Skip to content

build(jupyter): bump the uv-deps group across 1 directory with 13 updates - #199

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/apps/cogstack-jupyter-hub/uv-deps-cb6efdce9d
Open

build(jupyter): bump the uv-deps group across 1 directory with 13 updates#199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/apps/cogstack-jupyter-hub/uv-deps-cb6efdce9d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv-deps group with 13 updates in the /apps/cogstack-jupyter-hub directory:

Package From To
medcat[deid,dict-ner,meta-cat,rel-cat,spacy] 2.9.0 2.10.1
cogstack-es[os] 0.2.0 0.3.0
virtualenv 21.13.0 21.15.2
jupyterlab 4.6.4 4.6.5
py7zr 1.1.3 1.1.4
isort 9.0.1 9.0.2
simplejson 4.1.2 4.2.0
nltk 3.10.3 3.10.4
pymssql 2.4.2 2.4.6
mysql-connector-python 26.7.0 26.10.0
jsonpickle 4.1.2 4.1.4
neo4j 6.3.1 6.4.1
ruff 0.16.9 0.17.3

Updates medcat[deid,dict-ner,meta-cat,rel-cat,spacy] from 2.9.0 to 2.10.1

Release notes

Sourced from medcat[deid,dict-ner,meta-cat,rel-cat,spacy]'s releases.

medcat/v2.10.1

🩺 MedCAT v2.10.1 Release Notes

This release focuses on improved model evaluation and diagnostics, component development tools, and performance estimation, alongside fixes to training, tokenisation, and statistics.

🚀 New Features & Enhancements

  • Detailed Model Statistics – Expanded get_stats with additional evaluation metrics, including character-level Intersection over Union (IoU), golden character IoU, and Cohen's kappa. Statistics can now also be gathered more easily for NER-only or linker-only evaluation through simplified arguments.
  • Failure Mode Analysis – Added diagnostics to help explain why expected concepts were missed during evaluation. Failure modes include missing CUIs, missing names, missing CUI-name associations, and disambiguation errors involving siblings, parents, children, or other concepts. New summary methods make it easier to understand common error patterns and identify areas for improvement.
  • Component Contracts – Introduced contracts defining the expected inputs and outputs of different component types. These help developers validate custom component implementations in tests without adding runtime overhead to inference.
  • Model Performance Estimation – Introduced a separate [medcat-performance-estimator](https://pypi.org/project/medcat-performance-estimator/) package for estimating relative concept-linking difficulty from a model and a list of concepts. Concepts are grouped into difficulty categories to provide a rough indication of which may need additional training. These estimates are indicative rather than reliable predictions of individual concept performance.
  • LLM Components – Added new components for integrating large language model (LLM) functionality into MedCAT workflows as a separate plugin / package (see on PyPI and GitHub).

🐛 Bug Fixes

  • NER Link Candidate Evaluation – Fixed an issue with NER link candidates that caused incomplete results for linker-only stats.
  • Fine-tuning Reset – Fixed an issue with the optional training reset during fine-tuning when the dataset contains concepts absent from the model's CDB.
  • Tokenisation and Annotation Text – Fixed an edge case where tokenisation could include extra punctuation, such as a trailing colon, in an entity span. Also corrected the text associated with PredicatedAnnotations.
  • Statistics Accuracy – Fixed issues affecting NER-only statistics and the printing of evaluation results.
  • Relation Extraction – Improved RelCAT handling in the MedCAT service.

🧰 Other Improvements

  • Repository Structure – Renamed the medcat-v2 directory to medcat. Users relying on hard-coded repository paths may need to update them.
  • Python Version Support – Dropped Python 3.10 support, as it has reached end of life.
  • Build and Release Workflow – Fixed a typo in the release workflow.

This release improves evaluation depth and interpretability, provides better tools for validating custom components, and introduces an initial approach to estimating relative concept-linking performance to help guide model improvement.

What's Changed

... (truncated)

Commits
  • d66b4fe Fix typo in release workflow (#654)
  • 00cd674 build(medcat):CPDT-291 Drop python 3.10 support (EoL) (#649)
  • 54907d9 build: bump pypa/gh-action-pypi-publish (#646)
  • 357d01b fix(medcat): fix tokenisation - and correct PredicatedAnnotations text (#639)
  • c6e3bda feat(medcat-trainer): mct client project groups creation (#643)
  • 2d37d81 fix(medcat-trainer): open FP, FN, and TP example dialogs (#635)
  • 1e37f74 feat(medcat-trainer): Solr backed full text search of clinical notes (#634)
  • 73da1ea feat(medcat-trainer): metrics report filter, on row, on low performing metric...
  • a535444 chore(medcat-trainer): lint fixes and package upgrades (#640)
  • c209322 feat(medcat): CPDT-223 Add failure modes to get stats (#627)
  • Additional commits viewable in compare view

Updates cogstack-es[os] from 0.2.0 to 0.3.0

Release notes

Sourced from cogstack-es[os]'s releases.

MedCAT den v0.3.0

Minor release.

Most notably difference is the addition of additional API to the den.

What's Changed

Full Changelog: CogStack/cogstack-nlp@medcat-den/v0.2.1...medcat-den/v0.3.0

cogstack-es/v0.3.0

Minor release to allow better data streaming.

What's Changed

Full Changelog: CogStack/cogstack-nlp@cogstack-es/v0.2.0...cogstack-es/v0.3.0

Commits
  • 09cb9ebCogStack/MedCAT2#46
  • 9e83d31CogStack/MedCAT2#62
  • 3b71d2cCogStack/MedCAT2#64
  • ecfc507 Fix test regarding installed dependencies - use lower case dep names (CogStac...
  • cf5cfb1CogStack/MedCAT2#60
  • d3d8a5eCogStack/MedCAT2#59
  • 31cfc78CogStack/MedCAT2#58
  • 62ad0e1CogStack/MedCAT2#57
  • 5967e99CogStack/MedCAT2#56
  • 9f28e8d Avoid resetting subnames upon model load - it is unnecessary (CogStack/MedCAT...
  • Additional commits viewable in compare view

Updates virtualenv from 21.13.0 to 21.15.2

Release notes

Sourced from virtualenv's releases.

21.15.2

Bug fixes

  • Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (#3488) by @​darrenhuai and @​gaborbernat.
  • Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (#3487) by @​darrenhuai and @​gaborbernat.
  • Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (#3494) by @​darrenhuai and @​gaborbernat.
  • On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (#3492) by @​darrenhuai and @​gaborbernat.
  • Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (#3491) by @​darrenhuai and @​gaborbernat.
  • Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (#3489) by @​darrenhuai.
  • Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (#3493) by @​darrenhuai and @​gaborbernat.

PyPI release

Full Changelog

21.15.1

Bug fixes

  • Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the environment's python executable (#3451) by @​JingHao-Leon and @​gaborbernat.
  • Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it (#3454) by @​JingHao-Leon and @​gaborbernat.
  • Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so Session.verbosity is 3 rather than 9 for a single -v (#3457) by @​darrenhuai and @​gaborbernat.
  • Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege (#3465) by @​darrenhuai and @​gaborbernat.
  • Run the interpreter that collects the target debug information (-vv output and Creator.debug) without PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the caller's PYTHONPATH entries (#3474) by @​RaphaelFakhri and @​gaborbernat.

New Contributors

PyPI release

Full Changelog

21.15.0

Features

  • Bundle dependencies for Python 3.15 in the standalone zipapp and stop bundling Python 3.8, which is outside the package's supported range (#3458) by @​gaborbernat.

Packaging

  • Publish GitHub Releases with categorized notes from the tagged changelog, retaining the zipapp, SBOM, and PyPI links (#3458) by @​gaborbernat.

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-5:

21.15.5 (2026-11-04)

.. _release-21-15-4:

21.15.4 (2026-11-04)

.. _release-21-15-4-fixed:

Fixed

  • Upgrade embedded wheels: pip to 26.3 from 26.2.2 (:pr:3508) by :user:gaborbernat.

.. _release-21-15-3:

21.15.3 (2026-11-03)

.. _release-21-15-3-fixed:

Fixed

  • Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
  • Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
  • Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
  • Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and

... (truncated)

Commits
  • 53c21ee release 21.15.2
  • a7999ab 🐛 fix(create): reject an empty destination (#3491)
  • bf99d28 🐛 fix(discovery): let -p replace the python set in config or env (#3494)
  • 9015069 🐛 fix(batch): remember an undefined PATH so deactivate can restore it (#3493)
  • 58c5c10 🐛 fix(create): replace read-only interpreter files on Windows (#3492)
  • 861cff7 🐛 fix(batch): save an undefined PROMPT so deactivate can restore it (#3489)
  • c279422 ♻️ refactor(seed): pass the build folder explicitly (#3490)
  • 7e8102f 🐛 fix(app-data): build the default folder only when none is given (#3488)
  • 59edf49 🐛 fix(seed): keep partial wheel images out of the cache (#3487)
  • fc01ea4 👷 ci: lint activate.sh prompt with semgrep (#3483)
  • Additional commits viewable in compare view

Updates jupyterlab from 4.6.4 to 4.6.5
Updates py7zr from 1.1.3 to 1.1.4

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

  • Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).
    • canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.
    • Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.
    • Archive member names containing a .. component are now rejected outright.
  • Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).
  • Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

  • Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)
  • Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)
  • Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)
  • Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)
  • Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits
  • c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
  • c51e4f6 Merge commit from fork
  • f4204fa Merge commit from fork
  • 5c78459 Merge commit from fork
  • 23610d1 fix: raise Bad7zFile when decompression makes no progress
  • f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
  • e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
  • 8ff8a30 docs: add guidelines for writing and organizing security regression tests
  • 0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
  • 3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
  • Additional commits viewable in compare view

Updates isort from 9.0.1 to 9.0.2

Release notes

Sourced from isort's releases.

9.0.2

🪲 Fixes

Other changes

Full Changelog: PyCQA/isort@9.0.1...9.0.2

Commits
  • 9f90561 Core developers revision
  • 4371472 Fix a "security" issue
  • e74b4ba Do some formatting and setting updates
  • 539abb1 Bump the uv group with 15 updates
  • 0482160 Fully type check tests and modernize code
  • bbda474 Bump pypa/cibuildwheel from 4.2.0 to 4.2.1 in the github-actions group
  • 1fd0701 Agent Host changes for agents/dependabot-monthly-updates-uv
  • 6911091 Always split on parsed.line_separator
  • 3808b70 Keep CRLF regression cases beside existing check-mode tests
  • 3202ce8 Preserve CRLF blank lines during float-to-top preprocessing
  • Additional commits viewable in compare view

Updates simplejson from 4.1.2 to 4.2.0

Release notes

Sourced from simplejson's releases.

v4.2.0

What's Changed

New Contributors

Full Changelog: simplejson/simplejson@v4.1.2...v4.2.0

Changelog

Sourced from simplejson's changelog.

Version 4.2.0 released 2026-10-02

  • Start building wheels for Python 3.15 and drop Python 3.8 support via upgrade to cibuildwheel v4.2.0 simplejson/simplejson#385
  • Build and test riscv64 Linux wheels on native RISE runners simplejson/simplejson#389
  • The C scanner now reports the same error message as the pure Python decoder for an invalid first key in an object simplejson/simplejson#388
  • int_as_string_bitcount now supports thresholds of 64 bits and above (including 128-bit integers) in both the C and pure Python encoders; the C encoder previously rejected them simplejson/simplejson#387
  • Circular references introduced through for_json() or _asdict() now raise ValueError("Circular reference detected") instead of recursing without bound simplejson/simplejson#390
  • CI now tests Python 3.15 (including free-threaded 3.15t), PyPy 3.12, CPython 3.14.8 debug builds, and uses current GitHub Actions and cibuildwheel v4.2.1 simplejson/simplejson#386

Version 4.1.2 released 2026-08-26

Version 4.1.1 released 2026-04-24

  • The build_wheels_py27 CI job now also builds Python 2.7 wheels for Windows AMD64 and Windows x86, joining the existing Py2.7 manylinux1 / manylinux2010 x86_64 wheels. This unblocks offline / --no-index installs on Py2.7-on-Windows (the original reporter's case), which previously had no matching binary wheel on PyPI, fell through to the sdist, and failed on the PEP 517 isolated-build step complaining that setuptools>=42 was not in the wheelhouse. simplejson/simplejson#377

Version 4.1.0 released 2026-04-22

  • The C extension now accelerates encoding when indent= is set.

... (truncated)

Commits
  • 0ace7d1 Prep for v4.2.0 - Update CHANGES and build matrix (#386)
  • c3edf28 ci: build and test riscv64 wheels (#389)
  • 41f8017 Check circular references introduced by custom JSON methods (#390)
  • 48e7c3b Support large integer stringification thresholds in both encoders (#387)
  • 50cadb6 Use the first-key error message in the C scanner (#388)
  • fbc057f Start building CPython 3.15 wheels (#385)
  • See full diff in compare view

Updates nltk from 3.10.3 to 3.10.4

Release notes

Sourced from nltk's releases.

v3.10.4

Version 3.10.4 2026-10-20

This release routes every file path, archive, download, URL fetch and external program through one sandbox that keeps reads and writes inside the trusted data directories, refuses path traversal, symlink escapes and decompression bombs, blocks requests to internal network addresses, and runs Java and other third-party tools only from trusted absolute locations with validated options and input. Pickled models now load through a restricted unpickler, XML and JSON parsing are hardened, and regular expressions, recursion and slow algorithms in the tokenizers, parsers, stemmers and corpus readers are bounded against denial-of-service input. Text that NLTK writes to the terminal, to CSV files, to the WordNet browser and to third-party tool input is sanitized against injection.

Security changes you may notice

Every refusal below raises with a message that starts with "Security Violation" and names the check, so a failure is easy to search for (PR #3877).

  • Data directories (nltk.pathsec, nltk.data): corpora, models and every other resource are read and written only inside the directories listed in nltk.data.path. A path that leaves a data root, a symlink that points out of one, and a NUL byte or encoded traversal in a resource name are refused. A data root, or a directory on the way to a resource, that another account can write to is skipped with a warning naming the directory and the remedy. Keep private data in a private directory and add it to nltk.data.path; /tmp is not a data root. Model save and load methods (perceptron, maxent, named-entity chunker, Weka, crf, hunpos, Stanford) accept destinations inside a data root only (PR #3797, #3753, #3850, #3761, #3755, #3759, #3760, #3763, #3806, #3807, #3808, #3809, #3813, #3814, #3815, #3848, #3851, #3852, #3853, #3863, #3871, #3888, #3945, #3961, #3969, #3981)
  • Downloader: downloaded package archives stay private to the installing account (0600). An install another account must read is extracted: a download made as root or outside the installing account's home extracts on its own, and nltk.download(..., extract=True) / python -m nltk.downloader --extract (or --no-extract) decide explicitly. This also unpacks the packages the index leaves zipped (wordnet, omw-1.4 ...); the extracted files are readable by every account and are found before the archive. find() names an archive it cannot read and says how to extract it instead of reporting it "not found". The downloader installs only into directories no other account can write to, treats an archive another account owns or can write to as stale and downloads it afresh, extracts only from an archive no other account could have changed since its checksum was verified, bounds the size of what it fetches, and refuses index entries and archive members that would write outside the package directory (PR #3929, #3804, #3850, #3778)
  • Pickles: nltk.data.load(..., format="pickle") reconstructs plain data only; a pickle that names any class or function is refused. Model loaders that need classes use an explicit allowlist of audited globals, so a gadget such as os.system can never be reconstructed from a model file. chat80 shelve values load the same way (PR #3794, #3754, #3757, #3802, #3817, #3823, #3824)
  • XML, JSON and YAML: nltk.xmlsec refuses any document that declares an entity or references an external one (billion-laughs, external-entity and DTD attacks) and bounds the tree depth, and every corpus XML view, the downloader index, Toolbox and internals parse through it. JSON resources load with a depth and size bound; YAML (the markdown corpus front matter and nltk.data.load(..., format="yaml")) loads through a bounded safe loader. Oversized or too deeply nested input raises ValueError naming the limit (PR #3754, #3805, #3828, #3933, #3972, #3974)
  • Regular expressions (nltk.redos): every regular expression NLTK compiles, including one you pass to RegexpTokenizer, RegexpStemmer, RegexpParser, re_show, TokenSearcher.findall, tgrep, nltk.help tag-set lookups and the concordance and nemo GUIs, now goes through nltk.redos on the regex engine. A pattern longer than 100,000 characters, nested more than 100 deep, with more than 1,000 capturing groups or an excessive repetition product is refused with nltk.redos.error, a subclass of re.error; a match that runs longer than nltk.redos.DEFAULT_TIMEOUT (5 seconds) raises TimeoutError instead of hanging. Patterns keep re syntax; match objects are the regex engine's (PR #3825, #3829, #3830, #3831, #3832, #3833, #3834, #3835, #3836, #3837, #3838, #3839, #3840, #3841, #3842, #3843, #3844, #3845, #3846, #3796, #3801, #3906, #3907, #3908, #3910)
  • Regular expressions made linear: the leading-run and re-anchoring patterns that a timeout cannot catch were rewritten or bounded in the word, Treebank, blankline, TextTiling, toktok and syllable tokenizers, the readline of corpus streams, the CoNLL SRL, TIMIT, senseval, pl196x, NKJP, Alpino, YCOE, IEER, ACE, VerbNet, reviews and Lin readers, relextract, the valuation parser, the CCG lexicon parser, dependency grammars and chomsky_normal_form, each verified on the real corpus (PR #3947, #3934, #3932, #3938, #3935, #3933, #3869, #3944, #3911, #3909, #3953, #3895)
  • Size, depth and time bounds: trees deeper than nltk.tree.MAX_TREE_DEPTH (500), WordNet and other relation walks deeper than nltk.util.MAX_RECURSION_DEPTH (500), tgrep deeper than 50, Toolbox deeper than 500, dependency graphs deeper than 200, are refused with ValueError naming the limit rather than exhausting the stack, and the stemmers, distance metrics, skipgrams, parsers and grammar transforms run in linear or bounded time with identical output for legitimate input. chart_parse stops after nltk.parse.chart.DEFAULT_MAX_TIME (5 seconds of wall-clock, needed only for feature grammars; max_time=None disables it). Tree.repr no longer recurses, so a deep accepted tree prints (PR #3827, #3885, #3895, #3767, #3784, #3917, #3958, #3960, #3977)
  • External tools and Java: a tool binary is resolved from an absolute path or a trusted search path only, never from the current directory; the binary, its directory and the model and data files handed to it must not be writable by another account (symlinked and multi-call executables such as a packaged Graphviz dot are supported). java() accepts a main class as the first argument only (no -jar, @​argfile or .java source file), validates its options against an allowlist, and loads jars only from a data root unless NLTK_ALLOW_UNSAFE_JARS=1 opts out with a warning. CoreNLP server options are allowlisted. Stanford, Malt, Senna, hunpos, Prover9, megam, TADM, Weka and crf wrappers validate their paths and the text they pipe to the tool against line and argument injection (PR #3772, #3771, #3975, #3743, #3782, #3788, #3768, #3798, #3887, #3858, #3950, #3951, #3812, #3816, #3868, #3894, #3941, #3850, #3925)
  • Network: the downloader, nltk.data.load of a URL and the CHILDES reader fetch through pathsec.urlopen, which refuses addresses that are not globally routable (loopback, private, link-local and multicast, including tunnelled and obfuscated forms), pins the validated address for the connection, allows file:// with a local authority only, and refuses a proxied fetch unless NLTK_ALLOW_PROXIED_URLOPEN=1 (or nltk.pathsec.ALLOW_PROXIED_FETCH = True) asserts the proxy is trusted. The CoreNLP client talks to its local server with requests and is not affected (PR #3847, #3810, #3750, #3850)
  • Terminal, CSV, DOT and HTML output: every print in the library goes through nltk.termsec.safe_print, which renders control characters, escape ...

    Description has been truncated

@dependabot
build(jupyter): bump the uv-deps group across 1 directory with 13 upd…
9246818 
…ates

Bumps the uv-deps group with 13 updates in the /apps/cogstack-jupyter-hub directory:

| Package | From | To |
| --- | --- | --- |
| [medcat[deid,dict-ner,meta-cat,rel-cat,spacy]](https://github.com/CogStack/cogstack-nlp) | `2.9.0` | `2.10.1` |
| [cogstack-es[os]](https://github.com/CogStack/cogstack-nlp) | `0.2.0` | `0.3.0` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.13.0` | `21.15.2` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.6.4` | `4.6.5` |
| [py7zr](https://github.com/miurahr/py7zr) | `1.1.3` | `1.1.4` |
| [isort](https://github.com/PyCQA/isort) | `9.0.1` | `9.0.2` |
| [simplejson](https://github.com/simplejson/simplejson) | `4.1.2` | `4.2.0` |
| [nltk](https://github.com/nltk/nltk) | `3.10.3` | `3.10.4` |
| [pymssql](https://github.com/pymssql/pymssql) | `2.4.2` | `2.4.6` |
| [mysql-connector-python](https://github.com/mysql/mysql-connector-python) | `26.7.0` | `26.10.0` |
| [jsonpickle](https://github.com/jsonpickle/jsonpickle) | `4.1.2` | `4.1.4` |
| [neo4j](https://github.com/neo4j/neo4j-python-driver) | `6.3.1` | `6.4.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.9` | `0.17.3` |



Updates `medcat[deid,dict-ner,meta-cat,rel-cat,spacy]` from 2.9.0 to 2.10.1
- [Release notes](https://github.com/CogStack/cogstack-nlp/releases)
- [Commits](CogStack/cogstack-nlp@medcat/v2.9.0...medcat/v2.10.1)

Updates `cogstack-es[os]` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/CogStack/cogstack-nlp/releases)
- [Commits](CogStack/cogstack-nlp@MedCAT2/v0.2.0...MedCAT2/v0.3.0)

Updates `virtualenv` from 21.13.0 to 21.15.2
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.13.0...21.15.2)

Updates `jupyterlab` from 4.6.4 to 4.6.5
- [Release notes](https://github.com/jupyterlab/jupyterlab/releases)
- [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md)
- [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.6.4...@jupyterlab/lsp@4.6.5)

Updates `py7zr` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/miurahr/py7zr/releases)
- [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst)
- [Commits](miurahr/py7zr@v1.1.3...v1.1.4)

Updates `isort` from 9.0.1 to 9.0.2
- [Release notes](https://github.com/PyCQA/isort/releases)
- [Changelog](https://github.com/PyCQA/isort/blob/main/CHANGELOG.md)
- [Commits](PyCQA/isort@9.0.1...9.0.2)

Updates `simplejson` from 4.1.2 to 4.2.0
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](simplejson/simplejson@v4.1.2...v4.2.0)

Updates `nltk` from 3.10.3 to 3.10.4
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@v3.10.3...v3.10.4)

Updates `pymssql` from 2.4.2 to 2.4.6
- [Release notes](https://github.com/pymssql/pymssql/releases)
- [Changelog](https://github.com/pymssql/pymssql/blob/master/ChangeLog.rst)
- [Commits](pymssql/pymssql@v2.4.2...v2.4.6)

Updates `mysql-connector-python` from 26.7.0 to 26.10.0
- [Changelog](https://github.com/mysql/mysql-connector-python/blob/trunk/CHANGES.txt)
- [Commits](mysql/mysql-connector-python@26.7.0...26.10.0)

Updates `jsonpickle` from 4.1.2 to 4.1.4
- [Release notes](https://github.com/jsonpickle/jsonpickle/releases)
- [Changelog](https://github.com/jsonpickle/jsonpickle/blob/v4.1.4/CHANGES.rst)
- [Commits](jsonpickle/jsonpickle@v4.1.2...v4.1.4)

Updates `neo4j` from 6.3.1 to 6.4.1
- [Release notes](https://github.com/neo4j/neo4j-python-driver/releases)
- [Changelog](https://github.com/neo4j/neo4j-python-driver/blob/6.x/CHANGELOG.md)
- [Commits](neo4j/neo4j-python-driver@6.3.1...6.4.1)

Updates `ruff` from 0.16.9 to 0.17.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.17.3)

---
updated-dependencies:
- dependency-name: medcat[deid,dict-ner,meta-cat,rel-cat,spacy]
  dependency-version: 2.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: cogstack-es[os]
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: virtualenv
  dependency-version: 21.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: jupyterlab
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: py7zr
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: isort
  dependency-version: 9.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: simplejson
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: nltk
  dependency-version: 3.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: pymssql
  dependency-version: 2.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: mysql-connector-python
  dependency-version: 26.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: jsonpickle
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: neo4j
  dependency-version: 6.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants