Skip to content

chore(deps): Bump the python-minor-patch group across 1 directory with 15 updates - #107

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend/python-minor-patch-513e0fcdbb
Closed

chore(deps): Bump the python-minor-patch group across 1 directory with 15 updates#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend/python-minor-patch-513e0fcdbb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python-minor-patch group with 15 updates in the /backend directory:

Package From To
fastapi 0.141.1 0.143.0
asyncpg 0.31.0 0.32.0
alembic 1.19.1 1.20.0
pymysql 1.2.0 1.2.3
pydantic 2.13.4 2.14.0
duar-auth 1.4.1 1.4.3
rdkit 2026.3.5 2026.9.1
temporalio 1.32.0 1.34.0
fsspec 2026.7.0 2026.9.0
numpy 2.5.2 2.5.4
pandas 3.0.5 3.0.6
matplotlib 3.11.1 3.11.2
ruff 0.16.4 0.17.0
mypy 2.3.1 2.4.0
import-linter 2.13 2.15

Updates fastapi from 0.141.1 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates asyncpg from 0.31.0 to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

  • Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

  • Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

  • Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

  • Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

  • Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

  • Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

  • Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

  • Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

  • Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

  • Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

  • Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits
  • d701e11 asyncpg v0.32.0
  • b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
  • 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
  • 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
  • b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
  • 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
  • 8d2a5ae Support PostgreSQL 19 (#1379)
  • 58c0c59 Bump uvloop (#1378)
  • 67a1cbc Make pool min_size a maintained connection floor (#1323)
  • 25aaaf5 fix: allow cursors in external transactions (#1350)
  • Additional commits viewable in compare view

Updates alembic from 1.19.1 to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

  • [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

    References: #1846

  • [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

    References: #916

bug

  • [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

    References: #1768

  • [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

Updates pymysql from 1.2.0 to 1.2.3

Release notes

Sourced from pymysql's releases.

v1.2.3

Full Changelog: PyMySQL/PyMySQL@v1.2.2...v1.2.3

v1.2.2

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

Full Changelog: PyMySQL/PyMySQL@v1.2.1...v1.2.2

v1.2.1

What's Changed

New Contributors

Full Changelog: PyMySQL/PyMySQL@v1.2.0...v1.2.1

Changelog

Sourced from pymysql's changelog.

v1.2.3

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for compatibility with aiomysql.

Use pymysql.converters at your own risk. It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1 (security fix)

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from bytes using surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

  • Queries are now encoded using the strict error handler instead of surrogateescape. Queries that cannot be encoded using the connection encoding can no longer be sent.

  • bytes parameters are now always sent as hexadecimal literals, such as X'636174'. Note that this increases the number of bytes sent.

  • The binary_prefix parameter of connect() is deprecated. The _binary prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (utf8mb4). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.

Commits

Updates pydantic from 2.13.4 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates duar-auth from 1.4.1 to 1.4.3

Updates rdkit from 2026.3.5 to 2026.9.1

Release notes

Sourced from rdkit's releases.

2026_09_1 (Q3 2026) Release

Release_2026.09.1

(Changes relative to Release_2026.03.1)

Acknowledgements

(Note: I'm no longer attempting to manually curate names. If you would like to see your contribution acknowledged with your name, please set your name in GitHub)

reza bagheri alashti, Rody Arantes, Marco Ballarotto, Chris Von Bargen, Kevin Boyd, Katharina Buchthal, Kerim Buyukakyuz, Arthur Chan, Michael Cho, David Cosgrove, Mike DePaulo, Eloy Félix, Peter Gedeck, Lukas Geiger, Guillaume Godin, Huw Jones, Steven Kearnes, Brian Kelley, Jakub Klinkovský, Jimmy Kromann, Niels Maeder, John Mayfield, Vedran Miletić, Dan Nealschneider, Dmytro Radchenko, Emily Rhodes, Ricardo Rodriguez, Wonseok Shin, Raul Sofia, Vaibhav Srivastava, Jon Swain, Pavel Tomanek, Paolo Tosco, Ivan Tubert-Brohman, Riccardo Vianello, Inwan Yoo, Nic Zonta, dd, ajeyabsf, m_holmer, zengkaipeng(SII), css, reowszer, thomp-j, vwe-ibm, ankar-dav, dpdoughe

Highlights

  • This release includes a number of improvements to the RDKit's conformer generator, including beta versions of ETKDGv4 and a new strategy for selecting initial coordinates. These are not yet used by default, but we encourage people to try them out - try the rdDistGeom.ETKDGv4 parameters object and/or setting initialEmbeddingMode to rdDistGeom.INTERNAL_COORDINATE_EMBEDDING - and are looking for feedback.
  • We've created a new set of Python wrappers based on nanobind instead of Boost::Python. The new wrappers, still in beta, are significantly faster. We will be doing conda-forge builds of the new wrappers and would greatly appreciate feedback from the community.
  • It's now possible to do shape-based searches in synthon spaces.

Backwards incompatible changes:

  • The C++ canonicalization helpers Canon::initCanonAtoms() and Canon::detail::initFragmentCanonAtoms() now require caller-owned neighbor ID storage. Canon::canon_atom::nbrIds is now a non-owning std::span<int>.
  • Canon::canon_atom::bonds now uses boost::container::small_vector.
  • Since #9208, atom rings are "normalized" so that the first atom in the ring definition is the one with the lowest index, and the second one is the neighbor to the first which also has the lowest index.
  • MolTransforms.h now includes <Eigen/Core> instead of <Eigen/Dense>. C++ code that included MolTransforms.h and relied on it to transitively pull in the Eigen dense modules (LU/QR/SVD/etc.) must now include <Eigen/Dense> directly.
  • PicklerOps::QueryDetails (in GraphMol/MolPickler.h) is now a std::variant instead of a boost::variant. C++ code that inspects this type must use std::get/std::holds_alternative and .index() in place of boost::get and .which(). MolPickler.h also no longer includes

... (truncated)

Changelog

Sourced from rdkit's changelog.

Release_2026.09.1

(Changes relative to Release_2026.03.1)

Acknowledgements

(Note: I'm no longer attempting to manually curate names. If you would like to see your contribution acknowledged with your name, please set your name in GitHub)

reza bagheri alashti, Rody Arantes, Marco Ballarotto, Chris Von Bargen, Kevin Boyd, Katharina Buchthal, Kerim Buyukakyuz, Arthur Chan, Michael Cho, David Cosgrove, Mike DePaulo, Eloy Félix, Peter Gedeck, Lukas Geiger, Guillaume Godin, Huw Jones, Steven Kearnes, Brian Kelley, Jakub Klinkovský, Jimmy Kromann, Niels Maeder, John Mayfield, Vedran Miletić, Dan Nealschneider, Dmytro Radchenko, Emily Rhodes, Ricardo Rodriguez, Wonseok Shin, Raul Sofia, Vaibhav Srivastava, Jon Swain, Pavel Tomanek, Paolo Tosco, Ivan Tubert-Brohman, Riccardo Vianello, Inwan Yoo, Nic Zonta, dd, ajeyabsf, m_holmer, zengkaipeng(SII), css, reowszer, thomp-j, vwe-ibm, ankar-dav, dpdoughe

Highlights

  • This release includes a number of improvements to the RDKit's conformer generator, including beta versions of ETKDGv4 and a new strategy for selecting initial coordinates. These are not yet used by default, but we encourage people to try them out - try the rdDistGeom.ETKDGv4 parameters object and/or setting initialEmbeddingMode to rdDistGeom.INTERNAL_COORDINATE_EMBEDDING - and are looking for feedback.
  • We've created a new set of Python wrappers based on nanobind instead of Boost::Python. The new wrappers, still in beta, are significantly faster. We will be doing conda-forge builds of the new wrappers and would greatly appreciate feedback from the community.
  • It's now possible to do shape-based searches in synthon spaces.

Backwards incompatible changes:

  • The C++ canonicalization helpers Canon::initCanonAtoms() and Canon::detail::initFragmentCanonAtoms() now require caller-owned neighbor ID storage. Canon::canon_atom::nbrIds is now a non-owning std::span<int>.
  • Canon::canon_atom::bonds now uses boost::container::small_vector.
  • Since #9208, atom rings are "normalized" so that the first atom in the ring definition is the one with the lowest index, and the second one is the neighbor to the first which also has the lowest index.
  • MolTransforms.h now includes <Eigen/Core> instead of <Eigen/Dense>. C++ code that included MolTransforms.h and relied on it to transitively pull in the Eigen dense modules (LU/QR/SVD/etc.) must now include <Eigen/Dense> directly.
  • PicklerOps::QueryDetails (in GraphMol/MolPickler.h) is now a std::variant instead of a boost::variant. C++ code that inspects this type must use std::get/std::holds_alternative and .index() in place of boost::get and .which(). MolPickler.h also no longer includes <boost/variant.hpp>.

... (truncated)

Commits

Updates temporalio from 1.32.0 to 1.34.0

Release notes

Sourced from temporalio's releases.

1.34.0

Notable Changes

Added

  • Added WorkflowAlreadyStartedError.first_run_id for the first execution run ID when provided by the server.

  • Experimental: temporalio.contrib.google_adk_agents now supports ADK v2 graph workflows, dynamic @node workflows, and durable HITL.

  • Experimental: Experimental support for Event Groups. Event Groups is a new form of Workflow-level metadata that allows for improved visibility into a Workflow execution's history by grouping logically related Events together based on user-defined or system-inferred criteria. workflow.create_event_group(...) takes the Event Group's ID as its first and only required argument; the user-provided ID is used verbatim and should not contain sensitive information. The label is optional and passed as a keyword argument; it is a codec-encoded Payload.

  • Added workflow.Info.original_execution_run_id, the run ID recorded on the workflow execution started event. Unlike run_id, this value is preserved across workflow resets.

  • Experimental: temporalio.contrib.strands now supports durable, Workflow-isolated Strands sandboxes through TemporalSandbox and worker-side factories registered with StrandsPlugin(sandboxes=...).

  • Added the temporalio.contrib.gcp.cloud_run.id module with the CloudRunIdPlugin client plugin to set the worker identity on Cloud Run.

Changed

  • The deepagents extra now requires deepagents>=0.7,<0.8 (was <0.7). Because deepagents 0.7 requires langsmith>=0.10.9, the langsmith extra now allows langsmith<0.13 (was <0.9).

💥 Breaking Changes

  • The google-adk extra now requires google-adk>=2.8.0,<3, up from >=2.2.0.
  • temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from the workflow's deterministic random stream. A workflow started under an earlier release that calls workflow.random() or workflow.uuid4() after ADK code may not replay deterministically across the upgrade; drain such workflows or use worker versioning.

Fixed

  • temporalio.contrib.deepagents now preserves model binding options such as response_format and tool_choice when tools are also bound.

  • Workflow handles returned when a start attaches to a running workflow now use the server-provided first execution run ID with Temporal Server 1.32.0 or later.

  • Restore frozenset values when decoding JSON payloads with a frozenset type hint, including nested frozen sets.

  • Ordinary absolute imports of already-loaded modules in sandboxed workflows no longer go through

... (truncated)

Changelog

Sourced from temporalio's changelog.

[1.34.0] - 2026-09-30

Added

  • Added WorkflowAlreadyStartedError.first_run_id for the first execution run ID when provided by the server.

  • Experimental: temporalio.contrib.google_adk_agents now supports ADK v2 graph workflows, dynamic @node workflows, and durable HITL.

  • Experimental: Experimental support for Event Groups. Event Groups is a new form of Workflow-level metadata that allows for improved visibility into a Workflow execution's history by grouping logically related Events together based on user-defined or system-inferred criteria. workflow.create_event_group(...) takes the Event Group's ID as its first and only required argument; the user-provided ID is used verbatim and should not contain sensitive information. The label is optional and passed as a keyword argument; it is a codec-encoded Payload.

  • Added workflow.Info.original_execution_run_id, the run ID recorded on the workflow execution started event. Unlike run_id, this value is preserved across workflow resets.

  • Experimental: temporalio.contrib.strands now supports durable, Workflow-isolated Strands sandboxes through TemporalSandbox and worker-side factories registered with StrandsPlugin(sandboxes=...).

  • Added the temporalio.contrib.gcp.cloud_run.id module with the CloudRunIdPlugin client plugin to set the worker identity on Cloud Run.

Changed

  • The deepagents extra now requires deepagents>=0.7,<0.8 (was <0.7). Because deepagents 0.7 requires langsmith>=0.10.9, the langsmith extra now allows langsmith<0.13 (was <0.9).

💥 Breaking Changes

  • The google-adk extra now requires google-adk>=2.8.0,<3, up from >=2.2.0.
  • temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from the workflow's deterministic random stream. A workflow started under an earlier release that calls workflow.random() or workflow.uuid4() after ADK code may not replay deterministically across the upgrade; drain such workflows or use worker versioning.

Fixed

  • temporalio.contrib.deepagents now preserves model binding options such as response_format and tool_choice when tools are also bound.

  • Workflow handles returned when a start attaches to a running workflow now use the server-provided first execution run ID with Temporal Server 1.32.0 or later.

  • Restore frozenset values when decoding JSON payloads with a frozenset type hint, including nested frozen sets.

  • Ordinary absolute imports of already-loaded modules in sandboxed workflows no longer go through importlib's module locks, fixing intermittent Failed validating workflow errors on Python 3.10

... (truncated)

Commits

Updates fsspec from 2026.7.0 to 2026.9.0

Commits
  • 0f76baa changelog (#2166)
  • 695f831 Add age-based cleanup for simplecache (#2118)
  • 42aa468 Mirror readinto from the pyarrow stream onto ArrowFile (#2111)
  • 4a4e6ae Make the SFTP host key policy configurable (#2126)
  • a0ce6db Normalize paths in AsyncFileSystemWrapper like the wrapped filesystem (#2159)
  • c5fea6d Fix cat_ranges on whole-file caches after #2154 (#2163)
  • 9efb18b Patch HAS_CPYTHON_API where _fast_slice reads it (#2164)
  • 27bcd35 feat(AdaptiveReadaheadCache): introducing a new cache-type adaptive (#2093)
  • a681aca Ignore a leading slash in TarFileSystem paths (#2148)
  • 57c55f8 Make names relative in DirFileSystem.walk(detail=True) (#2160)
  • Additional commits viewable in compare view

Updates numpy from 2.5.2 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and ...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 14, 2026
@dependabot dependabot Bot changed the title chore(deps): Bump the python-minor-patch group in /backend with 15 updates chore(deps): Bump the python-minor-patch group across 1 directory with 15 updates Oct 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/backend/python-minor-patch-513e0fcdbb branch from e8c5db3 to 1308b9c Compare October 14, 2026 02:21
@dependabot
chore(deps): Bump the python-minor-patch group across 1 directory wit…
987a1b4 
…h 15 updates

Bumps the python-minor-patch group with 15 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.143.0` |
| [asyncpg](https://github.com/MagicStack/asyncpg) | `0.31.0` | `0.32.0` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.19.1` | `1.20.0` |
| [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.2.0` | `1.2.3` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.14.0` |
| duar-auth | `1.4.1` | `1.4.3` |
| [rdkit](https://github.com/rdkit/rdkit) | `2026.3.5` | `2026.9.1` |
| [temporalio](https://github.com/temporalio/sdk-python) | `1.32.0` | `1.34.0` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.7.0` | `2026.9.0` |
| [numpy](https://github.com/numpy/numpy) | `2.5.2` | `2.5.4` |
| [pandas](https://github.com/pandas-dev/pandas) | `3.0.5` | `3.0.6` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.17.0` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |
| [import-linter](https://github.com/seddonym/import-linter) | `2.13` | `2.15` |



Updates `fastapi` from 0.141.1 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.143.0)

Updates `asyncpg` from 0.31.0 to 0.32.0
- [Release notes](https://github.com/MagicStack/asyncpg/releases)
- [Commits](MagicStack/asyncpg@v0.31.0...v0.32.0)

Updates `alembic` from 1.19.1 to 1.20.0
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `pymysql` from 1.2.0 to 1.2.3
- [Release notes](https://github.com/PyMySQL/PyMySQL/releases)
- [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md)
- [Commits](PyMySQL/PyMySQL@v1.2.0...v1.2.3)

Updates `pydantic` from 2.13.4 to 2.14.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.14.0)

Updates `duar-auth` from 1.4.1 to 1.4.3

Updates `rdkit` from 2026.3.5 to 2026.9.1
- [Release notes](https://github.com/rdkit/rdkit/releases)
- [Changelog](https://github.com/rdkit/rdkit/blob/master/ReleaseNotes.md)
- [Commits](https://github.com/rdkit/rdkit/commits)

Updates `temporalio` from 1.32.0 to 1.34.0
- [Release notes](https://github.com/temporalio/sdk-python/releases)
- [Changelog](https://github.com/temporalio/sdk-python/blob/main/CHANGELOG.md)
- [Commits](temporalio/sdk-python@1.32.0...1.34.0)

Updates `fsspec` from 2026.7.0 to 2026.9.0
- [Commits](fsspec/filesystem_spec@2026.7.0...2026.9.0)

Updates `numpy` from 2.5.2 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.2...v2.5.4)

Updates `pandas` from 3.0.5 to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.5...v3.0.6)

Updates `matplotlib` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.1...v3.11.2)

Updates `ruff` from 0.16.4 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.17.0)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `import-linter` from 2.13 to 2.15
- [Changelog](https://github.com/seddonym/import-linter/blob/main/docs/release_notes.md)
- [Commits](seddonym/import-linter@v2.13...v2.15)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: asyncpg
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: duar-auth
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: fsspec
  dependency-version: 2026.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: import-linter
  dependency-version: '2.15'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pymysql
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: rdkit
  dependency-version: 2026.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: temporalio
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/backend/python-minor-patch-513e0fcdbb branch from 1308b9c to 987a1b4 Compare October 14, 2026 15:11
@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/backend/python-minor-patch-513e0fcdbb branch October 19, 2026 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants