build(deps): bump the minor-update group with 183 updates

[dependabot]

Bumps the minor-update group with 183 updates:

Package	From	To
regex	2026.2.28	2026.7.19
requests	2.32.3	2.34.2
tqdm	4.67.3	4.70.0
transformers	5.15.0	5.16.1
huggingface-hub	1.28.0	1.29.0
tokenizers	0.22.2	0.23.1
fastapi	0.136.3	0.141.1
starlette	1.3.1	1.6.0
aiohttp	3.13.3	3.14.3
pydantic	2.12.0	2.13.5
prometheus-client	0.22.0	0.26.0
prometheus-fastapi-instrumentator	8.0.2	8.1.0
tiktoken	0.12.0	0.14.0
lark	1.2.2	1.3.1
typing-extensions	4.15.0	4.16.0
filelock	3.16.1	3.32.4
jsonschema	4.23.0	4.26.0
pyzmq	27.1.0	27.2.0
python-json-logger	4.1.0	4.2.0
pybase64	1.4.3	1.5.0
opentelemetry-sdk	1.35.0	1.44.0
opentelemetry-api	1.35.0	1.44.0
opentelemetry-exporter-otlp	1.35.0	1.44.0
opentelemetry-semantic-conventions-ai	0.4.13	0.5.1
grpcio	1.78.0	1.83.1
grpcio-reflection	1.78.0	1.83.1
numba	0.65.0	0.67.0
peft	0.19.1	0.20.0
tensorizer	2.10.1	2.12.1
runai-model-streamer	0.15.7	0.16.1
conch-triton-kernels	1.2.1	1.3
annotated-types	0.7.0	0.8.0
charset-normalizer	3.4.0	3.5.1
click	8.4.2	8.5.0
griffelib	2.0.2	2.2.0
idna	3.10	3.19
platformdirs	4.3.6	4.11.5
pydantic-core	2.41.1	2.48.0
pygments	2.18.0	2.21.0
ruff	0.15.12	0.16.5
six	1.16.0	1.17.0
urllib3	2.2.3	2.7.0
tblib	3.1.0	3.2.2
absl-py	2.1.0	2.5.0
accelerate	1.13.0	1.14.0
aiohappyeyeballs	2.6.1	2.7.1
alembic	1.16.4	1.19.1
arctic-inference	0.1.1	0.3.0
argcomplete	3.5.1	3.7.2
audioread	3.0.1	3.1.0
azure-core	1.38.2	1.41.0
azure-storage-blob	12.28.0	12.30.1
blobfile	3.0.0	3.3.0
bm25s	0.2.13	0.3.11
boto3	1.35.57	1.43.83
botocore	1.35.57	1.43.83
cffi	2.0.0	2.1.1
cohere	7.0.8	7.1.0
cohere-melody	0.11.1	0.13.4
colorlog	6.10.1	6.12.0
coverage	7.10.6	7.16.0
cramjam	2.9.0	2.11.0
cuda-bindings	13.0.3	13.3.1
cuda-pathfinder	1.3.3	1.8.0
cuda-toolkit	13.0.3.0	13.3.1
datamodel-code-generator	0.26.3	0.76.0
dataproperty	1.0.1	1.1.1
decorator	5.1.1	5.3.1
dill	0.3.8	0.4.1
distlib	0.3.9	0.4.3
dnspython	2.7.0	2.8.0
docker	7.1.0	7.2.0
einx	0.3.0	0.4.3
email-validator	2.2.0	2.3.0
fastapi-cloud-cli	0.21.0	0.24.0
fastar	0.11.0	0.12.0
fonttools	4.55.0	4.63.0
frozenlist	1.5.0	1.8.0
genson	1.3.0	1.4.0
google-api-core	2.24.2	2.34.0
google-auth	2.40.2	2.57.0
google-cloud-core	2.4.3	2.7.0
google-cloud-storage	3.4.0	3.13.1
google-crc32c	1.7.1	1.8.0
google-resumable-media	2.7.2	2.10.2
googleapis-common-protos	1.70.0	1.75.2
greenlet	3.2.3	3.5.5
h11	0.14.0	0.16.0
h2	4.3.0	4.4.1
hiredis	3.0.0	3.4.1
hpack	4.1.0	4.2.0
httpx	0.27.2	0.28.1
humanize	4.11.0	4.16.0
hypothesis	6.131.0	6.165.10
iniconfig	2.0.0	2.3.0
jiter	0.15.0	0.16.0
jmespath	1.0.1	1.1.0
joblib	1.4.2	1.5.3
jsonschema-rs	0.46.5	0.52.0
kiwisolver	1.4.7	1.5.1
lazy-loader	0.4	0.5
llguidance	1.7.6	1.8.0
llvmlite	0.47.0	0.49.0
mako	1.3.10	1.4.1
matplotlib	3.9.2	3.10.9
mpmath	1.3.0	1.4.1
msal	1.34.0	1.38.0
msgpack	1.1.0	1.2.2
mteb	2.8.3	2.20.4
multidict	6.1.0	6.7.1
mypy-extensions	1.0.0	1.1.0
networkx	3.2.1	3.4.2
nltk	3.9.1	3.10.3
nvidia-cublas	13.1.1.3	13.6.1.10
nvidia-cuda-cupti	13.0.85	13.3.75
nvidia-cuda-nvrtc	13.0.88	13.3.33
nvidia-cuda-runtime	13.0.96	13.3.29
nvidia-cudnn-cu13	9.20.0.48	9.25.1.1
nvidia-cufft	12.0.0.61	12.3.0.29
nvidia-cufile	1.15.1.6	1.18.1.6
nvidia-cusolver	12.0.4.66	12.2.6.9
nvidia-cusparse	12.6.3.3	12.8.2.51
nvidia-cusparselt-cu13	0.8.1	0.9.1
nvidia-nccl-cu13	2.29.7	2.31.2
nvidia-nvjitlink	13.0.88	13.3.33
nvidia-nvshmem-cu13	3.4.5	3.7.2
nvidia-nvtx	13.0.85	13.3.29
opentelemetry-exporter-otlp-proto-common	1.35.0	1.44.0
opentelemetry-exporter-otlp-proto-grpc	1.35.0	1.44.0
opentelemetry-exporter-otlp-proto-http	1.35.0	1.44.0
opentelemetry-exporter-prometheus	0.56b0	0.65b0
opentelemetry-proto	1.35.0	1.44.0
opentelemetry-semantic-conventions	0.56b0	0.65b0
orjson	3.11.5	3.12.0
pathvalidate	3.2.1	3.3.1
perceptron	0.1.4	0.3.5
pluggy	1.5.0	1.6.0
polars	1.29.0	1.44.1
pooch	1.8.2	1.9.0
propcache	0.2.0	0.5.2
proto-plus	1.26.1	1.28.4
pycryptodomex	3.22.0	3.23.0
pydantic-extra-types	2.10.5	2.11.1
pydantic-settings	2.14.2	2.15.0
pyjwt	2.11.0	2.13.0
pyparsing	3.2.0	3.3.2
pystemmer	3.0.0	3.1.0
pytest-forked	1.6.0	1.7.5
pytest-mock	3.14.0	3.15.1
pytest-timeout	2.3.1	2.4.0
python-rapidjson	1.20	1.23
rapidfuzz	3.12.1	3.14.5
referencing	0.35.1	0.37.0
responses	0.25.3	0.26.3
rignore	0.7.6	0.8.1
runai-model-streamer-azure	0.15.7	0.16.1
runai-model-streamer-gcs	0.15.7	0.16.1
runai-model-streamer-s3	0.15.7	0.16.1
s3transfer	0.10.3	0.19.2
sacrebleu	2.4.3	2.6.0
schemathesis	4.21.6	4.25.2
scikit-learn	1.5.2	1.7.2
scipy	1.13.1	1.15.3
sentry-sdk	2.63.0	2.68.1
soundfile	0.12.1	0.14.0
statsmodels	0.14.4	0.15.0
sympy	1.13.3	1.14.0
tabulate	0.9.0	0.10.0
termcolor	3.1.0	3.3.0
threadpoolctl	3.5.0	3.6.0
torchcodec	0.14.0+cu130	0.16.0
triton	3.7.1	3.8.0
tritonclient	2.64.0	2.71.0
typer	0.26.8	0.27.2
uvicorn	0.35.0	0.52.4
vector-quantize-pytorch	1.21.2	1.31.1
wcwidth	0.2.13	0.8.3
yarl	1.17.1	1.24.5
auto-round-lib	0.14.2	0.15.0
pynvvideocodec	2.0.4	2.2.2
nvidia-cutlass-dsl	4.6.2	4.7.1
tokenspeed-mla	0.1.8	0.2.5
b12x	1.2.6	1.3.0

Updates regex from 2026.2.28 to 2026.7.19

Changelog

Sourced from regex's changelog.

Version: 2026.9.3

New version of cibuildwheel no longer supports building for free-threaded Python 3.13.

Version: 2026.9.2

New version of cibuildwheel no longer needs nor supports cpython-freethreading option.

Version: 2026.9.1

Updated cibuildwheel.
Support Python 3.15.

Version: 2026.8.31

Fixed version.

Version: 2026.8.30

Git issue 611: Heap out-of-bounds write at compile time
Git issue 612: count_one() size underflow through the stale required-string cache
Git issue 613: (*SKIP) inside an atomic group, plus an equality-only scan stop
Git issue 614: build_GROUP() does not propagate the match direction

Version: 2026.8.12

Support Python 3.15.

Version: 2026.7.19

Git issue 607: SIGSEGV: NULL pointer dereference in `basic_match()` when `(?R)`/`(?0)` recursion is used inside a fuzzy-matching quantifier
Git issue 608: SIGSEGV: out-of-bounds read in `bytes1_char_at()` with `DOTALL` + a fuzzy constraint + `(?r)` reverse-direction matching

Version: 2026.7.10

Clarified that the POSIX flag makes it look for only the longest overall match.
Git issue 606: regex's compiled-pattern cache eviction is not free-threading-safe

Version: 2026.6.28

Git issue 604: regex fails on free-threading python because setlocale is not thread-safe

Version: 2026.5.9

Reverse matching with full unicode casefolding could lead to out-of-range string indexes.

Version: 2026.4.4

A fix for older Python versions before free-threading was  supported.

... (truncated)

Commits

• 0525aff Git issue 608: SIGSEGV: out-of-bounds read in bytes1_char_at() with `DOTALL...
• 07dfa3b Git issue 607: SIGSEGV: NULL pointer dereference in basic_match() when `(?R...
• e7716da Python 3.15 not released yet.
• e204ddb Git issue 606: regex's compiled-pattern cache eviction is not free-threadin...
• d7e1927 Updated main.yml for Python 3.15.
• b18daa6 Git issue 604: regex fails on free-threading python because setlocale is not ...
• e57d185 Reverse matching with full unicode casefolding lead to out-of-range string in...
• bc57b04 A fix for older Python versions before free-threading was supported.
• 773e213 More fixes for free-threading.
• 5d51c75 Fixed segfault.
• Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates tqdm from 4.67.3 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

• contrib.concurrent: major improvements
  • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
  • fix total based on shortest iterable length (#1473)
  • use default max_workers (#1543 <- #1530, #1518)
  • support timeout, buffersize (#1576)
  • improve ETA (#1708 <- #1161)
  • update as_completed (#1709 <- #1565)
  • add tqdm.concurrent.intepreter_map (#1777)
• asyncio: support iterables with only __aiter__ (#1714 <- #1686)
• support reset(float("inf")) (#1783 <- #1781, #651)
• framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

• contrib.logging: preserve filters (#1775 <- #1581)
• rich: misc fixes (#1773)
  • support generators (without len) (#1391)
  • fix potential AttributeError on exit (#1674)
• fix total=float('inf') (#1781 <- #651)
• fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)
• fix minor docs typos (#1780, #1746)

tqdm v4.69.0 stable

• add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
• misc minor framework updates
  • bump workflow actions & pre-commit hooks

tqdm v4.68.4 stable

• trim to ncols even when '{bar}' not in bar_format (#1717, #1767 <- #1658)
• fix tqdm.write when stdout=None (#1768 <- #1654)

tqdm v4.68.3 stable

• utils: delay os.get_terminal_size (#1763 <- #1760)
• autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098, #512)
• minor docs updates
  • fix typo (#1762)
  • use git-fame
• misc minor framework updates
  • fix & update CI build
  • pre-commit: add docs & metadata generation
  • move tox.ini -> pyproject.toml, move tox-gh-actions -> tox-gh
  • add Python 3.14, drop 3.7 support

tqdm v4.68.2 stable

• revert accidental change to ascii default (fixes #1760)
  • UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1
• misc docs updates
  • fix links
  • replace stray rst -> md syntax
  • consistent "progress bar" terminology (#1737)

... (truncated)

Commits

• 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
• c27393e misc tidy
• 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
• 9fc160b Update how we check for interpreter_map support in the tests
• b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
• 16d5486 Add support for nested progress bars
• 9f5890f Add initial implementation for interpreter_map
• 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
• 4664b57 minor tidy
• 426a098 Treat inf total as unknown in reset() too
• Additional commits viewable in compare view

Updates transformers from 5.15.0 to 5.16.1

Release notes

Sourced from transformers's releases.

Release v5.16.1

This is a special release as we include GLM! (and a few small fixes)

GLM-5.3-Flash

GLM-5.3-Flash, the first natively multimodal model in the GLM-5 series. With 320B total parameters and just 18B active parameters, it outperforms GLM-5.2 across benchmarks and real-world workloads at one-tenth the price, while approaching Claude Opus 4.8 on coding and agentic benchmarks.

GLM-5.3-Flash starts from a newly trained base model, with its architecture and training recipe redesigned around capability and efficiency. For the first time in the GLM series, we introduce a hybrid architecture combining sparse and linear attention, sharply reducing long-context serving costs while preserving precise long-context capabilities. The model also adopts Manifold-Constrained Hyper-Connections (mHC) to further improve scaling efficiency. Together with our latest 30T-token multimodal pre-training corpus, these changes enable GLM-5.3-Flash to deliver more intelligence with less compute.

Links: Documentation

• [Glm 5.3 Flash] GLM 5.3 Flash Support (#48342) by @​Dovis01 in #48342

Small patch fixes

Mainly BC behavior for TP and pinning a hf kernel for security reasons 🤗

• Restore BC for the tensor-parallel API (#48300) by @​ArthurZucker
• Fix kernel commit and repo paths for ESMFold2 (#48186) by @​Rocketknight1

Full Changelog: huggingface/transformers@v5.16.0...v5.16.1

Release: v5.16.0

Release v5.16.0

New Model additions

Qwen4-Exp

Qwen4-Exp builds on Qwen3.5's hybrid text and multimodal architecture with three key components: GatedResidual (GR), Qwen Sparse Attention (QSA), and Per-Layer Embedding (PLE).

GR is a Qwen-developed residual architecture that combines Hyper-Connection with GatedNorm. It mixes multiple residual streams with fine-grained elementwise gating before each attention and Mixture-of-Experts (MoE) block, then controls how much of the block output is injected back into each stream.

QSA uses multiple query heads to score compressed key blocks, selects the most relevant contiguous token blocks, and keeps the incomplete trailing block uncompressed. This block-level selection reduces indexing overhead and improves memory locality for long sequences. Combined with Gated DeltaNet, QSA makes Qwen4-Exp the first hybrid architecture to integrate linear and sparse attention, substantially improving inference efficiency for long-context workloads.

PLE enriches selected decoder layers with layer-specific lexical features derived from hashed token n-grams and a dilated depthwise convolution.

Links: Documentation

• Add Qwen4Exp model (#48337) by @​Cyrilvallez in #48337

GraniteSpeech5

... (truncated)

Commits

• 93c8b7b v5.16.1
• cdaca83 [Glm 5.3 Flash] GLM 5.3 Flash Support (#48342)
• b366ad3 Fix kernel commit and repo paths for ESMFold2 (#48186)
• f2f4327 Restore BC for the tensor-parallel API (#48300)
• 93d1bcf release: v5.16.0
• 276c5c4 Add Qwen4Exp model (#48337)
• d3cdaec Fix video-llama modular conversion (#48336)
• 949e301 CI: gate the hunyuan-moe slow test (#48330)
• 5fcf605 Add a regression test for force_accelerate_hooks signature preservation (#48...
• 27e7f6c Add an opt-in per-frame pixel cap (cap_pixels_per_frame) to the Qwen3-VL vide...
• Additional commits viewable in compare view

Updates huggingface-hub from 1.28.0 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

• [Xet] Cache connection info to avoid one token request per file by @​hanouticelina in #4732

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

• [Buckets] Add support for updating bucket visibility by @​hanouticelina in #4715

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

• [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
• Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

• [Inference Providers] Send LoRA weights for fal-ai text-to-video by @​moon-bot-app[bot] in #4706
• Hint at stream=True when a non-streaming inference call fails with 504 by @​moon-bot-app[bot] in #4744

🖥️ CLI

... (truncated)

Commits

• 4237d95 Release: v1.29.0
• dd44abc Release: v1.29.0.rc1
• 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
• b1bf950 Release: v1.29.0.rc0
• 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
• c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
• 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
• 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
• 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
• c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
• Additional commits viewable in compare view

Updates tokenizers from 0.22.2 to 0.23.1

Release notes

Sourced from tokenizers's releases.

Release v0.23.1

TL;DR

tokenizers 0.23.1 is the first proper stable release in the 0.23 line — 0.23.0 only ever shipped as rc0 because the release pipeline itself was broken (Node side hadn't shipped multi-platform binaries since 2023, Python side was on pyo3 0.27 without free-threaded support). 0.23.1 is the version where everything actually goes out the door together: full Node multi-platform wheels for the first time in years, Python 3.14 (regular and free-threaded 3.14t), full type hints for every Python class, and a stack of measurable perf wins on the BPE / added-vocab hot paths.

There is no functional 0.23.0 published — we tag 0.23.1 directly so users don't accidentally pull a never-shipped version.

---

🚨 Breaking changes

• Drop Python 3.9 (#1952) — requires-python = ">=3.10"; 3.9 users stay on 0.22.x.
• add_tokens normalizes content at insertion (#1995) — re-saved tokenizer.json may differ in the added_tokens block. Existing files load unchanged.
• Type stubs are precise (#1928, #1997) — methods that returned Any now return real types; mypy --strict may surface previously-hidden errors. Stub layout also moved from tokenizers/<sub>/__init__.pyi to tokenizers/<sub>.pyi. This breaks the surface of some of the processors like RobertaProcessign's __init__ .
• 3.14t-only: setters/getters return PyResult<T> because of Arc<RwLock<Tokenizer>>; a poisoned lock surfaces as PyException instead of a panic.

---

⚡ Performance — measured locally on this Mac, not lifted from PRs

Run with cargo bench --bench <name> -- --save-baseline v0_22_2 on v0.22.2, then --baseline v0_22_2 on v0.23.1. Numbers are point-in-time wall clock on a single laptop; relative deltas are what matters, absolute numbers will differ on CI hardware.

Added-vocabulary deserialize — the headline win (#1995, #1999)

bench: improve added_vocab_deserialize to reflect real-world workloads (#2000) is now representative of how transformers actually loads tokenizer.json files. The combined effect of daachorse for the matching automaton plus the normalize-on-insert refactor is enormous on this workload:

benchmark	v0.22.2	v0.23.1	change
100k tokens, special, no norm	~410 ms	248 ms	−40%
100k tokens, non-special, no norm	~7.1 s	273 ms	−96%
100k tokens, special, NFKC	~395 ms	235 ms	−40%
100k tokens, non-special, NFKC	~7.4 s	290 ms	−96%
400k tokens, special, no norm	~15 s	980 ms	−94%

Real-world impact: loading a Llama-3-style tokenizer with a large set of added tokens dropped from "noticeable pause" to "instant".

BPE encode

benchmark	v0.22.2	v0.23.1	change
BPE GPT2 encode batch, no cache	530 ms	446 ms	−16%
BPE GPT2 encode batch (cached)	690 ms	685 ms	noise
BPE GPT2 encode (single)	1.95 s	1.94 s	noise
BPE Train (small)	32.6 ms	31.5 ms	−3%
BPE Train (big)	1.01 s	988 ms	−2%

The BPE per-thread cache PR (#2028) shows much larger wins on highly-parallel workloads (+47–62% at 88+ threads on a server box, per the PR's own measurements on Vera). Single-thread batch numbers above are flat or slightly improved because cache-hit overhead was already low without contention.

Llama-3 encode

... (truncated)

Commits

• 7f1623b Bump version to 0.23.1
• bbe43ad ci: release workflow fixes (node + python) (#2043)
• ab0c5d8 Fix node release (#2034)
• decd8e0 bindings/python: free-threaded Python (3.14t) support (#2041)
• 3992692 update for release (#2033)
• bcdd25b BPE cache: per-thread read-through cache to avoid RwLock atomics on hits (#2028)
• 618eb38 Bump follow-redirects in /tokenizers/examples/unstable_wasm/www (#2024)
• b6b1688 chore: bump doc-builder SHA for PR upload workflow (#2025)
• 19015d6 fix: use uvx --with cairosvg instead of uv pip install --system (#2021)
• efbcc68 Ci benchmarks (#2019)
• Additional commits viewable in compare view

Updates fastapi from 0.136.3 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release not...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.