chore(deps): bump the all-dependencies group in /autobot-backend with 33 updates

[dependabot]

Updates the requirements on apscheduler, croniter, fastapi, uvicorn, pydantic, email-validator, sqlalchemy, reportlab, openai, anthropic, boto3, protobuf, sentence-transformers, opencv-python-headless, tree-sitter-python, asyncssh, faiss-cpu, structlog, llama-index-core, langchain, langchain-core, langchain-community, langgraph, mcp, praw, pywebpush, spacy, scikit-learn, bleach, beautifulsoup4, pillow, redis and pandas to permit the latest version.
Updates apscheduler to 3.11.2

Release notes

Sourced from apscheduler's releases.

3.11.2

• Fixed an issue where a job using a CronTrigger scheduled in a repeated time interval during DST transitions could cause the scheduler to get stuck in an infinite loop (#1021; PR by @​soulofakuma)

Commits

• 0f70950 Added the release version
• bc404e6 Updated publish actions
• c3aa155 Updated pre-commit modules
• ad6b2dc Added fix for get_next_fire_time not advancing through fold with unfolded pre...
• f4df139 Added the release version
• 25be7b7 Fixed CronTrigger getting stuck on fallback DST transition (#1079)
• 1261386 Updated etcd image repository name
• b1f5636 Fixed shutdown() not raising the correct exception for some schedulers
• 6c72a51 Backported release job from master
• 4b96510 Added the release version
• Additional commits viewable in compare view

Updates croniter to 6.2.2

Changelog

Sourced from croniter's changelog.

6.2.2 (2026-03-15)

Packaging

- Switch build backend from ``flit_core`` to ``hatchling`` with pinned dependencies. [4cce160]
- Add PEP 639 license expression (``license = "MIT"``) to project metadata. [4cce160]
- Pin all GitHub Actions to SHA hashes across CI workflows. [4cce160]
- Add dependabot for automated dependency updates. [4cce160]
- Add zizmor workflow for CI security scanning. [4cce160]
6.2.1 (2026-03-15)
Bugfixes
- Fix ``get_prev`` skipping Feb 29 on leap years for day-of-month expressions. [441a0b5, [#203](https://github.com/pallets-eco/croniter/issues/203), @Souls-R]
Packaging

</code></pre>

<ul>

<li>Add <code>License :: OSI Approved :: MIT License</code> classifier. [270cbbc, <a href="/cdheiser"><code>@​cdheiser</code></a>]</li>

</ul>

<h2>6.2.0 (2026-03-14)</h2>

<p>Features and Improvements</p>

<pre><code>- Add support for W (nearest weekday) in the day-of-month field. [c79d88a]

Add precision_in_seconds parameter to match() and match_range() to allow overriding the default matching precision. [7415d1e, #58]
Add strict parameter to is_valid() and expand() for cross-field validation of impossible day/month combinations. [0352d48, #199]

Bugfixes



Fix memory leak by removing EXPRESSIONS global dict cache. [6ebfe56, @​Souls-R]

Testing and Documentation

• Document day_or and implement_cron_bug parameters for day-of-month/day-of-week interaction. [289bf73, #75]
• Document precision_in_seconds parameter and default precision behavior for match(). [7415d1e, #58]

6.1.0 (2026-03-14)

Features and Improvements

- Support for `zoneinfo` timezones. [b4e7295, Benjamin Drung (@bdrung)]
- Add type hints to `croniter.__init__`, `timestamp_to_datetime`, and property initializations. [b171ea9, 257741e, c4f5e44, Benjamin Drung (@bdrung)]
</tr></table> 

... (truncated)

Commits

• f453fa2 Prepare for release 6.2.2
• 4cce160 Switch to hatchling, add PEP 639 license, pin actions, add dependabot and zizmor
• 06f89da Prepare for 6.2.2 development
• c37bfb9 Prepare for release 6.2.1
• 441a0b5 fix: use _last_day_of_month in get_prev to handle leap year Feb 29 (#204)
• 270cbbc Add License :: OSI Approved :: MIT License classifier (#205)
• dc1d952 Prepare for 6.2.1 development
• 12d25c2 Prepare for release 6.2.0
• 7415d1e Add precision_in_seconds parameter to match and match_range (#58) (#202)
• 289bf73 Add docs for day-of-month/day-of-week interaction and implement_cron_bug (#75...
• Additional commits viewable in compare view

Updates fastapi to 0.138.0

Release notes

Sourced from fastapi's releases.

0.138.0

Features

• ✨ Add support for app.frontend("/", directory="dist") and router.frontend("/", directory="dist"). PR #15800 by @​tiangolo.
  • Read the docs: Frontend.

Docs

• 📝 Fix typo in release notes. PR #15807 by @​tiangolo.
• 📝 Add app.frontend() instructions to Agent Library Skill. PR #15805 by @​tiangolo.
• 📝 Update release notes link. PR #15802 by @​tiangolo.
• ✏️ Update white space characters in bigger apps. PR #15801 by @​tiangolo.
• ✏️ Fix grammar, typos, and broken links in docs. PR #15694 by @​YuriiMotov.

Translations

• 🌐 Enable Hindi docs translations. PR #15554 by @​YuriiMotov.

Internal

• 🐛 Fix failing test, update format for raised errors. PR #15804 by @​tiangolo.
• 👷 Fix test-alls-green. PR #15803 by @​tiangolo.
• 🔧 Enable checking release-notes.md for typos. PR #15796 by @​YuriiMotov.
• 📝 Tweak wording about deploying to FastAPI Cloud. PR #15793 by @​tiangolo.
• 🔨 Use gpt-5.5 model in translate.py, specify -chat to avoid warnings. PR #15792 by @​YuriiMotov.

Commits

• 4b83b0d 🔖 Release version 0.138.0 (#15808)
• 041cb0c 📝 Update release notes
• 1039384 📝 Fix typo in release notes (#15807)
• 0303491 📝 Update release notes
• 190f6e2 📝 Add Frontend instructions to Agent Library Skill (#15805)
• 17945e5 📝 Update release notes
• 2260afa 🐛 Fix failing test, update format for raised errors (#15804)
• 0cd5001 📝 Update release notes
• 7cb1ab6 👷 Fix test-alls-green (#15803)
• 9c7eceb 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn to 0.49.0

Release notes

Sourced from uvicorn's releases.

Version 0.49.0

What's Changed

• Bump httptools minimum version to 0.8.0 by @​Kludex in Kludex/uvicorn#2962
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by @​Kludex in Kludex/uvicorn#2971

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Changelog

Sourced from uvicorn's changelog.

0.49.0 (June 3, 2026)

Changed

• Bump httptools minimum version to 0.8.0 (#2962)
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

Changed

• Default ssl_ciphers to None and use OpenSSL defaults (#2940)

Fixed

• Ignore duplicate forwarding headers in ProxyHeadersMiddleware (#2944)

0.47.0 (May 14, 2026)

Added

• Add ssl_context_factory for custom SSLContext configuration (#2920)

Changed

• Eagerly import the ASGI app in the parent process (#2919)

Fixed

• Treat fd=0 as a valid file descriptor with reload/workers (#2927)

0.46.0 (April 23, 2026)

Added

• Support ws_max_size in wsproto implementation (#2915)
• Support ws_ping_interval and ws_ping_timeout in wsproto implementation (#2916)

Changed

• Use bytearray for incoming WebSocket message buffer in websockets-sansio (#2917)

0.45.0 (April 21, 2026)

Added

• Add --reset-contextvars flag to isolate ASGI request context (#2912)
• Accept os.PathLike for log_config (#2905)
• Accept log_level strings case-insensitively (#2907)

... (truncated)

Commits

• 3ef2e3e Version 0.49.0 (#2973)
• eeb64b1 Consume duplicate forwarding headers in ProxyHeadersMiddleware (#2971)
• 630f4ac Make the watchfiles reload tests deterministic (#2972)
• 9154922 chore(deps): bump the github-actions group across 1 directory with 6 updates ...
• 739727a Migrate docs deploy from Cloudflare Pages to Workers (#2967)
• be4a240 Gate docs preview deploy on Cloudflare token presence (#2966)
• c489d7e Bump httptools minimum version to 0.8.0 (#2962)
• 9f547bd Skip docs preview deploy for Dependabot PRs (#2961)
• 44446b8 Migrate documentation from MkDocs Material to Zensical (#2959)
• cfd659c Bump pymdown-extensions to 10.21.3 (#2958)
• Additional commits viewable in compare view

Updates pydantic to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #13079

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• Additional commits viewable in compare view

Updates email-validator to 2.3.0

Release notes

Sourced from email-validator's releases.

v2.3.0

• The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
• The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
• New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
• When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
• TypeError is now raised if something other than str (or bytes) is passed as the email address.

Changelog

Sourced from email-validator's changelog.

2.3.0 (August 26, 2025)

• The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
• The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
• New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
• When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
• TypeError is now raised if something other than str (or bytes) is passed as the email address.

2.2.0 (June 20, 2024)

• Email addresses with internationalized local parts could, with rare Unicode characters, be returned as valid but actually be invalid in their normalized form (returned in the normalized field). In particular, it is possible to get a normalized address with a ";" character, which is not valid and could change the interpretation of the address. Local parts now re-validated after Unicode NFC normalization to ensure that invalid characters cannot be injected into the normalized address and that characters with length-increasing NFC normalizations cannot cause a local part to exceed the maximum length after normalization. Thanks to khanh@calif.io from https://calif.io for reporting the issue.
• The length check for email addresses with internationalized local parts is now also applied to the original address string prior to Unicode NFC normalization, which may be longer and could exceed the maximum email address length, to protect callers who do not use the returned normalized address.
• Improved error message for IDNA domains that are too long or have invalid characters after Unicode normalization.
• A new option to parse My Name <address@domain> strings, i.e. a display name plus an email address in angle brackets, is now available. It is off by default.
• Improvements to Python typing.
• Some additional tests added.

2.1.2 (June 16, 2024)

• The domain name length limit is corrected from 255 to 253 IDNA ASCII characters. I misread the RFCs.
• When a domain name has no MX record but does have an A or AAAA record, if none of the IP addresses in the response are globally reachable (i.e. not Private-Use, Loopback, etc.), the response is treated as if there was no A/AAAA response and the email address will fail the deliverability check.
• When a domain name has no MX record but does have an A or AAAA record, the mx field in the object returned by validate_email incorrectly held the IP addresses rather than the domain itself.
• Fixes in tests.

2.1.1 (February 26, 2024)

• Fixed typo 'marking' instead of 'marketing' in case-insensitive mailbox name list.
• When DNS-based deliverability checks fail, in some cases exceptions are now thrown with raise ... from for better nested exception tracking.
• Fixed tests to work when no local resolver can be configured.
• This project is now licensed under the Unlicense (instead of CC0).
• Minor improvements to tests.
• Minor improvements to code style.

2.1.0 (October 22, 2023)

• Python 3.8+ is now required (support for Python 3.7 was dropped).
• The old email field on the returned ValidatedEmail object, which in the previous version was superseded by normalized, will now raise a deprecation warning if used. See https://stackoverflow.com/q/879173 for strategies to suppress the DeprecationWarning.
• A __version__ module attribute is added.
• The email address argument to validate_email is now marked as positional-only to better reflect the documented usage using the new Python 3.8 feature.

2.0.0 (April 15, 2023)

This is a major update to the library, but since email address specs haven't changed there should be no significant changes to which email addresses are considered valid or invalid with default options. There are new options for accepting unusual email addresses that were previously always rejected, some changes to how DNS errors are handled, many changes in error message text, and major internal improvements including the addition of type annotations. Python 3.7+ is now required. Details follow:

... (truncated)

Commits

• 030a63a Version 2.3.0
• e943a0f Raise TypeError when an invalid argument is passed for email, closes #155
• f90d256 Remove local part length check unless new strict flag is given, fixes #158
• 98800ba Add explicit checks for internationalized domain name characters invalid unde...
• 936aead Fix final syntax checks on normalized internationalized domains checking the ...
• 8043de4 NFC-normalize display names per UTS #39
• bc08faa Add one-off error messages for full-width-at and small-commercial-at which ar...
• a1c90ab Split exceptions_types.py into exceptions.py and types.py
• dbcf07c Change package name from using underscore to dash to match PyPi normalized pa...
• 7c22208 Support ALLOW_DISPLAY_NAME and ALLOW_EMPTY_LOCAL in the CLI (#145)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates reportlab to 5.0.0

Updates openai to 2.43.0

Release notes

Sourced from openai's releases.

v2.43.0

2.43.0 (2026-06-17)

Full Changelog: v2.42.0...v2.43.0

Features

• api: update OpenAPI spec or Stainless config (2254235)

Changelog

Sourced from openai's changelog.

2.43.0 (2026-06-17)

Full Changelog: v2.42.0...v2.43.0

Features

• api: update OpenAPI spec or Stainless config (2254235)

2.42.0 (2026-06-16)

Full Changelog: v2.41.1...v2.42.0

Features

• api: admin spend_alerts (6134198)
• api: manual updates (f337bf4)
• api: update OpenAPI spec or Stainless config (7015158)

Build System

• fix release workflow permissions (#3389) (a526ee8)
• Use CI environment for examples API key (#3394) (d64d811)

2.41.1 (2026-06-05)

Full Changelog: v2.41.0...v2.41.1

Build System

• Remove scheduled release workflow trigger (#3366) (2a91011)

2.41.0 (2026-06-03)

Full Changelog: v2.40.0...v2.41.0

Features

• api: responses.moderation and chat_completions.moderation (87e46c2)

2.40.0 (2026-06-01)

Full Changelog: v2.39.0...v2.40.0

Features

• api: Add Amazon Bedrock Responses support

Bug Fixes

• api: allow setting bedrock api keys on the client directly (4d5bfde)

... (truncated)

Commits

• e20b6b8 release: 2.43.0
• 4d35453 feat(api): update OpenAPI spec or Stainless config
• 2bba15e release: 2.42.0
• 1ec3e82 codegen metadata
• 93c2eca feat(api): manual updates
• b269f88 codegen metadata
• ee821d6 feat(api): admin spend_alerts
• 60002e5 feat(api): update OpenAPI spec or Stainless config
• d64d811 build: Use CI environment for examples API key (#3394)
• a526ee8 build: fix release workflow permissions (#3389)
• Additional commits viewable in compare view

Updates anthropic to 0.111.0

Release notes

Sourced from anthropic's releases.

v0.111.0

0.111.0 (2026-06-18)

Full Changelog: v0.110.0...v0.111.0

Features

• helpers: tag refusal-fallback middleware requests with fallback-refusal-middleware (#96) (2f8ac78)

Changelog

Sourced from anthropic's changelog.

0.111.0 (2026-06-18)

Full Changelog: v0.110.0...v0.111.0

Features

• helpers: tag refusal-fallback middleware requests with fallback-refusal-middleware (#96) (2f8ac78)

0.110.0 (2026-06-18)

Full Changelog: v0.109.2...v0.110.0

Features

• api: add support for new code_execution_20260120 tool (5e23212)

Bug Fixes

• append x-stainless-helper across header merges instead of clobbering (#105) (922558e)
• bedrock: preserve stream event type (#1682) (b27e343)
• helpers: single source of truth for x-stainless-helper key + closed value vocabulary (#95) (e6f7a56)

0.109.2 (2026-06-15)

Full Changelog: v0.109.1...v0.109.2

Chores

• api: remove retired models from API and SDKs (d4bcfcc)

0.109.1 (2026-06-09)

Full Changelog: v0.109.0...v0.109.1

Bug Fixes

• api: add frontier_llm refusal category (d3a806b)

0.109.0 (2026-06-09)

Full Changelog: v0.108.0...v0.109.0

Features

• api: add support for Managed Agents deployments and environment variable credentials (47633bf)

0.108.0 (2026-06-09)

Full Changelog: v0.107.1...v0.108.0

... (truncated)

Commits

• 5d6fd8d release: 0.111.0
• 9fdf2ef feat(helpers): tag refusal-fallback middleware requests with fallback-refusal...
• af2b702 release: 0.110.0
• a10dbaa feat(api): add support for new code_execution_20260120 tool
• 9d49b63 fix(helpers): single source of truth for x-stainless-helper key + closed valu...
• e8a5c84 fix: append x-stainless-helper across header merges instead of clobbering (#105)
• ed0af5b fix(bedrock): preserve stream event type (#1682)
• ebb1715 release: 0.109.2
• 37a7d36 chore(api): remove retired models from API and SDKs
• 992f11c release: 0.109.1
• Additional commits viewable in compare view

Updates boto3 to 1.43.34

Commits

• 1820b7d Merge branch 'release-1.43.34'
• 2178e7a Bumping version to 1.43.34
• 797f30d Add changelog entries from botocore
• 325a059 Remove DocumentModifiedShape and re-export it from botocore (#4795)
• 44bfb9a Merge branch 'release-1.43.33'
• 447ab8f Merge branch 'release-1.43.33' into develop
• 1a41f9c Bumping version to 1.43.33
• 3a2819d Add changelog entries from botocore
• 22ffece Bump https://github.com/astral-sh/ruff-pre-commit (#4802)
• 19645b7 Merge branch 'release-1.43.32'
• Additional commits viewable in compare view

Updates protobuf to 7.35.1

Commits

• See full diff in compare view

Updates sentence-transformers to 5.6.0

Release notes

Sourced from sentence-transformers's releases.

v5.6.0 - Fixes for Causal LM Rerankers, Hard-Negative Mining, and More

This minor version is a correctness- and robustness-focused release. It fixes a silent scoring bug for causal-LM rerankers, corrects several hard-negative mining and GIST loss edge cases, restores TSDAE on transformers v5, and adds Apple Silicon (MPS) support for the cached losses.

The headline fix affects chat-template models that read the final token position, i.e. causal-LM rerankers (like Qwen3-Reranker) and last-token-pooling embedders: when an over-long input was truncated, the chat template's trailing suffix (e.g. the assistant prefill the model scores from) was silently dropped, producing wrong scores with no error. There's also a forward-looking deprecation: loading local custom code without trust_remote_code=True now warns, and will require it from v6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.0
Inference only, use one of:
pip install sentence-transformers==5.6.0
pip install sentence-transformers[onnx-gpu]==5.6.0
pip install sentence-transformers[onnx]==5.6.0
pip install sentence-transformers[openvino]==5.6.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.0
pip install sentence-transformers[audio]==5.6.0
pip install sentence-transformers[video]==5.6.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.0

Fixed silently wrong scores when truncation drops chat-template suffixes (#3787)

Chat-template models render the full conversation to a flat string before tokenizing, so when the rendered input is longer than the tokenizer's model_max_length, the tokenizer truncates it from the right and drops the template's trailing suffix: the fixed tokens a template appends after the content, e.g. a prompt, instruction, [/INST], or a trailing EOS. For models that read the final token position, this silently corrupted the result:

• causal-LM rerankers (e.g. Qwen/Qwen3-Reranker-0.6B) score a pair from the last token's yes/no logits, and
• last-token-pooling embedders read the final hidden state.

When the suffix was truncated away, that final position landed mid-document instead of after the prefill, so the score or embedding came from the wrong place.

Transformer.preprocess now detects when truncation drops the suffix and splices it back onto the tail of each truncated row. Because the fix lives in the shared base Transformer, it applies across SentenceTransformer, CrossEncoder, and SparseEncoder. It's enabled by default and saved to the model configuration. Pass processing_kwargs={"chat_template": {"restore_suffix": False}} to opt back into raw truncation.

Hard-negative mining and GIST loss correctness (#3821, #3817, #3816)

A trio of correctness and scalability fixes for hard-negative mining and the GIST losses:

• Sign-independent relative margin: mine_hard_negatives(relative_margin=...) and the margin_strategy="relative" branch of GISTEmbedLoss / CachedGISTEmbedLoss used a multiplicative threshold (positive * (1 - margin)) that only behaves correctly when the positive-pair similarity is positive. When that similarity was negative, the threshold moved the wrong way and let through false negatives: candidates more similar to the anchor than the true positive. The threshold is now positive - |positive| * margin, identical to before for positive scores but correct for negative ones.
• Distributed positive masking in the GIST losses: with gather_across_devices=True and a non-zero margin, the false-negative suppression mask protected the wrong columns on ranks beyond the first (it ignored the per-rank offset into the gathered batch), which set the true positive's logit to -inf and produced a +inf loss. The mask now accounts for the cross-rank offset, so multi-GPU GIST training stays finite.
• Memory-bounded mining without FAISS: mine_hard_negatives(use_faiss=False) (the default) materialized the full (queries × corpus) similarity matrix at once, which could OOM on large corpora. It now batches over the query axis (controlled by faiss_batch_size, default 16384), bounding peak memory while producing identical results.

TSDAE weight tying restored on transformers v5 (#3781)

transformers v5 removed the private PreTrainedModel._tie_encoder_decoder_weights helper that DenoisingAutoEncoderLoss (TSDAE) used to tie its separate encoder and decoder. As a stopgap, v5.5 raised a RuntimeError for the default tie_encoder_decoder=True on transformers >= 5.0.0, effectively breaking TSDAE there unless you pinned an older transformers or disabled tying. TSDAE now ships its own tying routine that shares storage between encoder and decoder, so it works on both transformers <5 and >=5 with the default settings.

Deprecation: loading local custom code without trust_remote_code (#3807)

... (truncated)

Commits

• 9c73df3 Release v5.6.0
• 222b052 [fix] Don't override device_map placement with the device argument (#3823)
• a38a6bf Fix causal LM reranker scoring when max_length truncates chat-template suffix...
• 1812103 [fix] Make relative margin sign-independent in mining and GIST losses (#3821)
• ae1acc3 Warn when loading local custom code without trust_remote_code (#3807)
• 429cf5d [fix] Support MPS in the cached losses' RandContext (#3812)
• 77fdbff [fix] fix MPS errors (#3818)
• bfba988 [fix] Fix positive masking in GIST losses with multi-GPU + gather_across_devi...
• 29e382b [docs] Fix doc build problems (part 1) (#3811)
• d16e6bf [fix] Avoid materializing the full similarity matrix in mine_hard_negatives w...
• Additional commits viewable in compare view

Updates opencv-python-headless to 4.13.0.92

Release notes

Sourced from opencv-python-headless's releases.

4.13.0.92

Follow up release for 4.13.0 with X server dependency fix. See #28438 for details.

Commits

• See full diff in compare view

Updates tree-sitter-python to 0.25.0

Release notes

Sourced from tree-sitter-python's releases.

v0.25.0

NOTE: Download tree-sitter-python.tar.gz for the complete source code.

Commits

• 293fdc0 0.25.0
• 34a91a2 chore: generate
• 8ad8a51 ci: update failing files
• a0b84ed test: update tests
• 1b1ca93 fix: give a higher lexical precedence to the * in except*
• a4c106f feat: allow multiple exception expressions without parenthesis
• 29e3bc2 refactor!: simplify exceptions
• d8f9e69 feat: add PEP 750 template string support
• 7ff26da feat: simplify try statement by accepting missing else/except/finally blocks
• afdba00 build: updat...

  Description has been truncated

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[mrveiss]

Holding: this 33-package group breaks the required smoke-test gate — the major bumps (langchain 1.x is the known blocker tracked in #10386, plus pydantic/sqlalchemy/fastapi majors) need per-package migration, not a force-merge. Safe floors are already at latest (#10403 merged). Will revisit once #10386 unblocks langchain; Dependabot keeps this branch current meanwhile.