Skip to content

chore(deps): bump the backend-minor-patch group with 6 updates - #920

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend-minor-patch-4b4b4acdf9
Open

chore(deps): bump the backend-minor-patch group with 6 updates#920
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend-minor-patch-4b4b4acdf9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-minor-patch group with 6 updates:

Package From To
pydantic 2.13.5 2.14.0
fastapi 0.142.2 0.143.0
typer 0.27.2 0.27.3
sqlalchemy 2.1.3 2.1.4
transformers 5.18.0 5.19.0
ultralytics 8.4.173 8.4.174

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates fastapi from 0.142.2 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates sqlalchemy from 2.1.3 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

  • [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

    References: #13659

engine

  • [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

    This change is also backported to: 2.0.55

    References: #13640

  • [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

    This change is also backported to: 2.0.55

    References: #13641

  • [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the Result along with the DBAPI

... (truncated)

Commits

Updates transformers from 5.18.0 to 5.19.0

Release notes

Sourced from transformers's releases.

Release v5.19.0

New Model additions

EmbeddingGemma2

EmbeddingGemma 2 is a multimodal embedding model from Google built on the Gemma 4 architecture. It encodes text, images, audio, and video, individually or combined in one input, into a shared 768-dimensional vector space for cross-modal retrieval, semantic similarity, clustering, and classification. It uses Matryoshka Representation Learning, so embeddings can be truncated to 512, 256, or 128 dimensions. It also offers configurable visual and video token budgets, and unused vision or audio towers can be disabled at load time to save memory.

Links: Documentation

Breaking changes

All MoE models whose routers compute logits now return them when output_router_logits=True, following the Qwen3-MoE pattern (a router_logits recorder on the base model, MoeModelOutputWithPast from the backbone, and a MoE causal LM output from the head), so code that relied on the previous outputs or their absence should read the router logits from these output classes.

Owlv2ForObjectDetection.embed_image_query now selects the query box with the highest objectness score, as in the original OWLv2 notebook, instead of the OWL-ViT heuristic, so image-guided query embeddings and detections may differ from earlier releases.

The "paged|" prefix for SDPA and flash attention implementations is deprecated, so users should set the regular attention implementation (e.g. sdpa or flash_attention_2) for continuous batching instead of paged|sdpa or paged|flash_attention_2.

  • 🚨 Attention 🚨 Deprecate "paged|" prefix for SDPA and flash (#49112) by @​remi-or

The regular flash and SDPA attention functions (flash_attention.py, sdpa_attention.py) now support continuous batching directly, and "paged|..." implementations for these are redirected to them, while eager still requires the "paged|eager" prefix.

In continuous batching, the cache update for the index-based and block-table paths is now fused into a single call, which slightly changes the cache update function's behavior and affects any custom code that calls the separate update paths.

Continuous batching internals changed in preparation for removing "paged": `max

Parallelization

Expert parallelism gains a token-dispatch implementation, selected via the new ep_dispatch_experts plan rule and now the default for Qwen3 MoE and Mellum, which removes the requirement that EP size equal TP size. The Trainer was also adapted to work with expert parallelism, and the docs now note that PEFT adapters support tensor parallelism. A CI-related fix for pipeline-parallel chart2table inference was also included.

Cache

... (truncated)

Commits

Updates ultralytics from 8.4.173 to 8.4.174

Release notes

Sourced from ultralytics's releases.

v8.4.174 - ultralytics 8.4.174 Fix AutoBatch backward profiling for YOLO26 and speed up prediction logs (#26547)

🌟 Summary

Release 8.4.174 fixes AutoBatch’s backward-pass profiling for YOLO26 and speeds up prediction summaries, alongside improvements to exports, inference, tracking, and data handling.

📊 Key Changes

  • AutoBatch profiling — the main change: The profiler now finds tensors inside nested model outputs, so backward profiling works with YOLO26 detection heads and other task heads. Prediction summaries also avoid unnecessary tensor conversions, making their logs faster.
  • More reliable inference and exports: Dynamic CoreML models can handle batches larger than their exported batch size by processing them in chunks. Hailo INT8 optimization now receives reusable calibration images, fixing calibration methods that need to revisit the data.
  • Correct edge-case behavior: Fast-NMS now keeps detections when the IoU threshold is zero. Tracking hides unconfirmed tracks when appropriate without dropping first-frame detections. INT8 calibration warnings are limited to export formats that support calibration data.
  • Improved data handling: Dataset splitting preserves the caller’s random state, DOTA splitting accepts images without label files, and image loading and shape calculations better handle EXIF rotations and Unicode paths. Saved crops also retain dotted source names.
  • More dependable model setup: Predictors and trackers are rebuilt when relevant setup arguments change; model-format detection handles compound filenames more reliably. YouTube inputs no longer require a stream of at least 1080p.
  • Documentation and packaging updates: Guides cover per-object depth estimates and newer Platform workflows, including image search and live-camera inference. Docker images can cache Python bytecode, while CI and Conda guidance were updated for more compatible dependency resolution.

🎯 Purpose & Impact

  • AutoBatch can now measure YOLO26 training memory more accurately. Because backward profiling runs successfully, automatic batch-size selections may change; fixed-batch training and prediction are unaffected.
  • Exported models are more practical across deployment targets. CoreML handles larger prediction batches, and Hailo calibration methods that revisit their input data can work as intended.
  • Predictions and datasets are more consistent in edge cases, reducing unexpected missing detections, failed dataset splits, or crop files that are hard to match to their sources.
  • No model architecture, checkpoint, or default changes are introduced.

What's Changed

New Contributors

Full Changelog: ultralytics/ultralytics@v8.4.173...v8.4.174

Commits
  • ac5c3c0 ultralytics 8.4.174 Fix AutoBatch backward profiling for YOLO26 and speed u...
  • b62cda1 Cache EXIF-rotated image shapes as imread decodes them (#26545)
  • 18ce343 Detect model format from the terminal file suffix (#26549)
  • 7142057 fix: materialize Hailo calibration set before optimization (#26544)
  • 16b9b64 Use rounded letterbox size for per-axis gains in scale_boxes and `scale_coo...
  • 9682c97 Fix dynamic CoreML inference above the export batch limit (#26551)
  • efe2669 Rebuild the predictor and persisted trackers when their arguments change (#26...
  • 8da90a3 Sync docs with explore image search, live camera inference and class-name mat...
  • 97d50a6 Fix model.track unconfirmed leak without clearing first-frame dets (#26543)
  • b739caa Preserve caller random state during autosplit (#26548)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the backend-minor-patch group with 6 updates
2377bc6 
Bumps the backend-minor-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.142.2` | `0.143.0` |
| [typer](https://github.com/fastapi/typer) | `0.27.2` | `0.27.3` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.3` | `2.1.4` |
| [transformers](https://github.com/huggingface/transformers) | `5.18.0` | `5.19.0` |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.173` | `8.4.174` |


Updates `pydantic` from 2.13.5 to 2.14.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.0)

Updates `fastapi` from 0.142.2 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.143.0)

Updates `typer` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `sqlalchemy` from 2.1.3 to 2.1.4
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `transformers` from 5.18.0 to 5.19.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.18.0...v5.19.0)

Updates `ultralytics` from 8.4.173 to 8.4.174
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.173...v8.4.174)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: transformers
  dependency-version: 5.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: ultralytics
  dependency-version: 8.4.174
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added backend visionset Python distribution — kernel, server, cli, mcp, formats dependencies Dependency updates (Dependabot) labels Oct 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backend visionset Python distribution — kernel, server, cli, mcp, formats dependencies Dependency updates (Dependabot)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants