build(deps): bump the all-dependencies group across 1 directory with 10 updates

[dependabot]

Updates the requirements on python-dotenv, openai, boto3, sentence-transformers, xxhash, langchain-core, ddgs, fakeredis, tiktoken and python-json-logger to permit the latest version.
Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates openai from 2.53.0 to 3.2.0

Release notes

Sourced from openai's releases.

v3.2.0

3.2.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#3623) (86267d2)
• api: Add shell call streaming events and new service/image types (#3635) (ff14a33)

v3.1.0

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

v3.0.0

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

v2.54.0

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

... (truncated)

Changelog

Sourced from openai's changelog.

3.2.0 (2026-08-17)

Features

• add Bedrock Runtime endpoint support (SDK-290) (#3623) (86267d2)
• api: Add shell call streaming events and new service/image types (#3635) (ff14a33)

3.1.0 (2026-08-14)

Features

• api: add WebSocket stream IDs (#3612) (d9029e3)
• api: add workload identity access token issued event (#3601) (df274d4)
• api: deprecate Sora video APIs (#3610) (721cb1c)
• api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

• remove Stainless attribution and infrastructure (#3599) (a1eeab5)

3.0.0 (2026-08-12)

⚠ BREAKING CHANGES

• api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

• api: migrate to HTTPX2 (#3594)

2.54.0 (2026-08-11)

Features

• api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

• api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

• api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

Commits

• 3e8301c release: 3.2.0 (#3638)
• bccad58 feat(auth): add X.509 workload identity federation for HTTP (#3622)
• 86267d2 feat: add Bedrock Runtime endpoint support (SDK-290) (#3623)
• ff14a33 feat(api): Add shell call streaming events and new service/image types (#3635)
• 10ee3f0 release: 3.1.0 (#3600)
• f38355e feat(api): Ultrafast tier, structured MCP and websocket errors, separate webs...
• d9029e3 feat(api): add WebSocket stream IDs (#3612)
• 721cb1c feat(api): deprecate Sora video APIs (#3610)
• df274d4 feat(api): add workload identity access token issued event (#3601)
• 5578d39 ci: fix CodeQL permissions for private repositories (#3606)
• Additional commits viewable in compare view

Updates boto3 to 1.43.73

Commits

• 97c19e9 Merge branch 'release-1.43.73'
• a08d771 Bumping version to 1.43.73
• 0cdfdc2 Add changelog entries from botocore
• a3fc41f Merge branch 'release-1.43.72'
• 2ec791c Merge branch 'release-1.43.72' into develop
• 27a2636 Bumping version to 1.43.72
• 33a1671 Add changelog entries from botocore
• f1ea765 Merge branch 'release-1.43.71' into develop
• See full diff in compare view

Updates sentence-transformers from 5.7.0 to 6.0.0

Release notes

Sourced from sentence-transformers's releases.

v6.0.0 - MultiVectorEncoder for ColBERT & late interaction models, transformers v5, float32 scoring, faster training & encoding

This major release introduces Multi-Vector Embedding models, also known as late interaction or ColBERT-style models, as a fourth model type alongside SentenceTransformer, CrossEncoder, and SparseEncoder. Going forward, you'll be able to use Sentence Transformers for training, inferencing, and interpreting Multi-Vector Embedding models.

It also modernizes the dependency floors to transformers v5, fixes a class of silent scoring bugs caused by half precision, and speeds up both training and encoding.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.0.0
Inference only, use one of:
pip install sentence-transformers==6.0.0
pip install sentence-transformers[onnx-gpu]==6.0.0
pip install sentence-transformers[onnx]==6.0.0
pip install sentence-transformers[openvino]==6.0.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.0.0
pip install sentence-transformers[audio]==6.0.0
pip install sentence-transformers[video]==6.0.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.0.0

[!TIP] Our Multi-Vector (Late Interaction) Embedding Models with Sentence Transformers blogpost is an excellent place to learn about multi-vector models: loading the various checkpoint formats, encoding and scoring, plugging them into a search stack, running them on page images, and keeping the index affordable.

[!WARNING] This is a major release with breaking changes. Upgrading from v5.x to v6.0 may require code updates. The changes marked 🚨 below are the ones most likely to affect you, and the Migration Guide has the full list. If you run into issues when upgrading, feel free to open an issue.

MultiVectorEncoder: ColBERT-style late interaction models (#3794)

Sentence Transformers v6.0 introduces MultiVectorEncoder, for ColBERT-style late interaction retrieval. Where a regular embedding model compresses a whole text into one vector, a multi-vector model keeps one vector per token and scores query against document with the MaxSim operator. That preserves token-level matching information that a single vector has to average away, which usually means stronger retrieval at the cost of a bigger index. It is also the state of the art for visual document retrieval, where a text query is matched against page images directly, with no OCR step in between.

Any PyLate checkpoint and any Stanford-NLP ColBERT checkpoint loads straight into it, and colpali-engine models for visual document retrieval work too, through the same familiar API you already use for dense, sparse, and reranker models.

from sentence_transformers import MultiVectorEncoder
Download from the 🤗 Hub
model = MultiVectorEncoder("lightonai/LateOn")
query_embeddings = model.encode_query(["Which planet is known as the Red Planet?"])
document_embeddings = model.encode_document([
"Venus is often called Earth's twin because of its similar size and proximity.",
"Mars, known for its reddish appearance, is often referred to as the Red Planet.",
"Jupiter, the largest planet in our solar system, has a prominent red spot.",
"Saturn, famous for its rings, is sometimes mistaken for the Red Planet.",
</tr></table>

... (truncated)

Commits

• 56c9548 [docs] Remove revision from EVIE now that it's integrated (#3951)
• aa791eb Release v6.0.0
• 8b332d1 tests: Fix the pretrained MultiVectorEncoder tests for device tensors and Hub...
• a03cfd6 docs: Point cross-references at their documented targets (#3947)
• 310ed7b docs: Rank the pretrained MultiVectorEncoder models by NanoBEIR and NanoViDoR...
• 345c538 Speed up multi-vector padding and numpy to tensor conversion (#3942)
• 8d62fa2 [v6] Return tensors on the model device from MultiVectorEncoder encoding (#...
• 8a73e35 [v6] Keep the prompt-excluded mask out of the feature dicts (#3944)
• c8d2c0c [v6] Extend the merged column forward to the SentenceTransformer losses (#3...
• adc09fc [v6] Fix XTR input validation, padding masks, and integer embedding support...
• Additional commits viewable in compare view

Updates xxhash to 4.0.1

Release notes

Sourced from xxhash's releases.

v4.0.1

• Clean up _parse_init_args keyword handling so the defensive check for a duplicate data keyword raises a proper error message
• Add _xxhash module docstring

Full Changelog: ifduyue/python-xxhash@v4.0.0...v4.0.1

Changelog

Sourced from xxhash's changelog.

v4.0.1 2026-08-17

- Clean up ``_parse_init_args`` keyword handling so the defensive check
  for a duplicate ``data`` keyword raises a proper error message
- Add ``_xxhash`` module docstring
v4.0.0 2026-08-12

• Breaking change: Drop support for Python 3.8, require Python >= 3.9
• Breaking change: Remove deprecated xxhash.VERSION_TUPLE
• Breaking change: The input keyword argument is renamed to data in constructors and one-shot functions. update() additionally gains a data keyword argument (it accepted no keyword arguments before).
• Breaking change: str input is no longer accepted and raises TypeError: Strings must be encoded before hashing; encode to bytes before hashing
• Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source builds that target AVX2 (e.g. -march=x86-64-v3), upstream v0.8.3 autovectorizes XXH64_update() and makes the xxh64 streaming path about 2x slower. The shipped wheels are built for baseline x86-64 and are unaffected. Source builds can work around it by adding -fno-tree-vectorize to the compiler flags.
• Add per-object locking for thread safety, with sub-interpreter and free-threaded (no-GIL) Python support. The GIL is now released only while hashing inputs larger than 64 KiB; previously update() released it unconditionally and one-shot functions always held it.
• Speed up hash constructors by switching them to tp_vectorcall.
• Build pyodide wasm32 wheels
• Add s390x big-endian test job
• Add Python 3.15 classifier
• CI: shard the PyPI upload into parallel groups and create the GitHub Release automatically

v3.8.1 2026-07-06

- Register the "benchmark" pytest mark to avoid PytestUnknownMarkWarning
- Update C extension docstrings and remove stale comments
v3.8.0 2026-06-27

• Speed up module-level one-shot digest(), intdigest(), and hexdigest() functions by switching them to METH_FASTCALL.
• Keep one-shot argument handling consistent with hash constructors, including positional and keyword input/seed arguments, duplicate argument

... (truncated)

Commits

• e2c1bcf Release v4.0.1
• 669a69c Clean up _parse_init_args keyword handling
• 4a6136d build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1
• aa26ed6 Bump version to 4.0.1.dev0
• d774e2a Add _xxhash module docstring
• c8d9a0e Clarify changelog: update() keyword and GIL release threshold
• 80d42d2 Mention exact str rejection error in changelog
• befdf3b Update changelog: note str input rejection
• See full diff in compare view

Updates langchain-core to 1.5.6

Release notes

Sourced from langchain-core's releases.

langchain-core==1.5.6

Changes since langchain-core==1.5.5

chore(core): release 1.5.6 (#39704) feat(core): incorporate gateway metadata to traces (#39703)

Commits

• 4033a4e chore(core): release 1.5.6 (#39704)
• 5650448 feat(core): incorporate gateway metadata to traces (#39703)
• 3a122c6 fix: typo (#39684)
• 6e2d4f4 chore(openai): update snapshots (#39657)
• 5327463 chore(model-profiles): refresh model profile data (#39692)
• 313bc54 fix(openai): support o-series models in get_num_tokens_from_messages (#38710)
• 82fd042 chore(model-profiles): refresh model profile data (#39670)
• 9a58107 release(openrouter): 0.2.8 (#39658)
• c197a7b chore(model-profiles): refresh model profile data (#39646)
• 555702e release(core): 1.5.5 (#39655)
• Additional commits viewable in compare view

Updates ddgs to 9.15.0

Release notes

Sourced from ddgs's releases.

v9.15.0

What's Changed

• feat: remove dht by @​deedy5 in deedy5/ddgs#466
• refactor(ddgs): improve extract performance by @​Mizarka in deedy5/ddgs#467
• fix(engines): disable Google, Yandex

Full Changelog: deedy5/ddgs@v9.14.4...v9.15.0

Commits

• 173ccbd chore(release): bump version to 9.15.0
• a770102 feat(mcp): migrate to mcp 2.0
• f4ba66c fix(engines): disable Google, Yandex
• a12929a refactor(ddgs): improve extract performance
• a97a4fc feat: remove dht
• See full diff in compare view

Updates fakeredis to 2.37.1

Release notes

Sourced from fakeredis's releases.

v2.37.1

What's Changed

🐛 Bug Fixes

• fix: honor the FILTER-EF (max filtering effort) option in VSIM — the value was previously parsed but ignored, so a low FILTER-EF could return filter matches that real Redis skips
• fix: ZPOPMIN/ZPOPMAX in RESP3 now return a flat [member, score] pair when no count is given (an array of pairs is only returned when an explicit count is passed), matching real Redis
• fix: ZPOPMIN/ZPOPMAX now reject a negative count with value is out of range, must be positive
• fix: ZPOPMIN/ZPOPMAX/BZPOPMIN/BZPOPMAX/ZMPOP/BZMPOP now delete the sorted set key once its last member is popped
• fix: LTRIM now signals the key as modified even when the trim is a no-op, so a WATCH on that key correctly aborts the following transaction, matching real Redis
• fix: align stream group errors with Redis — XPENDING on a missing key or unknown group now raises NOGROUP instead of returning 0/an empty array, and neither XPENDING nor XINFO GROUPS creates the key as a side effect (#532)

🧰 Maintenance

• perf: VADD/VSIM keep a row-oriented matrix of the vector set resident and reuse it, instead of restacking every stored vector on each call; re-adding an existing member now replaces its row rather than leaving a stale one
• perf: cache compiled JSONPath objects in the JSON stack mixin (#538)
• build: drop Python 3.9, target Python 3.10+ (#534)
• Update to redis-py 8.1
• refactor: modernize typing for Ruff 0.16 defaults (#533)
• test: refactor hypothesis tests

New Contributors

• @​emerardd made their first contribution in cunla/fakeredis-py#532
• @​flowln made their first contribution in cunla/fakeredis-py#538

Full Changelog: cunla/fakeredis-py@v2.37.0...v2.37.1

Commits

• 0f2b05a fix: update changelog with recent fixes and performance improvements
• 1bafdc9 chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#539)
• ce4db1b openspec
• fbb004c openspec
• f62d010 chore:update deps
• 36ff68c docs: ratify project constitution v1.0.0
• 275ebec chore:update deps
• 97e659f Cache JSONPath objects in the JSON stack mixin (#538)
• ecf28cf fix: align stream group errors with Redis (#532)
• 1b5f75f fix: update dependencies and improve test configurations
• Additional commits viewable in compare view

Updates tiktoken from 0.13.0 to 0.14.0

Changelog

Sourced from tiktoken's changelog.

[v0.14.0]

• Build wheels for Python 3.15
• Support looking up more GPT-5 series models
• Upgrade dependencies

Commits

• 4e71bbe Release 0.14.0 (#597)
• 212b893 Fail open for GPT-5 model tokenisers (#596)
• 4187ba3 Upgrade dependencies (#595)
• 92a8255 Remove test-skip comment for macOS arm64 (#562)
• 674f5e6 Build Python 3.15 (#594)
• dbea866 Remove deprecated freethreading build
• f678224 Update cibuildwheel
• 08a5f3b ci: use static artifact name for sdist build job (#535)
• See full diff in compare view

Updates python-json-logger from 4.1.0 to 4.2.0

Release notes

Sourced from python-json-logger's releases.

4.2.0

4.2.0 - 2026-08-15

Changed

• Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict. #66
• Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735). #46

Fixed

• $ style formats now support unbraced $name fields, not just ${name}. #18

Thanks @​gaoflow, @​prateek-dagar, @​Sanjays2402

Changelog

Sourced from python-json-logger's changelog.

4.2.0 - 2026-08-15

Changed

• Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict. #66
• Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735). #46

Fixed

• $ style formats now support unbraced $name fields, not just ${name}. #18

Thanks @​gaoflow, @​prateek-dagar, @​Sanjays2402

Commits

• 806dba9 Release 4.2.0
• 010b730 [core] Fixup doc-strings, remove outdated comments
• b865bd3 [core] support unbraced $name fields in $ style formats (#69)
• 23a2c12 test: Add tests for exception notes, exception groups, and exception note gro...
• 355e44f docs: fix spelling typos in docs and core docstrings (#71)
• 0fcfc06 Move development dependencies to dependency-groups (PEP 735) (#70)
• 2557bbc fix: prevent mutation of original dict when record.msg is a dict (#66)
• 3cc30fc Fix tox build failure under PyPy 3.10 by conditionally pinning mypy<2 (#68)
• 01cb83c [docs.security] Fix type on last date
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.