Skip to content

Bump the pip-minor-patch group with 16 updates - #1729

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-minor-patch-3389e22663
Closed

Bump the pip-minor-patch group with 16 updates#1729
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-minor-patch-3389e22663

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip-minor-patch group with 16 updates:

Package From To
fastapi 0.141.1 0.143.3
uvicorn 0.53.0 0.54.0
onnxruntime 1.30.0 1.31.0
starlette 1.6.0 1.8.0
nemoguardrails 0.24.0 0.24.1
langgraph 1.2.11 1.2.16
langchain-core 1.6.3 1.6.12
pgvector 0.5.0 0.5.1
tzdata 2026.2 2026.5
ruff 0.16.8 0.17.1
mypy 2.3.0 2.4.0
hatchling 1.32.0 1.32.4
pydantic-settings 2.15.0 2.16.0
aiohttp 3.14.4 3.14.5
pendulum 3.2.0 3.3.0
langsmith 0.13.0 0.14.11

Updates fastapi from 0.141.1 to 0.143.3

Release notes

Sourced from fastapi's releases.

0.143.3

Fixes

  • 🐛 Fix non-finite float serialization in JSONL and SSE streams. PR #16509 by @​tiangolo.

Docs

0.143.2

Fixes

Translations

Internal

0.143.1

Fixes

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

... (truncated)

Commits

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates onnxruntime from 1.30.0 to 1.31.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

  • Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
  • Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
  • Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
  • Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
  • Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

  • CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
  • GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
  • Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
  • ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
  • The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
  • Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

  • Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
  • Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
  • Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
  • Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
  • Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

  • Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
  • Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
  • Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
  • Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

  • Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
  • Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
  • Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
  • Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

... (truncated)

Commits
  • 402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
  • 660125b [Compile API] Add support for writing external initializers and EP context to...
  • 06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
  • 864d871 Fix isolated provider tests in Windows GPU CI (#33203)
  • 1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
  • be3b8e8 Fix complex STFT window handling (#33136)
  • 40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
  • 430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
  • 26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
  • d8024cd Improve CUDA RMSNorm reduction and aligned half2 output (#33178)
  • Additional commits viewable in compare view

Updates starlette from 1.6.0 to 1.8.0

Release notes

Sourced from starlette's releases.

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
  • Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

... (truncated)

Changelog

Sourced from starlette's changelog.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.

... (truncated)

Commits
  • 7b2948f Version 1.8.0 (#3660)
  • 5b544ce Send response start immediately when GZipMiddleware cannot compress (#3631)
  • 96d5023 Emit Max-Age=0 on session cookie when max_age=0 (#3651)
  • 0a15da3 Include allowed methods in StaticFiles 405 responses (#3640)
  • ff5b4df Close Request.stream() generators with aclosing (#3628)
  • 7cb2f09 Mark sessions as accessed when popping existing keys (#3186)
  • c67ca4e Add HTTP 103 Early Hints support (#3435)
  • 04741d0 Update broken external documentation links (#3621)
  • 470f986 Correct the documented WebSocket and Request constructor signatures (#3580)
  • b2e8750 Bracket IPv6 hostnames in URL.replace() (#3617)
  • Additional commits viewable in compare view

Updates nemoguardrails from 0.24.0 to 0.24.1

Release notes

Sourced from nemoguardrails's releases.

v0.24.1

What's Changed

This patch release addresses bug fixes and improvements.

🐛 Bug Fixes

  • (benchmark) Correct Locust concurrency measurements and sweeps (#2323)
  • (content-safety) Parse Nemotron 3.5 responses (#2370)
  • (server) Return overload response for IORails admission shedding (#2334)
  • (rails) Load config.py for combined configurations (#2371)

Full Changelog: NVIDIA-NeMo/Guardrails@v0.24.0...v0.24.1

Changelog

Sourced from nemoguardrails's changelog.

[0.24.1] - 2026-09-16

🐛 Bug Fixes

  • (benchmark) Correct Locust concurrency measurements and sweeps (#2323)
  • (content-safety) Parse Nemotron 3.5 responses (#2370)
  • (server) Return overload response for IORails admission shedding (#2334)
  • (rails) Load config.py for combined configurations (#2371)
Commits
  • 5d81d67 chore: prepare for release v0.24.1 (#2387)
  • c99d599 chore(deps): bump tornado from 6.5.7 to 6.5.8 (#2357)
  • ca8ccfc chore(deps): bump gitpython from 3.1.58 to 3.1.59 (#2372)
  • 273651f chore(deps-dev): bump chainlit from 2.11.1 to 2.12.0 (#2358)
  • a4c1405 test: make config path fixture portable (#2378)
  • f33f062 test: add Nemotron 3.5 Content Safety recorded tests (#2373)
  • 8c20efe fix(rails): load config.py for combined configurations (#2371)
  • a1f1fb3 feat: nemotron-3.5-content-safety parser (#2370)
  • 39b9c5b docs(benchmark): drop AIPerf comparison from Locust README (#2356)
  • 4f9672e fix(server): return overload response for IORails admission shedding (#2334)
  • Additional commits viewable in compare view

Updates langgraph from 1.2.11 to 1.2.16

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

  • release(langgraph): 1.2.16 (#9334)
  • fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • fix(langgraph): apply a resumed Command's update once (#9322)
  • fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (#9315)
  • fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • release(prebuilt): 1.1.1 (#9316)
  • release(checkpoint-postgres): 3.2.0 (#9313)
  • feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver (#9290)
  • fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer (#9302)
  • release(checkpoint-postgres): 3.1.3 (#9287)
  • release(checkpoint-sqlite): 3.1.2 (#9288)

langgraph==1.2.15

Changes since 1.2.14

  • release(langgraph): 1.2.15 (#9283)
  • fix(langgraph): give every message written to a messages DeltaChannel an id (#9275)
  • fix(langgraph): save a cached node's writes like a node that ran (#9259)
  • fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it (#9281)
  • fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269)
  • fix(langgraph): store an update_state input's writes on the checkpoint it updates (#9258)
  • fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints (#9260)
  • fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets (#9263)
  • fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264)
  • fix(langgraph): don't save a checkpoint past a failed DeltaChannel write (#9235)
  • fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values (#9232)
  • fix(langgraph): never store exit-mode delta writes under the null task id (#9229)
  • fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 (#9219)
  • chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph (#9206)
  • fix(langgraph): give each bulk_update_state update its own task id (#9128)
  • fix(langgraph): replay a resumed exit-mode run's delta writes in live order (#9114)
  • fix: order delta channel replay by task path (#8544)

langgraph==1.2.14

Changes since 1.2.13

  • release(langgraph): 1.2.14 (#9215)

langgraph==1.2.13

Changes since 1.2.12

  • fix(langgraph): fork before replaying an update checkpoint the thread moved past (#9170)
  • fix(langgraph): keep an update_state on an older checkpoint out of its other branches (#9165)
  • fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
  • release(langgraph): 1.2.13 (#9205)
  • fix(langgraph): don't walk history for a DeltaChannel that was never written (#9141)
  • fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8548)

... (truncated)

Commits
  • 41c9c22 release(langgraph): 1.2.16 (#9334)
  • 5101865 release(sdk-py): 0.4.8 (#9335)
  • 9e6fc45 fix(sdk-py): surface thread stream errors and stop retrying a rejected stream...
  • b0cabd9 fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • 4ac46ba release(cli): 0.4.36 (#9330)
  • e14f427 fix(langgraph): apply a resumed Command's update once (#9322)
  • 4e2dfe4 fix(cli): accept serverless and dedicated deployment aliases (#9325)
  • e77a5cb fix(cli): push through the active Docker context in langgraph deploy (#9321)
  • b0482d0 fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (...
  • 889a5ff fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • Additional commits viewable in compare view

Updates langchain-core from 1.6.3 to 1.6.12

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.12

Changes since langchain-core==1.6.11

release(core): 1.6.12 (#41277) fix(core): propagate extras on content-block-start events (#41272)

langchain-core==1.6.11

Changes since langchain-core==1.6.10

release(core): 1.6.11 (#41260) feat(core): accept address inside LangChainTracer (#41006)

langchain-core==1.6.10

Changes since langchain-core==1.6.9

release(core): 1.6.10 (#41220) feat(core,anthropic,openai): declare mid-conversation support in model profiles (#41180)

langchain-core==1.6.9

Changes since langchain-core==1.6.8

release(core): 1.6.9 (#41160) feat(core): accept a callable in with_retry (#41158)

langchain-core==1.6.8

Changes since langchain-core==1.6.7

release(core): 1.6.8 (#41153) fix(core): harden scoped and compatible IPv6 SSRF checks (#41151)

langchain-core==1.6.7

Changes since langchain-core==1.6.6

release(core): 1.6.7 (#41087) fix(core): include openai redacted_content in v1 output for bedrock converse (#41086) fix(core): python 3.14 hardening around inspect.signature (#41059) chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/core (#41057) chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/core (#40992) chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/core (#40972) chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/core (#40970)

langchain-core==1.6.6

Changes since langchain-core==1.6.5

release(core): 1.6.6 (#40906) fix(anthropic): support Claude Sonnet 5.5 compatibility (#40882) docs(core): fix docstring examples that don't run as copied (#40815)

langchain-core==1.6.5

Changes since langchain-core==1.6.4

... (truncated)

Commits

Updates pgvector from 0.5.0 to 0.5.1

Changelog

Sourced from pgvector's changelog.

0.5.1 (2026-10-08)

  • Fixed error with non-canonical SciPy sparse arrays
  • Fixed error with SciPy sparse arrays with explicit zeros
  • Fixed error with Bit constructor for NumPy 1.24-1.26
Commits
  • 5275164 Version bump to 0.5.1 [skip ci]
  • 474522b Improved validation for bit strings - fixes #161
  • 9005637 Updated changelog [skip ci]
  • f3a05b4 Updated changelog [skip ci]
  • f4dde19 Fixed handling of duplicates for SciPy sparse arrays - fixes #162
  • c451fb0 Improved code consistency [skip ci]
  • 63f5a48 Fixed typo [skip ci]
  • cd18c3f Fixed error with SciPy sparse arrays with zeros
  • d3c5d4b Improved performance by checking has_canonical_format [skip ci]
  • fd74f78 Fixed error with unordered SciPy sparse arrays - resolves #160
  • Additional commits viewable in compare view

Updates tzdata from 2026.2 to 2026.5

Release notes

Sourced from tzdata's releases.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

2026.4: Release of upstream tzdata 2026d

Version 2026.4

Upstream version 2026d released 2026-09-11T22:21:07+00:00

Briefly:

Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime.

Changes to future timestamps

... (truncated)

Changelog

Sourced from tzdata's changelog.

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario h...

Description has been truncated

@dependabot
Bump the pip-minor-patch group with 16 updates
ce8e96c 
---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: onnxruntime
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: nemoguardrails
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph
  dependency-version: 1.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pgvector
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: hatchling
  dependency-version: 1.32.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pendulum
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.14.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from cgfixit as a code owner October 20, 2026 14:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 20, 2026
@cgfixit cgfixit mentioned this pull request Oct 20, 2026
Merged
6 of 18 tasks
@cgfixit cgfixit closed this Oct 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/pip-minor-patch-3389e22663 branch October 20, 2026 14:28
cgfixit added a commit that referenced this pull request Oct 20, 2026
@cgfixit
[docs] - Resync README, setup guide and install docs after the agenti…
2478ad0 
…c removal and extras drop (#1731)

## Proposed changes
Documentation and dependency resync against `main` @ `b0683515` (after
#1726 and #1727 merged). The five deterministic checkers (doc-sync
D1-D13, dep-guard D1-D11, env drift E1-E7, `check_lock_contract.py`,
invariant-guard) were already green, so every change here is prose plus
one dated audit. **No pin, lock, manifest, or code line changes.**

- `README.md`: the removed agentic coding loop no longer appears in the
ship-off list, the security-model "Optional surfaces" row, or "Current
development"; the docs map stops crediting `setup-guide.md` with
Docker/conda and gains a `locks/README.md` row.
- `setup-guide.md`: the editable self-install is `pip install -e . -c
constraints.txt` on Linux/Windows and `pip install -e . --no-deps` on
macOS. The old text pointed at `/tmp/constraints-macos.txt` (exists
nowhere in the repo) and said the install went through
`requirements.txt` (it goes through the hashed locks). Lock count 25 ->
19 (six locks left with #1700). "step 4b" -> step 4 (no 4b exists). The
lock-freshness section was stranded after the footer and now sits above
it. Reconciled date 2026-10-20. Option C step 5 notes `GH_TOKEN` is
optional and unread by the runtime.
- `locks/README.md`: records that `constraints.txt`, `requirements*.txt`
and `scripts/ci-lock-inputs/` are hashed byte-for-byte into the lock
records (a comment edit alone fails the contract), and a Dependabot
section matching #1726.
- `docs/DOCKER.md`, `macos/README.md`, `powershell/README.md`: "agentic
registry" / "agentic writes" / "Agentic / registry" wording replaced
with what exists (model caches, fsconnect writes, connectors).
- `AGENTS.md`: `verify-dep` -> `verify-deps`. `CLAUDE.md` §8: one
trailing comment on the macOS editable install. Both files steer agent
sessions; the diff is those two lines, nothing copied from any external
source.
- `docs/audits/2026-10-20-dependency-currency-sweep.md` (new) and a
`docs/changelog.txt` row: PyPI currency + per-release advisory sweep
over all 42 pins. 0 new advisories (chromadb and nltk remain the two
accepted in `SECURITY.md`). Bump candidates are grouped for the owner;
the stale `constraints.txt` pydantic comment is flagged but left alone
because fixing it would re-hash the file.

**Invariant / Governance Impact:** none. No core file, graph edge,
config value, sanitizer pattern, auth path, or manifest changed.
`check_invariants.py`: 46 passed, 0 failed on the pushed head.

---

## Types of changes
- [ ] Bugfix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Security (auth, privacy, injection, egress, redaction, or secrets)
- [ ] Invariant / Governance refinement (use this for changes that
strengthen or evolve the 6 invariants, I6 isolation, or harness phases)
- [ ] Dependencies (added, removed, or bumped)
- [ ] CI / infrastructure (workflows, hooks, templates, or checkers)
- [ ] Refactor or tests (behavior-preserving, no new capability)
- [x] Documentation update
- [ ] Other (none of the boxes above fit)

Scope note: Docs + audits.

---

## Benefits / why
- An operator following `setup-guide.md` on macOS was told to pass a
constraints file that does not exist; the new line (`--no-deps`) was run
and resolves.
- README, Docker and installer docs stop describing a subsystem removed
two days ago (#1699/#1700), so a reader cannot go looking for the
agentic loop, registry, or `/ops/agentic`.
- `locks/README.md` now states the one rule that bites a would-be
contributor: the manifests are hashed, so a pin or comment edit needs
the Mac re-lock. Dependabot's role (#1726) is documented where the locks
live.
- The currency sweep gives the owner a reviewed bump list without
landing a red lock contract.

---

## Risks to monitor
- Prose only; the only executable claim is the macOS `pip install -e .
--no-deps` line. Signal if wrong: `cyclaw-*` shims missing after that
command on a Mac. Verified on Linux 3.12 only (dry-run, "Would install
cyclaw-1.9.0"); not run on macOS.
- `doc_sync.py` D9/D10 would catch a broken link or anchor from the
moved section; it reports 0 drift on the head.
- The sweep is a point-in-time PyPI read (2026-10-20); it is not a pin
change and goes stale like every dated audit.

---

## Checklist
- [x] I have read `docs/THREAT_MODEL.md`, `INVARIANTS.md` and
`SECURITY.md` (and any relevant Phase docs)
- [x] This change preserves all 6 security invariants and I6 module
isolation (explicit evidence or invariant matrix included for core
changes)
- [ ] Full sandbox validation has been run (docs-only; per CLAUDE.md §5
the suites are CI's to run)
- [x] No new external network dependencies or mandatory online LLM
assumptions were introduced without explicit justification + offline
fallback path
- [ ] For any agentic/fsconnect change: n/a
- [x] Relevant architecture docs or threat model notes have been updated
if core behavior or topology changed
- [x] Commit messages follow the title prefix convention above
- [ ] For large or complex changes: n/a

---

## Further comments
Checks run directly on the pushed head: `doc_sync.py` (0 drift),
`check_deps.py` (0/0), `check_env_drift.py` (0/0),
`check_lock_contract.py` (passed), `check_invariants.py` (46/0), a
lock-vs-constraints agreement pass over 148 shared entries, and `pip
install --dry-run --no-deps -e .` in a Python 3.12 venv. CI only: ruff,
the four test legs, coverage, pr-template-check.

---

## Suggested merge order of open PRs
_Trial merges verified against main @ b068351 on 2026-10-20: this
branch is rebased directly onto that SHA (fast-forward, nothing to
merge)._

**#1728** · Blocked
Impact: Dependabot Docker base 3.12 -> 3.15; `requires-python <3.13`, so
this cannot merge as proposed.
Action: Close or re-pin; independent of this PR.

**#1729** · Blocked
Impact: Dependabot pip minor+patch, 16 packages; red on the lock
contract until the Mac re-lock (see `locks/README.md` Dependabot section
in this PR).
Action: Owner re-locks on arm64 macOS, then merge; does not touch this
PR's files.

**this PR** · Safe
Impact: Docs and one audit only; no shared file with #1728/#1729.
Action: Merge any time; squash.

## ELI5
The code moved on (the agentic coding loop and its extras were deleted
last week, the lock set shrank, Dependabot got new rules) and the
instruction manuals did not. This PR is the manual catching up; it
changes no behavior.

- **What was broken or missing:** like a museum map still showing a wing
that was demolished. `README.md`, `docs/DOCKER.md` and the
macOS/PowerShell READMEs still named the agentic loop, its registry and
its writes. `setup-guide.md` told Mac users to pass `-c
/tmp/constraints-macos.txt` (a file nothing creates), said the install
went through `requirements.txt` (it goes through `locks/`), counted 25
locks (there are 19), referenced a "step 4b" that does not exist, and
had its lock-freshness section sitting after the signature line.
- **What changed:** those sentences now say what the tree does. The
macOS self-install is `pip install -e . --no-deps`, because
`constraints.txt` pins `torch==2.13.0+cpu` and no such wheel exists for
macOS. `locks/README.md` gains two facts: the manifests are hashed into
the lock records byte-for-byte, and a Dependabot pip PR is a shopping
list until someone re-locks on the Mac. A new dated audit lists every
pin against PyPI today with advisories checked per pinned release; two
advisories exist (chromadb, nltk) and both were already accepted in
`SECURITY.md`. Deliberately not done: no pin bumped, no
`constraints.txt` comment fixed, because either one turns
`check_lock_contract.py` red until the arm64 re-lock.
- **What could still go wrong:** the only runnable claim is the macOS
`--no-deps` line. It was dry-run on Linux 3.12 and resolved; it was not
run on a Mac. If it is wrong, `cyclaw-user` and friends stay "command
not found" after it. Everything else is words; `doc_sync.py` D9/D10
guard the links and anchors and report 0 drift.

Last updated: 2026-10-20 10:12 ET

---
_Generated by [Claude
Code](https://claude.ai/code/session_0196C68GFwq9cXGmpqDMDGJe)_
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cgfixit cgfixit Awaiting requested review from cgfixit cgfixit is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cgfixit