Skip to content

chore(deps): bump the backend-dependencies group across 1 directory with 14 updates - #97

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-3a33555e42
Open

chore(deps): bump the backend-dependencies group across 1 directory with 14 updates#97
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-dependencies-3a33555e42

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-dependencies group with 14 updates in the /backend directory:

Package From To
fastapi 0.142.2 0.162.0
sqlalchemy 2.1.2 2.1.8
psycopg 3.3.6 3.3.8
pillow 12.3.0 13.0.0
pillow-heif 1.8.0 1.8.1
pydantic-settings 2.15.0 2.16.2
python-multipart 0.0.32 0.0.33
alembic 1.20.0 1.20.1
onnxruntime 1.30.0 1.31.1
numpy 2.5.3 2.5.4
sentry-sdk 2.71.0 2.74.0
google-auth 2.59.1 2.62.1
pytest 9.1.1 9.2.0
ruff 0.16.10 0.17.4

Updates fastapi from 0.142.2 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

  • 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

  • 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

... (truncated)

Commits

Updates sqlalchemy from 2.1.2 to 2.1.8

Release notes

Sourced from sqlalchemy's releases.

2.1.8

Released: November 3, 2026

general

  • [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

    This change is also backported to: 2.0.57

    References: #13759

2.1.7

Released: November 3, 2026

orm

  • [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used within that SAVEPOINT; the root transaction returned by _orm.Session.get_transaction() reports all connections. The same accessors are available on _asyncio.AsyncSessionTransaction, returning _asyncio.AsyncConnection objects. Pull request courtesy Artur Shiriev.

    References: #13685

  • [orm] [bug] An informative InvalidRequestError is now raised when more than one PropComparator.of_type() loader option is applied along the same relationship using targets of differing classes, such as two _orm.aliased() constructs against different subclasses, which previously failed with a bare AssertionError during compilation. These options can't be combined since each target brings its own aliased copy of the base table; to load multiple subclasses along a single relationship, a single _orm.with_polymorphic() object that includes all of the target classes should be used.

... (truncated)

Commits

Updates psycopg from 3.3.6 to 3.3.8

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.9 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Use the C implementation of the wait functions on Windows too. It was disabled because of an excessive CPU usage, fixed in Psycopg 3.2.11 (:ticket:[#645](https://github.com/psycopg/psycopg/issues/645)).
  • Limit the memory used by :sql:COPY FROM if the server consumes data slower than it is produced. Add a !flush_threshold parameter to ~copy.LibpqWriter to tune it (:ticket:[#1437](https://github.com/psycopg/psycopg/issues/1437)).
  • Don't wait on the event loop when the socket is already writable, which made pipeline mode, ~AsyncCursor.executemany() and ~AsyncCopy.write() on async connections several times slower than on sync ones (:ticket:[#1468](https://github.com/psycopg/psycopg/issues/1468)).
  • Fix client-side quoting of negative zero floats and decimals, which could produce a -- SQL comment (:ticket:[#1480](https://github.com/psycopg/psycopg/issues/1480)).
  • Raise DataError instead of !ValueError registering a composite whose name or attributes are not valid namedtuple names, for instance Python keywords (:ticket:[#1482](https://github.com/psycopg/psycopg/issues/1482)).
  • Speed up the C implementation of the sync wait function, in particular when the connection doesn't need to wait, for instance at every ~Copy.write() (:ticket:[#1484](https://github.com/psycopg/psycopg/issues/1484)).
  • Reduce the size of the binary packages.

Current release

Psycopg 3.3.8 ^^^^^^^^^^^^^

  • Revert the use of /etc/ssl as SSL directory in the binary packages on Linux and macOS: it caused the system openssl.cnf to be loaded, which could break connections, for instance on FIPS-enabled systems (:ticket:[#1476](https://github.com/psycopg/psycopg/issues/1476)).
  • Fix the size of the binary packages on Linux x86_64, increased in 3.3.7 by padding of the bundled libraries (:ticket:[#1477](https://github.com/psycopg/psycopg/issues/1477)).

... (truncated)

Commits
  • b9e2f35 chore: bump psycopg package version to 3.3.8
  • 53a0eb4 Merge pull request #1478 from dvarrazzo/fix-openssldir-1476
  • 0880f2e ci: fix skipping the OpenSSL build if already installed
  • d48cc84 fix(binary): don't use /etc/ssl as OpenSSL directory
  • 2ce4384 ci: only restore the libpq cache in the packages-bin workflow
  • 78bf2ad docs: add news entry for #1477
  • ae74a87 Revert "chore(deps): bump pypa/cibuildwheel"
  • 4daf632 chore: bump psycopg package version to 3.3.7
  • 7ce93bb chore(deps): bump pypa/cibuildwheel
  • 70dce7a test: run three assertions trapped after the expected exception
  • Additional commits viewable in compare view

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

Deprecations

Documentation

Dependencies

... (truncated)

Commits
  • 293218a 13.0.0 version bump
  • 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
  • af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
  • 0a87417 Bound retained TIFF tag data by stream size (#10225)
  • 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
  • 8501adc Fix test
  • ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
  • 4b63dff Share TIFF tag data budget across frames
  • Additional commits viewable in compare view

Updates pillow-heif from 1.8.0 to 1.8.1

Release notes

Sourced from pillow-heif's releases.

v1.8.1

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

  • libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499
  • Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499
  • libx265 was updated from the 4.2 to 4.3 version. #503
Changelog

Sourced from pillow-heif's changelog.

[1.8.1 - 2026-10-11]

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

  • libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499
  • Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499
  • libx265 was updated from the 4.2 to 4.3 version. #503
Commits
  • 0ed5379 v1.8.1
  • 39acefb feat(libheif): update libx265 to 4.3, download it from GitHub (#503)
  • 1a3f85a chore(deps): update dependency strukturag/libheif to v1.23.6 (#499)
  • 3937253 chore(deps): update msys2/setup-msys2 action to v2.33.0 (#495)
  • 2f183a4 [pre-commit.ci] pre-commit autoupdate (#497)
  • 33c51b7 chore(deps): update actions/download-artifact action to v8.0.2 (#500)
  • 7c08c7f chore(deps): update actions/upload-artifact action to v7.0.2 (#501)
  • b16be11 ci: fix leak tests failing on free-threaded Linux and Python 3.10 (#494)
  • 4ce7129 chore(deps): update dependency strukturag/libheif to v1.23.5 (#491)
  • f99594a chore(deps): update codecov/codecov-action action to v7.1.1 (#485)
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.2

Highlights

This patch release fixes env decoding of nested dictionary values, CliApp handling of AliasPath, nested secrets directory precedence and discriminated union defaults with nested_model_default_partial_update.

Behavior changes

  • An explicit secrets_dir on NestedSecretsSettingsSource now takes precedence (#1093). Previously it was ignored when the wrapped SecretsSettingsSource inherited a directory from model config, and an explicit empty list was masked too. The order is now: the wrapper's secrets_dir argument, then the wrapped source's directory, then model config. If you pass both Settings(_secrets_dir=...) and NestedSecretsSettingsSource(..., secrets_dir=...), the wrapper's argument now wins.

Bug fixes

Env and dotenv sources

  • Dictionary values typed as a union, such as dict[str, list[str] | str] or dict[str, list[str] | None], now JSON-decode values set through env_nested_delimiter (#1089, #1097). Only JSON arrays and objects are decoded, so plain values like 123, true or "quoted" are kept as strings. Decoding follows enable_decoding and the NoDecode/ForceDecode of the field that holds the dict, and type aliases and Annotated value types are resolved.
  • Nested dictionary values such as dict[str, list[dict[str, str]]] are decoded at the right level again (#1109), so APP_VALUES__X='[{"k":"v"}]' no longer reaches validation as a string.

CLI

  • CliApp.run now rebuilds AliasPath inputs for BaseModel and pydantic dataclass commands (#1096). A supplied path used to be reduced to the field name, which failed validation. AliasChoices priority is respected and unsupplied path defaults are left to the model.

Discriminated union defaults

  • With nested_model_default_partial_update=True, inner discriminated unions written as Annotated[..., Field(discriminator='...')] are now detected (#1076). When the incoming tag selects another member, the default's fields are no longer merged into it.
  • A stdlib dataclass default on a discriminated union field no longer raises NameError when another field of the dataclass has a string annotation naming a local class (#1077). Only the discriminator's own annotation is resolved now.

What's Changed

New Contributors

Full Changelog: pydantic/pydantic-settings@v2.16.1...v2.16.2

v2.16.1

Highlights

... (truncated)

Commits
  • 94150a0 Prepare release 2.16.2 (#1111)
  • 9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
  • 7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
  • 2d1f924 Fix explicit nested secrets directory precedence (#1093)
  • e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
  • e71a53e Decode nested dictionary values with complex union types (#1089)
  • 8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
  • c50c853 Detect nested Field discriminators in default partial updates (#1076)
  • 9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • Additional commits viewable in compare view

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33
  • Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
  • Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
  • UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
  • Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
  • parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

  • Faster opening boundary matching (#328). Complete boundaries are matched in one step.
  • Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
  • Faster querystring callback dispatch (#316).

🐍 Python support

  • Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
  • Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

  • Drop Python 3.10 support #329.
  • Add Python 3.15 support #350.
  • Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
  • Normalize the content type returned by parse_options_header when the header has parameters #287.
  • Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
  • Keep only the incomplete escape when quoted-printable data is split across writes #355.
  • Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
  • Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
  • Speed up parser state lookups #330.
  • Speed up opening boundary matching #328.
  • Speed up querystring callback dispatch #316.
Commits
  • 9217f26 Bump version to 0.0.33 (#357)
  • d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
  • 44871df Handle nameless uploads when keeping the filename or extension (#343)
  • b21ea59 Add streaming field limits to FormParser (#333)
  • 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
  • 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
  • 95f6376 Use the shared security policy (#353)
  • 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
  • d7af81c Rewrite README for newcomers (#351)
  • b035d14 Add Python 3.15 classifier (#350)
  • Additional commits viewable in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

  • [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

    References: #1085

  • [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

    References: #1360

  • [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

    References: #1462

  • [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

  • [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

Updates onnxruntime from 1.30.0 to 1.31.1

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.31.1

ONNX Runtime 1.31.1 is a patch release that fixes an OpenVINO-enabled Python build regression and corrects WASM Debug external-data tests. These notes cover changes since ONNX Runtime 1.31.0.

Highlights

  • Fixed a provider-info namespace mismatch that caused compilation failures when building with both OpenVINO and Python enabled (#33327).
  • Fixed WASM Debug test failures by skipping file-backed external-data cases unsupported by the WASM test module, while retaining compile-output checks, buffer-destination coverage, and native test coverage. This is a test-only change and does not change runtime behavior (#33226).

Contributors

Thanks to our 3 human contributors for this release!

@​eserscor, @​mustjab, @​tianleiwu

Full Changelog: rel-1.31.0...rel-1.31.1

Release highlights were prepared with AI assistance.

ONNX Runtime v1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

  • Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
  • Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
  • Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
  • Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
  • Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

  • CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
  • GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
  • Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
  • ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
  • The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
  • Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

  • Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
  • Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
  • Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
  • Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
  • Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

... (truncated)

Commits
  • 6af1a93 1.31.1 version bump and cherry pick
  • 402979a Revert "Bump version to 1.32.0 (#33197)" (#33212)
  • 660125b [Compile API] Add support for writing external initializers and EP context to...
  • 06cab16 Update parameterized requirement from >=0.8.1 to >=0.9.0 (#33022)
  • 864d871 Fix isolated provider tests in Windows GPU CI (#33203)
  • 1744702 Bump baseline-browser-mapping from 2.10.31 to 2.11.26 in /js/react_native/e2e...
  • be3b8e8 Fix complex STFT window handling (#33136)
  • 40a7167 [CPU] Avoid degenerate GQA FlashAttention tiles when L2 cache size is unknown...
  • 430f563 Fix EP assignment reporting after NHWC layout transformation (#33184)
  • 26ab6c7 Improve GQA shared-cache and sliding-window handling (#33175)
  • Additional commits viewable in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer d...

Description has been truncated

@dependabot
chore(deps): bump the backend-dependencies group across 1 directory w…
744ce60 
…ith 14 updates

Bumps the backend-dependencies group with 14 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.142.2` | `0.162.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.2` | `2.1.8` |
| [psycopg](https://github.com/psycopg/psycopg) | `3.3.6` | `3.3.8` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.3.0` | `13.0.0` |
| [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.8.0` | `1.8.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.2` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.32` | `0.0.33` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.20.0` | `1.20.1` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.30.0` | `1.31.1` |
| [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.71.0` | `2.74.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.59.1` | `2.62.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.4` |



Updates `fastapi` from 0.142.2 to 0.162.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.162.0)

Updates `sqlalchemy` from 2.1.2 to 2.1.8
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `psycopg` from 3.3.6 to 3.3.8
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.6...3.3.8)

Updates `pillow` from 12.3.0 to 13.0.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.3.0...13.0.0)

Updates `pillow-heif` from 1.8.0 to 1.8.1
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.8.0...v1.8.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.2)

Updates `python-multipart` from 0.0.32 to 0.0.33
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.32...0.0.33)

Updates `alembic` from 1.20.0 to 1.20.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `onnxruntime` from 1.30.0 to 1.31.1
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.30.0...v1.31.1)

Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `sentry-sdk` from 2.71.0 to 2.74.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.71.0...2.74.0)

Updates `google-auth` from 2.59.1 to 2.62.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.59.1...google-auth-v2.62.1)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `ruff` from 0.16.10 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.4)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: psycopg
  dependency-version: 3.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: backend-dependencies
- dependency-name: pillow-heif
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: pydantic-settings
  dependency-version: 2.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: python-multipart
  dependency-version: 0.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: alembic
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: onnxruntime
  dependency-version: 1.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: google-auth
  dependency-version: 2.62.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants