Skip to content

Bump the pip-all group across 1 directory with 55 updates - #1724

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-all-b99e99a679
Closed

Bump the pip-all group across 1 directory with 55 updates#1724
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-all-b99e99a679

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip-all group with 55 updates in the / directory:

Package From To
fastapi 0.141.1 0.143.3
uvicorn 0.53.0 0.54.0
huggingface-hub 1.32.0 2.2.0
onnxruntime 1.30.0 1.31.0
starlette 1.6.0 1.8.0
nemoguardrails 0.24.0 0.24.1
langgraph 1.2.11 1.2.16
langchain-core 1.6.3 1.6.12
websockets 15.0.1 17.2
pgvector 0.5.0 0.5.1
tzdata 2026.2 2026.5
ruff 0.16.8 0.17.1
mypy 2.3.0 2.4.0
hatchling 1.32.0 1.32.4
pydantic-settings 2.15.0 2.16.0
aiohttp 3.14.4 3.14.5
pendulum 3.2.0 3.3.0
langsmith 0.13.0 0.14.11
iniconfig 2.3.0 2.3.1
pluggy 1.6.0 1.7.0
jsonpickle 4.1.3 4.1.4
pbr 7.0.3 7.1.3
fastembed 0.8.1 0.9.0
filelock 4.0.10 4.2.0
hf-xet 1.6.0 1.7.0
httptools 0.8.0 0.9.0
jsonpatch 1.33 1.35
jsonpointer 3.1.1 3.2.1
kubernetes 36.0.3 37.0.1
langgraph-checkpoint 4.2.0 4.3.0
langgraph-prebuilt 1.1.0 1.1.1
langgraph-sdk 0.4.5 0.4.8
mpmath 1.3.0 1.4.1
multidict 6.9.1 7.1.0
narwhals 2.26.0 2.27.1
opentelemetry-api 1.45.0 1.45.1
opentelemetry-exporter-otlp-common 0.66b0 0.66b1
opentelemetry-exporter-otlp-proto-common 1.45.0 1.45.1
opentelemetry-exporter-otlp-proto-grpc 1.45.0 1.45.1
opentelemetry-proto 1.45.0 1.45.1
opentelemetry-sdk 1.45.0 1.45.1
opentelemetry-semantic-conventions 0.66b0 0.66b1
orjson 3.12.0 3.13.0
ormsgpack 1.12.2 1.13.0
pillow 12.3.0 13.0.0
pybase64 1.5.0 1.5.1
rpds-py 2026.6.3 2026.9.1
scipy 1.17.1 1.18.1
tenacity 9.1.4 9.2.1
tokenizers 0.23.2 0.23.3
transformers 5.18.0 5.20.1
truststore 0.10.4 0.10.5
typer 0.27.2 0.27.3
wcwidth 0.9.1 0.9.2
ast-serialize 0.12.1 0.13.1

Updates fastapi from 0.141.1 to 0.143.3

Release notes

Sourced from fastapi's releases.

0.143.3

Fixes

  • 🐛 Fix non-finite float serialization in JSONL and SSE streams. PR #16509 by @​tiangolo.

Docs

0.143.2

Fixes

Translations

Internal

0.143.1

Fixes

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

... (truncated)

Commits

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates huggingface-hub from 1.32.0 to 2.2.0

Release notes

Sourced from huggingface-hub's releases.

[v2.2.0] hf jobs stats snapshots, download and HfFileSystem fixes

A small release this week, mostly bug fixes and quality-of-life improvements. hf jobs stats now returns right away instead of streaming forever, concurrent downloads reliably use hf_xet, and HfFileSystem caching is more predictable. Two behavior changes are listed under Breaking changes.

📊 hf jobs stats prints a snapshot by default

hf jobs stats used to stream metrics until the job finished, so scripts and agents calling it on a running job hung until their own timeout. It now prints the latest sample of each job once and exits, like hf jobs logs and hf spaces logs. Use -f/--follow for the previous live view. Snapshot output also supports --format json|agent|quiet, which outputs the raw API metrics.

On the Python side, HfApi.fetch_job_metrics gets the same follow parameter as fetch_job_logs. It defaults to False and returns only the current sample. Pass follow=True to stream until the job completes.

>>> hf jobs stats 6ac3bd9afbc85ba6823a9ad4
JOB ID                CPU % NUM CPU MEM % MEM USAGE      NET I/O         GPU UTIL % GPU MEM % GPU MEM USAGE
--------------------- ----- ------- ----- -------------- --------------- ---------- --------- -------------
6ac3bd9afbc85ba682... 0%    2.0     0.01% 1.0MB / 16.0GB 0.0bps / 0.0bps N/A        N/A       N/A
Hint: Use `hf jobs stats -f celinah/6ac3bd9afbc85ba6823a9ad4` to follow live stats.
Stream live stats until the job completes
>>> hf jobs stats -f 6ac3bd9afbc85ba6823a9ad4

>>> from huggingface_hub import fetch_job_metrics
>>> for metrics in fetch_job_metrics(job_id=job.id, follow=True):
...     print(metrics)

Other Jobs fixes in this release: hf jobs logs and hf spaces logs without -f no longer hang while the job keeps printing, hf jobs stats no longer fails when one of the requested jobs has finished, and hf jobs stats --json prints [] when no job is running.

📚 Documentation: Jobs guide

⚡ Concurrent downloads always use hf_xet

In a fresh process, the first concurrent hf_hub_download calls could read a placeholder version for hf_xet while another thread was still looking it up. Those calls treated hf_xet as missing and downloaded through the plain HTTP path. This mostly affected parallel downloads such as snapshot_download, where some of the files skipped Xet. The version lookup is now cached only once it is resolved, so every download sees the real value.

  • Fix race in _get_version that makes concurrent downloads skip hf_xet by @​BramVanroy in #5102

📂 HfFileSystem cache fixes

Three fixes to how HfFileSystem caches listings and missing paths:

  • ls() on a newly created empty bucket returns an empty list instead of raising FileNotFoundError.
  • Directory listings are now replaced in the cache instead of appended to. Before, ls() after find() or ls(refresh=True) could return duplicate entries, refresh=True kept deleted files, and listing a single bucket file cached it as the whole folder's listing.
  • exists(path, refresh=True) and invalidate_cache(path) now clear cached "not found" results. Before, a repo, branch or bucket created in the same process stayed missing until a full invalidate_cache().
</tr></table>

... (truncated)

Commits
  • acfdf30 Release: v2.2.0
  • 193d9d9 Release: v2.2.0.rc0
  • 5be3565 [Cache] Speed up delete_revisions with a set lookup (#5118)
  • dab6a96 [CLI] Don't glob-expand arguments on Windows (#5117)
  • cca4d3a [Download] Fix offline snapshot_download with a pinned revision (#5113)
  • c6cc03e Fix argument name in raise_text_generation_error docstring (#5108)
  • 8abbfe5 Fix race in _get_version that makes concurrent downloads skip hf_xet (#5102)
  • bb3a875 [Docs] Fix from_pretrained integration example (#5105)
  • cf992a9 [HfFileSystem] Make refresh=True clear cached not-found results (#5106)
  • af74167 [Tests] Wait for bucket listings after writes (#5095)
  • Additional commits viewable in compare view

Updates onnxruntime from 1.30.0 to 1.31.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

  • Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
  • Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
  • Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
  • Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
  • Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

  • CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
  • GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
  • Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
  • ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
  • The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
  • Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

  • Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
  • Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
  • Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
  • Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
  • Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

  • Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
  • Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
  • Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
  • Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

  • Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
  • Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
  • Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
  • Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

... (truncated)

Commits
  • 402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
  • 660125b [Compile API] Add support for writing external initializers and EP context to...
  • 06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
  • 864d871 Fix isolated provider tests in Windows GPU CI (#33203)
  • 1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
  • be3b8e8 Fix complex STFT window handling (#33136)
  • 40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
  • 430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
  • 26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
  • d8024cd Improve CUDA RMSNorm reduction and aligned half2 output (#33178)
  • Additional commits viewable in compare view

Updates starlette from 1.6.0 to 1.8.0

Release notes

Sourced from starlette's releases.

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
  • Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

... (truncated)

Changelog

Sourced from starlette's changelog.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.

... (truncated)

Commits
  • 7b2948f Version 1.8.0 (#3660)
  • 5b544ce Send response start immediately when GZipMiddleware cannot compress (#3631)
  • 96d5023 Emit Max-Age=0 on session cookie when max_age=0 (#3651)
  • 0a15da3 Include allowed methods in StaticFiles 405 responses (#3640)
  • ff5b4df Close Request.stream() generators with aclosing (#3628)
  • 7cb2f09 Mark sessions as accessed when popping existing keys (#3186)
  • c67ca4e Add HTTP 103 Early Hints support (#3435)
  • 04741d0 Update broken external documentation links (#3621)
  • 470f986 Correct the documented WebSocket and Request constructor signatures (#3580)
  • b2e8750 Bracket IPv6 hostnames in URL.replace() (#3617)
  • Additional commits viewable in compare view

Updates nemoguardrails from 0.24.0 to 0.24.1

Release notes

Sourced from nemoguardrails's releases.

v0.24.1

What's Changed

This patch release addresses bug fixes and improvements.

🐛 Bug Fixes

  • (benchmark) Correct Locust concurrency measurements and sweeps (#2323)
  • (content-safety) Parse Nemotron 3.5 responses (#2370)
  • (server) Return overload response for IORails admission shedding (#2334)
  • (rails) Load config.py for combined configurations (#2371)

Full Changelog: NVIDIA-NeMo/Guardrails@v0.24.0...v0.24.1

Changelog

Sourced from nemoguardrails's changelog.

[0.24.1] - 2026-09-16

🐛 Bug Fixes

  • (benchmark) Correct Locust concurrency measurements and sweeps (#2323)
  • (content-safety) Parse Nemotron 3.5 responses (#2370)
  • (server) Return overload response for IORails admission shedding (#2334)
  • (rails) Load config.py for combined configurations (#2371)
Commits
  • 5d81d67 chore: prepare for release v0.24.1 (#2387)
  • c99d599 chore(deps): bump tornado from 6.5.7 to 6.5.8 (#2357)
  • ca8ccfc chore(deps): bump gitpython from 3.1.58 to 3.1.59 (#2372)
  • 273651f chore(deps-dev): bump chainlit from 2.11.1 to 2.12.0 (#2358)
  • a4c1405 test: make config path fixture portable (#2378)
  • f33f062 test: add Nemotron 3.5 Content Safety recorded tests (#2373)
  • 8c20efe fix(rails): load config.py for combined configurations (#2371)
  • a1f1fb3 feat: nemotron-3.5-content-safety parser (#2370)
  • 39b9c5b docs(benchmark): drop AIPerf comparison from Locust README (#2356)
  • 4f9672e fix(server): return overload response for IORails admission shedding (#2334)
  • Additional commits viewable in compare view

Updates langgraph from 1.2.11 to 1.2.16

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

  • release(langgraph): 1.2.16 (#9334)
  • fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • fix(langgraph): apply a resumed Command's update once (#9322)
  • fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (#9315)
  • fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • release(prebuilt): 1.1.1 (#9316)
  • release(checkpoint-postgres): 3.2.0 (#9313)
  • feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver (#9290)
  • fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer (#9302)
  • release(checkpoint-postgres): 3.1.3 (#9287)
  • release(checkpoint-sqlite): 3.1.2 (#9288)

langgraph==1.2.15

Changes since 1.2.14

  • release(langgraph): 1.2.15 (#9283)
  • fix(langgraph): give every message written to a messages DeltaChannel an id (#9275)
  • fix(langgraph): save a cached node's writes like a node that ran (#9259)
  • fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it (#9281)
  • fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269)
  • fix(langgraph): store an update_state input's writes on the checkpoint it updates (#9258)
  • fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints (#9260)
  • fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets (#9263)
  • fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264)
  • fix(langgraph): don't save a checkpoint past a failed DeltaChannel write (#9235)
  • fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values (#9232)
  • fix(langgraph): never store exit-mode delta writes under the null task id (#9229)
  • fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 (#9219)
  • chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph (#9206)
  • fix(langgraph): give each bulk_update_state update its own task id (#9128)
  • fix(langgraph): replay a resumed exit-mode run's delta writes in live order (#9114)
  • fix: order delta channel replay by task path (#8544)

langgraph==1.2.14

Changes since 1.2.13

  • release(langgraph): 1.2.14 (#9215)

langgraph==1.2.13

Changes since 1.2.12

  • fix(langgraph): fork before replaying an update checkpoint the thread moved past (#9170)
  • fix(langgraph): keep an update_state on an older checkpoint out of its other branches (#9165)
  • fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
  • release(langgraph): 1.2.13 (#9205)
  • fix(langgraph): don't walk history for a DeltaChannel that was never written (#9141)
  • fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8548)

... (truncated)

Commits
  • 41c9c22 release(langgraph): 1.2.16 (#9334)
  • 5101865 release(sdk-py): 0.4.8 (#9335)
  • 9e6fc45 fix(sdk-py): surface thread stream errors and stop retrying a rejected stream...
  • b0cabd9 fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • 4ac46ba release(cli): 0.4.36 (#9330)
  • e14f427 fix(langgraph): apply a resumed Command's update once (#9322)
  • 4e2dfe4 fix(cli): accept serverless and dedicated deployment aliases (#9325)
  • e77a5cb fix(cli): push through the active Docker context in langgraph deploy (#9321)
  • b0482d0 fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (...
  • 889a5ff fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • Additional commits viewable in compare view

Updates langchain-core from 1.6.3 to 1.6.12

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.12

Changes since langchain-core==1.6.11

release(core): 1.6.12 (#41277) fix(core): propagate extras on content-block-start events (#41272)

langchain-core==1.6.11

Changes since langchain-core==1.6.10

release(core): 1.6.11 (#41260) feat(core): accept address inside LangChainTracer (#41006)

langchain-core==1.6.10

Changes since langchain-core==1.6.9

release(core): 1.6.10 (

@dependabot
dependabot Bot requested a review from cgfixit as a code owner October 20, 2026 11:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 20, 2026
@cgfixit cgfixit mentioned this pull request Oct 20, 2026
Merged
6 of 7 tasks
@dependabot
Bump the pip-all group across 1 directory with 55 updates
bd6a0bb 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: ast-serialize
  dependency-version: 0.13.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: fastapi
  dependency-version: 0.143.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: fastembed
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: filelock
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: hatchling
  dependency-version: 1.32.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: hf-xet
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: httptools
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: huggingface-hub
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: jsonpatch
  dependency-version: '1.35'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: jsonpickle
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: jsonpointer
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: kubernetes
  dependency-version: 37.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: langchain-core
  dependency-version: 1.6.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: langgraph
  dependency-version: 1.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: langgraph-checkpoint
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: langgraph-prebuilt
  dependency-version: 1.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: langgraph-sdk
  dependency-version: 0.4.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: langsmith
  dependency-version: 0.14.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: mpmath
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: multidict
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: narwhals
  dependency-version: 2.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: nemoguardrails
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: onnxruntime
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: opentelemetry-exporter-otlp-common
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: pip-all
- dependency-name: opentelemetry-exporter-otlp-proto-common
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: opentelemetry-exporter-otlp-proto-grpc
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: opentelemetry-proto
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: pip-all
- dependency-name: orjson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: ormsgpack
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: pbr
  dependency-version: 7.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: pendulum
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: pgvector
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: pybase64
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: rpds-py
  dependency-version: 2026.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: starlette
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: tenacity
  dependency-version: 9.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: tokenizers
  dependency-version: 0.23.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: transformers
  dependency-version: 5.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: truststore
  dependency-version: 0.10.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: wcwidth
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: websockets
  dependency-version: '17.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-all-b99e99a679 branch from 7074bda to bd6a0bb Compare October 20, 2026 13:33
@cgfixit cgfixit closed this Oct 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/pip-all-b99e99a679 branch October 20, 2026 13:39
@cgfixit cgfixit mentioned this pull request Oct 20, 2026
Merged
6 of 7 tasks
@cgfixit Claude

cgfixit commented Oct 20, 2026

Copy link
Copy Markdown
Owner

Closing this unmerged. It rewrites all 15 hashed lock files but not locks/runtime-inputs.json / locks/ci-inputs.json, so scripts/check_lock_contract.py fails it by construction, and the locks can only be regenerated on arm64 macOS. It also bundles two majors (huggingface-hub 1.32 → 2.2, websockets 15 → 17) into a 55-package batch.

#1726 changes the pip config: locks/** is excluded, the schedule is monthly, and minor+patch and major updates come in separate groups. Once that merges, the next run should open lock-free PRs that act as a list of pins to re-lock on the Mac.

Generated by Claude Code

cgfixit added a commit that referenced this pull request Oct 20, 2026
@cgfixit @claude
[infra] - Keep Dependabot out of locks/ and split pip majors into the…
b068351 
…ir own PR (#1726)

* [infra] - Keep Dependabot out of locks/ and split pip majors into their own PR

Dependabot's pip-all PRs (#1717, #1724) rewrote every hashed lock without the
locks/*-inputs.json records, so the lock contract failed them by
construction and each one conflicted with any other lock change. pip now:

- excludes locks/** (exclude-paths); pins move only in constraints.txt,
  pyproject.toml and requirements*.txt, and the operator re-locks on the Mac
- runs monthly instead of weekly, since every PR costs a re-lock
- groups minor+patch together and majors separately, so a major such as
  huggingface-hub 1->2 is reviewed on its own (grouped, not ignored, because
  ignore rules also suppress security updates)

Also corrects the header comment that said constraints.txt is never fetched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

* [docs] - Reword the locks note in the dependabot.yml header comment

Comment-only; the parsed config is byte-identical before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

---------

Co-authored-by: Claude <noreply@anthropic.com>
@cgfixit cgfixit mentioned this pull request Oct 20, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cgfixit cgfixit Awaiting requested review from cgfixit cgfixit is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cgfixit