build(deps): bump the compatible-updates group across 1 directory with 11 updates

[dependabot]

Bumps the compatible-updates group with 11 updates in the / directory:

Package	From	To
dbos	2.28.0	2.29.0
filelock	3.32.0	3.32.2
genai-prices	0.0.72	0.1.0
huggingface-hub	1.25.1	1.26.0
mpmath	1.3.0	1.4.1
openai	2.50.0	2.51.0
pydantic-ai-slim	2.20.0	2.21.0
pydantic-core	2.46.4	2.47.0
pydantic-graph	2.20.0	2.21.0
tokenizers	0.22.2	0.23.1
uvicorn	0.51.0	0.52.0

Updates dbos from 2.28.0 to 2.29.0

Release notes

Sourced from dbos's releases.

2.29.0

Note: This release formally deprecates the internal DBOS admin server. It is now off by default. It will be removed in a future version of DBOS.

What's Changed

• Resume Fails on Non-Existent Workflow by @​kraftp in dbos-inc/dbos-transact-py#787
• Fix Kafka Logging by @​kraftp in dbos-inc/dbos-transact-py#789
• Idempotent Recovery by @​kraftp in dbos-inc/dbos-transact-py#786
• Fix Flaky SQLite Tests by @​kraftp in dbos-inc/dbos-transact-py#790
• Add print only flags to dbos migrate by @​maxdml in dbos-inc/dbos-transact-py#780
• Better Index Partition Keys by @​kraftp in dbos-inc/dbos-transact-py#791
• Move CLI From Typer to Click by @​kraftp in dbos-inc/dbos-transact-py#792
• Partition Key Index Fixes by @​kraftp in dbos-inc/dbos-transact-py#794
• Improve Timing Records by @​kraftp in dbos-inc/dbos-transact-py#793
• Deprecate the Admin Server by @​kraftp in dbos-inc/dbos-transact-py#795
• Fix Spurious Error Log by @​kraftp in dbos-inc/dbos-transact-py#797
• Optimize Partition Query by @​kraftp in dbos-inc/dbos-transact-py#800
• Batch Partitioned Queues by @​kraftp in dbos-inc/dbos-transact-py#802

Full Changelog: dbos-inc/dbos-transact-py@2.28.0...2.29.0

Commits

• ab99c99 Batch Partitioned Queues (#802)
• f5d47f0 Optimize Partition Query (#800)
• d1b4c6f Fix Spurious Error Log (#797)
• fd9d33a Deprecate the Admin Server (#795)
• 0884e30 Improve Timing Records (#793)
• ae9d5f8 Partition Key Index Fixes (#794)
• bd2d864 Move CLI From Typer to Click (#792)
• 5037f91 Better Index Partition Keys (#791)
• 50234b2 Add print only flags to dbos migrate (#780)
• 311a8b8 Fix Flaky SQLite Tests (#790)
• Additional commits viewable in compare view

Updates filelock from 3.32.0 to 3.32.2

Release notes

Sourced from filelock's releases.

3.32.2

What's Changed

• Fix test failures on NetBSD (#689) by @​gaborbernat in tox-dev/filelock#693
• 🧪 test(soft-rw): deflake writer phase-2 peer-marker test by @​gaborbernat in tox-dev/filelock#694
• hand back the claim when a heartbeat thread fails to start by @​dxbjavid in tox-dev/filelock#691
• 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by @​gaborbernat in tox-dev/filelock#695

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.32.2 (2026-07-29)

---

• A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

---

3.32.1 (2026-07-26)

---

• Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

---

3.32.0 (2026-07-21)

---

• SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
• Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
• The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

---

3.31.2 (2026-07-21)

---

• filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

---

3.31.1 (2026-07-20)

---

• A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

---

... (truncated)

Commits

• 9a6cc43 Release 3.32.2
• 56879c7 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (#695)
• ecf5be0 hand back the claim when a heartbeat thread fails to start (#691)
• ee70d2e 🧪 test(soft-rw): deflake writer phase-2 peer-marker test (#694)
• 1eb14dd Fix test failures on NetBSD (#689) (#693)
• d81e859 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#692)
• 6fbc905 [pre-commit.ci] pre-commit autoupdate (#690)
• 34d1c38 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#688)
• bf13ec7 Release 3.32.1
• 887f114 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#687)
• Additional commits viewable in compare view

Updates genai-prices from 0.0.72 to 0.1.0

Commits

• f1c7fab Prep 0.1.0 release (#528)
• e15b266 feat: publish v2 pricing data for expanded billing units (#512)
• d97b240 Prep 0.0.73 release (#521)
• 189073d build: validate unit registry and provider usage (#511)
• 9682d06 fix: validate Python pricing inputs (#519)
• 7f60b4d refactor: use unit registry in JavaScript runtime (#510)
• 2a1225a refactor: use unit registry in Python runtime (#509)
• 3d97646 build: generate static unit registry data (#507)
• 78c6ff5 docs: add data-driven unit registry specs (#506)
• 4ecb864 Honor timezone-aware price intervals in JavaScript (#508)
• Additional commits viewable in compare view

Updates huggingface-hub from 1.25.1 to 1.26.0

Release notes

Sourced from huggingface-hub's releases.

[v1.26.0] Resolve revisions only once, security hardening, and resource groups for Jobs & Collections

📌 Pin a revision once with resolve_revision

Libraries that download many files one by one (config, weights, tokenizer, processor, ...) had to resolve revision="main" into a commit hash on every call — costing one HTTP request per file and risking two calls landing on two different commits if the repo is updated in between. The new HfApi.resolve_revision resolves the revision once and returns a ResolvedRevision: a str subclass whose value stays the user-facing revision (so error messages keep saying "main") while its .resolved attribute holds the commit hash. Download helpers (hf_hub_download, snapshot_download, get_cached_repo_tree) detect it and use the commit hash directly, guaranteeing every file comes from the same commit. The mapping is also written to the refs/ folder of the cache, so later runs in offline mode transparently fall back to the cached value.

>>> from huggingface_hub import resolve_revision, hf_hub_download
>>> revision = resolve_revision("openai-community/gpt2")
>>> revision
ResolvedRevision(initial=None, resolved='607a30d783dfa663caf39e06633721c8d4cfcd7e')
>>> revision == "main"  # readable error messages
True
>>> config = hf_hub_download("openai-community/gpt2", "config.json", revision=revision)
>>> weights = hf_hub_download("openai-community/gpt2", "model.safetensors", revision=revision)

📚 Documentation: Manage the cache — Pin a revision (advanced)

• [Download] Add HfApi.resolve_revision and ResolvedRevision by @​Wauplin in #4604

🔒 Security hardening for downloads and sandboxes

This release ships two security fixes. First, downloading or uploading to a --local-dir now rejects absolute, drive-relative, root-relative, UNC and ..-traversal filenames on all platforms, interpreting each name under both POSIX and Windows rules (refs CVE-2026-15717). Previously only a Windows-only ..\ check existed, so a malicious repo could write files outside the target directory on Windows clients — and even leak a NetNTLMv2 hash via UNC paths. Legitimate repo filenames never contain such segments, so real downloads are unaffected; note that exotic names like folder/..\..\..\file, previously tolerated on Linux, are now rejected everywhere. Second, Sandbox.create no longer injects your HF token into the job environment to download the sbx-server binary: the bucket is public, so the bootstrap now downloads it anonymously and no HF credential ever lands in the sandbox unless you explicitly opt in with forward_hf_token=True.

• [Download] Reject absolute/UNC/traversal filenames on local_dir & cache paths by @​Wauplin in #4540
• [Sandbox] Don't send the HF token to sandbox jobs by @​Wauplin in #4583

🗂️ Resource groups for Jobs and Collections

Organization resource groups are now supported across the client. For collections, create_collection accepts an optional resource_group_id, and the new update_collection_resource_group method wraps the dedicated Hub endpoint to assign a collection to a resource group afterwards (passing None removes it). For Jobs, run_job, run_uv_job and create_scheduled_job accept a resource_group_id parameter, mirrored by a --resource-group-id option on the hf jobs run, hf jobs uv run and hf jobs scheduled run commands. Beyond access control within an organization, resource groups are also used for cost attribution and per-group spending limits.

hf jobs run --resource-group-id <group-id> python:3.12 python train.py

📚 Documentation: Collections reference, CLI reference

• Support resource groups for collections by @​moon-bot-app[bot] in #4575
• feat(jobs): support resource group at Job creation by @​moon-bot-app[bot] in #4576

📊 Job names, front and center in the CLI

Job names are now much easier to work with from the terminal. hf jobs ls (and hf jobs scheduled ls) display a dedicated NAME column, and a new --name filter acts as a shortcut for --label name=NAME. The name is also surfaced as a top-level field in hf jobs inspect and in command results, instead of only living inside labels — where it remains for compatibility.

$ hf jobs ls -a --name training-v2
JOB_ID      NAME         IMAGE/SPACE COMMAND      CREATED      STATUS    RUNTIME
----------- ------------ ----------- ------------ ------------ --------- -------
6a60b190... training-v2  python:3.12 python -c... 2026-07-2... COMPLETED 0s

... (truncated)

Commits

• c998254 Release: v1.26.0
• 8a89097 Release: v1.26.0.rc2
• ac1c66b Release: v1.26.0.rc1
• 9c594e6 Release: v1.26.0.rc0
• 5af012a [Core] Fix tilde expansion in CommitOperationAdd (#4612)
• da90367 [CLI] Don't crash when stdout can't encode non-ASCII output (#4610)
• a782edf [Download] Add HfApi.resolve_revision and ResolvedRevision (#4604)
• 59df95f Reject token=False in create_inference_endpoint_from_catalog (#4605)
• a1028f8 [Safetensors] Fix truncated header on 100kb boundary (#4603)
• bbdef5b [Download] Reject redacted Xet hashes from tree cache (#4595)
• Additional commits viewable in compare view

Updates mpmath from 1.3.0 to 1.4.1

Release notes

Sourced from mpmath's releases.

1.4.1

Bug fixes:

• Fix test_hexadecimal_with_libc_bulk(), see #1049 (Doug Torrance)
• Keep available deprecated aliases for mpc/mpf_log() (Sergey B Kirpichev)
• Use version_file option of setuptools-scm to keep version info, see #1048 (Sergey B Kirpichev)
• Add workaround for test on s390x, see #1061 (Sergey B Kirpichev)

Full Changelog: mpmath/mpmath@1.4.0...1.4.1

1.4.0

Features:

• Support underscores as digit separators per PEP 515, see #661 (Sergey B Kirpichev)
• Add rationals converter for mpf's, see #666 (Sergey B Kirpichev)
• Rewrite bernpoly/eulerpoly to avoid dependency on bernoulli(1) convention, see #700 (Sergey B Kirpichev)
• Support base kwarg for from_str(), see #703 (Jonathan Warner, Sergey B Kirpichev)
• Support randmatrix() for mp.iv and mp contexts, see #527 (Maximilian Gaukler)
• Added rank() function for matrices, see #610 (Jan-Philipp Hoffmann)
• Add plus flag to select the B_1 sign convention for bernoulli/bernfrac, see #724 (Jeremy Tan Jie Rui, Sergey B Kirpichev)
• Add mpf.as_integer_ratio() method, support construction of mpf from Decimal objects, see #731 (Sergey B Kirpichev)
• Expose lower/upper_gamma functions, see #740 (Sergey B Kirpichev)
• Support mpc initialization from string, see #743 (Sergey B Kirpichev)
• Support asinh/acosh/atanh in the fp context, see #750 (Sergey B Kirpichev)
• Support binary/octal/hexadecimal string output, see #711 (Jonathan Warner, Sergey B Kirpichev)
• Support pickling for matrices and mpi, see #761 (Sergey B Kirpichev)
• Support matrix.__array__() dunder method, see #767 (Sergey B Kirpichev)
• Support more number syntaxes, see #778 (Sergey B Kirpichev)
• Run mpmath as a module for interactive work, see #773, #923, #931, #936, #939 and #954 (Sergey B Kirpichev)
• Add signed option to to_man_exp(), see #783 (Sergey B Kirpichev)
• Add fp.hypot, see #798 (Sergey B Kirpichev)
• Support inf/nan's in ctx.almosteq(), #802 (Sergey B Kirpichev)
• Implement mpf.__format__(), see #819, #831, #850, #859, #857, #862, #881, #944 and #966 (Javier Garcia, Sergey B Kirpichev)
• Support conversion from scalar ndarray's, see #821 (Sergey B Kirpichev)
• Support rounding modes in mpf.__format__, see #823, #831, #834 and #969 (Javier Garcia, Sergey B Kirpichev)
• Support '%' presentation type for mpf, see #847 (Sergey B Kirpichev)
• Support gmpy2-like rounding modes in to_str(), see #830 (Javier Garcia)
• Implement 'a'/'A' formating types for mpf.__format__, see #841 and #870 (Sergey B Kirpichev)
• Add mpc.__format__(), see #855 (Sergey B Kirpichev)
• Now mpf.__round__() returns mpf, see #826 and #966 (Sergey B Kirpichev)
• Support 'b' (binary) format type for mpf/mpc, see #867 (Sergey B Kirpichev)
• Implement mpf.__floordiv__() and mpf.__divmod__(), see #873 (Sergey B Kirpichev)
• Add parameters for MPContext constructor, see #876 and #963 (Sergey B Kirpichev)
• Add MPFR-compatible aliases for rounding modes, see #892 (Sergey B Kirpichev)
• Support negative indexes in matrix, see #897 (Riccardo Orsi)
• Better introspection support for decorated functions, see #900 (Sergey B Kirpichev)
• Add moving sofa demo, see #924 (Sergey B Kirpichev)
• Support spherical Bessel functions (jn/yn), #935 (Sergey B Kirpichev)
• Add pretty_dps context property to control number of printed digits, see #933 (Sergey B Kirpichev)

... (truncated)

Changelog

Sourced from mpmath's changelog.

--1.5.0-- Released TBD

Features:

• Support special numbers in mpf_frexp() like math.frexp(), see #1081 (Sergey B Kirpichev)
• Add ModAB rootfinding algorithm, see #1093 (Ayush Baranwal)
• Add Brent root-finding algorithm, see #1103 (Ayush Baranwal)
• Correct integral path of the lerchphi() to use Laplace transform integral, see #1109 (Sergey B Kirpichev)

Compatibility:

• Drop support for CPython 3.9, see #1058 (Sergey B Kirpichev)
• Remove deprecated math2 and rational modules, see #1057 (Sergey B Kirpichev)
• Remove deprecated mp.mpnumeric alias, see #1057 (Sergey B Kirpichev)
• Remove deprecated bitcount(), fp.is_special() and to/from_pickable() functions, see #1057 (Sergey B Kirpichev)
• Drop DeprecationWarning for force_type kwarg for matrix(), see #1057 (Sergey B Kirpichev)
• Use signed=True per default in to_man_exp(), see #1057 (Sergey B Kirpichev)
• Use asc=True per default for polynomial functions, see #1057 (Sergey B Kirpichev)
• Restrict libmp exports to public API, see #1089 (Sergey B Kirpichev)

Bug fixes:

• Fix test_hexadecimal_with_libc_bulk(), see #1049 (Doug Torrance)
• Keep available deprecated aliases for mpc/mpf_log() (Sergey B Kirpichev)
• Use version_file option of setuptools-scm to keep version info, see #1048 (Sergey B Kirpichev)
• Add workaround for test on s390x, see #1061 (Sergey B Kirpichev)
• Fix signature of root(), see #1072 (Sergey B Kirpichev)
• Speedup removal trailing zeros in _normalize/from_man_exp(), see #1074 (Fredrik Johansson and Sergey B Kirpichev)
• Improve documentation about rounding in the mp context, see #1079 (Sergey B Kirpichev)
• Correct to_float() conversion for double-rounding cases (e.g. subnormals), see #1082 (Sergey B Kirpichev)
• Fix qr_solve() failure on well-conditioned matrices with zero pivot, see #1083 (Jam Balaya)
• Clarify to_float() docstring, see #1087 (Sergey B Kirpichev)
• Add extra precision for summation in mpf_hypot(), see #1088 (Sergey B Kirpichev)
• Fix typo and function names for sin/cospi(), see #1091 (Sergey B Kirpichev)
• Raise ValueError when same sign at interval boundaries in bisection rootfinding algorithm, see #1092 (Ayush Baranwal)
• Correct interval update for Ridder's method, see #1096 (Sergey B Kirpichev)
• Set dynamic maxsteps value for the bisect method, see

... (truncated)

Commits

• c1131e2 Merge pull request #1053 from skirpichev/release-1.4.1
• d3d3eb9 Update CHANGES
• 629daff Add a workaround for test on s390x
• 96272f3 Revert "Add backport action"
• e129480 Test frozen package version (#1055)
• 1ef88b4 Amend docstring for round_digits()
• 650520b Use version_file option of setuptools-scm to keep version info
• 501af4a Keep forever deprecated aliases for mpc/mpf_log()
• 6887127 Set argtypes for sprintf from ctypes
• f3e9cf0 Update CHANGES (free-threading support)
• Additional commits viewable in compare view

Updates openai from 2.50.0 to 2.51.0

Release notes

Sourced from openai's releases.

v2.51.0

2.51.0 (2026-07-30)

Full Changelog: v2.50.0...v2.51.0

Features

• api: fast tier (8808ed2)

Bug Fixes

• api: add fast tier to helper methods (6064126)

Changelog

Sourced from openai's changelog.

2.51.0 (2026-07-30)

Full Changelog: v2.50.0...v2.51.0

Features

• api: fast tier (8808ed2)

Bug Fixes

• api: add fast tier to helper methods (6064126)

Commits

• 3844843 release: 2.51.0 (#3553)
• See full diff in compare view

Updates pydantic-ai-slim from 2.20.0 to 2.21.0

Release notes

Sourced from pydantic-ai-slim's releases.

v2.21.0 (2026-07-29)

What's Changed

🚀 Features

• feat(usage): add per_request_input_tokens_limit to UsageLimits by @​Oxygen56 in pydantic/pydantic-ai#5907

🐛 Bug Fixes

• Refresh KnownModelName from Gateway probes and stable Google image IDs by @​adtyavrdhn in pydantic/pydantic-ai#6806

Full Changelog: pydantic/pydantic-ai@v2.20.0...v2.21.0

Commits

• abed399 Fix minor format issues for the DBOS doc and add custom serializer (#6873)
• f5577ef feat(usage): add per_request_input_tokens_limit to UsageLimits (#5907)
• 3d66418 Refresh KnownModelName from Gateway probes and stable Google image IDs (#6806)
• 251de3d Derive ModelSettings prefix test from dynamic discovery so it can't rot (#6...
• 1e269ed Document the trust boundary for client-supplied message_history (#6800)
• 699810c Add the zai optional group to docs/install.md (#6802)
• See full diff in compare view

Updates pydantic-core from 2.46.4 to 2.47.0

Commits

• See full diff in compare view

Updates pydantic-graph from 2.20.0 to 2.21.0

Release notes

Sourced from pydantic-graph's releases.

v2.21.0 (2026-07-29)

What's Changed

🚀 Features

• feat(usage): add per_request_input_tokens_limit to UsageLimits by @​Oxygen56 in pydantic/pydantic-ai#5907

🐛 Bug Fixes

• Refresh KnownModelName from Gateway probes and stable Google image IDs by @​adtyavrdhn in pydantic/pydantic-ai#6806

Full Changelog: pydantic/pydantic-ai@v2.20.0...v2.21.0

Commits

• abed399 Fix minor format issues for the DBOS doc and add custom serializer (#6873)
• f5577ef feat(usage): add per_request_input_tokens_limit to UsageLimits (#5907)
• 3d66418 Refresh KnownModelName from Gateway probes and stable Google image IDs (#6806)
• 251de3d Derive ModelSettings prefix test from dynamic discovery so it can't rot (#6...
• 1e269ed Document the trust boundary for client-supplied message_history (#6800)
• 699810c Add the zai optional group to docs/install.md (#6802)
• See full diff in compare view

Updates tokenizers from 0.22.2 to 0.23.1

Release notes

Sourced from tokenizers's releases.

Release v0.23.1

TL;DR

tokenizers 0.23.1 is the first proper stable release in the 0.23 line — 0.23.0 only ever shipped as rc0 because the release pipeline itself was broken (Node side hadn't shipped multi-platform binaries since 2023, Python side was on pyo3 0.27 without free-threaded support). 0.23.1 is the version where everything actually goes out the door together: full Node multi-platform wheels for the first time in years, Python 3.14 (regular and free-threaded 3.14t), full type hints for every Python class, and a stack of measurable perf wins on the BPE / added-vocab hot paths.

There is no functional 0.23.0 published — we tag 0.23.1 directly so users don't accidentally pull a never-shipped version.

---

🚨 Breaking changes

• Drop Python 3.9 (#1952) — requires-python = ">=3.10"; 3.9 users stay on 0.22.x.
• add_tokens normalizes content at insertion (#1995) — re-saved tokenizer.json may differ in the added_tokens block. Existing files load unchanged.
• Type stubs are precise (#1928, #1997) — methods that returned Any now return real types; mypy --strict may surface previously-hidden errors. Stub layout also moved from tokenizers/<sub>/__init__.pyi to tokenizers/<sub>.pyi. This breaks the surface of some of the processors like RobertaProcessign's __init__ .
• 3.14t-only: setters/getters return PyResult<T> because of Arc<RwLock<Tokenizer>>; a poisoned lock surfaces as PyException instead of a panic.

---

⚡ Performance — measured locally on this Mac, not lifted from PRs

Run with cargo bench --bench <name> -- --save-baseline v0_22_2 on v0.22.2, then --baseline v0_22_2 on v0.23.1. Numbers are point-in-time wall clock on a single laptop; relative deltas are what matters, absolute numbers will differ on CI hardware.

Added-vocabulary deserialize — the headline win (#1995, #1999)

bench: improve added_vocab_deserialize to reflect real-world workloads (#2000) is now representative of how transformers actually loads tokenizer.json files. The combined effect of daachorse for the matching automaton plus the normalize-on-insert refactor is enormous on this workload:

benchmark	v0.22.2	v0.23.1	change
100k tokens, special, no norm	~410 ms	248 ms	−40%
100k tokens, non-special, no norm	~7.1 s	273 ms	−96%
100k tokens, special, NFKC	~395 ms	235 ms	−40%
100k tokens, non-special, NFKC	~7.4 s	290 ms	−96%
400k tokens, special, no norm	~15 s	980 ms	−94%

Real-world impact: loading a Llama-3-style tokenizer with a large set of added tokens dropped from "noticeable pause" to "instant".

BPE encode

benchmark	v0.22.2	v0.23.1	change
BPE GPT2 encode batch, no cache	530 ms	446 ms	−16%
BPE GPT2 encode batch (cached)	690 ms	685 ms	noise
BPE GPT2 encode (single)	1.95 s	1.94 s	noise
BPE Train (small)	32.6 ms	31.5 ms	−3%
BPE Train (big)	1.01 s	988 ms	−2%

The BPE per-thread cache PR (#2028) shows much larger wins on highly-parallel workloads (+47–62% at 88+ threads on a server box, per the PR's own measurements on Vera). Single-thread batch numbers above are flat or slightly improved because cache-hit overhead was already low without contention.

Llama-3 encode

... (truncated)

Commits

• 7f1623b Bump version to 0.23.1
• bbe43ad ci: release workflow fixes (node + python) (#2043)
• ab0c5d8 Fix node release (#2034)
• decd8e0 bindings/python: free-threaded Python (3.14t) support (#2041)
• 3992692 update for release (#2033)
• bcdd25b BPE cache: per-thread read-through cache to avoid RwLock atomics on hits (#2028)
• 618eb38 Bump follow-redirects in /tokenizers/examples/unstable_wasm/www (#2024)
• b6b1688 chore: bump doc-builder SHA for PR upload workflow (#2025)
• 19015d6 fix: use uvx --with cairosvg instead of uv pip install --system (#2021)
• efbcc68 Ci benchmarks (#2019)
• Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.52.0

Release notes

Sourced from uvicorn's releases.

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Commits

• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• d26c85c Prepare compatibility with websockets 17.0. (#3036)
• 7e11cc6 Clarify how limit_concurrency and backlog differ (#3029)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions