Bump the python-minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the python-minor-and-patch group with 4 updates in the / directory: pypdf, langchain, sentence-transformers and faiss-cpu.

Updates pypdf from 6.18.0 to 6.19.0

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @​j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @​stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @​stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @​anandghegde
• Use page reference for existing internal link targets (#4076) by @​r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @​Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @​RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @​stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @​stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @​stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @​r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @​youdie006
• Use font color for FreeText default appearance (#4051) by @​Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @​MeggyCal and @​stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @​r-kamei

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087)
• Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
• Use page reference for existing internal link targets (#4076)
• Arabic-Indic digits are reversed during text extraction (#4077)
• Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

• Further restrict FlateDecode recovery (#4073)
• Limit entry count for TrueType and Type1 font /Widths (#4072)
• Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• Use font color for FreeText default appearance (#4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#4066)

Full Changelog

Commits

• d62cb58 REL: 6.19.0
• 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
• 959467a PI: Move static value out of loop body for appearance stream data (#4087)
• 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
• 25f2301 DEP: Replace PdfWriter method add_js (#3979)
• a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
• cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
• 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
• 2d21901 DEV: Fix Color class for latest mypy (#4082)
• 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
• Additional commits viewable in compare view

Updates langchain from 1.4.0 to 1.4.2

Release notes

Sourced from langchain's releases.

langchain-openai==1.4.2

Changes since langchain-openai==1.4.1

release(openai): 1.4.2 (#39322) fix(openai): handle ContextWindowExceededError (#39300) chore: bump the minor-and-patch group across 3 directories with 7 updates (#39187) fix(openai): filter langchain-generated content block IDs (#39209) fix(openai): preserve Responses text options (#39204) fix(openai): redact MCP authorization (#39155) chore(model-profiles): refresh model profile data (#39050)

langchain==1.4.2

Changes since langchain==1.4.1

release(langchain): 1.4.2 (#40621) fix(langchain): preserve model-generated tool calls in HITL tool call edits and add notice to ToolMessage (#40463)

langchain-openai==1.4.1

Changes since langchain-openai==1.4.0

release(openai): 1.4.1 (#39045) feat(anthropic,fireworks,openai): support langsmith gateway through env var (#38742) fix(openai): correct gpt-5.3-chat-latest profile (#39009)

langchain-perplexity==1.4.1

Changes since langchain-perplexity==1.4.0

release(perplexity): 1.4.1 (#39826) fix(perplexity): include type="message" on Responses input items (#39774) fix(perplexity): preserve caller extra_body (#39203) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/perplexity (#38991) chore(deps): refresh lockfiles (#38746) fix(perplexity): use supported Responses API model (#38337) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/partners/perplexity (#38290) chore: bump langsmith from 0.8.5 to 0.8.18 in /libs/partners/perplexity (#38289) docs: refresh README installation and resources (#38119) release(core): 1.4.7 (#38111) fix(core,partners): rename package version trace metadata (#38110) style(core,langchain,langchain-classic,partners): replace double backticks in docstrings (#38095) release(core): 1.4.6 (#38061) feat(core,partners): add package version tracking to tracing metadata (#35295) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470) feat(standard-tests): validate tool call chunks during streaming (#34707) chore(partners): bump locks (#38052)

langchain==1.4.1

Changes since langchain==1.4.0

release(langchain): 1.4.1 (#40498) fix(langchain): preserve open MCP object arguments (#40414)

... (truncated)

Commits

• a18de59 release(langchain): 1.4.2 (#40621)
• 5bf6a15 fix(langchain): preserve model-generated tool calls in HITL tool call edits a...
• a893bbd chore(model-profiles): refresh model profile data (#40600)
• fd4f161 chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/text-splitters (#40579)
• 3b81e02 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/chroma (#40582)
• fa369c9 chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/chroma (#...
• eb544d3 chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/fireworks (#4...
• 5e8888f chore(deps): bump filelock from 3.32.5 to 4.0.0 in /libs/partners/chroma (#40...
• a62361a chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/fireworks...
• e2d39c4 chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/fireworks ...
• Additional commits viewable in compare view

Updates sentence-transformers from 6.0.1 to 6.1.0

Release notes

Sourced from sentence-transformers's releases.

v6.1.0 - Documentation and input handling improvements

This is a small release with refreshed inference benchmarks, clearer documentation, and a few improvements to multimodal input handling.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.1.0
Inference only, use one of:
pip install sentence-transformers==6.1.0
pip install sentence-transformers[onnx-gpu]==6.1.0
pip install sentence-transformers[onnx]==6.1.0
pip install sentence-transformers[openvino]==6.1.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.1.0
pip install sentence-transformers[audio]==6.1.0
pip install sentence-transformers[video]==6.1.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.1.0

Changes

• Refreshed the inference benchmarks and efficiency guide, clarified benchmark labels, and documented ONNX CPU thread tuning (#3977, #4007, #3987).
• Added a shared input formats guide and SPARSEUP to the pretrained sparse model tables (#4036, #4038).
• Improved multimodal input handling and chat-template argument routing (#4037, #4048).
• Corrected loss formulas and argument descriptions in docstrings, clarified custom-module import requirements, and fixed links, typos, and optional type annotations.

For existing multimodal dict inputs, message content now follows each input's key order, which can change embeddings or scores. Video-frame URLs without recognizable image extensions need an explicit frame wrapper to remain one video. See #4037 for details.

All Changes

• [docs] Document that optional imports in a custom module become load-time requirements by @​abtonmoy in huggingface/sentence-transformers#3922
• [docs] Name the metric on the quality axis of the backend benchmark figures by @​tomaarsen in huggingface/sentence-transformers#3977
• docs: fix Constrastive/heaqp typos and subject-verb agreement by @​simpleqt in huggingface/sentence-transformers#3983
• docs: drop stale margin/squared Args from triplet loss docstrings by @​simpleqt in huggingface/sentence-transformers#3981
• docs: fix cross-encoder link and 'show case' wording in examples READMEs by @​simpleqt in huggingface/sentence-transformers#3982
• Correct the inverted CoSENT loss formula in two docstrings by @​vineethsaivs in huggingface/sentence-transformers#3984
• Fix implicit Optional annotations by @​VenishPaneliya in huggingface/sentence-transformers#3990
• [docs] Clarify sparse COO inputs for semantic_search by @​tomaarsen in huggingface/sentence-transformers#4001
• [docs] Refresh inference benchmarks and promote efficiency guides by @​tomaarsen in huggingface/sentence-transformers#4007
• [docs] Describe the MarginMSE target as the signed margin by @​MaxFreedomPollard in huggingface/sentence-transformers#4009
• Document ONNX CPU thread tuning and benchmark settings by @​ErnisBadmae in huggingface/sentence-transformers#3987
• docs: Document shared input formats across model archetypes by @​tomaarsen in huggingface/sentence-transformers#4036
• [docs] Add SPARSEUP to pretrained sparse models by @​tomaarsen in huggingface/sentence-transformers#4038
• Support multiple items per modality in one input by @​tomaarsen in huggingface/sentence-transformers#4037
• Fix load_audio_from_video routing in chat templates by @​tomaarsen in huggingface/sentence-transformers#4048

... (truncated)

Commits

• b0bf399 Release v6.1.0
• 55f2f9c Fix load_audio_from_video routing in chat templates (#4048)
• ad8e77b Support multiple items per modality in one input (#4037)
• ad356eb [docs] Add SPARSEUP to pretrained sparse models (#4038)
• 5f1bfb0 docs: Document shared input formats across model archetypes (#4036)
• b0ef5ef Document ONNX CPU thread tuning and benchmark settings (#3987)
• 6a841ce [docs] Describe the MarginMSE target as the signed margin (#4009)
• dc0d7c3 [docs] Refresh inference benchmarks and promote efficiency guides (#4007)
• 1a4b62a [docs] Clarify sparse COO inputs for semantic_search (#4001)
• 24d718f Fix implicit Optional annotations (#3990)
• Additional commits viewable in compare view

Updates faiss-cpu from 1.15.0 to 1.15.1

Release notes

Sourced from faiss-cpu's releases.

v1.15.1

See CHANGELOG.md for the full list of changes.

Changelog

Sourced from faiss-cpu's changelog.

[1.15.1] - 2026-09-15

Added

• 3b3711c112fbf7dfb9c64b6fcf90ffc3ca412548 Add explicit IVFPQ scanner distance modes (#5632)
• 4fdbc9dc18adbfef3cd410a2446aa4c757320a8a Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a14632a6f2bfdc824c86d683b9d6e9205c2604 Run the eight SIMD kernel tests that no build executed (#5620)
• e6bd1d252caa5b9315a04390269d382845984ae2 Add AVX512 VPOPCNT dynamic dispatch level (#5531)
• 7f4cedda9c384de652c7bd5690db0f808d668216 Add staged RaBitQ storage to HNSW (#5526)
• cfbf4ec5ff68d0bca4701d0b24b8a0736e110932 SVS: allow option to disable vector storing (#5525)
• cda4f6e7133c629e502c2ea9bc51e0ef51847ab1 Expose IndexBinaryIVF.set_direct_map_type via the C API (#5451)
• 256980cb6ea6610e4b0edf497a038086df8bbfce Add SVE low-dimensional nearest fast path and spherical SuperKMeans support (#5530)
• 3a716ead1a3c4562fe6e96d982d26789c58e19ed Add Windows ARM64 support to CI (#5544)
• 7059eaf7da7eddda62e71367e684d4bdedd7f94f Add AVX512 bitplane kernel for multi-bit RaBitQ inner product (#5522)
• a424dcb809fd725c44dd976d9063febd4837d16a faiss HNSW: add opt-in deterministic lock-free graph build (faiss::hnsw_deterministic_build) (#5486)
• da3191e754b49ca67b6503a9262e96ce5a3d8ed8 IDSelectorWithContext: extend context hook to IVFPQ/PQR, multibit RaBitQ, and Panorama scanners (#5491)
• edddbc998e858f16330f9b226dfd72f73d4d1d46 IDSelectorWithContext: scan-context hook for locality-aware selectors (#5490)

Changed

• 3bb48643ab8ea9e50162b354d2463270acd6ed9c Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 6bbb068ad8dab612b84304400846da1b14539085 Measure 20-byte Hamming codes eight at a time (#5587)
• 3c7042f17a467c38d99f490ef39e4dfa615dc510 Let the binary Hamming paths reach the VPOPCNT kernels
• 9f993087b07e83f026248addb01dd99e99b15a3e Name the SIMD level masks after what they hold (#5600)
• e2cf9e1ebf24c14b888fa69eee96713aa6d64b1a Accept ragged code sizes in faiss::hammings(), and fix the vectorization axis for wide codes (#5520)
• 545550f6a27031c2269881d97237fd6a5bef15df Use unittest assertions and f-strings in test_index_composite (#5571)
• af9eeffcf70d7795107c2b0511bdba507ac45339 Reserve cs vector capacity in hammings_knn_mc_impl to avoid reallocations (#5548)
• 317a207bcacfcfa695d98289c3f4ea562b782837 ARM SVE optimization for L2 distance kernels adapted to new simd_impl structure (#5098)
• 2027d3b33144dbf19674b540ec0e31b2f842b1cc Make cuVS dispatch opt-in rather than build-implied (#5529)
• a39e2606887bbacc6c8f54e783c4b42da00cf4b3 Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5521)
• 1f93154314afbef210f0ebebeab840da22f9ec7d Revert D114685755: Fold multi-GPU CAGRA build into train(), delete trainMultiGpu
• 6644dcfa5576221b1a4417fd766a8b2af71d869e Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5500)
• 80a16564f86530dbf0bfaf96c2b71feffeb5093f Enable Faiss dynamic dispatch for OVIS and VeST fbpkgs (#5515)
• 2688c34f942c8462d97c8632c720a53653456270 Parallelize the k-means++ D^2 seeding update (#5457)
• 76c67b7b736ca80c2b3ea29528434d6583adc88b Update default Panorama batch size to 1024 (#5441)
• 3b50babc5914570576b09da043f64dfd7d62a075 Optimize RVV batch-4 distance kernels (#5469)

Fixed

• 7c3b55c01b8418dc044881625a260fceae9c712b Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a3121c073828d2ed7d04ccf09d8bea771c Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• fc13c81fb8b22f76e4c2c7bd2f027bd049b9a207 Stop aarch64 falling back to SIMDLevel::NONE in faiss dispatch (#5572)
• 00928e3f7628b8288c17cfece5ee9600a8287f56 Fix ROCm CI: build in a dedicated conda env instead of the runner's broken base (#5545)
• 1e5780fbbfbe191f3ed3517f93ace8301239e9b2 Fix OOB read in Panorama::reconstruct via IndexPreTransform (T287094917) (#5562)
• 2ed4c106e9fb9686e7727e5daf8ad6ad1e164109 Fix: Windows SIMD detection (#5497)
• b4c66ba6031d1f659163e43430f8ce745b0dbe79 Fix reverse_index_factory/get_code_size round-trip for HNSW, IMI and IVFPQR (#5564)
• c0084f5cd2534236acda05cf7b8e0fc8062ddec3 Clamp EDEN unbiased L2 distances to be non-negative (#5569)
• 6457e941f5f4808303bb480679cb78df0df51934 Contain DirectoryArchiver entries within the extraction root (#5561)
• ac60182fc009476c91a2788e639191d1f624157f RaBitQ: Fix zero residual sign convention (#5553)
• 1a0cfa64e015923d5009d8c7d917aa591e9eac9a Apply the deserialization byte limit to SVS IVF (#5568)
• 718002f7cf269f3f3752dde04a4cc3f8eabb0050 Fix distance conversion in IndexBinaryFromFloat for non-L2 metrics (#5549)
• 02ea14372c9983f3eaa15698512180dc62ea234d Fix range_search_max_results to respect all similarity metrics (#5533)
• bd7087453e6d2262b6e6c76ab0cfa1e2dfeddebf fix(faiss): use is_similarity_metric for IndexShardsIVF merge (#5541)

... (truncated)

Commits

• 75c755c Add missing CHANGELOG entry for #5632 in v1.15.1 (#5651)
• d63faea Increment to next release, v1.15.1 (#5645)
• 3b3711c Add explicit IVFPQ scanner distance modes (#5632)
• 3bb4864 Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 7c3b55c Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• a74867c faiss HNSW: delete the flag and the lock-based graph build (#5611)
• 4fdbc9d Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a1463 Run the eight SIMD kernel tests that no build executed (#5620)
• 6bbb068 Measure 20-byte Hamming codes eight at a time (#5587)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.