Skip to content

ci: bump the pip-all group with 30 updates - #61

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-all-4b82f70073
Open

ci: bump the pip-all group with 30 updates#61
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-all-4b82f70073

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip-all group with 30 updates:

Package From To
ultralytics 8.4.118 8.4.132
typer 0.27.1 0.27.2
boto3 1.43.70 1.43.83
pygments 2.20.0 2.21.0
msgpack 1.2.1 1.2.2
mypy 2.3.0 2.3.1
ruff 0.16.2 0.16.5
boto3-stubs 1.43.70 1.43.83
botocore 1.43.70 1.43.83
build 1.5.0 1.6.0
charset-normalizer 3.5.0 3.5.1
click 8.4.2 8.5.0
coverage 7.15.4 7.16.0
cuda-pathfinder 1.6.0 1.8.0
filelock 3.32.2 3.32.4
grpcio 1.83.0 1.83.1
idna 3.18 3.19
kiwisolver 1.5.0 1.5.1
ml-dtypes 0.5.4 0.6.0
mypy-boto3-ec2 1.43.67 1.43.82
mypy-boto3-lambda 1.43.60 1.43.76
mypy-boto3-rds 1.43.62 1.43.82
narwhals 2.24.0 2.25.0
optree 0.19.1 0.20.0
platformdirs 4.11.2 4.11.5
polars 1.43.2 1.44.1
polars-runtime-32 1.43.2 1.44.1
protobuf 7.35.1 7.36.0
triton 3.7.1 3.8.0
types-tqdm 4.70.0.20260805 4.70.0.20260827

Updates ultralytics from 8.4.118 to 8.4.132

Release notes

Sourced from ultralytics's releases.

v8.4.132 - Extend fraction to the test split (#25966)

🌟 Summary

🚀 Ultralytics v8.4.132 improves dataset efficiency, hardware compatibility, export workflows, and experiment-tracking documentation, with the headline feature being finer control over test-split downloads.

📊 Key Changes

  • 🎯 Test-split control with fraction (PR #25966 — @​fcakyon)

    • List-based fraction now supports train, validation, and test splits.
    • Use a third value to limit test data or set it to 0 to skip test-image downloads entirely.
    • Existing two-value lists remain compatible and continue using the full test split.
    • The same split-selection behavior is shared across training, validation, dataset conversion, and export calibration.

  • ⚡ More efficient NDJSON workflows

    • Platform NDJSON runs no longer need to download unused test images, which can significantly reduce transfer time, storage use, and bandwidth during multi-dataset sweeps.

  • 🩹 Corrected NMS and validation on Ascend NPU

    • NMS now uses the optimized torchvision path on supported Ascend NPU setups while continuing to avoid unsupported XPU behavior.
    • Fixes repeated NMS time-limit warnings and prevents incomplete batches from producing incorrect mAP results.

  • 📚 Improved YOLO26 end-to-end and export guidance

    • Documentation now more accurately describes NMS-free detection, segmentation, pose, and OBB models.
    • Clarifies export-format fallbacks, quantization limitations, Hailo behavior, detection limits, and expected accuracy trade-offs.
    • Updates performance claims and explains when custom post-processing or NMS is still required.

  • 🔄 Broader support for exported non-YOLO models

    • Documents loading generic exported models through YOLO() when task and imgsz are supplied explicitly.
    • Adds guidance for using format-specific backend classes and explains input-layout, autograd, and post-processing differences.
    • Corrects TensorFlow SavedModel, LiteRT, and numerical-parity documentation.

  • 🧪 Better classification subset sampling

    • Fraction-based sampling for local classification datasets now selects images across classes instead of taking a class-ordered prefix.
    • Produces more representative subsets for quick experiments and validation.

  • 📈 Updated experiment-tracking integrations

    • Ray Tune now uses its public context and reporting APIs.
    • ClearML, Comet, TensorBoard, MLflow, Ray Tune, and W&B instructions now better match current callback behavior.
    • Neptune integration and settings were retired following the service shutdown.
    • MLflow environment-variable handling is more flexible, and TensorBoard setup is clearly documented as optional.

  • 🧩 Additional training and export corrections

    • RT-DETR documentation recommends disabling deterministic mode on CUDA, since its attention operation cannot provide fully deterministic backward training.
    • Copy-Paste augmentation is correctly documented for both segment and OBB tasks.
    • Classification color-jitter settings are clarified when automatic augmentation is disabled.
    • IMX exports no longer reject end-to-end models at the exporter entry point.
    • CLA workflow matching now accepts signature comments with surrounding whitespace or text.

🎯 Purpose & Impact

  • 💾 Lower data-transfer costs: Users running Platform or NDJSON workflows can avoid downloading test data they do not need.

... (truncated)

Commits

Updates typer from 0.27.1 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

Commits

Updates boto3 from 1.43.70 to 1.43.83

Commits

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
    • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits
  • a43b45d Get ready for the 2.21.0 release.
  • d8f14cb Fix version_added for Purescript.
  • 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
  • 9992e09 Merge pull request #3191 from jvoisin/dupes
  • bd22577 Fix regexlint warnings after latest update.
  • 6a62df1 Release preparation: Update the changelog.
  • aabba32 Merge pull request #3221 from jvoisin/alter
  • d3441d0 Merge pull request #3225 from jvoisin/caddy
  • c593f3f Add a lexer for Caddy
  • 0644b53 Simplify single-character regex alternations to character classes
  • Additional commits viewable in compare view

Updates msgpack from 1.2.1 to 1.2.2

Release notes

Sourced from msgpack's releases.

v1.2.2

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.1...v1.2.2

Changelog

Sourced from msgpack's changelog.

1.2.2

Release Date: 2026-08-27

  • Fix the read_size documentation. #700
  • Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
  • Prevent reentrant calls to Unpacker.feed() while unpacking. #704
  • Improve error handling and reporting in unpacking functions. #707
  • Fix Timestamp.from_datetime() precision for far-future datetimes. #710
  • Fix typos in the documentation. #712
  • Validate the nanoseconds range when unpacking timestamps in the C extension. #716
  • Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722
  • Prevent a buffer overflow when converting Packer's buf_size. #726
  • Translate RecursionError to StackError in the fallback Unpacker.skip(). #727
  • Raise OverflowError when use_single_float=True cannot represent a value. #728
Commits
  • 7381b31 release
  • ee1bd3c release v1.2.2 (#730)
  • 57d28a2 Raise OverflowError when use_single_float cannot represent a value (#728)
  • d374a17 Avoid parallel execution of the recursion-limit nesting test on free-threaded...
  • e94e1dc Validate nanoseconds range when unpacking timestamps in the C extension (#716)
  • 2e4be09 fix: translate RecursionError to StackError in fallback Unpacker.skip() (#727)
  • 9f9bdae Convert Packer's buf_size once (#726)
  • 809bfcd remove unused variable
  • 186d4db Bump pypa/cibuildwheel from 4.1.1 to 4.2.0(#724)
  • ea6b84f Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencie...
  • Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

Updates ruff from 0.16.2 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

Updates boto3-stubs from 1.43.70 to 1.43.83

Commits

Updates botocore from 1.43.70 to 1.43.83

Commits
  • b6cdacd Merge branch 'release-1.43.83'
  • bcf4c85 Bumping version to 1.43.83
  • 073e2f0 Update to latest models
  • de6b6ea Merge branch 'release-1.43.82'
  • 84f9282 Merge branch 'release-1.43.82' into develop
  • 95e4083 Bumping version to 1.43.82
  • 0ba3a74 Update to latest models
  • b5c1794 Merge branch 'release-1.43.81'
  • 5fbd66e Merge branch 'release-1.43.81' into develop
  • 7459719 Bumping version to 1.43.81
  • Additional commits viewable in compare view

Updates build from 1.5.0 to 1.6.0

Release notes

Sourced from build's releases.

1.6.0

What's Changed

New Contributors

@dependabot
ci: bump the pip-all group with 30 updates
78ab0cf 
Bumps the pip-all group with 30 updates:

| Package | From | To |
| --- | --- | --- |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.118` | `8.4.132` |
| [typer](https://github.com/fastapi/typer) | `0.27.1` | `0.27.2` |
| [boto3](https://github.com/boto/boto3) | `1.43.70` | `1.43.83` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.2` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.2` | `0.16.5` |
| [boto3-stubs](https://github.com/youtype/mypy_boto3_builder) | `1.43.70` | `1.43.83` |
| [botocore](https://github.com/boto/botocore) | `1.43.70` | `1.43.83` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.0` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.5.0` | `3.5.1` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [cuda-pathfinder](https://github.com/NVIDIA/cuda-python) | `1.6.0` | `1.8.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.4` |
| [grpcio](https://github.com/grpc/grpc) | `1.83.0` | `1.83.1` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.19` |
| [kiwisolver](https://github.com/nucleic/kiwi) | `1.5.0` | `1.5.1` |
| [ml-dtypes](https://github.com/jax-ml/ml_dtypes) | `0.5.4` | `0.6.0` |
| [mypy-boto3-ec2](https://github.com/youtype/mypy_boto3_builder) | `1.43.67` | `1.43.82` |
| [mypy-boto3-lambda](https://github.com/youtype/mypy_boto3_builder) | `1.43.60` | `1.43.76` |
| [mypy-boto3-rds](https://github.com/youtype/mypy_boto3_builder) | `1.43.62` | `1.43.82` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.25.0` |
| [optree](https://github.com/metaopt/optree) | `0.19.1` | `0.20.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.2` | `4.11.5` |
| [polars](https://github.com/pola-rs/polars) | `1.43.2` | `1.44.1` |
| [polars-runtime-32](https://github.com/pola-rs/polars) | `1.43.2` | `1.44.1` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.1` | `7.36.0` |
| [triton](https://github.com/triton-lang/triton) | `3.7.1` | `3.8.0` |
| [types-tqdm](https://github.com/python/typeshed) | `4.70.0.20260805` | `4.70.0.20260827` |


Updates `ultralytics` from 8.4.118 to 8.4.132
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.118...v8.4.132)

Updates `typer` from 0.27.1 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.1...0.27.2)

Updates `boto3` from 1.43.70 to 1.43.83
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.70...1.43.83)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `msgpack` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.2)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `ruff` from 0.16.2 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.2...0.16.5)

Updates `boto3-stubs` from 1.43.70 to 1.43.83
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `botocore` from 1.43.70 to 1.43.83
- [Commits](boto/botocore@1.43.70...1.43.83)

Updates `build` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.0)

Updates `charset-normalizer` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.5.0...3.5.1)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `cuda-pathfinder` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/NVIDIA/cuda-python/releases)
- [Commits](NVIDIA/cuda-python@cuda-pathfinder-v1.6.0...cuda-pathfinder-v1.8.0)

Updates `filelock` from 3.32.2 to 3.32.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.4)

Updates `grpcio` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.83.0...v1.83.1)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `kiwisolver` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/nucleic/kiwi/releases)
- [Changelog](https://github.com/nucleic/kiwi/blob/main/releasenotes.rst)
- [Commits](nucleic/kiwi@1.5.0...1.5.1)

Updates `ml-dtypes` from 0.5.4 to 0.6.0
- [Release notes](https://github.com/jax-ml/ml_dtypes/releases)
- [Changelog](https://github.com/jax-ml/ml_dtypes/blob/main/CHANGELOG.md)
- [Commits](jax-ml/ml_dtypes@v0.5.4...v0.6.0)

Updates `mypy-boto3-ec2` from 1.43.67 to 1.43.82
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `mypy-boto3-lambda` from 1.43.60 to 1.43.76
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `mypy-boto3-rds` from 1.43.62 to 1.43.82
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `narwhals` from 2.24.0 to 2.25.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.24.0...v2.25.0)

Updates `optree` from 0.19.1 to 0.20.0
- [Release notes](https://github.com/metaopt/optree/releases)
- [Changelog](https://github.com/metaopt/optree/blob/main/CHANGELOG.md)
- [Commits](metaopt/optree@v0.19.1...v0.20.0)

Updates `platformdirs` from 4.11.2 to 4.11.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.2...4.11.5)

Updates `polars` from 1.43.2 to 1.44.1
- [Release notes](https://github.com/pola-rs/polars/releases)
- [Commits](pola-rs/polars@py-1.43.2...py-1.44.1)

Updates `polars-runtime-32` from 1.43.2 to 1.44.1
- [Release notes](https://github.com/pola-rs/polars/releases)
- [Commits](pola-rs/polars@py-1.43.2...py-1.44.1)

Updates `protobuf` from 7.35.1 to 7.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `triton` from 3.7.1 to 3.8.0
- [Release notes](https://github.com/triton-lang/triton/releases)
- [Changelog](https://github.com/triton-lang/triton/blob/main/RELEASE.md)
- [Commits](triton-lang/triton@v3.7.1...v3.8.0)

Updates `types-tqdm` from 4.70.0.20260805 to 4.70.0.20260827
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: ultralytics
  dependency-version: 8.4.132
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: boto3
  dependency-version: 1.43.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: msgpack
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: boto3-stubs
  dependency-version: 1.43.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: botocore
  dependency-version: 1.43.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: cuda-pathfinder
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: filelock
  dependency-version: 3.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: grpcio
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: kiwisolver
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: ml-dtypes
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: mypy-boto3-ec2
  dependency-version: 1.43.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: mypy-boto3-lambda
  dependency-version: 1.43.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: mypy-boto3-rds
  dependency-version: 1.43.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: narwhals
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: optree
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: platformdirs
  dependency-version: 4.11.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: polars
  dependency-version: 1.44.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: polars-runtime-32
  dependency-version: 1.44.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: protobuf
  dependency-version: 7.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: triton
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: types-tqdm
  dependency-version: 4.70.0.20260827
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 1, 2026
@labro-bot

labro-bot Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot

labro-bot Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Labro's agent (claude-code) ran out of turns before completing this pr.

Progress so far:
Agent reached the turn limit before completing the task.

Remove the ai-handover label to re-queue this item.

@rssrn rssrn removed the ai-handover label Sep 2, 2026
@labro-bot

labro-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot labro-bot Bot added the ai-handover label Sep 2, 2026
@labro-bot

labro-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Labro's agent (claude-code) ran out of turns before completing this pr.

Progress so far:
Agent reached the turn limit before completing the task.

Remove the ai-handover label to re-queue this item.

@rssrn rssrn mentioned this pull request Sep 2, 2026
Closed
@labro-bot

labro-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot labro-bot Bot added the ai-failed label Sep 2, 2026
@labro-bot

labro-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Labro's agent (claude-code) ran out of turns before completing this pr.

Reason: error_max_turns

@rssrn

rssrn commented Sep 3, 2026

Copy link
Copy Markdown
Owner

max_turns bumped from 15 to 40 (and timeout_s 600 to 900) — this run failed by running out of turns, and should be picked up by Labro again on its next scheduled pass.

@labro-bot

labro-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot

labro-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Semver risk: minor/patch — none of the 30 bumped packages cross a major version boundary (highest-risk are ml-dtypes 0.5.4→0.6.0, optree 0.19.1→0.20.0, cuda-pathfinder 1.6.0→1.8.0, all pre-1.0 minor bumps). No CVE/security advisory is cited for this batch.

Changes in this release (highlights, not exhaustive across 30 packages):

  • ultralytics 8.4.118→8.4.132: bug fixes only (Ascend NPU NMS/mAP fix, classification fraction-sampling fix, docs corrections). No breaking API changes noted.
  • ruff 0.16.2→0.16.5: preview rule additions + bug fixes (ASYNC210, DTZ007, SIM401).
  • mypy 2.3.0→2.3.1: mypyc crash/coroutine fixes only.
  • msgpack 1.2.1→1.2.2: fixes a use-after-free and a buffer-overflow-adjacent issue in Packer.buf_size — worth taking, not security-critical for this project's usage.
  • typer, click, boto3/botocore/boto3-stubs, polars, build, pygments, etc.: routine patch/minor releases, nothing breaking spotted.
  • triton 3.7.1→3.8.0: routine minor bump — but see Conflict check below, this is the one that matters.

Lock file: clean — diffed requirements.txt between main and the PR branch; exactly the 30 packages listed in the PR description changed, no unexpected transitive upgrades.

Prior pins: none found directly on triton, but this repo has handled this exact class of problem twice before and it's happening again:

  • a3e9dbe — pinned mpmath<1.4 because sympy==1.14.0 requires it, after a dependabot bump broke resolution.
  • efb80cd — pinned h5py<3.15 because tensorflow==2.21.0 requires it, same failure mode.

The same thing has happened here with triton.

Conflict check: 🚫 BROKEN. pip install --dry-run -r requirements.txt fails:

ERROR: Cannot install -r requirements.txt (line 392) and triton==3.8.0 because these package versions have conflicting dependencies.
The conflict is caused by:
    The user requested triton==3.8.0
    torch 2.12.1 depends on triton==3.7.1; platform_system == "Linux"
ERROR: ResolutionImpossible

torch is pinned at 2.12.1 in this repo (not touched by this PR) and hard-requires triton==3.7.1 exactly on Linux. Bumping triton to 3.8.0 in isolation produces an uninstallable lock file. This is not a transitive-drift issue — triton is one of the 30 packages Dependabot explicitly bumped, but the pip-all group resolution didn't account for torch's exact pin.

CI: failing — the single resolve check run fails with exactly the ResolutionImpossible error above (confirmed via the check-run's job logs for commit 78ab0cf). This is a real, reproducible break, not a flaky CI issue.

Proposed fix: follow the existing repo pattern (a3e9dbe, efb80cd) — add an explicit constraint in pyproject.toml to keep triton compatible with the pinned torch, e.g.:

# triton: torch==2.12.1 requires triton==3.7.1 exactly; pin to prevent dependabot from bumping past 3.7.x
"triton<3.8",

then re-run pip-compile to regenerate requirements.txt (dropping the triton bump while keeping the other 29 updates), or simply exclude triton from this PR and let the other 29 packages merge. This session does not have push access to the branch, so I'm leaving the fix as a recommendation for a maintainer or the next automated pass rather than applying it directly.

Recommendation: 🚫 Do not merge — the lock file is currently uninstallable (ResolutionImpossible on triton vs. pinned torch). Everything else in this batch (the other 29 package bumps) looks safe, but they're bundled with the broken triton bump in a single lock file, so the whole PR is blocked until triton is either excluded or pinned <3.8 to match torch's constraint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ai-contributed ai-maintainer-done dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rssrn