Skip to content

Bump the patch-and-minor group with 8 updates - #128

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/master/patch-and-minor-bf0b586b70
Open

Bump the patch-and-minor group with 8 updates#128
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/master/patch-and-minor-bf0b586b70

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-and-minor group with 8 updates:

Package From To
fastapi 0.142.2 0.143.0
pydantic 2.13.5 2.14.1
gliner2 2.0.0 2.1.0
transformers 5.17.0 5.19.0
hypothesis 6.168.5 6.169.0
ruff 0.16.10 0.17.0
pip-tools 7.6.1 7.6.2
onnxruntime 1.30.0 1.31.0

Updates fastapi from 0.142.2 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates gliner2 from 2.0.0 to 2.1.0

Release notes

Sourced from gliner2's releases.

v2.1.0

GLiNER2 2.1.0 is on PyPI. Paste the note below into a Hugging Face model card or discussion.

# GLiNER2 2.1.0
Released 9 October 2026. Install with:
pip install -U "gliner2==2.1.0"
</code></pre>
<p>This is the library release after <a href="https://pypi.org/project/gliner2/2.0.0/">gliner2 2.0.0</a> (24 August 2026, the GLiNER2.5 release). It is built from <a href="https://github.com/fastino-ai/GLiNER2">fastino-ai/GLiNER2</a> <code>main</code> at <code>b86d35c</code>. Checkpoint weights are unchanged. What changed is inference, training, schemas, and packaging.</p>
<p>Full history: <a href="https://github.com/fastino-ai/GLiNER2/compare/v2.0.0...b86d35c">v2.0.0...b86d35c</a></p>
<h2>Highlights</h2>
<ul>
<li><strong>Transformers 5.</strong> <code>transformers&gt;=4.43,&lt;6</code> on every install profile. The <code>disentangled-flash</code> extra requires <code>transformers&gt;=4.57,&lt;6</code>.</li>
<li><strong>DisentangledFlash attention</strong> for DeBERTa encoders, including an automatic packed (unpadded) path and a differentiable training path.</li>
<li><strong>Faster span scoring and decoder synchronization.</strong></li>
<li><strong>Schemas from JSON now match the Python builder</strong>, including thresholds, <code>top_k</code>, label descriptions, prompts, and few-shot examples.</li>
<li><strong>Precomputed encoder states</strong> can be passed into every batch inference API, and a boundary model can be loaded without the encoder.</li>
<li>Training fixes for gold-label corruption, Indic tokenization, phantom entity spans, half-precision NaNs, record choice fields, and LoRA unload.</li>
</ul>
<h2>Faster inference</h2>
<h3>DisentangledFlash</h3>
<p>New load option <code>attention_backend</code>:</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Behavior</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>&quot;standard&quot;</code></td>
<td>Transformers attention</td>
</tr>
<tr>
<td><code>&quot;flashdeberta&quot;</code></td>
<td>FlashDeBERTa. <code>use_flashdeberta</code> remains a compatibility alias</td>
</tr>
<tr>
<td><code>&quot;disentangled_flash&quot;</code></td>
<td><a href="https://github.com/delyan-boychev/disentangled-flash">DisentangledFlash</a></td>
</tr>
</tbody>
</table>
<pre lang="python"><code>from gliner2 import GLiNER2
model = GLiNER2.from_pretrained(
&quot;fastino/gliner2-base-v1&quot;,
attention_backend=&quot;disentangled_flash&quot;,
)
</code></pre>
<p>Install the extra with <code>pip install &quot;gliner2[disentangled-flash]&quot;</code>. On CUDA, FP16 or BF16 is what makes the flash kernels pay off.</p>
<p>Packed layout is on by default in auto mode. A batch uses the unpadded kernel when padding is at least 15% and the batch is large enough (<code>B * L2 &gt;= 221</code>, measured on an H200). Smaller batches stay on the padded path. Tune it with <code>disentangled_flash_packed</code>, <code>disentangled_flash_min_padding</code>, <code>disentangled_flash_min_work</code>, and <code>disentangled_flash_tuning</code>.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/b86d35c02f2c1a4d9840ea50197bd1b6d13b031e&quot;&gt;&lt;code&gt;b86d35c&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/fastino-ai/GLiNER2/issues/189&quot;&gt;#189&lt;/a> from MattThomas-fastino/transformers-v5-support</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/ec0e31271d1a627e135e91ccc2932a97cbd68494&quot;&gt;&lt;code&gt;ec0e312&lt;/code&gt;&lt;/a> Support Transformers 5 and refresh dependency caps</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/08c8c8df0803075035ac6a02e8ee8c5554d2e06b&quot;&gt;&lt;code&gt;08c8c8d&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/fastino-ai/GLiNER2/issues/188&quot;&gt;#188&lt;/a> from delyan-boychev/optimize-decoder-sync</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/2763f94753ef910d77e71e4bcc3018207508c640&quot;&gt;&lt;code&gt;2763f94&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/fastino-ai/GLiNER2/issues/187&quot;&gt;#187&lt;/a> from kfastino/fix/cls-true-label-synthetic</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/467ea4fdbbb8ee3077b545333be2a23c2331d8a5&quot;&gt;&lt;code&gt;467ea4f&lt;/code&gt;&lt;/a> Add decoder synchronization benchmark matrix</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/f59fab04eb1d3c95fe223677e289820ea677c124&quot;&gt;&lt;code&gt;f59fab0&lt;/code&gt;&lt;/a> Merge remote-tracking branch 'upstream/main' into optimize-decoder-sync</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/0b67de781678825c8cd4fda5a9a25e5563ff3137&quot;&gt;&lt;code&gt;0b67de7&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/fastino-ai/GLiNER2/issues/143&quot;&gt;#143&lt;/a> from delyan-boychev/optimize-span-scoring</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/879fc2d4d3e9ef481dcc1368a0eebe462e0d802d&quot;&gt;&lt;code&gt;879fc2d&lt;/code&gt;&lt;/a> Optimize boundary decoder synchronization</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/cf348748194dd878831390d4bd674bfe651b1e9b&quot;&gt;&lt;code&gt;cf34874&lt;/code&gt;&lt;/a> Optimize accelerator decoder synchronization</li>
<li><a href="https://github.com/fastino-ai/GLiNER2/commit/0fa0e8870cfc30495b5c3870e0fe87dcef7af99a&quot;&gt;&lt;code&gt;0fa0e88&lt;/code&gt;&lt;/a> Merge remote-tracking branch 'origin/main' into optimize-span-scoring</li>
<li>Additional commits viewable in <a href="https://github.com/fastino-ai/GLiNER2/compare/v2.0.0...v2.1.0&quot;&gt;compare view</a></li>
</ul>
</details>
<br />
Updates transformers from 5.17.0 to 5.19.0

Release notes
Sourced from transformers's releases.

Release v5.19.0
New Model additions
EmbeddingGemma2

EmbeddingGemma 2 is a multimodal embedding model from Google built on the Gemma 4 architecture. It encodes text, images, audio, and video, individually or combined in one input, into a shared 768-dimensional vector space for cross-modal retrieval, semantic similarity, clustering, and classification. It uses Matryoshka Representation Learning, so embeddings can be truncated to 512, 256, or 128 dimensions. It also offers configurable visual and video token budgets, and unused vision or audio towers can be disabled at load time to save memory.
Links: Documentation

Smthn smthn (#49364) by @​vasqu in #49364

Breaking changes
All MoE models whose routers compute logits now return them when output_router_logits=True, following the Qwen3-MoE pattern (a router_logits recorder on the base model, MoeModelOutputWithPast from the backbone, and a MoE causal LM output from the head), so code that relied on the previous outputs or their absence should read the router logits from these output classes.

🚨 Return router logits from every MoE model that computes them (#48920) by @​qgallouedec

Owlv2ForObjectDetection.embed_image_query now selects the query box with the highest objectness score, as in the original OWLv2 notebook, instead of the OWL-ViT heuristic, so image-guided query embeddings and detections may differ from earlier releases.

🚨 Select the OWLv2 image query by objectness (#49200) by @​qgallouedec

The "paged|" prefix for SDPA and flash attention implementations is deprecated, so users should set the regular attention implementation (e.g. sdpa or flash_attention_2) for continuous batching instead of paged|sdpa or paged|flash_attention_2.

🚨 Attention 🚨 Deprecate "paged|" prefix for SDPA and flash  (#49112) by @​remi-or

The regular flash and SDPA attention functions (flash_attention.py, sdpa_attention.py) now support continuous batching directly, and "paged|..." implementations for these are redirected to them, while eager still requires the "paged|eager" prefix.

🚨 Attention 🚨 Make regular attention support CB (#49101) by @​remi-or

In continuous batching, the cache update for the index-based and block-table paths is now fused into a single call, which slightly changes the cache update function's behavior and affects any custom code that calls the separate update paths.

🚨 [CB] 🚨 Fuse update for index and block table path (#49088) by @​remi-or

Continuous batching internals changed in preparation for removing "paged": `max

🚨 [CB] 🚨 Little fixes before removing "paged" (#49069) by @​remi-or

Parallelization
Expert parallelism gains a token-dispatch implementation, selected via the new ep_dispatch_experts plan rule and now the default for Qwen3 MoE and Mellum, which removes the requirement that EP size equal TP size. The Trainer was also adapted to work with expert parallelism, and the docs now note that PEFT adapters support tensor parallelism. A CI-related fix for pipeline-parallel chart2table inference was also included.

[distributed]: adapt Trainer to work Expert Parallel (#48873) by @​3outeille in #48873
[distributed] Add expert-parallel token dispatch, default for Qwen3 MoE (#48865) by @​3outeille in #48865
Fix pp chart2table inference (#49225) by @​zucchini-nlp in #49225
[docs] TP for PEFT adapters (#49060) by @​stevhliu in #49060

Cache


... (truncated)


Commits

c4c4605 v5.19.0
92cd495 Smthn smthn (#49364)
a7e8ff2 Revert "[CI] Temporarily disable AMD scheduled CI trigger" (#49271) (#49362)
571c5cc ALM testx fIxing... (#49355)
b4526a7 Fix DataCollatorForLanguageModeling ignoring seed=0 (#49349)
5a27d2d Fix explicit kernelization modes for evaluation models (#49339)
23c21ac fix(cohere_compass): add video to input_modalities (#49320) (#49323)
f1d0d9f GPT-OSS: read the clamped SwiGLU's alpha and limit from the config (#49346)
9921402 [distributed] Default MoE ep_plans to token dispatch (#49160)
8625785 [distributed]: adapt Trainer to work Expert Parallel (#48873)
Additional commits viewable in compare view



Updates hypothesis from 6.168.5 to 6.169.0

Commits

82fa40a Bump hypothesis version to 6.169.0 and update changelog
0116655 Merge pull request #4899 from Arjun-Aravind/fix/uv-download-metadata-url
4f7ef96 claude: exclude rarely-hit realize branch from coverage
4d42db9 Update uv download-metadata URL
1484f6d Merge pull request #4896 from Liam-DeVoe/drop-python-3.10
e3e5fea claude: address review comments
7c22da6 claude: simplify add_note fallback
f6a8067 claude: check ghostwriter golden outputs on 3.11 instead of 3.10
2416a79 Merge remote-tracking branch 'upstream/master' into plait/worktop-270d0237
b4c5a08 claude: drop support for Python 3.10
Additional commits viewable in compare view



Updates ruff from 0.16.10 to 0.17.0

Release notes
Sourced from ruff's releases.

0.17.0
Release Notes
Released on 2026-10-09.
The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.
Breaking changes


Update the default and latest Python versions for 3.15 (#28792)
Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.


Update the default rule set (#28786)
Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.


Update Rust crate quick-junit to 0.8.0 (#27295)
JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.


[flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)


Support Unicode dummy variable names (#28722)
The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.


Update to Unicode 17 (#21229, #28784)
Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").


Always show unsafe and display-only fixes in the CLI (#27810)
The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.


Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)
The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.


Remove support for ruff-lsp (#28750)
Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.


Stabilization
The following rules have been stabilized and are no longer in preview:

lazy-import-mismatch (TID254)
lazy-import-immediately-resolved (TID255)
os-path-commonprefix (RUF071)



... (truncated)


Changelog
Sourced from ruff's changelog.

0.17.0
Released on 2026-10-09.
The executables in our macOS and Windows release archives and ruff wheels are now code-signed.
macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows
executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables
verification of the release publisher and binary integrity, supports publisher-based allowlisting,
and should reduce security warnings and antivirus false positives.
Breaking changes


Update the default and latest Python versions for 3.15 (#28792)
Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through
target-version or
requires-python. When
checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15
instead of 3.14.


Update the default rule set (#28786)
Several of the flake8-datetimez rules
(DTZ001,
DTZ005,
DTZ006,
DTZ007,
DTZ011,
DTZ012, and
DTZ901) are no longer enabled by default,
while undefined-local-with-nested-import-star-usage
(F406), which corresponds to a syntax error, is now enabled by default.


Update Rust crate quick-junit to 0.8.0 (#27295)
JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and
includes a skipped attribute on the root <testsuites> element.


[flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)


Support Unicode dummy variable names (#28722)
The default lint.dummy-variable-rgx
now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.


Update to Unicode 17 (#21229, #28784)
Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").


Always show unsafe and display-only fixes in the CLI (#27810)




... (truncated)


Commits

5b27c1c Bump version to 0.17.0 (#29259)
8f362bf Integrate vendored Unicode names into Ruff
88a50d6 Revert upstream Unicode loose matching
276832a Revert upstream Unicode alias normalization
26911ca Vendor unicode_names2 from upstream
27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
ef23c9c Update default and latest Python versions for 3.15 (#28792)
Additional commits viewable in compare view



Updates pip-tools from 7.6.1 to 7.6.2

Release notes
Sourced from pip-tools's releases.

v7.6.2
Bug fixes


Fixed pip-compile sometimes adding --no-index to the recorded command even when it was not passed, with click 8.5.0 -- by @​mnencia.
PRs and issues: #2472


Make pip-tools compatible with {pypi}click version 8.5 -- by @​sirosen.
PRs and issues: #2474


Packaging updates and notes for downstreams

License metadata has updated to use :pep:639 License-Expression data -- by @​sirosen.

Contributor-facing changes


pip-tools now has a local coverage plugin for conditional coverage based on the installed pip version -- by @​sirosen.
PRs and issues: #2264





Changelog
Sourced from pip-tools's changelog.

v7.6.2
2026-10-06
Bug fixes


Fixed pip-compile sometimes adding --no-index to the recorded command
even when it was not passed, with click 8.5.0 -- by {user}mnencia.
PRs and issues: {issue}2472


Make pip-tools compatible with {pypi}click version 8.5 -- by {user}sirosen.
PRs and issues: {issue}2474


Packaging updates and notes for downstreams

License metadata has updated to use :pep:639 License-Expression data
-- by {user}sirosen.

Contributor-facing changes


pip-tools now has a local coverage plugin for conditional coverage based on
the installed pip version -- by {user}sirosen.
PRs and issues: {issue}2264





Commits

4492554 Merge pull request #2486 from sirosen/release/v7.6.2
a427c88 Update changelog for v7.6.2
b81fb05 Merge pull request #2485 from jazzband/dependabot/pip/docs/urllib3-2.8.0
9707a2a Merge pull request #2453 from sirosen/testing/coverage/env-var
8962828 Improve env var context manager per review
245d716 Move and make the "_env_var" wrapper testable
77c0000 Bump urllib3 from 2.7.0 to 2.8.0 in /docs
71a34a6 Merge pull request #2484 from jazzband/pre-commit-ci-update-config
8ed9836 [pre-commit.ci] pre-commit autoupdate
28538e4 Merge pull request #2477 from jazzband/dependabot/pip/docs/soupsieve-2.9
Additional commits viewable in compare view



Updates onnxruntime from 1.30.0 to 1.31.0

Release notes
Sourced from onnxruntime's releases.

ONNX Runtime v1.31.0
ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.
Highlights

Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features
Core APIs & Runtime

Stabilized the model-package C and C++ APIs for loading pack...
Description has been truncated

@dependabot
Bump the patch-and-minor group with 8 updates
0526f12 
Bumps the patch-and-minor group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.142.2` | `0.143.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.1` |
| [gliner2](https://github.com/fastino-ai/GLiNER2) | `2.0.0` | `2.1.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.17.0` | `5.19.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.168.5` | `6.169.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.0` |
| [pip-tools](https://github.com/jazzband/pip-tools) | `7.6.1` | `7.6.2` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.30.0` | `1.31.0` |


Updates `fastapi` from 0.142.2 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.143.0)

Updates `pydantic` from 2.13.5 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.1)

Updates `gliner2` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/fastino-ai/GLiNER2/releases)
- [Changelog](https://github.com/fastino-ai/GLiNER2/blob/main/RELEASE.md)
- [Commits](fastino-ai/GLiNER2@v2.0.0...v2.1.0)

Updates `transformers` from 5.17.0 to 5.19.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.17.0...v5.19.0)

Updates `hypothesis` from 6.168.5 to 6.169.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.5...v6.169.0)

Updates `ruff` from 0.16.10 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.0)

Updates `pip-tools` from 7.6.1 to 7.6.2
- [Release notes](https://github.com/jazzband/pip-tools/releases)
- [Changelog](https://github.com/pypa/pip-tools/blob/main/CHANGELOG.md)
- [Commits](pypa/pip-tools@v7.6.1...v7.6.2)

Updates `onnxruntime` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.30.0...v1.31.0)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: gliner2
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: transformers
  dependency-version: 5.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: hypothesis
  dependency-version: 6.169.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: pip-tools
  dependency-version: 7.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: onnxruntime
  dependency-version: 1.31.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants