Skip to content

chore(deps): bump the python-dependencies group across 1 directory with 4 updates - #246

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/api/measure/python-dependencies-934d7133bd
Open

chore(deps): bump the python-dependencies group across 1 directory with 4 updates#246
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/api/measure/python-dependencies-934d7133bd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 4 updates in the /api/measure directory: fastapi, uvicorn, mediapipe and numpy.

Updates fastapi from 0.141.1 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates mediapipe from 1.0.1 to 1.1.0

Release notes

Sourced from mediapipe's releases.

MediaPipe v1.1.0

Build and Bazel changes

  • Remove the dependency on internal Bazel Apple rules resources.bzl in mediapipe/metal.bzl, using the metal rule provided by Bazel Apple rules.
  • Add Python 3.13 and 3.14 support to the MediaPipe Bazel build.
  • Upgrade LiteRT dependency to v2.2.0 in MediaPipe WORKSPACE.
  • Move up declaration of kissfft in build configuration.
  • Fix xla llvm download URL by using mediapipe-assets mirror.
  • Fix Windows build.
  • Remove obsolete unistd.h header imports.
  • Configure MediaPipe for vendor/no-JNI Android builds.

Framework and core calculator improvements

  • Bump MediaPipe version to 1.1.0.
  • Add MediaPipe Universal Embedder, Semantic Retriever, and LiteRT-LM integration across C++, C, Python, and Android/Maven APIs.
  • MediaPipe Decision: Add EmbeddingGemma 1 & 2 decision backend with multimodal state and option support.
  • Implement core TaskPart and EmbeddingProvider interface.
  • Refactor TextPart, AudioPart, and ImagePart into tasks.core and unify duplicates.
  • Refactor TextEmbedder and ImageEmbedder to use executor abstractions (TextEmbedderExecutor, ImageEmbedderExecutor).
  • Add HasFile, GetBundleManifest, and GetBundleId helpers to ModelAssetBundleResources.
  • Add noexcept to move ctor/operator and add swap to Packet.
  • Add method to create an empty packet in Java API.
  • Use ABSL_ASSIGN_OR_RETURN and ABSL_RETURN_IF_ERROR in MediaPipe.
  • Rename GeckoPreprocessorCalculator to SentencePiecePreprocessorCalculator.
  • Add option to ignore missing encoded_media_bytes in UnpackMediaSequenceCalculator.
  • Add LiteRT-LM based C++ Audio Embedder.
  • C API for MediaPipe AudioEmbedder.
  • Select the MediaPipe OpenGL device by Vulkan device UUID.
  • Replace LiteRT delegate with use_litert option in MediaPipe BaseOptions.
  • Expose LiteRT and NPU delegate options to MediaPipe Tasks.
  • Only use public LiteRT API in LiteRT inference calculator.
  • Support passing LiteRtSystemHandles to Environment in LiteRT Inference Calculator.
  • Add support for specifying a signature key for LiteRT inference.
  • Retain MTLCommandQueue directly instead of DrishtiMetalHelper in InferenceRunnerLiteRt.
  • Use runtime layout for rank-0 LiteRT model outputs in InferenceRunnerLiteRt.
  • Check GPU service availability in TensorsToDetectionsCalculator.
  • Improve MediaPipe Metal GPU delegate error messages for unsupported configurations.
  • Allow size mismatched tensors for GPU execution.
  • Fix race condition in GpuResources.
  • Fix deprecated CreateSourceTexture usage in desktop GPU example.

MediaPipe Tasks update

This section highlights the changes that are done specifically for each platform and don't propagate to other platforms.

Android

  • Add plumbing needed for zero-copy AHardwareBuffer (AHWB) output from the GPU.
  • Fix OpenGL ES and AHardwareBuffer synchronization when converting between write and read views.
  • Wrap VC effects AHWB graph input as AHardwareBuffer (kRGBA32).
  • Raise MediaPipeException instead of crashing in surface_output_jni on Android EGL surface creation failure.
  • Fix crash in PathToResourceAsFile when TEST_SRCDIR is not set on Android.
  • Made AppSearch vector store optional for SemanticRetriever Android SDK.

... (truncated)

Commits

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-dependencies group across 1 directory wi…
b8cc9d8 
…th 4 updates

Bumps the python-dependencies group with 4 updates in the /api/measure directory: [fastapi](https://github.com/fastapi/fastapi), [uvicorn](https://github.com/Kludex/uvicorn), [mediapipe](https://github.com/google/mediapipe) and [numpy](https://github.com/numpy/numpy).


Updates `fastapi` from 0.141.1 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.143.0)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `mediapipe` from 1.0.1 to 1.1.0
- [Release notes](https://github.com/google/mediapipe/releases)
- [Commits](https://github.com/google/mediapipe/commits/v1.1.0)

Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mediapipe
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hibeekaey hibeekaey Awaiting requested review from hibeekaey hibeekaey is a code owner
@chordzz chordzz Awaiting requested review from chordzz chordzz is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants