chore(deps)(deps): bump the python-runtime group across 1 directory with 5 updates by dependabot[bot] · Pull Request #217 · Polycentric-Labs/evidentia

dependabot · 2026-07-27T10:20:30Z

Bumps the python-runtime group with 5 updates in the / directory:

Package	From	To
platformdirs	`4.10.0`	`4.11.0`
litellm	`1.92.0`	`1.93.0`
oracledb	`4.0.1`	`4.0.2`
fastapi	`0.139.0`	`0.140.0`
sentence-transformers	`5.6.0`	`5.6.1`

Updates platformdirs from 4.10.0 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

👷 ci: run the test suite against Python 3.15 by @gaborbernat in tox-dev/platformdirs#512

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

🐛 fix(windows): stop leaking memory on repeated folder lookups by @gaborbernat in tox-dev/platformdirs#507

🚀 ci(release): towncrier changelog + publish on tag push by @gaborbernat in tox-dev/platformdirs#509

📝 docs(changelog): rebuild against release history by @gaborbernat in tox-dev/platformdirs#510

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.0 (2026-07-21)

Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491

Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490

Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen

Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber

Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

... (truncated)

Commits

2140495 Release 4.11.0
a562df9 👷 ci: run the test suite against Python 3.15 (#512)
7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
2e74013 Release 4.10.1
3076722 📝 docs(changelog): rebuild against release history (#510)
42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
Additional commits viewable in compare view

Updates litellm from 1.92.0 to 1.93.0

Release notes

Sourced from litellm's releases.

v1.93.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0
Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.93.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0
Expected output:
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
What's Changed

feat(mcp): add entra_obo profile to the token_exchange (OBO) arm by @tin-berri in BerriAI/litellm#31983

chore(lint): zero out crash-class pyright rules and ban new type: ignore comments by @mateo-berri in BerriAI/litellm#32152

fix(headroom guardrail): log real token/compression stats instead of "allow" by @krrish-berri-2 in BerriAI/litellm#32158

fix(anthropic_messages): forward provider response headers on streaming /v1/messages responses by @mateo-berri in BerriAI/litellm#32160

fix(bedrock): emit SSE error event when invoke Messages stream ends without message_stop by @mateo-berri in BerriAI/litellm#32159

test(e2e): migrate access-control and inference-endpoint regression tests by @mubashir1osmani in BerriAI/litellm#32016

test(e2e): close coverage gaps across chat/responses, provider features, batches, prometheus, and langfuse eviction by @mubashir1osmani in BerriAI/litellm#32165

chore: add latest model rule to CLAUDE.md by @mateo-berri in BerriAI/litellm#32164

ci: gate CircleCI jobs on changed paths by @ryan-crabbe-berri in BerriAI/litellm#32080

fix(e2e): register batch + rust OCR deployments via /model/new by @mubashir1osmani in BerriAI/litellm#32166

fix: merge websearch tool params by @krrish-berri-2 in BerriAI/litellm#32162

test: de-flake langfuse callbacks-in-db e2e test by @yuneng-berri in BerriAI/litellm#32167

feat(router): add separate ITPM/OTPM deployment rate limits by @Sameerlite in BerriAI/litellm#31952

fix(streaming): surface in-body error payloads on OpenAI-compatible streams by @yassin-berriai in BerriAI/litellm#32237

fix(ui): reflect persisted "Store Prompts in Spend Logs" toggle on load by @devin-ai-integration[bot] in BerriAI/litellm#32145

... (truncated)

Commits

052b5a2 Merge pull request #33904 from BerriAI/litellm_models_listing_malformed_cost_...
db190ba fix(proxy): treat malformed cost-map token limits as absent on /v1/models
3510494 chore(release): backport #33853 and #33864 onto patch-1.93.0rc2 to complete t...
2530e32 chore(release): backport 11 staging PRs onto patch-1.93.0rc2 for the 1.93.0 s...
b5cd431 Merge pull request #33499 from BerriAI/litellm_backport_1930rc2
fba058b Merge pull request #32956 from BerriAI/litellm_fix_lit3859_wif_bridge
10d5804 Merge pull request #32884 from BerriAI/litellm_internal_staging
d37ba79 refactor(ui): convert projects page chart to shadcn/recharts (#32722)
4baeb28 chore: update Next.js build artifacts (2026-07-11 23:35 UTC, node v20.20.2) (...
ca877c7 refactor(ui): colocate the usage view, keeping the shared usage components (#...
Additional commits viewable in compare view

Updates oracledb from 4.0.1 to 4.0.2

Release notes

Sourced from oracledb's releases.

v4.0.2

python-oracledb 4.0.2 is now released. This release addresses a number of issues. See the full release notes for all of the details.

Commits

807750b Preparing to release python-oracledb 4.0.2.
1c6683b Fixed bug causing an exception to be raised when calling
98777f4 Correct test.
274db39 Tweaked release note.
c542377 Fixed bug where TIMESTAMP WITH TIME ZONE column data was converted incorrectly
b917422 Fixed bug causing precision and scale to be incorrect for timestamps and
65badc7 Fixed bug when fetching NCHAR or NVARCHAR2 columns (#595).
afc5445 Fixed segfault when calling Connection.fetch_df_all() and
c08edf6 Fixed bug where callers waiting on ConnectionPool.acquire() would wait
9c56a49 Fixed bug where ConnectionPool.wait_timeout returned the value in seconds
Additional commits viewable in compare view

Updates fastapi from 0.139.0 to 0.140.0

Release notes

Sourced from fastapi's releases.

0.140.0

Refactors

⚡️ Reduce memory usage in dependencies. PR #16049 by @tiangolo.

Docs

📝 Fix links in docs. PR #15967 by @YuriiMotov.

📝 Add Library Skills documentation. PR #16041 by @tiangolo.

📝 Update docs to use uv projects by default. PR #16032 by @tiangolo.

📝 Restructure FastAPI People and related pages. PR #16015 by @tiangolo.

Internal

👷 Add CI memory benchmark. PR #16046 by @tiangolo.

👥 Update FastAPI People - Sponsors. PR #16027 by @tiangolo.

🔥 Remove now-obsolete scripts to generate data for FastAPI People. PR #16016 by @tiangolo.

0.139.2

Fixes

🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @tiangolo.

0.139.1

Fixes

🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @tiangolo.

Docs

📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @YuriiMotov.

Translations

🌐 Update translations for tr (update-outdated). PR #16005 by @tiangolo.

🌐 Update translations for zh-hant (update-outdated). PR #15996 by @tiangolo.

🌐 Update translations for fr (update-outdated). PR #16006 by @tiangolo.

🌐 Update translations for de (update-outdated). PR #15999 by @tiangolo.

🌐 Update translations for ko (update-outdated). PR #16004 by @tiangolo.

🌐 Update translations for zh (update-outdated). PR #16001 by @tiangolo.

🌐 Update translations for uk (update-outdated). PR #16003 by @tiangolo.

🌐 Update translations for ja (update-outdated). PR #15998 by @tiangolo.

🌐 Update translations for pt (update-outdated). PR #16000 by @tiangolo.

🌐 Update translations for es (update-outdated). PR #15997 by @tiangolo.

🌐 Update translations for ru (update-outdated). PR #16002 by @tiangolo.

🌐 Update translations for hi (add-missing). PR #15990 by @tiangolo.

🌐 Update translations for hi (add-missing). PR #15925 by @tiangolo.

🌐 Update translations for hi (add-missing). PR #15797 by @tiangolo.

🌐 Update llm-prompt.md for Hindi. PR #15810 by @YuriiMotov.

🌐 Fix language-specific translation prompt for Russian language. PR #15924 by @YuriiMotov.

... (truncated)

Commits

255b912 🔖 Release version 0.140.0 (#16050)
892eacd 📝 Update release notes
0270829 ⚡️ Reduce memory usage in dependencies (#16049)
ae031be 📝 Update release notes
f3644b3 📝 Fix links in docs (#15967)
1e24ca0 📝 Update release notes
513c396 👷 Add CI memory benchmark (#16046)
a64dfbb 📝 Update release notes
4f15548 📝 Add Library Skills documentation (#16041)
704fbe1 📝 Update release notes
Additional commits viewable in compare view

Updates sentence-transformers from 5.6.0 to 5.6.1

Release notes

Sourced from sentence-transformers's releases.

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

This patch release fixes silently degraded embeddings for RoBERTa-family models when flash attention is requested with transformers v5, notably every XLM-R based multilingual embedding model (BAAI/bge-m3, intfloat/multilingual-e5-large, etc.). The bug affected v5.5.0, v5.5.1, and v5.6.0.

Install this version with
# Training + Inference
pip install sentence-transformers[train]==5.6.1
Inference only, use one of:
pip install sentence-transformers==5.6.1
pip install sentence-transformers[onnx-gpu]==5.6.1
pip install sentence-transformers[onnx]==5.6.1
pip install sentence-transformers[openvino]==5.6.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.1
pip install sentence-transformers[audio]==5.6.1
pip install sentence-transformers[video]==5.6.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.1
Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

Since v5.5.0, the Transformer module flattens text-only batches into one packed sequence when flash attention is requested, skipping all padding overhead for a notable performance improvement. The position_ids of that packed sequence restart at 0 for every text, which is correct for the vast majority of models. RoBERTa-family architectures however compute positions as padding_idx + 1 + n for the n-th token, so every token read a position embedding shifted by padding_idx + 1 (usually 2). Nothing crashes, the embeddings are just silently worse.
from sentence_transformers import SentenceTransformer
An affected configuration: flash attention with an XLM-R based model
model = SentenceTransformer(
"BAAI/bge-m3",
model_kwargs={"attn_implementation": "flash_attention_2"},
)
Measured on BAAI/bge-m3:

Evaluation padded packed, 0-based positions packed, with this fix

stsb test Spearman 0.8485 0.7239 0.8485

NanoBEIR mean nDCG@10 0.6041 0.5414 0.6050

The quality loss recovers exactly once the offset is applied. The fix scans the loaded model's modules once for an int padding_idx stored next to a learned position_embeddings table, and offsets the packed position_ids when that pair is found. An audit of transformers finds 16 architectures with that pair (roberta, xlm_roberta, xlm_roberta_xl, camembert, roberta_prelayernorm, xmod, data2vec_text, longformer, luke, ibert, mpnet, markuplm, lilt, layoutlmv3, esm, and pp_doclayout_v2), all offset by exactly padding_idx + 1, and no 0-based or rotary architecture matches.

You are only affected if you encoded text with flash attention requested on transformers v5 with a RoBERTa-family checkpoint. The default padded path (e.g. sdpa) was never affected, and neither were MPNet models like all-mpnet-base-v2 despite mpnet appearing in the audit: transformers does not support flash attention for MPNet at all. If you did index a corpus with such a configuration, re-encode it after upgrading: pre-fix embeddings score notably worse and do not mix with post-fix embeddings.

What's Changed

... (truncated)

Commits

7d3eb16 Release v5.6.1
286dcf3 [tests] Skip bf16 + Windows + CPU forwards, as they can WindowsError on tor...
30bad93 [ci] Exclude librosa/numba/llvmlite on Python 3.13 (#3835)
9ca6bbc 🚨 Fix position_ids offsetting for RoBERTa-family models when flattening input...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 5 updates Bumps the python-runtime group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.0` | | [litellm](https://github.com/BerriAI/litellm) | `1.92.0` | `1.93.0` | | [oracledb](https://github.com/oracle/python-oracledb) | `4.0.1` | `4.0.2` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.140.0` | | [sentence-transformers](https://github.com/huggingface/sentence-transformers) | `5.6.0` | `5.6.1` | Updates `platformdirs` from 4.10.0 to 4.11.0 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.10.0...4.11.0) Updates `litellm` from 1.92.0 to 1.93.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](BerriAI/litellm@v1.92.0...v1.93.0) Updates `oracledb` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/oracle/python-oracledb/releases) - [Commits](oracle/python-oracledb@v4.0.1...v4.0.2) Updates `fastapi` from 0.139.0 to 0.140.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.140.0) Updates `sentence-transformers` from 5.6.0 to 5.6.1 - [Release notes](https://github.com/huggingface/sentence-transformers/releases) - [Commits](huggingface/sentence-transformers@v5.6.0...v5.6.1) --- updated-dependencies: - dependency-name: platformdirs dependency-version: 4.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-runtime - dependency-name: litellm dependency-version: 1.93.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-runtime - dependency-name: oracledb dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-runtime - dependency-name: fastapi dependency-version: 0.140.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-runtime - dependency-name: sentence-transformers dependency-version: 5.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-runtime ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-27T10:20:36Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
evidentia	Ready	Preview, Comment	Jul 27, 2026 10:21am

codspeed-hq · 2026-07-27T10:22:48Z

Merging this PR will not alter performance

✅ 6 untouched benchmarks

_{Comparing dependabot/uv/python-runtime-5b508770f6 (31a61e1) with main (44dbb7f)}

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 27, 2026

vercel Bot deployed to Preview July 27, 2026 10:21 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)(deps): bump the python-runtime group across 1 directory with 5 updates - #217

chore(deps)(deps): bump the python-runtime group across 1 directory with 5 updates#217
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-runtime-5b508770f6

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

vercel Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Evaluation	padded	packed, 0-based positions	packed, with this fix
stsb test Spearman	0.8485	0.7239	0.8485
NanoBEIR mean nDCG@10	0.6041	0.5414	0.6050

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

4.11.0

What's Changed

4.10.1

What's Changed

v1.93.0

Verify Docker Image Signature

What's Changed

v4.0.2

0.140.0

Refactors

Docs

Internal

0.139.2

Fixes

0.139.1

Fixes

Docs

Translations

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

What's Changed

Uh oh!

vercel Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq Bot commented Jul 27, 2026

Merging this PR will not alter performance

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Jul 27, 2026 •

edited

Loading