Skip to content

chore(deps): bump the all-dependencies group across 1 directory with 12 updates - #16598

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/all-dependencies-e5d17f19f0
Closed

chore(deps): bump the all-dependencies group across 1 directory with 12 updates#16598
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/all-dependencies-e5d17f19f0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on vllm, alembic, psycopg2-binary, anthropic, transformers, langchain-core, langsmith, pypdf, weasyprint, boto3, mcp and fakeredis to permit the latest version.
Updates vllm to 0.29.0

Release notes

Sourced from vllm's releases.

v0.29.0

Highlights

This release features 594 commits from 277 contributors (91 new)!

  • Model Runner V2 is now the default for all models (#53183), completing the rollout that began with pooling models (#48290). MRV2 also gained CUDA graph memory profiling for KV cache auto-sizing (#53306), batch-sharded sampling that cuts per-step logits memory by 1/TP (#50465), prompt embeds (#42963), extract_hidden_states speculation (#49811), padded FULL cudagraph dispatch for uniform decode under spec decode (#53407), and DP-sync skipping before EAGLE/MTP draft prefill (#53694). MRV1 remains in use for a few ROCm models and features MRV2 does not yet support.
  • New models: Hy4-preview, Tencent's 770B/49B-active MoE with Gated DeepSeek Sparse Attention and native MTP (#54160); Qwen3.8-Flash-Next with BF16/FP8/NVFP4 and MTP (#53896); GraniteSWA and GraniteMoeSWA (#52706); NemotronH_Omni_Reasoning_V3 with MTP (#52929, #53121); Kimi K3 NVFP4 checkpoints (#53132).
  • Kimi-K3 and DeepSeek V4 performance: fused MXFP4 top-k finalization in the K3 latent tail (about 5% E2E latency, #53152), K3 Mamba metadata preparation in one Triton launch (6.6-7.6x kernel speedup, #52388), tuned Hopper low-latency GEMM (#54088) now also dispatched on SM100 (#53534) and used for eh_proj (12.9-25.2% kernel speedup, #53942), GEMM-RS extended to GEMM-AR (#53053), MLA gate merged into the QKV-A projection (#54015), K3 DCP with DSpark (#52188) and DCP partial prefix cache hits (#50493); DeepSeek V4 shared experts fused into MegaMoE (#53040), adaptive top-k width re-landed (#52823), a native SwiGLU clamp kernel for Humming MoE (#53685), and an opt-in FlashInfer moe_ep expert backend (#49636).
  • Speculative decoding: per-request acceptance stats in OpenAI API responses via --per-request-spec-decode-metrics (#48915), adaptive verification extended to logprobs (#52242), SM100 sparse MLA for GLM-5.2 (#52783) and DeepSeek V4 on SM90 (#52795), Qwen3-Omni DSpark drafts (#52560), PLaMo3 EAGLE-3/DFlash (#54239), and DFlash2 loading from speculators format (#53797).
  • RL weight sync: a new sharded_rdt P2P backend where each worker pulls only its TP/EP slice over NIXL or Ray Direct Transport (#43375), rank-local IPC weight updates (#52497), sparse checkpoint-coordinate updates through native weight loaders (#50723, #53751), and routed expert loading for gpt-oss (#52209).
  • Mamba prefix caching: internal prefill checkpoints deliver a 9%-25% TTFT improvement (#52789); prefix_cache_retention_interval is now a CLI argument defaulting to 0 (#52216), with dense retention automatically restored for hybrid models using EAGLE/MTP (#55760, #55861).
  • New defaults: FlashInfer all-reduce enabled by default for TP CUDA groups, opt out with VLLM_ALLREDUCE_USE_FLASHINFER=0 (#52998); prefix-cache NONE_HASH is deterministic by default so distributed KV cache users no longer need to pin PYTHONHASHSEED (#51875); new --max-num-queued-reqs / --max-num-queued-tokens admission-control flags (#49445).
  • Breaking changes: ten deprecated model architectures removed (#53608); FlexOlmo, Olmo3 and Hunyuan V1/VL migrated to the Transformers modeling backend (#53615); PyAV video decoder backend removed (#54231); python -m vllm.entrypoints.openai.api_server deprecated in favor of vllm serve (#52131); VLLM_TEST_FORCE_FP8_MARLIN (#52182) and VLLM_ROCM_USE_AITER_FP4_ASM_GEMM (#53141) removed.

⚠️ Model Runner V1 Deprecation

Now that Model Runner V2 is used by default, we are considering Model Runner V1 deprecated and are targeting v0.32 for its removal. We do not intend to accept any more MRV1-specific improvements or optimizations.

Some features are not yet supported in MRV2 but we are planning for these gaps to be closed within the next 2-3 weeks. These include sequence parallelism, dual-batch overlap, elastic expert parallellism, custom logits processors and certain speculative decoding methods. For now, vLLM will still fall back to use MRV1 if any of these features are configured.

Release Artifacts

Python Wheels

Platform Install
PyPI (CUDA 13.0) pip install vllm
PyPI (CUDA 13.0, uv) uv pip install vllm --torch-backend=auto
ROCm pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.29.0/rocm723
XPU uv pip install vllm --extra-index-url https://wheels.vllm.ai/0.29.0/xpu --extra-index-url https://download.pytorch.org/whl/xpu --index-strategy unsafe-best-match

Docker Images

Platform Docker Image
CUDA 13.0 (Default) docker pull vllm/vllm-openai:v0.29.0 (v0.29.0-cu130 also works)
CUDA 12.9 docker pull vllm/vllm-openai:v0.29.0-cu129
CUDA 13.0 + Ubuntu 24.04 docker pull vllm/vllm-openai:v0.29.0-ubuntu2404
CUDA 12.9 + Ubuntu 24.04 docker pull vllm/vllm-openai:v0.29.0-cu129-ubuntu2404
ROCm docker pull vllm/vllm-openai-rocm:v0.29.0
CPU docker pull vllm/vllm-openai-cpu:v0.29.0
XPU docker pull vllm/vllm-openai-xpu:v0.29.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

  • Source distribution tarball
  • CUDA 12.9 Python wheels for x86_64 and arm64
  • CUDA 13.0 Python wheels for x86_64 and arm64

... (truncated)

Commits
  • 98dff2a [Bugfix][Core] Remove misleading Mamba prefix cache warning (#55863)
  • 74c9692 [Bugfix][Core] Apply dense prefix cache default to hybrid models (#55861)
  • 0c766af [Core] Default prefix_cache_retention_interval to dense for Mamba + EAGLE (#5...
  • 15026e7 Revert "[CI] Remove deleted nvidia/Nemotron-3-Nano-Omni-30B-A3B-Reasoning-BF1...
  • d2906cc [Bugfix] Avoid sync in TRT-LLM ragged prefill
  • 4cf572b [CI] Remove deleted nvidia/Nemotron-3-Nano-Omni-30B-A3B-Reasoning-BF16 and it...
  • 586f1d6 [Bugfix][Multimodal] Handle prefix-covered items in SHM worker cache (#54994)
  • 82cbe53 [Bugfix][Core] Wait for the previous PP tensor sends before the next forward ...
  • 316a4d5 [Bugfix] Log platform plugin detection failures (#52285)
  • 33898f8 [Bugfix] Handle padded routes in CUTLASS MoE permutations (#54747)
  • Additional commits viewable in compare view

Updates alembic from 1.19.1 to 1.19.2

Release notes

Sourced from alembic's releases.

1.19.2

Released: September 4, 2026

changed

  • [changed] [autogenerate] The autogenerate plugin for CHECK constraint detection by name, added in 1.19.0. for #508, is no longer enabled by default. It has been renamed from alembic.autogenerate.checkconstraint_byname to alembic.ext.checkconstraint_byname and no longer matches on the "alembic.autogenerate.*" wildcard, which remains the default plugin specification. The previous name will still function as well if placed in the plugins list explicitly, both to enable the plugin and within a "~" exclusion, so that an env.py written against 1.19.0 or 1.19.1 requires no change.

    The plugin is now recommended only for schemas that ensure the naming of all constraints using a client side naming convention, otherwise there's a persistent risk of false positives. See autogenerate_check_constraints for background on things to be aware of when using this plugin.

    As part of this change "type bound" CHECK constraints, which include constraints generated for the Boolean and Enum datatypes when the create_constraint parameter is set to True, are no longer ignored in the metadata side, so that normal name-based matching can occur for these constraints.

    References: #1859

usecase

  • [usecase] [autogenerate] [batch] The target of a ~sqlalchemy.schema.ForeignKey is now located using the ForeignKey.target_tokens and ForeignKey.target_table_key accessors added in SQLAlchemy 2.1, rather than by splitting the dotted string form of that target on ".". As a dot inside a schema, table or column name cannot be told apart from the separator between those names, a foreign key whose target name contained a dot was previously mis-parsed by autogenerate rendering as well as by batch migrations. The dotted string continues to be split when running against SQLAlchemy 2.0, where these accessors are not present. Thanks to Gyanu Mayank for the initial pull request.

    References: #1860

Commits

Updates psycopg2-binary to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
  • Fix parsing of malformed bytea input.
  • Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
  • Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
  • Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.14.
  • Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
  • Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
  • Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.13.
  • Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
  • Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.12.
  • Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits
  • f650e7a chore: bump to release 2.9.13
  • 368c8a1 chore!: drop support for Python 3.9
  • 9b39e65 chore: drop scaleway build support
  • 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
  • 5385c02 Build CPython 3.15 wheels
  • 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
  • 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
  • 8fb80bc fix: fix parsing of malformed int64 input in arrays
  • f98014a fix: fix parsing of malformed bytea input
  • 822b79c chore: bump dependencies in binary package
  • Additional commits viewable in compare view

Updates anthropic from 1.3.0 to 1.4.0

Release notes

Sourced from anthropic's releases.

v1.4.0

1.4.0 (2026-09-04)

Full Changelog: v1.3.0...v1.4.0

Features

  • api: add Claude Tag category and user breakdowns to usage reports (9fce1e4)
  • api: add named types for organization compliance settings state (1de1957)
  • api: add support for sending a workspace ID on more endpoints (d1d2c01)

Bug Fixes

  • client: raise a clear error when an httpx object is passed instead of an httpx2 one (9447099)
  • repair custom-code merge in messages resources (#580) (85454ca)

Chores

  • examples: refresh platform model IDs (#499) (182abb5)
  • internal: bundle the mock server spec and update dev tooling (f9b0cf2)
  • internal: clean up code comments (#578) (d202327)
  • internal: fix mypy unreachable error in detect-breaking-changes script (07834f6)
  • internal: narrower codeowners scope (daca8f1)
  • internal: revert codeowners change (41aa767)
  • tests: remove stale warning filters (ba9bf35)
  • tests: reword the skip reason on the path-level query param tests (6b5046a)

Documentation

  • api: update a few doc strings (26c509d)
Changelog

Sourced from anthropic's changelog.

1.4.0 (2026-09-04)

Full Changelog: v1.3.0...v1.4.0

Features

  • api: add Claude Tag category and user breakdowns to usage reports (9fce1e4)
  • api: add named types for organization compliance settings state (1de1957)
  • api: add support for sending a workspace ID on more endpoints (d1d2c01)

Bug Fixes

  • client: raise a clear error when an httpx object is passed instead of an httpx2 one (9447099)
  • repair custom-code merge in messages resources (#580) (85454ca)

Chores

  • examples: refresh platform model IDs (#499) (182abb5)
  • internal: bundle the mock server spec and update dev tooling (f9b0cf2)
  • internal: clean up code comments (#578) (d202327)
  • internal: fix mypy unreachable error in detect-breaking-changes script (07834f6)
  • internal: narrower codeowners scope (daca8f1)
  • internal: revert codeowners change (41aa767)
  • tests: remove stale warning filters (ba9bf35)
  • tests: reword the skip reason on the path-level query param tests (6b5046a)

Documentation

  • api: update a few doc strings (26c509d)
Commits
  • 62de60b Merge pull request #1905 from anthropics/release-please--branches--main--chan...
  • 3be44ac release: 1.4.0
  • 1de1957 feat(api): add named types for organization compliance settings state
  • 6b5046a chore(tests): reword the skip reason on the path-level query param tests
  • 182abb5 chore(examples): refresh platform model IDs (#499)
  • 07834f6 chore(internal): fix mypy unreachable error in detect-breaking-changes script
  • ba9bf35 chore(tests): remove stale warning filters
  • 9fce1e4 feat(api): add Claude Tag category and user breakdowns to usage reports
  • ea8a347 Build SDK
  • f9b0cf2 chore(internal): bundle the mock server spec and update dev tooling
  • Additional commits viewable in compare view

Updates transformers from 5.16.1 to 5.17.0

Release notes

Sourced from transformers's releases.

Release 5.17.0

Release v5.17.0

New Model additions

HYV4

Hy4-Preview is a 780B-parameter mixture-of-experts language model that activates 49B parameters per token. Each MoE layer holds 256 routed experts plus one always-active shared expert and routes every token to 8 of them. The context window is 1M tokens.

The architecture combines four features:

  • Multi-head Latent Attention (MLA) compresses keys and values into a low-rank latent (kv_lora_rank) that kv_b_proj expands back to one key/value per query head.
  • DeepSeek Sparse Attention (DSA) selects index_topk keys per query with a lightweight indexer. Following IndexShare, only the layers marked "full" in indexer_types run an indexer; "shared" layers reuse the previous full layer's selection.
  • Gated MLA with learnable attention sinks, where each head owns a sink logit that participates in the softmax and contributes no value, as in GPT-OSS.
  • Independent Hyper-Connections (iHC) replace the plain residual path with hc_mult parallel residual streams that are collapsed before, and redistributed after, every sublayer.

The implementation does not execute the multi-token prediction (MTP) layers. Released checkpoints keep those weights so that other runtimes can use them for speculative decoding; they are ignored at load time.

Links: Documentation

VibeVoice

VibeVoice is a novel framework for synthesizing high-fidelity, long-form speech with multiple speakers by employing a next-token diffusion approach within a Large Language Model (LLM) structure. It's designed to capture the authentic conversational "vibe" and is particularly suited for generating audio content like podcasts and multi-participant audiobooks.

Links: Documentation

NeoMME

NeoMME is a family of efficient 260M and 800M parameter multimodal-native multilingual foundation encoders from H Company. It processes multilingual text tokens and raw image patches in a single bidirectional Transformer encoder, without a separately pretrained vision tower or causal language model.

NeoMME-Retriever is a model fine-tuned from the NeoMME backbone for visual document retrieval with joint late-interaction and dense objectives. It takes text queries and documents (text or page screenshots) and produces multi-vector embeddings for MeanMaxSim scoring (late-interaction) and mean-pooled embeddings for cosine similarity (dense).

Links: Documentation

... (truncated)

Commits
  • 856157a v5.17.0
  • 5b7dcb0 MRoPE continued (#48594)
  • 50bbcc6 [fix] Update stale expected strings in HunYuanVL integration tests (#48646)
  • e8bcd79 [Quantizaiton]support 5/6/7 bits in AutoRound (#48481)
  • 3283d5f [fix] Update stale golden values and fix expected_logits shape in FlavaForPre...
  • 5f47b5a [tests] Fix integration test golden values broken by fast image processor def...
  • fc50134 Add Fun-ASR-Nano model (#46180)
  • d9fe823 Fix YOLOS device mismatch with device_map="auto" (#46886)
  • cbc1651 [Generate] Avoid unconditionally downloading remote hub file (#48620)
  • bd05a4b Honor shift_labels in decoder-only LLM/VLM losses (#48493)
  • Additional commits viewable in compare view

Updates langchain-core to 1.6.2

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.2

Changes since langchain-core==1.6.1

release(core): 1.6.2 (#40209) feat(openai): support async tools (#40208) chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (#40150) chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (#40113) fix(core): avoid mutation in google-genai standard content (#40023) fix(core): avoid mutation in bedrock converse standard content (#40022)

Commits

Updates langsmith from 0.12.1 to 0.12.4

Release notes

Sourced from langsmith's releases.

v0.12.4

What's Changed

Full Changelog: langchain-ai/langsmith-sdk@v0.12.3...v0.12.4

v0.12.3

What's Changed

Full Changelog: langchain-ai/langsmith-sdk@v0.12.2...v0.12.3

v0.12.2

What's Changed

New Contributors

Full Changelog: langchain-ai/langsmith-sdk@v0.12.1...v0.12.2

Commits
  • 7bb9308 release(py): 0.12.4 (#3511)
  • 2d4e374 fix(livekit): support agents 1.7 and 1.8 telemetry [Closes LSDK-506] (#3510)
  • b08af92 release(py): 0.12.3 (#3507)
  • 506f44d feat(sandbox): support proxy_config in update_sandbox (Python + JS) (#3430)
  • 5b4d6ea feat: LangSmithSecret class for redacting sensitive function parameters (#3484)
  • ebe3833 fix(docs): correct README code examples and update model references (#3503)
  • 1468621 perf: avoid ThreadPoolExecutor churn in hybrid tracing [closes LSDK-213] (#3005)
  • b9073c0 fix(py): make the multipart body replayable across both retry layers (#3483)
  • f092b71 test(py): benchmark compressed trace ingestion (#3497)
  • 4792a53 release(js): 0.10.2 (#3495)
  • Additional commits viewable in compare view

Updates pypdf from 6.17.0 to 6.18.0

Release notes

Sourced from pypdf's releases.

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

  • Use apply_configuration as a context manager to temporarily overwrite configuration values.
  • Use overwrite_configuration to change the configuration values for the whole session.

The old overwrites should continue to work in most cases. If you have migrated successfully and do not need the legacy handling anymore (which can cause some overhead), consider using the temporary disable_legacy_handling setting:

from pypdf import overwrite_configuration
overwrite_configuration(disable_legacy_handling=True)

In case you are experiencing some unexpected issues after the migration, consider opening a new issue (or commenting on an existing one) with the necessary details to reproduce it.

Security (SEC)

Deprecations (DEP)

New Features (ENH)

  • Draw borders and backgrounds for appearance streams and annotations (#4033) by @​PJBrs

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.18.0, 2026-09-07

Security (SEC)

  • Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

  • Rework configuration value handling (#4044)

New Features (ENH)

  • Draw borders and backgrounds for appearance streams and annotations (#4033)

Full Changelog

Commits
  • 18e4c22 REL: 6.18.0
  • 82501d2 SEC: Limit allowed length of indirect object tokens (#4055)
  • d35834b ENH: Draw borders and backgrounds for appearance streams and annotations (#4033)
  • 4b16bbb STY: Rename variable for readability (#4049)
  • a1ce7fb ROB: Do not crash when a page tree entry is not a dictionary (#4048)
  • 06b97ce DEV: Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#4053)
  • d3f790c ROB: Do not crash when the annotations are not an array (#4046)
  • 3dc716e STY: Enforce lowercase function variables (#4045)
  • ec2406f DEP: Rework configuration value handling (#4044)
  • See full diff in compare view

Updates weasyprint to 70.0

Release notes

Sourced from weasyprint's releases.

v70.0

Read about this release on our blog.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you: * embed untrusted images, or * rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security

  • Don’t render EPS images.
  • Always use original URL fetcher when available.

Features

  • #2905: Add initial support of CSS Notes, with financial support from NLnet
  • #2731, #2781: Log an error on unknown render and write_pdf options
  • #2802, #2805: Create immutable releases on GitHub
  • #2809, #2810: Switch to MSYS2 UCRT64 environment for Windows tests and executables
  • #2777, #2814: Support COLR emoji fonts
  • #2667, #2744: Support context paint in SVG markers
  • #1862, #2844: Improve filename detection for attachments
  • #2816, #2827: Set SVG title as alternative text
  • #2718: Provide a 'onedir' Windows executable
  • #2863: Support box-shadow
  • #2755: Support RTL SVG text anchoring
  • #2866: Don’t use f-strings in logs

Bug fixes

  • #2799: Keep HarfBuzz font faces alive during PDF subsetting
  • #2764, #2793: Accept Path as base URL in CSS
  • #2800, #2801: Fix position of raster emojis
  • #2782, #2807: Use POSIX paths in Fontconfig
  • #2766, #2779: Use response bytes when image file path doesn’t exist
  • #2277, #2728: Honor page breaks on floated elements
  • #2789, #2818: Use base URL when solving pending properties
  • #2820: Ignore unresolvable math in image slices
  • #2901, #2825: Transform SVG size into CSS to apply CSS sizing algorithm
  • #2819: Resolve calc() division by zero to infinity
  • #2824: Remove old deprecation warnings
  • #2762, #2780: Set SVG gradient color before path construction
  • #2761: Handle split tables with captions
  • #2215, #2747: Discard broken at-rules
  • #2736, #2738: Apply transformations to SVG opacity groups
  • #2830: Use a stack to draw simple borders
  • #2831: Fix line_height() crash on calc() values
  • #2784, #2832: Set fallback font for Unicode test
  • #2726, #2881: Improve accessibility of PDF forms
  • #2803: Fix inline width after backtracked line breaks
  • #2833: Store root style in anonymous style

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 70.0

Released on 2026-09-08.

This is a security update (CVE-2026-55073, GHSA-r543-q48m-4c9j).

We strongly recommend to upgrade WeasyPrint to the latest version if you:

  • embed untrusted images, or
  • rely on the URL fetcher to filter metadata or stylesheets passed as Python parameters.

Security:

  • Don’t render EPS images.
  • Always use original URL fetcher when available.

Features:

  • [#2905](https://github.com/Kozea/WeasyPrint/issues/2905) <https://github.com/Kozea/WeasyPrint/pull/2905>_: Add initial support of CSS Notes, with financial support from NLnet
  • [#2731](https://github.com/Kozea/WeasyPrint/issues/2731) <https://github.com/Kozea/WeasyPrint/issues/2731>, [#2781](https://github.com/Kozea/WeasyPrint/issues/2781) <https://github.com/Kozea/WeasyPrint/pull/2781>: Log an error on unknown render and write_pdf options
  • [#2802](https://github.com/Kozea/WeasyPrint/issues/2802) <https://github.com/Kozea/WeasyPrint/issues/2802>, [#2805](https://github.com/Kozea/WeasyPrint/issues/2805) <https://github.com/Kozea/WeasyPrint/pull/2805>: Create immutable releases on GitHub
  • [#2809](https://github.com/Kozea/WeasyPrint/issues/2809) <https://github.com/Kozea/WeasyPrint/issues/2809>, [#2810](https://github.com/Kozea/WeasyPrint/issues/2810) <https://github.com/Kozea/WeasyPrint/pull/2810>Description has been truncated

@dependabot dependabot Bot added backend dependencies Pull requests that update a dependency file devops labels Sep 13, 2026
@dependabot
dependabot Bot requested a review from mrveiss as a code owner September 13, 2026 02:44
@dependabot dependabot Bot added backend devops dependencies Pull requests that update a dependency file labels Sep 13, 2026
@coderabbitai

coderabbitai Bot commented Sep 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 648ba3df-e020-476f-863f-7ff470aab5a3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot mentioned this pull request Sep 13, 2026
Merged
@github-actions

github-actions Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Retargeted to main (main-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.

@github-actions github-actions Bot mentioned this pull request Sep 13, 2026
Merged
@github-actions

github-actions Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

If the queue is draining normally, ignore this. Otherwise:

  1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
  2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
  3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

@dependabot
chore(deps): bump the all-dependencies group across 1 directory with …
a1eafd4 
…12 updates

Updates the requirements on [vllm](https://github.com/vllm-project/vllm), [alembic](https://github.com/sqlalchemy/alembic), [psycopg2-binary](https://github.com/psycopg/psycopg2), [anthropic](https://github.com/anthropics/anthropic-sdk-python), [transformers](https://github.com/huggingface/transformers), [langchain-core](https://github.com/langchain-ai/langchain), [langsmith](https://github.com/langchain-ai/langsmith-sdk), [pypdf](https://github.com/py-pdf/pypdf), [weasyprint](https://github.com/Kozea/WeasyPrint), [boto3](https://github.com/boto/boto3), [mcp](https://github.com/modelcontextprotocol/python-sdk) and [fakeredis](https://github.com/cunla/fakeredis-py) to permit the latest version.

Updates `vllm` to 0.29.0
- [Release notes](https://github.com/vllm-project/vllm/releases)
- [Changelog](https://github.com/vllm-project/vllm/blob/main/RELEASE.md)
- [Commits](vllm-project/vllm@v0.28.0...v0.29.0)

Updates `alembic` from 1.19.1 to 1.19.2
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `psycopg2-binary` to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `anthropic` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v1.3.0...v1.4.0)

Updates `transformers` from 5.16.1 to 5.17.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.16.1...v5.17.0)

Updates `langchain-core` to 1.6.2
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.6.1...langchain-core==1.6.2)

Updates `langsmith` from 0.12.1 to 0.12.4
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](langchain-ai/langsmith-sdk@v0.12.1...v0.12.4)

Updates `pypdf` from 6.17.0 to 6.18.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.17.0...6.18.0)

Updates `weasyprint` to 70.0
- [Release notes](https://github.com/Kozea/WeasyPrint/releases)
- [Changelog](https://github.com/Kozea/WeasyPrint/blob/main/docs/changelog.rst)
- [Commits](Kozea/WeasyPrint@v69.0...v70.0)

Updates `boto3` to 1.43.91
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.88...1.43.91)

Updates `mcp` to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.1...v2.2.0)

Updates `fakeredis` to 2.38.0
- [Release notes](https://github.com/cunla/fakeredis-py/releases)
- [Commits](cunla/fakeredis-py@v2.37.1...v2.38.0)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: anthropic
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: boto3
  dependency-version: 1.43.91
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: fakeredis
  dependency-version: 2.38.0
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: langchain-core
  dependency-version: 1.6.2
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: langsmith
  dependency-version: 0.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: mcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: pypdf
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: transformers
  dependency-version: 5.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: vllm
  dependency-version: 0.29.0
  dependency-type: direct:production
  dependency-group: all-dependencies
- dependency-name: weasyprint
  dependency-version: '70.0'
  dependency-type: direct:production
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/main/all-dependencies-e5d17f19f0 branch from f5dabc2 to a1eafd4 Compare September 13, 2026 06:48
This was referenced Sep 13, 2026
Merged
Closed
Closed
Merged
Closed
@dependabot @github

dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 13, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/main/all-dependencies-e5d17f19f0 branch September 13, 2026 14:09
@mrveiss mrveiss mentioned this pull request Sep 20, 2026
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrveiss mrveiss Awaiting requested review from mrveiss mrveiss is a code owner

Assignees

No one assigned

Labels

backend dependencies Pull requests that update a dependency file devops

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants