Skip to content

chore(deps)(deps): bump the python-versions group across 1 directory with 14 updates - #1075

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-0cb04ed74d
Open

chore(deps)(deps): bump the python-versions group across 1 directory with 14 updates#1075
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-0cb04ed74d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-versions group with 13 updates in the / directory:

Package From To
huggingface-hub 1.27.0 1.28.0
scipy-stubs 1.18.0.1 1.18.1.0
pydata-sphinx-theme 0.20.0 0.21.0
sphinx-autodoc-typehints 3.13.2 3.13.4
dagster 1.13.18 1.13.20
pydantic 2.13.4 2.13.5
onnxruntime 1.28.0 1.29.0
onnxruntime-gpu 1.28.0 1.29.0
holidays 0.102 0.103
mlflow-skinny 3.15.1 3.15.2
scipy 1.18.0 1.18.1
xgboost 3.4.0 3.4.1
xgboost-cpu 3.4.0 3.4.1

Updates huggingface-hub from 1.27.0 to 1.28.0

Release notes

Sourced from huggingface-hub's releases.

[v1.28.0] Hardware discovery and managed engine images for Inference Endpoints and more

🔎 Discover deployable hardware with hf endpoints hardware

Deploying an Inference Endpoint requires five hardware flags (--vendor, --region, --accelerator, --instance-type, --instance-size) whose valid values depend on each other, and until now there was no way to learn them from the CLI. The new hf endpoints hardware command lists the valid combinations along with the price per replica per hour and your namespace's accelerator quota, filtered by default to the hardware you can deploy on right now. The same data is available in the SDK via list_inference_endpoints_hardware(), which flattens the API response into InferenceEndpointHardware objects you can filter programmatically.

>>> hf endpoints hardware --vendor aws --region eu-west-1
VENDOR REGION    ACCELERATOR INSTANCE_TYPE INSTANCE_SIZE MEMORY_GB GPU_MEMORY_GB PRICE_PER_HOUR QUOTA STATUS
------ --------- ----------- ------------- ------------- --------- ------------- -------------- ----- ---------
aws    eu-west-1 cpu         intel-spr     x1                  2.0                        0.033 0/60  available
aws    eu-west-1 cpu         intel-spr     x2                  4.0                        0.067 0/60  available
aws    eu-west-1 gpu         nvidia-a10g   x1                 30.0            24            1.0 0/16  available
aws    eu-west-1 gpu         nvidia-t4     x1                 15.0            16            0.5 1/30  available

🚀 Managed engine images and multi-accelerator parallelism for Inference Endpoints

custom_image now accepts the engine-specific container types supported by the API: key the dictionary with the engine name (vLLM, sGLang, tgi, tei, llamacpp, hfServe, ...) instead of leaving it flat, and each engine takes the usual container fields plus its own tuning options. Any dict without a top-level url is forwarded to the API untouched, so engines added to the API later will work without upgrading huggingface_hub, and update_inference_endpoint now handles the same payload shapes as create_inference_endpoint. On the CLI, hf endpoints deploy and hf endpoints update gain --engine, --tensor-parallel-size and --data-parallel-size, and update also accepts --custom-image, --health-route and --port. This matters because vLLM and SGLang default to a single accelerator while an endpoint is allocated every accelerator of its instance — the API now rejects that misconfiguration, and these flags are how you set things right.

$ hf endpoints deploy gpt-oss-120b-vllm --repo openai/gpt-oss-120b --framework custom \
    --accelerator gpu --instance-size x8 --instance-type nvidia-h200 --region us-east-1 --vendor aws \
    --engine vllm --custom-image vllm/vllm-openai:v0.23.0 --tensor-parallel-size 8
Retune a running endpoint
$ hf endpoints update gpt-oss-120b-vllm --tensor-parallel-size 4 --data-parallel-size 2

💔 Breaking change: huggingface_hub.constants.INFERENCE_ENDPOINT_IMAGE_KEYS is removed. It was never exported at the package root nor documented, but code reading it directly will now get an AttributeError.

  • [Inference Endpoints] Support managed engine images in custom_image by @​hanouticelina in #4671
  • [CLI] Add --tensor-parallel-size / --data-parallel-size to hf endpoints deploy and update by @​moon-bot-app[bot] in #4661

🤖 Inference

  • [Inference Providers] deepinfra: add text-to-speech support by @​ovuruska in #4559
  • [Inference Providers] deepinfra: add feature-extraction support by @​ovuruska in #4656

🖥️ CLI

🐛 Bug and typo fixes

... (truncated)

Commits
  • b2da2d4 Release: v1.28.0
  • a718e44 Release: v1.28.0.rc0
  • 7105c3d [CLI] Add --tensor-parallel-size / --data-parallel-size to `hf endpoints depl...
  • a3d9d8a [Inference Endpoints] Omit model.task instead of sending null on create (#4...
  • 909b162 [Inference Endpoints] Add hf endpoints hardware to list available instances...
  • 5ac9711 Do not use a redirect's Content-Length as file size in get_hf_file_metadata (...
  • 99aba55 [Docs] Normalize malformed docstring parameter entries (#4623)
  • 2e6c67d [Inference Providers] deepinfra: add feature-extraction (embeddings) support ...
  • 7a522f0 docs: remove obsolete Repository guide references (#4679)
  • aa40a65 [Download] Fix ResolvedRevision string value after pickle/copy (#4692)
  • Additional commits viewable in compare view

Updates scipy-stubs from 1.18.0.1 to 1.18.1.0

Release notes

Sourced from scipy-stubs's releases.

v1.18.1.0

This scipy-stubs release comes with many improvements and even more fixes. It targets SciPy 1.18.1 and supports Python 3.12–3.15, NumPy 2.0–2.7, and optype 0.15–0.19.

🏆 Release Highlights

  • ✨ 105 improvements
  • 🐛 129 fixes
  • ✅ 100% test coverage
  • 🏷️ linalg.blas & linalg.lapack complete type coverage

What's Changed

⏬ SciPy Changes

✨ Improvements

... (truncated)

Commits
  • 844c24a 🔖 scipy-stubs 1.18.1.0
  • 6d3c811 Merge pull request #2302 from scipy:remove-update_dprint-workflow
  • fb4c765 ⚰️ remove broken update_dprint workflow
  • 19b2cb9 Merge pull request #2301 from scipy/bump-dev-deps
  • 7fbe7a2 ⬆️ update development dependencies
  • bd8ad95 Merge pull request #2300 from scipy:scipy-1.18.1
  • 52ce801 👽️ version: update version literals
  • 93cf36f 👽️ interpolate: update __class_getitem__ classmethods
  • c7cf199 📌 SciPy 1.18.1
  • 968e187 Merge pull request #2299 from scipy:stats.linregress/propagate-f32
  • Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.20.0 to 0.21.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.21.0

What's Changed

Breaking

None.

Fixes

Improvements

Dependencies

New Contributors

Full Changelog: pydata/pydata-sphinx-theme@v0.20.0...v0.21.0

Commits
  • a52f5c9 Bump 0.20.0 -> 0.21.0 (#2472)
  • dc10572 Prevent "Back to Top" button from being cropped on firefox/android (#2442)
  • a9f2040 Bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#2468)
  • fe3f573 Bump py-cov-action/python-coverage-comment-action from 4.1 to 4.3 (#2467)
  • 3e15d01 fix: don't share sidebars between pages with non-flat output URIs (#2469)
  • c90610d fix: correct typo in source (#2459)
  • 051ac2c Avoid redundant processing when collapse_navigation=False (#2449)
  • ca91fce refactor: drop user-select rule superseded by Sphinx's basic.css (#2464)
  • 2a63b5c Bump js-yaml from 4.2.0 to 4.3.1 (#2463)
  • cbb254b Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#2460)
  • Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.13.2 to 3.13.4

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.4

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.3...3.13.4

3.13.3

What's Changed

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.2...3.13.3

Commits
  • 7853f2e 🧪 test(docstring): pin what a nested handler restores (#759)
  • a708030 🐛 fix(resolver): bind only what a guarded statement defines (#760)
  • f6ca3fd 🐛 fix(parser): stop shadowing intersphinx roles in the type role (#761)
  • 02dd58f 🐛 fix(docstring): survive a re-entrant docstring handler (#758)
  • 3f6d334 🐛 fix(resolver): accept guarded code the interpreter rejects (#757)
  • d98ed0b 🐛 fix(parser): stop shadowing intersphinx roles in the rtype probe (#756)
  • c4b99d0 🔧 chore: batch dependency updates weekly on Tuesday (#755)
  • ce9abe3 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#754)
  • a032f12 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#752)
  • 3528bac [pre-commit.ci] pre-commit autoupdate (#749)
  • Additional commits viewable in compare view

Updates dagster from 1.13.18 to 1.13.20

Release notes

Sourced from dagster's releases.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster's changelog.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 728c047 1.13.20
  • cbad617 1.13.20 changelog (#26540)
  • de1c658 [rest-resources] support python 3.10 list[<type>] import resolution (#26523)
  • f08ff1a [app-managed-components][3/n] view and edit the repo binding from the code lo...
  • b611753 [app-managed-components] mock the git-backed gate in the component dialog tes...
  • 933db15 [app-managed-components][2/n] gate the authoring entry point on a repo bindin...
  • 5602898 [app-managed-components] Tell users the authoring form opens a pull request (...
  • a0686ab FE wiring for ability to wipe and delete partitions simultaneously (#26365)
  • dab616f Add a section for recent searches to our syntax typeaheads [UI-4] (#26363)
  • 0684508 [ui-core] Update Google kind tags with new icons (#33882)
  • Additional commits viewable in compare view

Updates dagster-webserver from 1.13.18 to 1.13.20

Release notes

Sourced from dagster-webserver's releases.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Changelog

Sourced from dagster-webserver's changelog.

1.13.20 (core) / 0.29.20 (libraries)

New

  • In Dagster+, dynamic partitions can now be wiped and deleted in a single action, clearing the asset's degraded health status. Multi-partitioned assets are not yet supported.
  • Alert policies can now notify on successful code location deploys.
  • [ui] Filter inputs now show your recent searches in the autocomplete dropdown before you start typing.
  • [ui] Refreshed the Dagster and Dagster+ logos and favicons to the new branding.
  • [ui] Updated the Google kind tag icons. (Thanks, @​dragos-pop!)

Bugfixes

  • [dagster-aws] Fixed an issue where an ECS run launch would fail instead of retrying when ECS reported a transient AGENT failure. (Thanks, @​yishern!)

1.13.19 (core) / 0.29.19 (libraries)

New

  • [ui] Added an expand/collapse all toggle to the automation condition evaluation table.

Bugfixes

  • [ui] Fixed an issue where the sensor dry run "Apply requests & commit tick result" action could launch runs even when creating or deleting dynamic partitions failed due to insufficient permissions.
Commits
  • 728c047 1.13.20
  • cbad617 1.13.20 changelog (#26540)
  • de1c658 [rest-resources] support python 3.10 list[<type>] import resolution (#26523)
  • f08ff1a [app-managed-components][3/n] view and edit the repo binding from the code lo...
  • b611753 [app-managed-components] mock the git-backed gate in the component dialog tes...
  • 933db15 [app-managed-components][2/n] gate the authoring entry point on a repo bindin...
  • 5602898 [app-managed-components] Tell users the authoring form opens a pull request (...
  • a0686ab FE wiring for ability to wipe and delete partitions simultaneously (#26365)
  • dab616f Add a section for recent searches to our syntax typeaheads [UI-4] (#26363)
  • 0684508 [ui-core] Update Google kind tags with new icons (#33882)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates onnxruntime from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates onnxruntime-gpu from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime-gpu's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872<...

    Description has been truncated

@dependabot
chore(deps)(deps): bump the python-versions group across 1 directory …
37cebb7 
…with 14 updates

Bumps the python-versions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.27.0` | `1.28.0` |
| [scipy-stubs](https://github.com/scipy/scipy-stubs) | `1.18.0.1` | `1.18.1.0` |
| [pydata-sphinx-theme](https://github.com/pydata/pydata-sphinx-theme) | `0.20.0` | `0.21.0` |
| [sphinx-autodoc-typehints](https://github.com/tox-dev/sphinx-autodoc-typehints) | `3.13.2` | `3.13.4` |
| [dagster](https://github.com/dagster-io/dagster) | `1.13.18` | `1.13.20` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [onnxruntime-gpu](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [holidays](https://github.com/vacanza/holidays) | `0.102` | `0.103` |
| [mlflow-skinny](https://github.com/mlflow/mlflow) | `3.15.1` | `3.15.2` |
| [scipy](https://github.com/scipy/scipy) | `1.18.0` | `1.18.1` |
| [xgboost](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |
| [xgboost-cpu](https://github.com/dmlc/xgboost) | `3.4.0` | `3.4.1` |



Updates `huggingface-hub` from 1.27.0 to 1.28.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.27.0...v1.28.0)

Updates `scipy-stubs` from 1.18.0.1 to 1.18.1.0
- [Release notes](https://github.com/scipy/scipy-stubs/releases)
- [Commits](scipy/scipy-stubs@v1.18.0.1...v1.18.1.0)

Updates `pydata-sphinx-theme` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/pydata/pydata-sphinx-theme/releases)
- [Changelog](https://github.com/pydata/pydata-sphinx-theme/blob/main/RELEASE.md)
- [Commits](pydata/pydata-sphinx-theme@v0.20.0...v0.21.0)

Updates `sphinx-autodoc-typehints` from 3.13.2 to 3.13.4
- [Release notes](https://github.com/tox-dev/sphinx-autodoc-typehints/releases)
- [Commits](tox-dev/sphinx-autodoc-typehints@3.13.2...3.13.4)

Updates `dagster` from 1.13.18 to 1.13.20
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.20)

Updates `dagster-webserver` from 1.13.18 to 1.13.20
- [Release notes](https://github.com/dagster-io/dagster/releases)
- [Changelog](https://github.com/dagster-io/dagster/blob/master/CHANGES.md)
- [Commits](dagster-io/dagster@1.13.18...1.13.20)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `onnxruntime` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `onnxruntime-gpu` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `holidays` from 0.102 to 0.103
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.102...v0.103)

Updates `mlflow-skinny` from 3.15.1 to 3.15.2
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.15.1...v3.15.2)

Updates `scipy` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

Updates `xgboost` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

Updates `xgboost-cpu` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.4.0...v3.4.1)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy-stubs
  dependency-version: 1.18.1.0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pydata-sphinx-theme
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-autodoc-typehints
  dependency-version: 3.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster
  dependency-version: 1.13.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: dagster-webserver
  dependency-version: 1.13.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: onnxruntime
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: onnxruntime-gpu
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: holidays
  dependency-version: '0.103'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: mlflow-skinny
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: xgboost-cpu
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from a team August 31, 2026 04:42
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 31, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants