Skip to content

chore(deps): bump the development-dependencies group across 1 directory with 5 updates - #88

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/development-dependencies-193128008a
Open

chore(deps): bump the development-dependencies group across 1 directory with 5 updates#88
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/development-dependencies-193128008a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 5 updates in the / directory:

Package From To
huggingface-hub 1.30.0 1.32.0
onnxruntime 1.29.0 1.30.0
httpx2 2.12.0 2.13.0
ruff 0.16.6 0.16.8
build 1.6.0 1.6.1

Updates huggingface-hub from 1.30.0 to 1.32.0

Release notes

Sourced from huggingface-hub's releases.

[v1.32.0] Shared blob store, sandbox security hardening and faster imports

📂 [Cache] Shared blob store: deduplicate Xet files across repos

The cache now deduplicates Xet files across repos. A Xet file downloaded through hf_xet is stored once at <CACHE_DIR>/blobs/<prefix>/<xet_hash> and every repo that needs it gets a relative symlink instead of a download: no bytes are transferred and no extra space is used, even across different repos — or after the repo that first downloaded the file was deleted. The per-repo snapshot layout is unchanged, older clients keep reading and downloading normally, and any failure to share silently falls back to regular repo-local storage. Set HF_HUB_DISABLE_SHARED_BLOBS=1 to opt out entirely. Shared files carry a <xet_hash>.refs manifest listing the repo blobs referencing them, which hf cache rm consults on deletion and hf cache prune sweeps to reclaim payloads that no cached repo uses anymore.

📚 Documentation: Manage your cache

💻 [Jobs] Ship config inside UV scripts

A UV script that only runs correctly on a specific runtime can now carry that runtime with it. An optional [tool.hf-jobs] table in the script's PEP 723 header accepts image, flavor, python, timeout, name, namespace, env, secrets, labels, volumes, network_group and network_aliases, and hf jobs uv run reads it at submit time. CLI flags always win, and env/secrets/labels/volumes merge entry by entry instead of being replaced, so -e/-v add to what the script declares. Typos and unknown keys are rejected with the list of valid options, secrets are passed by name only (values come from your environment), and every run prints a config summary with script-sourced values marked and secrets redacted. Note that the table is read by the CLI only: run_uv_job() and create_scheduled_uv_job() ignore it.

# /// script
# requires-python = ">=3.11"
# dependencies = ["vllm", "datasets"]
#
# [tool.hf-jobs]
# image   = "vllm/vllm-openai:unlimited-ocr"
# flavor  = "l4x1"
# python  = "/usr/bin/python3"
# secrets = ["HF_TOKEN"]
# ///

📚 Documentation: Run and manage Jobs

  • [CLI] Read a UV script's [tool.hf-jobs] launch config (opus-generated) by @​Wauplin in #4598

🛡️ [Sandbox] security hardening

An internal security review of the Sandbox API resulted in a 9-PR hardening series. Pooled sandboxes now use their own per-sandbox capability token instead of the host-wide credential, pool hosts are fully validated (initiator, namespace, image, flavor, command, URL) before any credential is sent to them, the sbx-server binary is pinned by digest and verified before being run as PID 1, and the local pool cache is bound to the endpoint, credential and namespace that wrote it. Secret values no longer end up in argv when using hf sandbox exec --secrets, background processes are addressed by their server-assigned id (so kill() actually stops them and reports honestly), transfers and command output are bounded to avoid unbounded memory usage in the client, and pool ownership is decided per host so a with SandboxPool(...) block never again tears down a colleague's discovered host. The security documentation was also rewritten to state precisely what the sandbox contract is — and what it is not — including a new "Known limitations" section.

📚 Documentation: Sandboxes

  • [sandbox audit] Make the sandbox security contract match the implementation by @​Wauplin in #4831
  • [sandbox audit] Use each pooled sandbox's own capability token by @​Wauplin in #4832
  • [sandbox audit] Validate a pool host before sending it a credential by @​Wauplin in #4834
  • [sandbox audit] Bind the sandbox pool cache to the endpoint, credential and namespace that wrote it by @​Wauplin in #4838
  • [sandbox audit] Bound what a transfer or a command's output costs the client by @​Wauplin in #4839
  • [sandbox audit] Decide host teardown per host, and report it honestly by @​Wauplin in #4840
  • [sandbox audit] Address background processes by their server-assigned id by @​Wauplin in #4836
  • [sandbox audit] Pin the sandbox server binary by digest and verify it before running it by @​Wauplin in #4837
  • [sandbox audit] Keep secret values out of argv in the CLI and fix the env/secrets docs by @​Wauplin in #4835

🔒 Security hardening for serialization and validation

Three changes make the library safer against malicious or malformed inputs, with a stricter behavior worth noting. Torch checkpoint deserialization was hardened across 11 reported vulnerabilities: load_state_dict_from_file now defaults to safe=True (always using the safetensors loader), the pickle path defaults to weights_only=True, and unsafe combinations raise explicit errors instead of silently falling through. Path validation now rejects .. segments anywhere in path_in_repo (previously only a leading one was caught), so uploads like "a/../../etc/passwd" are refused. Finally, repo_id validation is restricted to ASCII word characters as documented, so non-ASCII ids like café are rejected client-side instead of failing later on the Hub.

... (truncated)

Commits
  • 8814aab Release: v1.32.0
  • 4457706 Release: v1.32.0.rc0
  • b064a14 [Download] Send X-HF-Download-Counter header on download calls (#4613)
  • 79dd41e [Docs] Fix hf discussions info options that do not exist (#4886)
  • d7b62c7 [CLI] Fix card data serialization (#4882)
  • f94ea55 [Buckets] Send mtime when copying files (#4920)
  • 6e3d21f [Cache] Add cross-repo shared blob store (#4498)
  • 5a9cdda [Core] Speed up package imports (#4914)
  • 2075fd6 [Cache] Support kernel repos in hf cache commands (#4905)
  • af6b41e [Core] Reject path traversal via embedded ".." segments in path_in_repo (#4884)
  • Additional commits viewable in compare view

Updates onnxruntime from 1.29.0 to 1.30.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

  • Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
  • Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
  • Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
  • Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

  • FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
  • CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
  • CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
  • WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

  • Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
  • Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
  • Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
  • Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
  • Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
  • Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

  • Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
  • Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
  • Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
  • Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

  • Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
  • Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
  • Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

  • Added Go bindings for the ONNX Runtime C API (#29615).
  • Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
  • Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
  • Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

... (truncated)

Commits
  • f2c39fe [CUDA] Add INT4 paged KV cache with per-channel scales (#32515)
  • 5894ba8 Add portable random-access file reads to Env (#32503)
  • a2ee3eb Fix CUDA plugin device discovery on WSL (#32517)
  • b652e59 [WebGPU] Prepack Conv weights for the im2col-matmul path (#32420)
  • 0f0f29f Get rid of spurious warning about not being able to find spectre mitigation (...
  • 23dd651 Register ONNX schemas only when static registration is disabled (#32353)
  • 33af5d3 Release external data loaders after graph initialization (#32502)
  • 2e3c24d Clarify external initializer and EP context path interaction (#32442)
  • e76036b [CUDA] Pin FP8 GEMV residency for grids just past two blocks per SM (#32433)
  • 82583c5 Add session option for a BNHS GroupQueryAttention Value cache layout (#32139)
  • Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpx2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

httpcore2

Changed

Fixed

  • Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Changelog

Sourced from httpx2's changelog.

2.13.0 (September 14th, 2026)

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

  • Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
  • Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)
Commits

Updates ruff from 0.16.6 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates build from 1.6.0 to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

Bugfixes

  • Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

Documentation

  • Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

Miscellaneous

  • :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

... (truncated)

Commits
  • 89cccef chore: prepare for 1.6.1
  • a6f707a ci: support releases from v* branches (#1178)
  • 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
  • 244b250 fix: always use copies for the isolated venv on Windows (#1176)
  • c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
  • e02ffd3 pre-commit: bump repositories (#1173)
  • aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
  • 5c3fd46 docs: use PyPI ref directly (#1172)
  • 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
  • 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 22, 2026
@dependabot
dependabot Bot requested a review from ma2za as a code owner September 22, 2026 06:56
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/development-dependencies-193128008a branch from d4d74cb to db98846 Compare September 22, 2026 14:50
github-actions[bot]
github-actions Bot reviewed Sep 22, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Python Benchmark with pytest-benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.

Benchmark suite Current: db98846 Previous: 8ec7e11 Ratio
benchmarks/benchmark_detectors.py::test_detector_nonmatching_input[italian_fiscal_code] 419.3933270773218 iter/sec (stddev: 0.00028228925498948295) 540.7372141837318 iter/sec (stddev: 0.00006188757194108913) 1.29
benchmarks/benchmark_detectors.py::test_detector_nonmatching_input[italian_vat] 302.797489159509 iter/sec (stddev: 0.0002501459757218184) 383.40179949178633 iter/sec (stddev: 0.0001536003311994495) 1.27
benchmarks/benchmark_detectors.py::test_detector_nonmatching_input[spanish_nif] 276.9285891760928 iter/sec (stddev: 0.0004529118775934126) 361.2739513717544 iter/sec (stddev: 0.0001420193024801682) 1.30
benchmarks/benchmark_detectors.py::test_detector_nonmatching_input[secret] 182.54000918006582 iter/sec (stddev: 0.00014151621638893173) 226.3966090508282 iter/sec (stddev: 0.000051585449396659806) 1.24
benchmarks/benchmark_detectors.py::test_detector_nonmatching_input[location] 80.45258764082475 iter/sec (stddev: 0.0001553810606239513) 98.34849169529666 iter/sec (stddev: 0.000050514475070429994) 1.22
benchmarks/benchmark_engine.py::test_process_synthetic_messages[4 KiB] 117.23378263925386 iter/sec (stddev: 0.0012566126665918905) 140.99320454407186 iter/sec (stddev: 0.0001294952971978343) 1.20

This comment was automatically generated by workflow using github-action-benchmark.

@dependabot
chore(deps): bump the development-dependencies group across 1 directo…
647ef84 
…ry with 5 updates

Bumps the development-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.30.0` | `1.32.0` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.29.0` | `1.30.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.8` |
| [build](https://github.com/pypa/build) | `1.6.0` | `1.6.1` |



Updates `huggingface-hub` from 1.30.0 to 1.32.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.30.0...v1.32.0)

Updates `onnxruntime` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.29.0...v1.30.0)

Updates `httpx2` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.12.0...v2.13.0)

Updates `ruff` from 0.16.6 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.16.8)

Updates `build` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.6.0...1.6.1)

---
updated-dependencies:
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: httpx2
  dependency-version: 2.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: huggingface-hub
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: onnxruntime
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/development-dependencies-193128008a branch from db98846 to 647ef84 Compare September 24, 2026 18:05

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@ma2za ma2za Awaiting requested review from ma2za ma2za is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants