Skip to content

build(deps): bump the uv group across 8 directories with 9 updates - #1529

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-0abd9ed68e
Open

build(deps): bump the uv group across 8 directories with 9 updates#1529
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-0abd9ed68e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 3 updates in the / directory: lightning, mistune and tornado.
Bumps the uv group with 1 update in the /examples/ml/ocr directory: transformers.
Bumps the uv group with 1 update in the /plugins/agents/hermes directory: cryptography.
Bumps the uv group with 1 update in the /plugins/dask directory: tornado.
Bumps the uv group with 1 update in the /plugins/hydra directory: hydra-core.
Bumps the uv group with 1 update in the /plugins/mlflow directory: cryptography.
Bumps the uv group with 2 updates in the /plugins/papermill directory: mistune and tornado.
Bumps the uv group with 1 update in the /plugins/snowflake directory: snowflake-connector-python.

Updates lightning from 2.6.1 to 2.6.5

Release notes

Sourced from lightning's releases.

Lightning 2.6.5

Changes in 2.6.5

Lightning Fabric

  • Use fs.pipe() for S3/GCS checkpoint uploads in _atomic_save (#21595

Full commit list: 2.6.4 -> 2.6.5

Contributors

New Contributors

We thank all folks who submitted issues, features, fixes and doc changes. It's the only way we can collectively make Lightning ⚡ better for everyone, nice job!

In particular, we would like to thank the authors and co-authors of the pull-requests above:

@​c-pozzi @​justusschock

Lightning 2.6.4

Changes in 2.6.4

PyTorch Lightning

  • Removed support for Neptune logger (#21572).

Note: We usually don't remove features in a patch release, however in this case it's an exception since even without removing it the integration would be broken due to Neptune being acquired and sunsetting public service

  • Raised minimum LitLogger version to 2026-03-17 (#21591)

... (truncated)

Commits
  • be98784 Prepare Patch Release 2.6.5 (#21745)
  • 43a4411 Pin PyPI publish action for trusted publishing (#21731)
  • c016e62 Cherry-pick publishing changes to release/stable (#21727)
  • 458c50a ci: disable litbot checkgroup (#21728)
  • 9f074af Prepare Release Note for 2.6.2 Release (#21592)
  • 73f593d Remove NeptuneLogger integration from PyTorch Lightning (#21572)
  • 1690c21 Update Litlogger Integration to latest version (#21591)
  • 6c92678 fix: FSDP mixed precision initializes params in fp32, not bf16/fp16 (#21586)
  • a13361d build(deps): update rich requirement from <14.3.0,>=12.3.0 to >=12.3.0,<14.4....
  • 5730e81 build(deps): update nbconvert requirement from <7.17,>7.14 to >7.14,<7.18 in ...
  • Additional commits viewable in compare view

Updates mistune from 3.3.0 to 3.3.3

Release notes

Sourced from mistune's releases.

v3.3.3

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v3.3.2

   🐞 Bug Fixes

    View changes on GitHub

v3.3.1

   🐞 Bug Fixes

  • abbr: Update process_text method in abrr, adding parse_emphasis parameter  -  by @​lepture (ae850)
  • directive: Use correct file path for include directive  -  by @​lepture (18c21)
    View changes on GitHub
Changelog

Sourced from mistune's changelog.

Version 3.3.3

Released on Jul 9, 2026

  • Limit deeply nested emphasis and image parsing to avoid RecursionError.
  • Fix repeated link suffix and unclosed formatting marker performance issues.
  • Fix unclosed inline spoiler performance issues.
  • Avoid recursive parsing for adjacent ruby tokens.
  • Speed up footnote reference indexing.

Version 3.3.2

Released on Jun 23, 2026

  • Fix Python 3.8 import compatibility in the inline parser.
  • Fix mypy compatibility for list parsing on Python 3.8 and 3.9+.

Version 3.3.1

Released on Jun 22, 2026

  • Fix abbr plugin compatibility with escaped inline text.
  • Normalize included Markdown line endings before parsing directives.
Commits
  • 060f73a chore: release 3.3.3
  • ae7e9d5 perf: improve for footnotes, ruby and spoiler
  • c2228a2 perf: improve performance for math and formatting plugins
  • e001d51 perf: improve link label parsing performance
  • cca5ee6 fix: add image max depth
  • 0938fb7 fix: add max_emphasis_depth
  • 9946c92 tests: update dealine time for pypy
  • 4009f67 fix: use SAFE_PROTOCOLS instead of HARMFUL_PROTOCOLS
  • 3025549 Merge pull request #462 from Sanjays2402/fix/markdown-renderer-escape-emphasis
  • b042996 fix: escape literal emphasis markers in MarkdownRenderer
  • Additional commits viewable in compare view

Updates tornado from 6.5.7 to 6.5.8

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits
  • a55abe3 Merge pull request #3704 from bdarnell/security-6.5.8
  • fc79488 docs: add additional credit to release notes
  • 7b01763 Fix test_strip_headers_on_redirect's URL-embedded-credentials cases
  • d72fff8 release notes and version bump for 6.5.8
  • b168818 auth: Formally deprecated OpenIDMixin
  • da28476 web: Also check for semicolons in deprecated mixed-case cookie args
  • 8d6363e httputil: Enforce a new limit on the number of arguments in a request
  • de85b3f httputil: Apply multipart max_parts limit earlier
  • See full diff in compare view

Updates transformers from 5.0.0rc3 to 5.10.1

Release notes

Sourced from transformers's releases.

Release v5.10.1

v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!

New Model additions

Gemma4 unified+ Gemma4 MTP

Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.

Key differences from standard Gemma 4:

  • No Vision Tower: Raw pixel patches are projected directly into LM space via a Dense + LayerNorm pipeline with factorized 2D positional embeddings, replacing the vision encoder.
  • No Audio Tower: Raw 16 kHz waveform samples are chunked into fixed-length frames and projected through a simple RMSNorm → Linear pipeline, replacing the mel spectrogram + Conformer encoder.
  • Shared Multimodal Pipeline: Both vision and audio use the same Gemma4UnifiedMultimodalEmbedder (RMSNorm → Linear) for the final projection to text hidden space.

You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.

Sapiens2

Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.

Links: Documentation | Paper

DeepSeek-OCR-2

DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.

Links: Documentation

Mellum

Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.

Links: Documentation

Breaking changes

The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.

Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.

... (truncated)

Commits

Updates cryptography from 46.0.7 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates hermes-agent from 0.19.0 to 0.17.0

Commits

Updates tornado from 6.5.7 to 6.5.8

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits
  • a55abe3 Merge pull request #3704 from bdarnell/security-6.5.8
  • fc79488 docs: add additional credit to release notes
  • 7b01763 Fix test_strip_headers_on_redirect's URL-embedded-credentials cases
  • d72fff8 release notes and version bump for 6.5.8
  • b168818 auth: Formally deprecated OpenIDMixin
  • da28476 web: Also check for semicolons in deprecated mixed-case cookie args
  • 8d6363e httputil: Enforce a new limit on the number of arguments in a request
  • de85b3f httputil: Apply multipart max_parts limit earlier
  • See full diff in compare view

Updates hydra-core from 1.3.2 to 1.3.4

Release notes

Sourced from hydra-core's releases.

Hydra 1.3.4

Security patch release for the 1.3 line.

  • Add a blocklist to hydra.utils.instantiate() for security-sensitive _target_ callables.

Users on Hydra 1.3 should upgrade from hydra-core<=1.3.3 to hydra-core==1.3.4.

Hydra 1.3.3 fixes source builds with modern setuptools by removing the setup.py dependency on pkg_resources. Fixes #3207.

Changelog

Sourced from hydra-core's changelog.

1.3.4 (2026-07-05)

Bug Fixes

  • Add an instantiate target blocklist for security-sensitive callables. (#3259) 1.3.3 (2026-06-11) ==================

Bug Fixes

  • Remove the setup.py dependency on pkg_resources for source builds. (#3207)
Commits

Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates mlflow from 3.15.2 to 3.2.0

Changelog

Sourced from mlflow's changelog.

3.15.2 (2026-08-25)

MLflow 3.15.2 is a patch release that includes several major features and improvements.

Features:

Bug fixes:

3.15.1 (2026-08-03)

MLflow 3.15.1 is a patch release that includes bug fixes and documentation updates.

Bug fixes:

  • [Model Registry] Skip env_pack on ARM client images (#24762) (#24835, @​qyc)
  • [Scoring / Tracking] Harden version parsing against missing/non-PEP440 versions on Databricks Serverless (+ lint rule) (#24799) (#24813, @​PattaraS)

Documentation updates:

3.15.0 (2026-07-31)

MLflow 3.15.0 includes several major features and improvements

Major New Features

  • 🧩 MCP Registry: A centralized catalog for registering, versioning, and sharing Model Context Protocol servers — with semantic-versioned configs, promotable aliases, tags, auto-discovered tools, and ready-made connection instructions for Claude Code and .mcp.json. Manage it from the UI, REST API, or Python!
  • 🤖 MLflow Assistant enhancements: The in-app AI assistant now supports multiple LLM providers (Claude Code, Codex, and OpenAI-compatible/Gateway endpoints) chosen from a single settings page, displays live per-session token usage and estimated cost in the composer, and is easier to set up — mlflow agent setup can enable it in one prompt, with API keys stored securely in the Gateway's LLM Connections.
  • 🗂️ Sharable table views: Save named views of the Runs table — capturing columns, order, widths, filters, and sort — and share them by URL.
  • ⚡ Proxy-less artifact upload/download via presigned URLs: Large artifact transfers can now bypass the tracking server and talk directly to cloud storage (e.g. S3) through presigned URLs, cutting server load and timeouts on big files. We fall back to proxied transfer automatically for backward compatibility.
  • 🖼️ Multi-modal attachments in LLM judges: {{ trace }} judges created with make_judge() can now see images captured in trace spans via a new get_span_image tool, which fetches attachments as base64 data URLs and passes them to multimodal models (Anthropic, Gemini, and OpenAI-compatible via litellm) — enabling evaluation of vision tasks, screenshots, and other visual content.

Other Assorted Features & Improvements:

  • [Tracing / Tracking] Add Pydantic AI 2.x autologging support (#24721, @​B-Step62)
  • [Tracing / UI] [3/3] Add action recommendation for low-value issue detection result (#24580, @​B-Step62)
  • [Gateway] Support per-endpoint budget policies in the AI Gateway (#24370, @​joelrobin18)
  • [Evaluation / Gateway] Add sap-ai-core:/ provider for SAP AI Core Orchestration v2 with extra_headers support (#24356, @​shivamxtech)
  • [Model Registry] [Model Registry] Migrate UC model artifact download to native temp-creds (#24576, @​AknA13)
  • [Gateway / Tracing / UI] [2/3] Simplify issue detection start modal (#24579, @​B-Step62)
  • [Tracing / UI] [1/3] Run issue detection in the background (#24578, @​B-Step62)
  • [Tracing] [BUG] Fix otel parent context propagation (#24444, @​iyashk)

... (truncated)

Commits

Updates mistune from 3.3.0 to 3.3.3

Release notes

Sourced from mistune's releases.

v3.3.3

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v3.3.2

   🐞 Bug Fixes

    View changes on GitHub

v3.3.1

   🐞 Bug Fixes

  • abbr: Update process_text method in abrr, adding parse_emphasis parameter  -  by @​lepture (ae850)
  • directive: Use correct file path for include directive  -  by @​lepture (18c21)
    View changes on GitHub
Changelog

Sourced from mistune's changelog.

Version 3.3.3

Released on Jul 9, 2026

  • Limit deeply nested emphasis and image parsing to avoid RecursionError.
  • Fix repeated link suffix and unclosed formatting marker performance issues.
  • Fix unclosed inline spoiler performance issues.
  • Avoid recursive parsing for adjacent ruby tokens.
  • Speed up footnote reference indexing.

Version 3.3.2

Released on Jun 23, 2026

  • Fix Python 3.8 import compatibility in the inline parser.
  • Fix mypy compatibility for list parsing on Python 3.8 and 3.9+.

Version 3.3.1

Released on Jun 22, 2026

  • Fix abbr plugin compatibility with escaped inline text.
  • Normalize included Markdown line endings before parsing directives.
Commits
  • 060f73a chore: release 3.3.3
  • ae7e9d5 perf: improve for footnotes, ruby and spoiler
  • c2228a2 perf: improve performance for math and formatting plugins
  • e001d51 perf: improve link label parsing performance
  • cca5ee6 fix: add image max depth
  • 0938fb7 fix: add max_emphasis_depth
  • 9946c92 tests: update dealine time for pypy
  • 4009f67 fix: use SAFE_PROTOCOLS instead of HARMFUL_PROTOCOLS
  • 3025549 Merge pull request #462 from Sanjays2402/fix/markdown-renderer-escape-emphasis
  • b042996 fix: escape literal emphasis markers in MarkdownRenderer
  • Additional commits viewable in compare view

Updates tornado from 6.5.7 to 6.5.8

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits
  • a55abe3 Merge pull request #3704 from bdarnell/security-6.5.8
  • fc79488 docs: add additional credit to release notes
  • 7b01763 Fix test_strip_headers_on_redirect's URL-embedded-credentials cases
  • d72fff8 release notes and version bump for 6.5.8
  • b168818 auth: Formally deprecated OpenIDMixin
  • da28476 web: Also check for semicolons in deprecated mixed-case cookie args
  • 8d6363e httputil: Enforce a new limit on the number of arguments in a request
  • de85b3f httputil: Apply multipart max_parts limit earlier
  • See full diff in compare view

Updates snowflake-connector-python from 4.4.0 to 4.7.1

Release notes

Sourced from snowflake-connector-python's releases.

4.7.1

  • v4.7.1(Jul 15,2026)
    • Added support for Python 3.14t (free-threaded).
      • Note: Python 3.14t CI testing excludes win_arm64 (no cryptography wheels available) and mitmproxy proxy tests on all platforms (transitive dependencies aioquic/pylsqpack lack free-threaded-compatible wheels).
    • Improved verification of TLS connections (SNOW-3675579).
    • Fixed python-connector.log not rotating on Windows, and every record being logged twice, when easy logging is enabled via config.toml (SNOW-3680325).
      • Note: As part of this fix, easy logging no longer calls logging.basicConfig() and therefore no longer configures the root logger. python-connector.log now captures only the snowflake.connector, botocore, and boto3.
    • Improved URL validation reliability by replacing the hand-rolled regex in is_valid_url() with urllib.parse.urlparse (SNOW-3392651).
    • Fixed OAuth infinite loop when tokens expire by ensuring reauthenticate() calls _request_tokens() directly instead of looping through prepare(). Token cache is now read exactly once per connection, and _store_tokens() preserves macOS Keychain ACL by never calling remove(). The async OAuth reauthenticate() now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
    • Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC offline_access scope for token endpoints on *.snowflakecomputing.com<...

      Description has been truncated

@dependabot
build(deps): bump the uv group across 8 directories with 9 updates
a626c2d 
Bumps the uv group with 3 updates in the / directory: [lightning](https://github.com/Lightning-AI/pytorch-lightning), [mistune](https://github.com/lepture/mistune) and [tornado](https://github.com/tornadoweb/tornado).
Bumps the uv group with 1 update in the /examples/ml/ocr directory: [transformers](https://github.com/huggingface/transformers).
Bumps the uv group with 1 update in the /plugins/agents/hermes directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /plugins/dask directory: [tornado](https://github.com/tornadoweb/tornado).
Bumps the uv group with 1 update in the /plugins/hydra directory: [hydra-core](https://github.com/facebookresearch/hydra).
Bumps the uv group with 1 update in the /plugins/mlflow directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 2 updates in the /plugins/papermill directory: [mistune](https://github.com/lepture/mistune) and [tornado](https://github.com/tornadoweb/tornado).
Bumps the uv group with 1 update in the /plugins/snowflake directory: [snowflake-connector-python](https://github.com/snowflakedb/snowflake-connector-python).


Updates `lightning` from 2.6.1 to 2.6.5
- [Release notes](https://github.com/Lightning-AI/pytorch-lightning/releases)
- [Commits](Lightning-AI/pytorch-lightning@2.6.1...2.6.5)

Updates `mistune` from 3.3.0 to 3.3.3
- [Release notes](https://github.com/lepture/mistune/releases)
- [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst)
- [Commits](lepture/mistune@v3.3.0...v3.3.3)

Updates `tornado` from 6.5.7 to 6.5.8
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.7...v6.5.8)

Updates `transformers` from 5.0.0rc3 to 5.10.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.0.0rc3...v5.10.1)

Updates `cryptography` from 46.0.7 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.7...50.0.0)

Updates `hermes-agent` from 0.19.0 to 0.17.0
- [Release notes](https://github.com/NousResearch/hermes-agent/releases)
- [Commits](https://github.com/NousResearch/hermes-agent/commits)

Updates `tornado` from 6.5.7 to 6.5.8
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.7...v6.5.8)

Updates `hydra-core` from 1.3.2 to 1.3.4
- [Release notes](https://github.com/facebookresearch/hydra/releases)
- [Changelog](https://github.com/hydra-ecosystem/hydra/blob/v1.3.4/NEWS.md)
- [Commits](hydra-ecosystem/hydra@v1.3.2...v1.3.4)

Updates `cryptography` from 49.0.0 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.7...50.0.0)

Updates `mlflow` from 3.15.2 to 3.2.0
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.15.2...v3.2.0)

Updates `mistune` from 3.3.0 to 3.3.3
- [Release notes](https://github.com/lepture/mistune/releases)
- [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst)
- [Commits](lepture/mistune@v3.3.0...v3.3.3)

Updates `tornado` from 6.5.7 to 6.5.8
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.7...v6.5.8)

Updates `snowflake-connector-python` from 4.4.0 to 4.7.1
- [Release notes](https://github.com/snowflakedb/snowflake-connector-python/releases)
- [Commits](snowflakedb/snowflake-connector-python@v4.4.0...v4.7.1)

---
updated-dependencies:
- dependency-name: lightning
  dependency-version: 2.6.5
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: mistune
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.8
  dependency-type: indirect
  dependency-group: uv
- dependency-name: transformers
  dependency-version: 5.10.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: hermes-agent
  dependency-version: 0.17.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.8
  dependency-type: indirect
  dependency-group: uv
- dependency-name: hydra-core
  dependency-version: 1.3.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mlflow
  dependency-version: 3.2.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: mistune
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.8
  dependency-type: indirect
  dependency-group: uv
- dependency-name: snowflake-connector-python
  dependency-version: 4.7.1
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants