build(deps): bump the python-examples group across 2 directories with 6 updates

[dependabot]

Bumps the python-examples group with 3 updates in the /demos directory: cmcp-runtime, weight-custody-manifest and openai.
Bumps the python-examples group with 3 updates in the /examples directory: cryptography, transformers and torch.

Updates cmcp-runtime from 0.5.0 to 0.7.0

Release notes

Sourced from cmcp-runtime's releases.

cmcp v0.7.0

Security

• TPM 2.0: verify_tpm_measurement listed a qualifying_data mismatch as unverified but still returned verified, so a genuine quote could be attached to a claim signed by any key. It also never compared the quote's pcrDigest with the claim's measurement, though docs/spec/tpm-security-model.md said it did. Both now fail the check.

Changed

• verify_trace_claim takes expected_launch_measurements, and cmcp verify takes a repeatable --launch-measurement. A hardware claim whose measurement is outside the set fails. With no set, a hardware claim is partially_verified with launch_measurement unverified: genuine hardware says what ran, not that it was approved, and a report from any guest image used to come out verified.

v0.6.0

cmcp-runtime 0.6.0. Full detail is in CHANGELOG.md.

Kill switch

• Blocks survive a restart and live in the audit database. The close that trips the switch returns its signed claim, and later calls get 403 KILL_SWITCH_TRIPPED (#665).
• A session stops at the call that trips the switch, not at session close (#666).
• Claims carry a gateway.kill_switch block, each refused call returns a signed receipt, and cmcp_verify.verify_kill_switch_refusal checks one against the other. kill_switch.enabled with no Agent Manifest now stops startup (#667).
• A compromised policy signing key can be revoked without a restart through CMCP_POLICY_SUCCESSOR_SIGNING_KEY and signing-key-revocations.json (#668).
• agent_manifest.revocation_list_path makes startup refuse a revoked Agent Manifest; a missing or malformed list stops startup instead of reading as empty (#689).

Also in this release

• Verifier-owned SNP platform policy in native, Azure and TRACE verification (#656).
• Opt-in exact-output disclosure bound to scoped owner signatures (#672).
• Monotonic session boundary, and session close and reset release stdio children and upstream caches (#629, #634).
• Two tool names that derive the same Cedar action are refused at catalog load (#671).
• Operator sensitivity ceilings at tool and response sinks.
• Linux agent confinement reference (#663).
• Paginated tools/list is read to the end before drift and provenance checks (#633).
• session_state_path is accepted and wired at startup, so the session sensitivity value can live in a shared SQLite store. An unopenable path stops startup with SESSION_STATE_STORE_UNAVAILABLE (#661).
• verify_audit_bundle requires a recorded session_reset at every session change, and code_digest refuses an installed file whose bytes differ from its RECORD entry (#689).

Behaviour changes

• A tools/call carrying _cmcp.execution_id is refused with execution_correlation_unavailable until execution correlation ships (#606).
• Session reset and catalog exception take CMCP_OPERATOR_TOKEN, required outside dev mode. Where it is unset they still accept the bearer token.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.0] - 2026-09-30

Security

• TPM 2.0: verify_tpm_measurement listed a qualifying_data mismatch as unverified but still returned verified, so a genuine quote could be attached to a claim signed by any key. It also never compared the quote's pcrDigest with the claim's measurement, though docs/spec/tpm-security-model.md said it did. Both now fail the check.
• Agent Manifest v0.2: the SDK appraised the COSE envelope, but the binding fields were read from the decoded dict the caller passed, and nothing checked that the two were the same document. A valid envelope paired with a dict carrying another policy or catalog hash bound. The dict must now equal the signed payload, and issuer_key_id is the key that verified the envelope instead of an empty string.

Added

• build_server(ctx, trace_gate=...): an optional pre-transport hook for verifier-issued TRACE tokens (cmcp_runtime.trace_gate.TraceGate). With a gate, POST /trace/challenge and POST /trace/admit are registered behind bearer auth, every tools/call needs a holder proof bound to its exact action, and the gate is rechecked and a receipt committed before any byte goes upstream. A gate requires enforcing mode. With no gate, the routes do not exist and the call path is unchanged.
• cmcp_runtime.manifest_catalog.manifest_catalog_binding: the Agent Manifest tool Merkle root (spec 3.2.3) computed from the catalog being served, kept separate from cMCP's sealed catalog digest.
• Experimental evidence-requirements-experimental-v1 manifest profile: the tool binding is checked against that Merkle projection, and the signed evidence requirements must also name the sealed catalog digest.

Changed

• verify_trace_claim takes expected_launch_measurements, and cmcp verify takes a repeatable --launch-measurement. A hardware claim whose measurement is outside the set fails. With no set, a hardware claim is partially_verified with launch_measurement unverified: genuine hardware says what ran, not that it was approved, and a report from any guest image used to come out verified.

Fixed

• An Agent Manifest that lists its tools in tool_manifest.tools could never bind: cMCP handed the SDK its sealed catalog digest, and from agent-manifest 0.13 the SDK compares catalog_hash with the Merkle root of that list. Such a manifest now binds when its list and root equal the projection of the catalog being served (cmcp_runtime.manifest_catalog). A manifest that omits tools is still compared with the sealed digest. verify_agent_manifest_binding takes runtime_catalog for this; without it a manifest with tools does not bind, which includes cmcp verify, since it has no catalog to project.

... (truncated)

Commits

• 6676188 chore(release): cmcp-runtime 0.7.0 (#711)
• 0ff0d12 fix(verify): require TPM key and PCR binding; pin launch measurements (#709)
• 368626f build(deps): bump pyjwt to 2.15.1 for CVE-2026-102274 and CVE-2026-101917 (#703)
• c67f3b4 ci: bump the codeql-action group with 4 updates (#700)
• 3bd5e6c ci: bump ruff from 0.16.7 to 0.16.8 (#693)
• 1759319 ci: bump starlette from 1.6.0 to 1.7.0 (#698)
• 0e1de4c ci: bump platformdirs from 4.11.8 to 4.11.12 (#690)
• d2a0122 ci: bump mkdocstrings-python from 2.0.8 to 2.0.9 (#691)
• f9b1f7c ci: bump wcwidth from 0.8.4 to 0.9.1 (#699)
• 0d71fbe ci: bump python from 3.11.15-slim-bookworm to 3.11.16-slim-bookworm (#697)
• Additional commits viewable in compare view

Updates weight-custody-manifest from 0.28.4 to 0.30.0

Release notes

Sourced from weight-custody-manifest's releases.

weight-custody-manifest 0.30.0: release notes for after the advisory is published

DRAFT. Use this text only once advisory 01 (and its GHSA) is public. Until then the CHANGELOG carries the neutral entry on branch fix/server-launch-measurement.

Fixed: the reference server compared the serving image with an unsigned field

0.29.0 (#170) made QuoteVerifier.verify compare sha256(launch measurement) from the signed report with the measurement the key broker is about to approve. The reference server did not get that fix. wcm.server.build_kbs_from_env built QuoteVerifier(JsonQuoteParser(), trust) with no launch_measurement_offset, and no environment variable could set one, so the parser returned no launch measurement and the verifier skipped the comparison.

On a server started with WCM_CPU_TRUST_ROOT_FILE, the serving-image check therefore still rested on evidence.cpu.serving_image_measurement, which whoever builds the evidence writes. A genuine report from an unapproved image, with its REPORT_DATA correctly bound to the challenge nonce and its own transport key, could name an approved measurement in that field and receive the model key sealed to that transport key. This is THREAT-MODEL T1.3 on the reference container, in 0.29.0. Earlier versions are covered by advisory GHSA-3vqr-27fw-2c6w (advisory 01), which affected the library verifier as well.

Reproduction on 0.29.0: tests/test_server_launch_measurement.py posts a report signed under a test root, launch measurement 0xee * 48 at offset 0x90, naming the manifest's current measurement in serving_image_measurement. 0.29.0 returns released: true with a sealed_key_b64. 0.30.0 returns released: false, cpu_quote_verified failing with "signed workload launch measurement mismatch". The control, a report whose signed measurement matches the manifest, releases on both.

What changed

• build_kbs_from_env builds the parser with launch_measurement_offset from the new WCM_CPU_LAUNCH_MEASUREMENT_OFFSET (decimal or 0x hex; 0x90 for an AMD SEV-SNP report) and the verifier with require_launch_measurement=True.
• With WCM_CPU_TRUST_ROOT_FILE set and WCM_CPU_LAUNCH_MEASUREMENT_OFFSET unset, empty, negative or not an integer, the server raises ValueError at startup and does not serve.
• QuoteVerifier takes require_launch_measurement (default False). With it set, a quote whose parser yields no launch measurement is refused whenever an expected workload measurement is passed, with "quote carries no signed workload launch measurement".

Action for operators (breaking change)

If you run the reference server (uvicorn wcm.server:app_from_env --factory, or the wcm-kbs image) with WCM_CPU_TRUST_ROOT_FILE, upgrade to 0.30.0 and set WCM_CPU_LAUNCH_MEASUREMENT_OFFSET to the offset of the launch measurement in your report body. The server will not start without it. Servers without a CPU trust root already refused every release and are unchanged. Code that constructs KeyBrokerService with SnpQuoteParser or AzureSnpVtpmVerifier was fixed in 0.29.0 and is not affected.

Workaround on 0.29.0: construct the KBS in code with

... (truncated)

Changelog

Sourced from weight-custody-manifest's changelog.

0.30.0 - 2026-10-01

Fixed. The CLI reports missing manifest or key files and malformed manifest JSON as a single error: <path>: <reason> line on stderr and exits 1, instead of printing a Python traceback. Verification outcomes and exit codes are unchanged.

Fixed, security. AzureSnpVtpmVerifier verified the TPM quote with the key parsed from ak_pem, which the bundle's sender writes, and compared only its modulus with HCLAkPub from the SNP-authenticated HCL runtime JSON. The exponent was never checked. With cryptography 48.0.1, a public key of (HCL modulus, e=1) loads, and under e=1 a PKCS#1 v1.5 signature is just the padded digest, so anyone holding a genuine report could sign a quote for any nonce, any transport key and any PCR 23 measurement. The pinned cryptography 50.x refuses to load e=1; the verifier itself checked nothing about the exponent.

The quote is now verified under the key built from HCLAkPub itself: kty must be RSA, n and e must both be present as unpadded base64url, e must be 65537, and the modulus must be at least 2048 bits. ak_pem must name exactly that key, modulus and exponent, or the evidence is denied with the existing "TPM quote key does not match HCL-authenticated AK" reason. Every Azure capture on hand (two Genoa, one Milan, September 29 and 30 2026) carries "kty": "RSA", "e": "AQAB" and a 2048-bit modulus, and still verifies.

Fixed. The reference server (wcm.server.build_kbs_from_env) now takes the workload measurement for the serving-image check from the signed report, as the library verifier has since 0.29.0. A quote with no signed launch measurement is refused.

Changed, operator-facing (breaking). With WCM_CPU_TRUST_ROOT_FILE set, the server requires WCM_CPU_LAUNCH_MEASUREMENT_OFFSET: the byte offset of the 48-byte launch measurement in the report body, decimal or 0x hex (0x90 for an AMD SEV-SNP report). Without it the server refuses to start. Deployments without a CPU trust root are unchanged.

Added. QuoteVerifier(..., require_launch_measurement=True) refuses a quote whose parser yields no launch measurement when an expected workload measurement is passed. The default is unchanged.

0.29.0 - 2026-09-30

Fixed. QuoteVerifier.verify discarded expected_workload_measurement, so the key broker's serving-image check rested on serving_image_measurement, a structured field whoever builds the evidence controls. A genuine SEV-SNP report from an unapproved image could name an approved measurement there and receive the key. The verifier now compares sha256(launch measurement) from the signed report with the value the broker is about to approve, which is what broker_receiver already did. SnpQuoteParser supplies the launch measurement; JsonQuoteParser supplies one when constructed with launch_measurement_offset.

... (truncated)

Commits

• 66731f2 fix(server): take the launch measurement from the signed report; release 0.30...
• 5ef8c12 fix(azure): verify the TPM quote under the HCL-authenticated AK, exponent inc...
• b487c5a chore(release): 0.29.0 (#171)
• 0628848 fix(kbs): compare the signed launch measurement, bind renewals to their evide...
• 1c0ac36 feat(revocation): enforce nonce-bound OCSP for the GPU attestation chain (#154)
• 964792b build(deps): bump github/codeql-action/upload-sarif (#167)
• 94d5519 chore(release): 0.28.5 (#166)
• d7a66ae ci: scope workflow write permissions to the job that uses them (#165)
• f0199c0 ci: hash-pin pip installs in workflows and the fuzz build (#164)
• 8a716d2 feat(kbs): let the manifest require evidence verification (#162)
• Additional commits viewable in compare view

Updates openai from 3.19.2 to 3.31.0

Release notes

Sourced from openai's releases.

v3.31.0

3.31.0 (2026-10-14)

Features

• add browser and computer toolsets (1/4) (#4073) (47b9e4e)

v3.30.0

3.30.0 (2026-10-14)

Features

• api: add beta session spending limits (#4058) (b570279)
• api: add OCI external-storage provider support (#4060) (9eb83fe)
• api: add organization Decisions usage reporting (#4062) (5e7a23e)
• api: expose image tool error and moderation details (#4072) (c5452af)
• api: support image URLs and detailed safety alert explanations (#4061) (3c50399)
• api: support updating project API key expiry (#4066) (1f05e33)

Bug Fixes

• streaming: restore async HTTP/1.1 connection reuse (#4041) (1f6cfe1)

Chores

• api: clarify agent tool limits and environment pagination (#4065) (0f73f1d)

v3.29.0

3.29.0 (2026-10-11)

Features

• api: add billing_not_active session error code (#4052) (c88b320)
• api: add shida to named Live voices (#4053) (7352cf5)
• api: add vault updates and metadata filters (#4047) (e72f493)
• api: align beta pagination limits and non-null parameters (#4057) (800899e)

Chores

• api: clarify decision creation documentation (#4054) (16d3d3b)
• api: clarify Decisions question and answer descriptions (#4051) (895d617)
• api: document 128-character safety identifiers (#4050) (2c1ae52)
• api: document decision choice constraints (#4055) (b7a1990)
• api: document Files API rate-limit responses (#4049) (f6a3459)

... (truncated)

Changelog

Sourced from openai's changelog.

3.31.0 (2026-10-14)

Features

• add browser and computer toolsets (1/4) (#4073) (47b9e4e)

3.30.0 (2026-10-14)

Features

• api: add beta session spending limits (#4058) (b570279)
• api: add OCI external-storage provider support (#4060) (9eb83fe)
• api: add organization Decisions usage reporting (#4062) (5e7a23e)
• api: expose image tool error and moderation details (#4072) (c5452af)
• api: support image URLs and detailed safety alert explanations (#4061) (3c50399)
• api: support updating project API key expiry (#4066) (1f05e33)

Bug Fixes

• streaming: restore async HTTP/1.1 connection reuse (#4041) (1f6cfe1)

Chores

• api: clarify agent tool limits and environment pagination (#4065) (0f73f1d)

3.29.0 (2026-10-11)

Features

• api: add billing_not_active session error code (#4052) (c88b320)
• api: add shida to named Live voices (#4053) (7352cf5)
• api: add vault updates and metadata filters (#4047) (e72f493)
• api: align beta pagination limits and non-null parameters (#4057) (800899e)

Chores

• api: clarify decision creation documentation (#4054) (16d3d3b)
• api: clarify Decisions question and answer descriptions (#4051) (895d617)
• api: document 128-character safety identifiers (#4050) (2c1ae52)
• api: document decision choice constraints (#4055) (b7a1990)
• api: document Files API rate-limit responses (#4049) (f6a3459)

3.28.0 (2026-10-09)

... (truncated)

Commits

• 86cae50 release: 3.31.0 (#4078)
• 47b9e4e feat: add browser and computer toolsets (1/4) (#4073)
• 16a8340 release: 3.30.0 (#4059)
• 1f6cfe1 fix(streaming): restore async HTTP/1.1 connection reuse (#4041)
• c5452af feat(api): expose image tool error and moderation details (#4072)
• 1f05e33 feat(api): support updating project API key expiry (#4066)
• 0f73f1d chore(api): clarify agent tool limits and environment pagination (#4065)
• 5e7a23e feat(api): add organization Decisions usage reporting (#4062)
• 3c50399 feat(api): support image URLs and detailed safety alert explanations (#4061)
• 9eb83fe feat(api): add OCI external-storage provider support (#4060)
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates transformers from 5.17.0 to 5.19.0

Release notes

Sourced from transformers's releases.

Release v5.19.0

New Model additions

EmbeddingGemma2

EmbeddingGemma 2 is a multimodal embedding model from Google built on the Gemma 4 architecture. It encodes text, images, audio, and video, individually or combined in one input, into a shared 768-dimensional vector space for cross-modal retrieval, semantic similarity, clustering, and classification. It uses Matryoshka Representation Learning, so embeddings can be truncated to 512, 256, or 128 dimensions. It also offers configurable visual and video token budgets, and unused vision or audio towers can be disabled at load time to save memory.

Links: Documentation

• Smthn smthn (#49364) by @​vasqu in #49364

Breaking changes

All MoE models whose routers compute logits now return them when output_router_logits=True, following the Qwen3-MoE pattern (a router_logits recorder on the base model, MoeModelOutputWithPast from the backbone, and a MoE causal LM output from the head), so code that relied on the previous outputs or their absence should read the router logits from these output classes.

• 🚨 Return router logits from every MoE model that computes them (#48920) by @​qgallouedec

Owlv2ForObjectDetection.embed_image_query now selects the query box with the highest objectness score, as in the original OWLv2 notebook, instead of the OWL-ViT heuristic, so image-guided query embeddings and detections may differ from earlier releases.

• 🚨 Select the OWLv2 image query by objectness (#49200) by @​qgallouedec

The "paged|" prefix for SDPA and flash attention implementations is deprecated, so users should set the regular attention implementation (e.g. sdpa or flash_attention_2) for continuous batching instead of paged|sdpa or paged|flash_attention_2.

• 🚨 Attention 🚨 Deprecate "paged|" prefix for SDPA and flash (#49112) by @​remi-or

The regular flash and SDPA attention functions (flash_attention.py, sdpa_attention.py) now support continuous batching directly, and "paged|..." implementations for these are redirected to them, while eager still requires the "paged|eager" prefix.

• 🚨 Attention 🚨 Make regular attention support CB (#49101) by @​remi-or

In continuous batching, the cache update for the index-based and block-table paths is now fused into a single call, which slightly changes the cache update function's behavior and affects any custom code that calls the separate update paths.

• 🚨 [CB] 🚨 Fuse update for index and block table path (#49088) by @​remi-or

Continuous batching internals changed in preparation for removing "paged": `max

• 🚨 [CB] 🚨 Little fixes before removing "paged" (#49069) by @​remi-or

Parallelization

Expert parallelism gains a token-dispatch implementation, selected via the new ep_dispatch_experts plan rule and now the default for Qwen3 MoE and Mellum, which removes the requirement that EP size equal TP size. The Trainer was also adapted to work with expert parallelism, and the docs now note that PEFT adapters support tensor parallelism. A CI-related fix for pipeline-parallel chart2table inference was also included.

• [distributed]: adapt Trainer to work Expert Parallel (#48873) by @​3outeille in #48873
• [distributed] Add expert-parallel token dispatch, default for Qwen3 MoE (#48865) by @​3outeille in #48865
• Fix pp chart2table inference (#49225) by @​zucchini-nlp in #49225
• [docs] TP for PEFT adapters (#49060) by @​stevhliu in #49060

Cache

... (truncated)

Commits

• c4c4605 v5.19.0
• 92cd495 Smthn smthn (#49364)
• a7e8ff2 Revert "[CI] Temporarily disable AMD scheduled CI trigger" (#49271) (#49362)
• 571c5cc ALM testx fIxing... (#49355)
• b4526a7 Fix DataCollatorForLanguageModeling ignoring seed=0 (#49349)
• 5a27d2d Fix explicit kernelization modes for evaluation models (#49339)
• 23c21ac fix(cohere_compass): add video to input_modalities (#49320) (#49323)
• f1d0d9f GPT-OSS: read the clamped SwiGLU's alpha and limit from the config (#49346)
• 9921402 [distributed] Default MoE ep_plans to token dispatch (#49160)
• 8625785 [distributed]: adapt Trainer to work Expert Parallel (#48873)
• Additional commits viewable in compare view

Updates torch from 2.14.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

• Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
• Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
• Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
  • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
  • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

• Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
• Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

Commits

• 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
• 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
• 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
• e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
• 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[imran-siddique]

Dependency update and lock fix reviewed; CI green.

[imran-siddique]

@rajnisht7 could you review and approve this? WCM 0.29.0 refuses GPU evidence it cannot verify, so demo-09 now uses demo-06's waive_mock_verification (fa9092f), and 8d329f7 restores the markers three locks lost. That makes me the last pusher, so the ruleset needs an approval from another maintainer. CI is green at 8d329f7.