Python version guards
• 6c2c490 Drop support for EOL Python 3.8 (#1281)
• 4c60ae8 Bump version to 0.31.0.dev0
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates faiss-cpu from 1.12.0 to 1.15.0

Release notes

Sourced from faiss-cpu's releases.

v1.15.0

[1.15.0] - 2026-07-31

Full changelog

Added

• 4332ceb99492e3ba4ce09aada9bd9e48dc4e2f0b Enable byte-LUT gather path for QT_8bit_eden distance computation (#5498)
• 41133fde4222a8862650601d85f9af684314ebc8 Add EDEN quantizer indexes (#5278)
• 3110fd242458bf1458507d9d281847543e3b4d92 Add MetalIndexIVFPQ with product quantization and residual encoding support (#5288)
• 6c2b68775a21a24870f7fd10788ebc4ec0582650 Adding cuVS IVF-SQ backend (#5306)
• 4d778bc595917de51a0e76de8351984b8bd8203f Add multi-GPU CAGRA → HNSW build with trainAllNeighbors and multi-GPU optimize (#5282)
• 42dc2862c293b7c7f788be686cf6c9ac93abf6cf Implement memory-mapped I/O for Flat and static Vamana SVS indices (#5271)
• d22107beca7a6db4ff146700b19d507e52b595b1 feat(riscv): Add RISC-V RVV rabitq kernels (#5369)
• df51012a606bc352058e95fe58d45b348ffb201a feat(riscv): Add RISC-V RVV vector distance kernels (#5354)
• 3b52da37c40973d4816ff7d2a4e3fb9f74379988 Add AVX2 and AVX512 byte-domain kernels for QT_8bit_direct_signed (#5409)
• 88b6c47cf514d3bee7d1995c09a39234fa89d8f9 Implement IVFRaBitQ FastScan conversion constructor (#5422)
• d24cc844d2cabce819cda806217b243177293e09 Implement GPU IVF add_preassigned via add_core (implement #3908) (#5372)
• 5826578a7e8f3f9e45bdb74df0c504c242dfdba0 Read/Write support for IndexHNSW base class (#5305)
• a3350f6641f85d1e2d08fa191863bde6be470df9 faiss: support METRIC_L1 and extra metrics in IndexFlat range_search (#5391)
• 432e8b4248c2778b5023d5e2ac15b264ec120d02 Extend DistanceComputer batching to PQ, SQ, and PreTransform (#5309)
• 7d4bb39f7eb3e9bb4d160aa38ec821ee1a407afc Extract super_kmeans_assign_iteration as a shared public SuperKMeans kernel (#5443)
• aff8589c9e1c2d6ee6a0de615aa719a9a4fd6e86 c_api: expose ScalarQuantizer codec and complete FaissQuantizerType enum (#5477)
• 13aa39b7916824bc09ca6af7b5e241c2cba68f6d Clone index support for HadamardRotation (#5475)
• 3e313e4c496b6a042b71193fe0bd9dd713efc7a2 SIMDConfig::has_dynamic_dispatch() (#5460)
• a6f97750aeaf760c72d0526c3a346513823c4a0c Add faiss-gpu-cuvs pip wheel packaging (#5250)
• 6227323ffd0341679299ba9a8e71cac1e15674ee pyfaiss_gpu_cuvs_2602: cuVS faiss Python for aarch64/GH200 (26.02, CUDA 12.4)
• 522644cb2b7a29737fe669b263eccb946217dc93 Stand up parallel cuVS 26.02 IVF-PQ targets (rmm/raft/cuvs) at CUDA 12.8 (#5414)
• edebabf90fe79829ede6eaa02f3d9a78d3008a5b Include Python type stubs (init.pyi, py.typed) in conda packages (#5394)
• 9579d8f0a4dbc91bd7ce195ef0aceb937c89159e Add type stubs for SVS index classes + IndexIVFFlatPanorama.batch_size (#5489)
• fd7be0cfb0c8cee0d475bb6285ad996a87ebf917 Add QT_0bit and QT_2bit_tq..QT_5bit_tq to ScalarQuantizer pyi stub (#5323)
• ccecc847db5e1d20e929cf8df4a8ddb654769890 Add ClusteringInitMethod enum constants to init.pyi stub (#5324)
• 55990eb91f9042d811a76d72e43f9ca126d77beb Port test_rabitq_utils from C++ to Python (#5442)

Changed

• 0236390f2fd8e63ff5e4c6d4ca981b7ba032cd17 Optimize RaBitQ fastscan query setup + 80% qps (#5396)
• b1d61c3b883fb82063e024979404dd6ebe134eca Fuse RaBitQ AND-dot and popcount scan (#5412)
• 81031a97892896ca9167e5203e27420de4617e67 RaBitQ fastscan avx512 lut quant (#5397)
• b7f2b0f1fd8d62e902bdcdcb9ae9694a6fd8f792 RaBitQ SIMD-optimized bit-plane operation (#5392)
• 0a27700e05429e60221b0eccbf50c4a79ad2e450 Reuse RaBitQ IVF scanner distance computer (#5390)
• a3d59f0999c69015eeff54fdde3e0d051798179e faiss DD: use 256-bit fast-scan QBS kernel on AMD Zen 4 (split AVX-512) (#5488)
• c374dd917b75c8b1fef56e487d26e18d3aae5605 Panorama HNSW Optimizations (~x1.2) (#5190)
• cb9a72ac03f4e7f7d563e3e54ab4e86b8ce1af12 Reuse the HNSW visited table across searches instead of reallocating per call (#5448)
• 4d1657471f8590ccadf5c2f37d6b58999b8010ec Raise HNSW visited-table hash-set threshold from 500k to 10M (#5446)
• a4b4c0f2de14d30719e0750e40922e47517eaa80 Optimize exhaustive_L2sqr_blas_cmax with AVX-512 intrinsics. (#4569)
• 4a2f7e63280ec095bb16dbf0d8e837b2ab79c27f Optimize the DistanceComputerByte::compute_code_distance with AVX512F, AVX512BW, AVX512VL instructions (#5067)
• 9a74c6d3d14ccf02157782c8f47205765fad63d9 Speed up Top1 and Reservoir add_results with AVX2/AVX512 (#5297)
• 4030faae3d5b2c67a5931a637a1e77e2ceee9e1e Speed up polysemous training with AVX-512.
• ea107641d4ccc350e9c3eebaffcada74b586d801 Parallelize inverted-list append loop in IndexIVFPQ::add_core_o (#5382)
• cf045707c5342cf670b9e1176d47337b05fa0b6e ProductQuantizer::search_sdc: hoist per-subquantizer row pointers out of database-vector loop (#5338)
• caf88fca98d6693366642cbb7d9b8df27dcb91ce Improve ranklist intersection size (#5237)

... (truncated)

Changelog

Sourced from faiss-cpu's changelog.

[1.15.0] - 2026-07-31

Added

• 4332ceb99492e3ba4ce09aada9bd9e48dc4e2f0b Enable byte-LUT gather path for QT_8bit_eden distance computation (#5498)
• 41133fde4222a8862650601d85f9af684314ebc8 Add EDEN quantizer indexes (#5278)
• 3110fd242458bf1458507d9d281847543e3b4d92 Add MetalIndexIVFPQ with product quantization and residual encoding support (#5288)
• 6c2b68775a21a24870f7fd10788ebc4ec0582650 Adding cuVS IVF-SQ backend (#5306)
• 4d778bc595917de51a0e76de8351984b8bd8203f Add multi-GPU CAGRA → HNSW build with trainAllNeighbors and multi-GPU optimize (#5282)
• 42dc2862c293b7c7f788be686cf6c9ac93abf6cf Implement memory-mapped I/O for Flat and static Vamana SVS indices (#5271)
• d22107beca7a6db4ff146700b19d507e52b595b1 feat(riscv): Add RISC-V RVV rabitq kernels (#5369)
• df51012a606bc352058e95fe58d45b348ffb201a feat(riscv): Add RISC-V RVV vector distance kernels (#5354)
• 3b52da37c40973d4816ff7d2a4e3fb9f74379988 Add AVX2 and AVX512 byte-domain kernels for QT_8bit_direct_signed (#5409)
• 88b6c47cf514d3bee7d1995c09a39234fa89d8f9 Implement IVFRaBitQ FastScan conversion constructor (#5422)
• d24cc844d2cabce819cda806217b243177293e09 Implement GPU IVF add_preassigned via add_core (implement #3908) (#5372)
• 5826578a7e8f3f9e45bdb74df0c504c242dfdba0 Read/Write support for IndexHNSW base class (#5305)
• a3350f6641f85d1e2d08fa191863bde6be470df9 faiss: support METRIC_L1 and extra metrics in IndexFlat range_search (#5391)
• 432e8b4248c2778b5023d5e2ac15b264ec120d02 Extend DistanceComputer batching to PQ, SQ, and PreTransform (#5309)
• 7d4bb39f7eb3e9bb4d160aa38ec821ee1a407afc Extract super_kmeans_assign_iteration as a shared public SuperKMeans kernel (#5443)
• aff8589c9e1c2d6ee6a0de615aa719a9a4fd6e86 c_api: expose ScalarQuantizer codec and complete FaissQuantizerType enum (#5477)
• 13aa39b7916824bc09ca6af7b5e241c2cba68f6d Clone index support for HadamardRotation (#5475)
• 3e313e4c496b6a042b71193fe0bd9dd713efc7a2 SIMDConfig::has_dynamic_dispatch() (#5460)
• a6f97750aeaf760c72d0526c3a346513823c4a0c Add faiss-gpu-cuvs pip wheel packaging (#5250)
• 6227323ffd0341679299ba9a8e71cac1e15674ee pyfaiss_gpu_cuvs_2602: cuVS faiss Python for aarch64/GH200 (26.02, CUDA 12.4)
• 522644cb2b7a29737fe669b263eccb946217dc93 Stand up parallel cuVS 26.02 IVF-PQ targets (rmm/raft/cuvs) at CUDA 12.8 (#5414)
• edebabf90fe79829ede6eaa02f3d9a78d3008a5b Include Python type stubs (init.pyi, py.typed) in conda packages (#5394)
• 9579d8f0a4dbc91bd7ce195ef0aceb937c89159e Add type stubs for SVS index classes + IndexIVFFlatPanorama.batch_size (#5489)
• fd7be0cfb0c8cee0d475bb6285ad996a87ebf917 Add QT_0bit and QT_2bit_tq..QT_5bit_tq to ScalarQuantizer pyi stub (#5323)
• ccecc847db5e1d20e929cf8df4a8ddb654769890 Add ClusteringInitMethod enum constants to init.pyi stub (#5324)
• 55990eb91f9042d811a76d72e43f9ca126d77beb Port test_rabitq_utils from C++ to Python (#5442)

Changed

• 0236390f2fd8e63ff5e4c6d4ca981b7ba032cd17 Optimize RaBitQ fastscan query setup + 80% qps (#5396)
• b1d61c3b883fb82063e024979404dd6ebe134eca Fuse RaBitQ AND-dot and popcount scan (#5412)
• 81031a97892896ca9167e5203e27420de4617e67 RaBitQ fastscan avx512 lut quant (#5397)
• b7f2b0f1fd8d62e902bdcdcb9ae9694a6fd8f792 RaBitQ SIMD-optimized bit-plane operation (#5392)
• 0a27700e05429e60221b0eccbf50c4a79ad2e450 Reuse RaBitQ IVF scanner distance computer (#5390)
• a3d59f0999c69015eeff54fdde3e0d051798179e faiss DD: use 256-bit fast-scan QBS kernel on AMD Zen 4 (split AVX-512) (#5488)
• c374dd917b75c8b1fef56e487d26e18d3aae5605 Panorama HNSW Optimizations (~x1.2) (#5190)
• cb9a72ac03f4e7f7d563e3e54ab4e86b8ce1af12 Reuse the HNSW visited table across searches instead of reallocating per call (#5448)
• 4d1657471f8590ccadf5c2f37d6b58999b8010ec Raise HNSW visited-table hash-set threshold from 500k to 10M (#5446)
• a4b4c0f2de14d30719e0750e40922e47517eaa80 Optimize exhaustive_L2sqr_blas_cmax with AVX-512 intrinsics. (#4569)
• 4a2f7e63280ec095bb16dbf0d8e837b2ab79c27f Optimize the DistanceComputerByte::compute_code_distance with AVX512F, AVX512BW, AVX512VL instructions (#5067)
• 9a74c6d3d14ccf02157782c8f47205765fad63d9 Speed up Top1 and Reservoir add_results with AVX2/AVX512 (#5297)
• 4030faae3d5b2c67a5931a637a1e77e2ceee9e1e Speed up polysemous training with AVX-512.
• ea107641d4ccc350e9c3eebaffcada74b586d801 Parallelize inverted-list append loop in IndexIVFPQ::add_core_o (#5382)
• cf045707c5342cf670b9e1176d47337b05fa0b6e ProductQuantizer::search_sdc: hoist per-subquantizer row pointers out of database-vector loop (#5338)
• caf88fca98d6693366642cbb7d9b8df27dcb91ce Improve ranklist intersection size (#5237)
• 5c1afeed9666448708c8a036136a8a8bdf8827e1 Remove dead code in quantize_ex_bits to avoid wasted compute (#5384)
• e3dd6a85f3125d3338b2a5918e007230927c929f Remove unused fields in various DistanceComputers (#5318)
• 35c5495b8fa8fcab4b8b476d6a6efde67d3a0e85 Remove confusing double-negative throw-macro conditions (#5471)

... (truncated)

Commits

• 20f14b3 Increment to next release, v1.15.0 (#5494)
• 4332ceb Enable byte-LUT gather path for QT_8bit_eden distance computation (#5498)
• 6187d94 clang-diagnostic-unused-parameter in GpuCloner.cpp (#5480)
• 37313e7 Fix two memory leaks in shard_ivf_index_centroids (#5495)
• 7a4e797 Fix RaBitQ fast scan aux offsets for large bbs (#5421)
• b1d61c3 Fuse RaBitQ AND-dot and popcount scan (#5412)
• 9579d8f Add type stubs for SVS index classes + IndexIVFFlatPanorama.batch_size (#5489)
• a3d59f0 faiss DD: use 256-bit fast-scan QBS kernel on AMD Zen 4 (split AVX-512) (#5488)
• 4d74915 Bound lattice_nbit loop in IndexLattice ctor to fix deserialization timeout (...
• a032797 faiss DD: SQ AVX-512 falls back to AVX2 when d%16!=0 (#5478)
• Additional commits viewable in compare view

Updates fastapi from 0.136.3 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates fastmcp from 3.2.0 to 3.4.7

Release notes

Sourced from fastmcp's releases.

v3.4.7: Know Your Audience

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in PrefectHQ/fastmcp#4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in PrefectHQ/fastmcp#4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in PrefectHQ/fastmcp#4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in PrefectHQ/fastmcp#4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

• Expose ClientGroup from package root by @​jlowin in #4987
• skills: add release skill with changelog entry helper by @​zzstoatzz in #4982

Fixes 🐞

• docs: escape <1 in changelog so MDX parses by @​zzstoatzz in #4978

Docs 📚

• docs: note the 4.0.1 floor for ClientGroup reentrancy by @​zzstoatzz in #4980
• docs: link the GA announcement and blog from What's New by @​zzstoatzz in #4984

Full Changelog: v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

Fixes 🐞

• client: make ClientGroup context reentrant by @​zzstoatzz in #4975
• ci: fix the published-docs PR step's working base by @​zzstoatzz in #4960

Docs 📚

• docs: update banner for FastMCP 4 GA by @​zzstoatzz in #4958
• docs: correct whats-new and upgrade guide for GA by @​zzstoatzz in #4961
• docs: drop prerelease install framing from installation and SDK migration guides by @​zzstoatzz in #4963
• docs: refresh sidebar tags and fix audit findings by @​zzstoatzz in #4965

Full Changelog: v4.0.0...v4.0.1

v4.0.0: Four Real

... (truncated)

Commits

• 758397e Docs: add v3.4.7 changelog entries (#4810)
• 538611b Backport CIMD assertion audience fix to v3 (#4799)
• c587bdd Docs: add v3.4.6 changelog entries (#4761)
• fcdf422 Backport #4412 to 3.x: support trusted SSRF proxies (#4755)
• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• Additional commits viewable in compare view

Updates google-cloud-storage from 2.19.0 to 3.13.1

Changelog

Sourced from google-cloud-storage's changelog.

Changelog

PyPI History

3.15.0 (2026-06-02)

Features

• regenerate google-cloud-d packages (#17092) (d49a2b9412b4ee9105125db36104a3e18344e0ad)

3.14.0 (2026-04-02)

Features

• Update comments for proto fields (c36aa6169035fdb14bf84b0e56e4f81291600b5a)
• Added a fields for image and table annotation output (c36aa6169035fdb14bf84b0e56e4f81291600b5a)

3.13.0 (2026-03-26)

Features

• Allow Protobuf 7.x (1eb7c268482e55971966e284dac2cbeb903adcbb)

Bug Fixes

• Require Python 3.9 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Require google-api-core >= 2.11.0 (1eb7c268482e55971966e284dac2cbeb903adcbb)
• Improve type checking (1eb7c268482e55971966e284dac2cbeb903adcbb)

3.12.0 (2026-03-23)

Features

• Add a field for upgrading previous processor version when fine tuning (ee7dd7dc168ecf943440cef38efff348e8eff095)

3.11.0 (2026-03-05)

Features

• Added a field for enabling image and table annotation for layout parser processor (6120fb0db084f5e8d1502fb1bb37594ac9976f6e)

3.10.0 (2026-02-12)

... (truncated)

Commits

• 905bfe3 chore: release main (#17832)
• ad8f93c fix(api-core): use truthiness check in setup_request_id to support proto-plus...
• 06dd2c0 chore: bump google-api-core to 2.28.0 (#18003)
• 08f21a6 fix(proto-plus): add context to TypeErrors during message manipulation (#17682)
• 32fd479 tests(spanner): avoid table name collisions in tests (#18001)
• 2207ca6 feat: add pandas-gbq capability helper (#17957)
• 6167e41 fix: deduplicate x-goog-api-client headers (#17616)
• 71bc622 docs: add connector libraries overview table to package README (#17939)
• 1b5c48b fix(bigframes): fix field name typos for ai.generate* functions (#17983)
• f64ada2 fix: avoid retaining routing parameter instances in cache (#17961)
• Additional commits viewable in compare view

Updates huggingface-hub from 1.10.2 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

• [Xet] Cache connection info to avoid one token request per file by @​hanouticelina in #4732

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

• [Buckets] Add support for updating bucket visibility by @​hanouticelina in #4715

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

• [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
• Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

• [Inference Providers] Send LoRA weights for fal-ai text-to-video by @​moon-bot-app[bot] in #4706
• Hint at stream=True when a non-streaming inference call fails with 504 by @​moon-bot-app[bot] in #4744

🖥️ CLI

... (truncated)

Commits

• 4237d95 Release: v1.29.0
• dd44abc Release: v1.29.0.rc1
• 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
• b1bf950 Release: v1.29.0.rc0
• 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
• c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
• 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
• 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
• 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
• c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
• Additional commits viewable in compare view

Updates langchain from 1.3.14 to 1.3.18

Release notes

Sourced from langchain's releases.

langchain==1.3.18

Changes since langchain==1.3.17

release(langchain): 1.3.18 (#39966) fix(langchain): preserve content-block shape in PIIMiddleware redaction (