chore(deps): bump the all-dependencies group in /autobot-tts-worker with 3 updates

[dependabot]

Updates the requirements on uvicorn, huggingface-hub and pocket-tts to permit the latest version.
Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• See full diff in compare view

Updates huggingface-hub to 2.0.0

Release notes

Sourced from huggingface-hub's releases.

[v2.0.0] The httpx2 release

See MIGRATION GUIDE in docs.

💔 Breaking Change: HTTP stack moves to httpx2

See migration plan in huggingface/huggingface_hub#4802 .

huggingface_hub v2.0 replaces its HTTP dependency with httpx2: clients and transport exceptions now come from httpx2/httpcore2 instead of httpx/httpcore. Custom client factories (via set_client_factory / set_async_client_factory) and any except clauses catching transport errors must use httpx2 types. For code that must support both v1.x (starting with v1.30.0) and v2.x, import the HTTP module from huggingface_hub.utils:

from huggingface_hub.utils import get_session, httpx
try:
response = get_session().get("https://huggingface.co/api/models/gpt2")
response.raise_for_status()
except httpx.HTTPError:
...

Note that httpx2 uses the operating system's certificate trust store by default (custom CA bundles via SSL_CERT_FILE / SSL_CERT_DIR still work), logging configuration should target the httpx2 and httpcore2 loggers, and the oauth extra now requires authlib>=1.8.0.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4921

💔 Breaking Change: deprecated APIs are removed

This release also removes all APIs deprecated in 1.x:

• upload_large_folder / HfApi.upload_large_folder → use upload_folder
• duplicate_space → use duplicate_repo
• request_space_storage / delete_space_storage → use the volume APIs (set_space_volumes, delete_space_volumes)
• repo_type_and_id_from_hf_id → use parse_hf_uri
• InferenceEndpointType.PROTECTED → use AUTHENTICATED (create_inference_endpoint(type="protected") now raises ValueError)
• list_models(model_name=...) → use list_models(search=...)
• create_repo / duplicate_repo(space_storage=...) → use space_volumes
• text_generation(stop_sequences=...) → use stop
• Boolean InferenceClient(token=...) → pass a token string or None

On the CLI side, the following entry points and options are gone: huggingface-cli (use hf), hf repo and hf repo-files delete (use hf repos and hf repos delete-files), hf upload-large-folder (use hf upload), hf repos create/duplicate --storage (use --volume), hf jobs ps and hf jobs scheduled ps -f/--filter (use --status/--label), and hf skills add/update --claude (Claude Code installation is now automatic).

A migration guide covering all of this is available at https://github.com/huggingface/huggingface_hub/blob/main/docs/source/en/concepts/migration_v2.md.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4955
• huggingface/huggingface_hub#4971
• huggingface/huggingface_hub#4985

🏗️ Internal

• [CI] Support major (pre-)releases in release workflow by @​Wauplin in #4991

... (truncated)

Commits

• 97c5f5f Release: v2.0.0
• e2d609e Release: v2.0.0.rc0
• 89ae51f unbump
• 9f51867 [Release] Prepare huggingface_hub 2.0 (#4994)
• c2e6e0a Post-release: bump version to 1.34.0.dev0 (#4993)
• fa26f34 [CI] Support major (pre-)releases in release workflow (#4991)
• ac3ed2f [Xet] Show Validating progress during shard finalization (#4478)
• b904b94 Apply the repo_id length limit to the namespace as well (#4988)
• 1e0c305 Send PrivateLink config under privateService in create_inference_endpoint (#4...
• da5e244 Scope GITHUB_TOKEN permissions per job (#4982)
• Additional commits viewable in compare view

Updates pocket-tts to 3.3.0

Release notes

Sourced from pocket-tts's releases.

v3.3.0

What's Changed

• Default every shipped model to temperature 0.3 by @​manu-lm in kyutai-labs/pocket-tts#324
• French: rewrite characters the models never saw in training (quotes, curly apostrophes) by @​manu-lm in kyutai-labs/pocket-tts#325
• Retrained Spanish, Italian, Portuguese and German; new Dutch by @​manu-lm in kyutai-labs/pocket-tts#326

Full Changelog: kyutai-labs/pocket-tts@v3.2.0...v3.3.0

Commits

• 3dbee45 Bump version to 3.3.0
• 4d93957 Retrained Spanish, Italian, Portuguese and German; new Dutch (#326)
• 497f399 French: rewrite characters the models never saw in training (quotes, curly ap...
• d41a7d2 Default every shipped model to temperature 0.3 (#324)
• 30df3cc Bump version to 3.2.0
• eedf2ac French: 6-layer model and a new 24-layer model (#321)
• 5660137 Keep the data loaders alive through SIGTERM so the trainer can checkpoint (#320)
• d51cfd8 Ignore EOS on the first 6 generated frames (#319)
• 0acce6b Refuse manifests without word alignments at startup (#318)
• 4367c36 Load tokenizers from tokenizer.json, keeping .model support (#317)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a1d883a3-8a8d-486f-98f7-ae03531cba39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Retargeted to main (main-first flow, #11696). Dependabot security updates always open against the default branch; this workflow re-applies the retarget after every Dependabot push, so rebases cannot revert it.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.