Skip to content

build: bump the uv group across 8 directories with 13 updates - #655

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/medcat/uv-9714dc1a00
Closed

build: bump the uv group across 8 directories with 13 updates#655
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/medcat/uv-9714dc1a00

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 8 updates in the /medcat directory:

Package From To
transformers 4.57.0 5.10.1
datasets 2.21.0 5.0.1
aiohttp 3.13.4 3.14.4
certifi 2025.10.5 2026.10.18
filelock 3.19.1 4.2.1
fsspec 2024.6.1 2026.6.0
multidict 6.7.0 6.9.1
urllib3 2.5.0 2.8.0

Bumps the uv group with 1 update in the /medcat-service directory: setuptools.
Bumps the uv group with 2 updates in the /medcat-service/docs directory: certifi and urllib3.
Bumps the uv group with 1 update in the /medcat-trainer/docs directory: certifi.
Bumps the uv group with 5 updates in the /medcat-trainer/webapp directory:

Package From To
setuptools 84.0.0 84.1.0
certifi 2026.1.4 2026.10.18
filelock 3.20.3 4.2.1
fsspec 2024.6.1 2026.6.0
opentelemetry-api 1.40.0 1.45.1

Bumps the uv group with 4 updates in the /medcat-tutorials directory: certifi, urllib3, mistune and tornado.
Bumps the uv group with 5 updates in the /medcat/docs directory:

Package From To
certifi 2026.2.25 2026.10.18
urllib3 2.6.3 2.8.0
mistune 3.2.0 3.3.3
nbconvert 7.17.1 7.17.2
tornado 6.5.5 6.6

Bumps the uv group with 7 updates in the /v1/medcat/docs directory:

Package From To
transformers 4.51.3 5.10.1
datasets 2.21.0 5.0.1
aiohttp 3.11.11 3.14.4
certifi 2024.12.14 2026.10.18
filelock 3.16.0 4.2.1
fsspec 2024.6.1 2026.6.0
urllib3 2.3.0 2.8.0

Updates transformers from 4.57.0 to 5.10.1

Release notes

Sourced from transformers's releases.

Release v5.10.1

v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!

New Model additions

Gemma4 unified+ Gemma4 MTP

Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.

Key differences from standard Gemma 4:

  • No Vision Tower: Raw pixel patches are projected directly into LM space via a Dense + LayerNorm pipeline with factorized 2D positional embeddings, replacing the vision encoder.
  • No Audio Tower: Raw 16 kHz waveform samples are chunked into fixed-length frames and projected through a simple RMSNorm → Linear pipeline, replacing the mel spectrogram + Conformer encoder.
  • Shared Multimodal Pipeline: Both vision and audio use the same Gemma4UnifiedMultimodalEmbedder (RMSNorm → Linear) for the final projection to text hidden space.

You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.

Sapiens2

Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.

Links: Documentation | Paper

DeepSeek-OCR-2

DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.

Links: Documentation

Mellum

Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.

Links: Documentation

Breaking changes

The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.

Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.

... (truncated)

Commits

Updates datasets from 2.21.0 to 5.0.1

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

Docs

New Contributors

... (truncated)

Commits
  • 921c2a7 release: 5.0.1 (#8370)
  • c6fc5cd Preserve nullable integer columns in to_json/to_csv/to_sql (#8366)
  • 6747b87 Fix DatasetDict.push_to_hub leaving removed splits in the dataset card (#8367)
  • b305031 fix buckets on windows (#8369)
  • 030a3e5 Decode Json() columns in Dataset.to_pandas() (#8344)
  • 0f207a0 Rebatch arrow source before formatting in IterableDataset.filter to fix resum...
  • adad35d Keep integers on the python read path for fixed-shape ArrayXD columns with nu...
  • 8966746 Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 (#8358)
  • b8e861a Fix bucket dataset card handling and push metadata accounting (#8354)
  • 521a590 Keep flat numeric columns with nulls numeric in numpy format (#8352)
  • Additional commits viewable in compare view

Updates aiohttp from 3.13.4 to 3.14.4
Updates certifi from 2025.10.5 to 2026.10.18

Commits

Updates filelock from 3.19.1 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

Bug fixes

  • On a singleton wrapper, AsyncReadWriteLock.close() and AsyncSoftReadWriteLock.close() end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832 by @​gaborbernat.
  • ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833 by @​gaborbernat.
  • Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834 by @​gaborbernat.
  • Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836 by @​gaborbernat.
  • The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838 by @​gaborbernat.
  • StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839 by @​gaborbernat.
  • Fix a lock reporting a hold the OS had dropped after a signal handler raised during acquire or release. A release that a signal handler cuts short after it has started now completes before the error propagates. A handler that acquires the lock its own thread is releasing now gets RuntimeError instead of a hold that stays held. The singleton cache no longer hands out an is_singleton=True lock or a ReadWriteLock whose finalizer is running, which released the new holder's lock. A signal during os.fork() no longer leaves the other threads blocked in their next lock call, and a fork from another thread no longer waits for a ReadWriteLock acquire on a busy database. #840 by @​gaborbernat.
  • Fix a lock on a relative path locking a file in the directory the process changed to while the lock waited, and leaving its marker behind on release after such a change. The path resolved when an acquisition starts stays in use until the hold ends. An is_singleton=True lookup no longer returns a cached lock whose relative path now resolves to another file; a held lock still matches the file it holds. A rename of the lock's directory during a hold no longer leaves the marker behind or reports a false lease compromise, and a waiter no longer creates a second lock file in a directory that was renamed away. #841 by @​gaborbernat.
  • SoftReadWriteLock reaches its records through descriptors of <path>.rw and gen or holders opened without following symlinks. On Windows it holds those directories open and refuses a junction (a directory that points at another directory). A tree swapped in after an earlier acquire therefore cannot redirect them. Its heartbeat rewrites a holder record only when the name still leads to the file it created, and does not block on a FIFO (a named pipe). A heartbeat that finds <path>.rw replaced by a symlink or junction reports the hold lost instead of ending the heartbeat thread. A live lock object repeats the ownership check whenever the tree it opens is not the one it prepared. #842 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing or displacing a live holder's marker in five cases. ext4 gave a freed inode number to the next marker. A stalled FileLock removed its ENOSYS placeholder after a peer replaced it. A failed acquire cleaned up after a successor took the path. A stale break left the lock path empty while it checked the marker it had moved. A lifetime break judged a marker by a reused inode number. On Linux and macOS a stale marker now changes hands in one atomic exchange. On other platforms without one, except Windows, including NFS and SMB, the marker stays in place and waits for timeout or break_lock(). Restoring a marker no longer follows a symlink found under the break name. A holder that releases while a peer's exchange has its marker aside leaves a record no lock parses, so the put-back lands a marker that ages out. A lease heartbeat that finds another file at the lock path once, while a peer's break has its marker aside, waits for the next refresh before it reports a compromise. A contender that finds a dead breaker's marker puts back the marker that breaker left under its break name. A marker is the breaker's own only when it names the breaker's process on this host; the same process number on another host is a holder. A contender takes a stranded marker under a name of its own before it puts the marker back, so two contenders no longer reverse each other's exchange and remove the live holder's marker. A claim left behind by a failed put-back is retried on the next poll. #843 by @​gaborbernat.
  • Canceling an AsyncReadWriteLock or AsyncSoftReadWriteLock acquire that waits for another process now stops the wait and raises the cancellation. It used to wait until that process released, or raise Timeout. A thread_local=True AsyncFileLock that threads with their own event loops share no longer deadlocks when one thread waits for the lock while another holds it. #844 by @​gaborbernat.
  • SoftReadWriteLock refuses a commit that lands a whole retention window behind the log, so two committers stalled at adjacent generations can no longer admit a second writer. Its stale check samples the clock before it reads a holder record, so a pause between the two no longer counts as time the record stayed unchanged. #845 by @​gaborbernat.
  • Fix a SoftFileLock contender evicting an empty marker after two seconds while its owner held the lock. The owner is a SoftFileLock before 3.22, which writes nothing into its marker, or a current one still writing its record. An empty marker now reads as held, and timeout, lifetime or break_lock() clears it. A contender that finds an empty marker a dead breaker left aside puts it back instead of removing it. #846 by @​gaborbernat.
  • Fix ReadWriteLock on Windows acting on -journal and -wal files another account places beside its database: an acquire could fail with OperationalError, or SQLite could replay the journal and delete the file it names. The lock now reads the database directory's access control list. Where an account other than the locking account, SYSTEM and Administrators can add or remove names, SQLite opens a hard link inside a directory only those accounts can write. A filesystem without hard links raises OSError. #854 by @​gaborbernat.
  • Fix SoftReadWriteLock subclasses sharing singleton instances with the base class or sibling subclasses. Each concrete class now keeps its own cache and construction guard, including after fork, while preserving cooperative class-definition keywords. #855 by @​AryanRG.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.2.0

Bug fixes

  • Fix StrictSoftFileLock raising SoftFileLockProtocolError on Windows when a contender read a claim whose owner was still finishing its unlink. #829 by @​gaborbernat.

Performance

  • import filelock is about twice as fast: lock types other than FileLock load on first use. #831 by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.1.2

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-4:

4.2.4 (2026-10-19)

.. _release-4-2-3:

4.2.3 (2026-10-19)

.. _release-4-2-3-fixed:

Fixed

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:861 - by :user:gaborbernat.
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error. :pr:859 - by :user:edsonsims.

.. _release-4-2-2:

4.2.2 (2026-10-18)

.. _release-4-2-2-fixed:

Fixed

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856 - by :user:spicysharkco.

.. _release-4-2-1:

4.2.1 (2026-10-17)

... (truncated)

Commits
  • 60331bb Release 4.2.1
  • 834bf13 🧪 test(soft): skip Unix pin test on Windows
  • 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
  • e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
  • 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
  • bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
  • 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
  • 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
  • 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
  • eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
  • Additional commits viewable in compare view

Updates fsspec from 2024.6.1 to 2026.6.0

Commits
  • a245700 changelog (#2049)
  • 652325d Fix async cat ranges on error (#2045)
  • 073aac8 Forward kwargs from cat_ranges to cat_file (#2044)
  • 2818611 FTP: preserve filenames containing whitespace in _mlsd2 (#2043)
  • c879384 Prevent attribute error by checking for 'forced' attribute before flushing ca...
  • 71b8a6b Reflect async _walk correctly (#2040)
  • 5eec9f9 Fix: Omit threading.get_ident() from cache token for async implementations ...
  • 8643878 Small safety improvements (#2039)
  • a1c16ab Honour simple_templates everywhere in referenceFS (#2029)
  • 85facaa Fix infinite recursion in expand_path when resolving paths with glob magic ch...
  • Additional commits viewable in compare view

Updates multidict from 6.7.0 to 6.9.1

Release notes

Sourced from multidict's releases.

6.9.1

Bug fixes

  • Fixed the C extension reading freed memory on free-threaded builds when a list handed to :py:meth:~multidict.MultiDict.update, :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.merge or the :py:class:~multidict.MultiDict and :py:class:~multidict.CIMultiDict constructors, a [key, value] item inside any iterable handed to them, or a list tested with in against :py:meth:~multidict.MultiDict.items, is changed by another thread; a call that catches the list shrinking under it now raises :py:exc:RuntimeError -- by :user:rodrigobnogueira.

    Related issues and pull requests on GitHub: #1437.

  • Fixed a data race on the free-threaded build where a retired hash table's reader count used relaxed atomics, letting a lock-free get()/getone()/ __getitem__() read race a concurrent free of that table. The reader-exit decrement and the drain's free check now use release/acquire ordering instead -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1481.

  • Fixed a free-threaded build bug where two threads calling update(), merge(), or __setitem__() on the same key at the same time could lose the key entirely instead of just racing on which value wins. A decref of the replaced value could transiently suspend the writer's critical section, letting a second writer for the same key observe the first writer's in-progress entry as absent and, once both settled, mistake it for a stale duplicate and delete it. Every such decref is now deferred until the writer has released its critical section, so the window can no longer open. setdefault() had an unrelated instance of the same blind spot (it could insert a duplicate rather than recognizing an in-flight key), fixed alongside it -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1483.

  • Fixed a free-threaded build bug where getall() and the items()/ keys()/values() equality path could raise KeyError or report a present, never-deleted key as missing. A concurrent update()/extend()/ __setitem__() call can have its critical section transiently suspended (a decref triggering a blocking allocator call) while an entry is marked as part of its own bookkeeping; a reader landing in that window used to treat the mark as "not found" instead of "still there, in flight" -- by :user:asvetlov.

    Related issues and pull requests on GitHub:

... (truncated)

Changelog

Sourced from multidict's changelog.

6.9.1

(2026-09-21)

Bug fixes

  • Fixed the C extension reading freed memory on free-threaded builds when a list handed to :py:meth:~multidict.MultiDict.update, :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.merge or the :py:class:~multidict.MultiDict and :py:class:~multidict.CIMultiDict constructors, a [key, value] item inside any iterable handed to them, or a list tested with in against :py:meth:~multidict.MultiDict.items, is changed by another thread; a call that catches the list shrinking under it now raises :py:exc:RuntimeError -- by :user:rodrigobnogueira.

    Related issues and pull requests on GitHub: :issue:1437.

  • Fixed a data race on the free-threaded build where a retired hash table's reader count used relaxed atomics, letting a lock-free get()/getone()/ __getitem__() read race a concurrent free of that table. The reader-exit decrement and the drain's free check now use release/acquire ordering instead -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1481.

  • Fixed a free-threaded build bug where two threads calling update(), merge(), or __setitem__() on the same key at the same time could lose the key entirely instead of just racing on which value wins. A decref of the replaced value could transiently suspend the writer's critical section, letting a second writer for the same key observe the first writer's in-progress entry as absent and, once both settled, mistake it for a stale duplicate and delete it. Every such decref is now deferred until the writer has released its critical section, so the window can no longer open. setdefault() had an unrelated instance of the same blind spot (it could insert a duplicate rather than recognizing an in-flight key), fixed alongside it -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1483.

  • Fixed a free-threaded build bug where getall() and the items()/ keys()/values() equality path could raise KeyError or report a present, never-deleted key as missing. A concurrent update()/extend()/ __setitem__() call can have its critical section transiently suspended (a decref triggering a blocking allocator call) while an entry is marked as

... (truncated)

Commits
  • 0a1770c Release 6.9.1 (#1504)
  • d220522 Upload release assets one at a time to avoid the secondary rate limit (#1503)
  • 30cd596 Stop a GIL-releasing del from segfaulting the standard C extension build ...
  • d1c331a Recheck the reader gate after taking the retired list (#1502)
  • b37f07c Allocate deferred decrefs in fixed-size blocks (#1501)
  • 563f667 Run CodSpeed benchmarks on Python 3.14 and loop the smallest ones (#1498)
  • 157c87c Cancel superseded CI runs on pull requests (#1500)
  • d43adfe Drop -I from the ASan test command so PYTHONMALLOC takes effect (#1499)
  • 2a68472 Stop items() iteration from reading a freed entry in CIMultiDict (#1496)
  • cd528d6 Rename GHSA-54p9-h82j-f925 changelog fragment to the merged commit (#1495)
  • Additional commits viewable in compare view

Updates urllib3 from 2.5.0 to 2.8.0

Release notes

Sourced from urllib3's releases.

2.8.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Fixed the following security issues:

  • The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)
  • HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)
  • Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)

[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.

Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.

[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.

Deprecations & Removals

  • Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)

Features

  • Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)
  • Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)

Bugfixes

  • Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)

  • Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)

  • Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)

  • Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)

  • Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)

  • Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)

  • Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)

  • Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (

@dependabot
build: bump the uv group across 8 directories with 13 updates
f074e75 
---
updated-dependencies:
- dependency-name: transformers
  dependency-version: 5.10.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: fsspec
  dependency-version: 2026.6.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: multidict
  dependency-version: 6.9.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: setuptools
  dependency-version: 84.1.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: setuptools
  dependency-version: 84.1.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: fsspec
  dependency-version: 2026.6.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mistune
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: indirect
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mistune
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: nbconvert
  dependency-version: 7.17.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: indirect
  dependency-group: uv
- dependency-name: transformers
  dependency-version: 5.10.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: fsspec
  dependency-version: 2026.6.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 29, 2026
@mart-r

mart-r commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator

I think this is trying to do too much at once.

Also updating the fragile (and probably unmanaged) v1 docs

@mart-r mart-r closed this Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mart-r