Skip to content

chore(deps)(deps): bump the python-versions group across 1 directory with 32 updates#930

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-999aabb7a9
Closed

chore(deps)(deps): bump the python-versions group across 1 directory with 32 updates#930
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-versions-999aabb7a9

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 29, 2026 •
edited
Loading

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the python-versions group with 32 updates in the / directory:

Package From To
huggingface-hub 1.2.2 1.16.1
jupytext 1.19.1 1.19.3
poethepoet 0.37.0 0.46.0
pyproject-fmt 2.11.1 2.21.2
pyright 1.1.407 1.1.409
pytest 9.0.1 9.0.3
pytest-cov 7.0.0 7.1.0
ruff 0.14.5 0.15.14
scipy-stubs 1.16.3.0 1.17.1.4
ipython 9.7.0 9.13.0
kaleido 1.2.0 1.3.0
matplotlib 3.10.7 3.10.9
optuna 4.7.0 4.8.0
pydata-sphinx-theme 0.16.1 0.18.0
sphinx-design 0.6.1 0.7.0
sphinx-gallery 0.19.0 0.21.0
sphinx-prompt 1.10.1 1.10.2
sphinx-autodoc-typehints 3.5.2 3.10.2
plotly 6.4.0 6.7.0
scoringrules 0.8.0 0.10.0
tqdm 4.67.1 4.67.3
joblib 1.5.2 1.5.3
numpy 2.3.5 2.4.6
pydantic 2.12.4 2.13.4
pydantic-extra-types 2.10.6 2.11.1
holidays 0.84 0.97
mlflow-skinny 3.6.0 3.12.0
pvlib 0.13.1 0.15.1
scikit-learn 1.7.2 1.8.0
scipy 1.16.3 1.17.1
xgboost 3.1.1 3.2.0
xgboost-cpu 3.1.1 3.2.0

Updates huggingface-hub from 1.2.2 to 1.16.1

Release notes

Sourced from huggingface-hub's releases.

[v1.16.1] [Hot-fix] [Inference] Remove Together ASR task to drop urllib3 dependency

  • [Hot-fix] [Inference] Remove Together ASR task to drop urllib3 dependency by @​Wauplin in #4248

Full Changelog: huggingface/huggingface_hub@v1.16.0...v1.16.1

[v1.16.0] Together goes multimodal on Inference Providers, CLI improvements, and token security

⚡ Together goes multimodal on Inference Providers

Together now supports five additional task types beyond chat and text-to-image on Inference Providers:

  • feature_extraction
  • text_to_speech
  • automatic_speech_recognition EDIT: hot-fix v1.16.1 removed this task (see huggingface/huggingface_hub#4248) to fix a dependency issue. We will add it back in a future release.
  • image_to_image
  • text_to_video
from huggingface_hub import InferenceClient
client = InferenceClient(provider="together")
Embeddings
embeddings = client.feature_extraction("Hello world", model="intfloat/multilingual-e5-large-instruct")
Text-to-speech
audio = client.text_to_speech("Hello world", model="hexgrad/Kokoro-82M", extra_body={'voice': 'af_heart'})
Text-to-video
video = client.text_to_video("A cat on the moon", model="Wan-AI/Wan2.2-T2V-A14B")

  • [Inference] Add embeddings, TTS, ASR, image-to-image and video tasks for Together by @​nbroad1881 in #4164

📚 Documentation: Inference guide

🔗 Centralized hf:// URI parsing

All scattered ad-hoc hf:// URI parsers throughout the codebase have been consolidated onto the new parse_hf_uri/parse_hf_mount helpers. This brings consistent parsing behavior, a new is_hf_uri public helper for validating URIs, and proper handling of @ in filenames (now treated as literal). The CLI error handler now catches HfUriError and displays a clean message instead of a raw traceback.

🚨 Breaking Changes

This migration includes several breaking changes: BucketUrl.handle has been renamed to BucketUrl.uri (type changed from str to HfUri, use .to_uri() for the string form), Volume.to_hf_handle() has been renamed to Volume.to_uri(), single-segment repo IDs (e.g. gpt2) are no longer supported in HfFileSystem paths or CLI -v flags — you must use the namespace/name format instead.

  • [Core] Migrate hf:// URI parsing to centralized parse_hf_uri by @​Wauplin in #4189

📚 Documentation: CLI guide | Buckets guide

🖥️ CLI

Global --no-truncate flag for CLI tables

... (truncated)

Commits
  • ff0cc60 Release: v1.16.1
  • a77e961 [Inference] Remove Together ASR task to drop urllib3 dependency (#4248)
  • c68a383 Release: v1.16.0
  • fa7fc45 Release: v1.16.0.rc0
  • 06d6990 [Jobs] Add ephemeral_storage field to JobHardware (#4233)
  • 2618a54 [CLI] Surface job runtime fields in ps + inspect (#4211)
  • 356b712 [CI] make test_model_info_with_security for robust (#4246)
  • 609e64a [CLI] Raise error when both --local-dir and --cache-dir are provided (#4245)
  • b4fd28d [Download] Fix snapshot bar inflation on http_get retry (#4209)
  • a117e68 [CLI] Expose linked repos in PaperInfo (#4240)
  • Additional commits viewable in compare view

Updates jupytext from 1.19.1 to 1.19.3

Release notes

Sourced from jupytext's releases.

Version 1.19.3

Fixed

  • The Jupytext CLI issues a warning when a notebook is not trusted. Also, trust is preserved when empty outputs are added (follow-up on #1505)

Changed

  • The dependabot config has been updated to correctly bump extension packages, now allowing only production updates and ignoring dev dependencies (#1532). Thanks to Mahendra Paipuri for this PR!
  • Removed deprecated stylelint packages (stylelint-config-prettier and stylelint-prettier) from the JupyterLab extension dependencies (#1530)
  • We have removed Python 3.9 testing from the CI (Python 3.9 reached EOL in October 2025)

Version 1.19.2

Fixed

  • Trusted notebooks remain trusted after jupytext --sync (#1505)
  • We have fixed the homepage link in package.json. Thanks to Michał Krassowski for making this PR (#1494)
  • Thanks to Brigitta Sipőcz for fixing a broken link in our CLI (#1428)
  • The --quiet flag now suppresses the creating missing directory warning when writing to a path that includes a prefix (#1533)

Changed

  • The CI workflow has been restructured to maximize parallelization. All test suites (pip, conda, UI) and the build step now run concurrently after pre-commit checks, instead of sequentially, reducing CI times (#1527)
  • We have skipped the tests that involve jupyterfs on Python 3.12+ as they started failing on the CI with no obvious way to fix them (#1509)
  • We have changed the configuration of Dependabot to get grouped dependency updates for our JupyterLab extension.
  • We have merged a series of Dependabot security updates: #1516, #1517, #1519, #1520, #1522, #1524
Changelog

Sourced from jupytext's changelog.

1.19.3 (2026-05-17)

Fixed

  • The Jupytext CLI issues a warning when a notebook is not trusted. Also, trust is preserved when empty outputs are added (follow-up on #1505)

Changed

  • The dependabot config has been updated to correctly bump extension packages, now allowing only production updates and ignoring dev dependencies (#1532). Thanks to Mahendra Paipuri for this PR!
  • Removed deprecated stylelint packages (stylelint-config-prettier and stylelint-prettier) from the JupyterLab extension dependencies (#1530)
  • We have removed Python 3.9 testing from the CI (Python 3.9 reached EOL in October 2025)

1.19.2 (2026-05-10)

Fixed

  • Trusted notebooks remain trusted after jupytext --sync (#1505)
  • We have fixed the homepage link in package.json. Thanks to Michał Krassowski for making this PR (#1494)
  • Thanks to Brigitta Sipőcz for fixing a broken link in our CLI (#1428)
  • The --quiet flag now suppresses the creating missing directory warning when writing to a path that includes a prefix (#1533)

Changed

  • The CI workflow has been restructured to maximize parallelization. All test suites (pip, conda, UI) and the build step now run concurrently after pre-commit checks, instead of sequentially, reducing CI times (#1527)
  • We have skipped the tests that involve jupyterfs on Python 3.12+ as they started failing on the CI with no obvious way to fix them (#1509)
  • We have changed the configuration of Dependabot to get grouped dependency updates for our JupyterLab extension.
  • We have merged a series of Dependabot security updates: #1516, #1517, #1519, #1520, #1522, #1524
Commits
  • 48fdfd8 Fix: Adding cells with no outputs preserves trust status (#1531)
  • 4706e65 chore: Update dependabot config (#1532)
  • 2ec5404 build (deps): Remove deprecated stylelint packages (#1530)
  • 309f97f Version 1.19.2 (#1529)
  • e4dded4 build(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /jupyterlab/packages/...
  • 2c262e5 Fix: --quiet also suppresses warning for directory creation (#1526)
  • 0bfcec1 build(deps): bump fast-uri from 3.1.0 to 3.1.2 in /jupyterlab (#1524)
  • 611e2c0 Explicitly close NotebookNotary signature store (#1528)
  • 70b1f20 All tests run after coverage tests have passed (#1527)
  • 399e934 Close SQLite database connections of Jupytext-created notaries
  • Additional commits viewable in compare view

Updates poethepoet from 0.37.0 to 0.46.0

Release notes

Sourced from poethepoet's releases.

0.46.0

Enhancements

Fixes

Experimental agent skill

This release ships an experimental agent skill that gives AI coding agents contextual knowledge of poe's task API when working in projects that use it. It works with any agent that supports the skills convention and aims to improve agent abilities when it comes to leveraging and authoring poe tasks.

Please try it out and provide feedback!

Two install methods:

  1. Via a built in poe task (similar to how shell completions are installed):
poe _install_skill                          # auto-detects .claude/.codex/.pi/.agents and prompts
poe _install_skill ~/.claude/skills         # explicit path (substitute your agent's dir)
poe _install_skill <skills-dir> --upgrade   # non-interactive upgrade (skips if same/newer)
  1. From github via npx skills
npx skills add https://github.com/nat-n/poethepoet/tree/v0.46.0/poethepoet/skills/poethepoet

Full Changelog: nat-n/poethepoet@v0.45.0...v0.46.0

0.45.0

Enhancements

Fixes

New Contributors

Full Changelog: nat-n/poethepoet@v0.44.0...v0.45.0

0.44.0

Enhancements

... (truncated)

Commits
  • 23a4c1a feat: experimental Claude Code skill and bump-version task (#387)
  • a04a215 refactor: use AST for $POE_EXTRA_ARGS detection and cache parsed content (#388)
  • 61d2e34 refactor: use AST parser for all templating (#386)
  • 1bfad47 fix: make uv and poetry executors check for bat files (#385)
  • 35e4a1b fix: Strip underscore prefix in documentation for private positional args (#383)
  • 244cf0b Bump version to 0.45.0
  • 3a6c09a feat: support forwarding free arguments via $POE_EXTRA_ARGS (#380)
  • a1edcda fix: preserve quotes in :+/:- operator arguments (#333) (#377)
  • 3e60a85 fix: handle cancelled asyncio tasks correctly (#378)
  • bbdd435 fix: handle ctrl+c attempt on windows if running bat/cmd scripts (#382)
  • Additional commits viewable in compare view

Updates pyproject-fmt from 2.11.1 to 2.21.2

Release notes

Sourced from pyproject-fmt's releases.

pyproject-fmt/2.21.2

pyproject-fmt/2.21.1

pyproject-fmt/2.21.0

What's Changed

  • ✨ feat(pyproject-fmt): add pixi support (#283)
  • 🐛 fix(toml-fmt-common): skip write check in --check and --stdout modes (#278)

pyproject-fmt/2.20.0

pyproject-fmt/2.19.0

pyproject-fmt/2.18.1

pyproject-fmt/2.18.0

pyproject-fmt/2.17.0

pyproject-fmt/2.16.2

... (truncated)

Commits
  • 76710cb Release pyproject-fmt 2.21.2 [skip ci]
  • 2c2c9b6 Release tox-toml-fmt 1.9.3 [skip ci]
  • af025bf ✨ feat(build): support free-threaded Python wheels (#307)
  • 0fa616e build(deps): bump taiki-e/install-action from 2.75.18 to 2.75.23 in the githu...
  • c8505ee [pre-commit.ci] pre-commit autoupdate (#303)
  • 973d97e 🐛 fix(common): skip empty tables in Tables::get (#304)
  • ebd487a Update Rust dependencies (#302)
  • cce6a40 Update Python dependencies (#301)
  • eecf4a0 build(deps): bump the github-actions group with 2 updates (#300)
  • a498b78 build(deps): bump rustls-webpki from 0.103.12 to 0.103.13 (#298)
  • Additional commits viewable in compare view

Updates pyright from 1.1.407 to 1.1.409

Commits

Updates pytest from 9.0.1 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

Updates pytest-cov from 7.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

  • Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

  • Improve handling of ResourceWarning from sqlite3.

    The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

    With this fix one can suppress ResourceWarning from sqlite3 from command line::

    pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

  • Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

  • Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

  • Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

Commits
  • 66c8a52 Bump version: 7.0.0 → 7.1.0
  • f707662 Make the examples use pypy 3.11.
  • 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
  • 8ebf20b Update changelog.
  • 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
  • fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
  • 78c9c4e Only run the 3.9 on older deps.
  • 4849a92 Punctuation.
  • 197c35e Update changelog and hopefully I don't forget to publish release again :))
  • 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
  • Additional commits viewable in compare view

Updates ruff from 0.14.5 to 0.15.14

Release notes

Sourced from ruff's releases.

0.15.14

Release Notes

Released on 2026-05-21.

Preview features

  • [airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)
  • [flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)
  • [pylint] Implement too-many-try-statements (W0717) (#23970)
  • [ruff] Add incorrect-decorator-order (RUF074) (#23461)
  • [ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

  • Fix lambda formatting in interpolated string expressions (#25144)
  • Treat generic frozenset annotations as immutable (#25251)
  • [flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)
  • [pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

  • [flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)
  • [flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

  • Avoid unnecessary parser lookahead for operators (#25290)

Documentation

  • Update code example setting Neovim LSP log level (#25284)

Other changes

  • Add full PEP 798 support (#25104)
  • Add a parser recursion limit (#24810)
  • Update various ruff_python_stdlib APIs (#25273)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.14

Released on 2026-05-21.

Preview features

  • [airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)
  • [flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)
  • [pylint] Implement too-many-try-statements (W0717) (#23970)
  • [ruff] Add incorrect-decorator-order (RUF074) (#23461)
  • [ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

  • Fix lambda formatting in interpolated string expressions (#25144)
  • Treat generic frozenset annotations as immutable (#25251)
  • [flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)
  • [pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

  • [flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)
  • [flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

  • Avoid unnecessary parser lookahead for operators (#25290)

Documentation

  • Update code example setting Neovim LSP log level (#25284)

Other changes

  • Add full PEP 798 support (#25104)
  • Add a parser recursion limit (#24810)
  • Update various ruff_python_stdlib APIs (#25273)

Contributors

... (truncated)

Commits
  • 9ad2da3 Bump 0.15.14 (#25295)
  • c714e84 [ty] Modernize setup of union types in mdtests (#25291)
  • 8a8e35e [flake8-comprehensions] Skip C417 for lambdas with positional-only parame...
  • aea5ed4 Avoid unnecessary parser lookahead for operators (#25290)
  • e9d72bb [ty] Allow enum member accesses on self (#25077)
  • 6cbd59b Set exclude-newer = "7 days" in our PEP-723 scripts (#25285)
  • 9999a39 Update code example on how to update Neovim LSP log level (#25284)
  • 67d8c54 [ty] Retain recursively-defined state in binary expressions (#25277)
  • 25a3191 [ty] Refine Callable class-decorator fallback for unknown results (#25250)
  • c423054 Add a recursion limit to the parser (#24810)
  • Additional commits viewable in compare view

Updates scipy-stubs from 1.16.3.0 to 1.17.1.4

Release notes

Sourced from scipy-stubs's releases.

v1.17.1.4

This release targets SciPy 1.17.1 and supports Python 3.11-3.14, NumPy 1.26-2.4, and optype 0.14-0.18.

🏆 Release Highlights

  • 🐛 Fix approx_fprime and newton to accept functions returning n-D arrays in scipy.optimize
  • ✨ Improved shape-typing support for statistical testing functions in scipy.stats and FFT shifting functions in scipy.fft
  • 🔒️ Enforce zizmor to improve security in GitHub Actions and dependabot (guard against supply-chain attacks, cache poisoning, etc.).

What's Changed

✨ Improvements

🐛 Fixes

↪️ Workarounds

📝 Documentation

🧹 Maintenance

... (truncated)

Commits
  • ff66e8a 🔖 scipy-stubs 1.17.1.4
  • 1ba8ccf Merge pull request #1546 from scipy/fix-mypy_primer-comment-workflow
  • b4beb7d 💚 fix mypy_primer comment workflow
  • 7494565 Merge pull request #1545 from scipy/bump-mypy-pyrefly

@dependabot
chore(deps)(deps): bump the python-versions group across 1 directory …
5c8b647 
…with 32 updates

Bumps the python-versions group with 32 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.2.2` | `1.16.1` |
| [jupytext](https://github.com/mwouts/jupytext) | `1.19.1` | `1.19.3` |
| [poethepoet](https://github.com/nat-n/poethepoet) | `0.37.0` | `0.46.0` |
| [pyproject-fmt](https://github.com/tox-dev/toml-fmt) | `2.11.1` | `2.21.2` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.407` | `1.1.409` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.1` | `9.0.3` |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.14.5` | `0.15.14` |
| [scipy-stubs](https://github.com/scipy/scipy-stubs) | `1.16.3.0` | `1.17.1.4` |
| [ipython](https://github.com/ipython/ipython) | `9.7.0` | `9.13.0` |
| [kaleido](https://github.com/plotly/kaleido) | `1.2.0` | `1.3.0` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.10.7` | `3.10.9` |
| [optuna](https://github.com/optuna/optuna) | `4.7.0` | `4.8.0` |
| [pydata-sphinx-theme](https://github.com/pydata/pydata-sphinx-theme) | `0.16.1` | `0.18.0` |
| [sphinx-design](https://github.com/executablebooks/sphinx-design) | `0.6.1` | `0.7.0` |
| [sphinx-gallery](https://github.com/sphinx-gallery/sphinx-gallery) | `0.19.0` | `0.21.0` |
| [sphinx-prompt](https://github.com/sbrunner/sphinx-prompt) | `1.10.1` | `1.10.2` |
| [sphinx-autodoc-typehints](https://github.com/tox-dev/sphinx-autodoc-typehints) | `3.5.2` | `3.10.2` |
| [plotly](https://github.com/plotly/plotly.py) | `6.4.0` | `6.7.0` |
| [scoringrules](https://github.com/frazane/scoringrules) | `0.8.0` | `0.10.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.67.1` | `4.67.3` |
| [joblib](https://github.com/joblib/joblib) | `1.5.2` | `1.5.3` |
| [numpy](https://github.com/numpy/numpy) | `2.3.5` | `2.4.6` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.4` | `2.13.4` |
| [pydantic-extra-types](https://github.com/pydantic/pydantic-extra-types) | `2.10.6` | `2.11.1` |
| [holidays](https://github.com/vacanza/holidays) | `0.84` | `0.97` |
| [mlflow-skinny](https://github.com/mlflow/mlflow) | `3.6.0` | `3.12.0` |
| [pvlib](https://github.com/pvlib/pvlib-python) | `0.13.1` | `0.15.1` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.7.2` | `1.8.0` |
| [scipy](https://github.com/scipy/scipy) | `1.16.3` | `1.17.1` |
| [xgboost](https://github.com/dmlc/xgboost) | `3.1.1` | `3.2.0` |
| [xgboost-cpu](https://github.com/dmlc/xgboost) | `3.1.1` | `3.2.0` |



Updates `huggingface-hub` from 1.2.2 to 1.16.1
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.2.2...v1.16.1)

Updates `jupytext` from 1.19.1 to 1.19.3
- [Release notes](https://github.com/mwouts/jupytext/releases)
- [Changelog](https://github.com/mwouts/jupytext/blob/main/CHANGELOG.md)
- [Commits](mwouts/jupytext@v1.19.1...v1.19.3)

Updates `poethepoet` from 0.37.0 to 0.46.0
- [Release notes](https://github.com/nat-n/poethepoet/releases)
- [Commits](nat-n/poethepoet@v0.37.0...v0.46.0)

Updates `pyproject-fmt` from 2.11.1 to 2.21.2
- [Release notes](https://github.com/tox-dev/toml-fmt/releases)
- [Commits](tox-dev/toml-fmt@pyproject-fmt/2.11.1...pyproject-fmt/2.21.2)

Updates `pyright` from 1.1.407 to 1.1.409
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.407...v1.1.409)

Updates `pytest` from 9.0.1 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.1...9.0.3)

Updates `pytest-cov` from 7.0.0 to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0)

Updates `ruff` from 0.14.5 to 0.15.14
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.14.5...0.15.14)

Updates `scipy-stubs` from 1.16.3.0 to 1.17.1.4
- [Release notes](https://github.com/scipy/scipy-stubs/releases)
- [Commits](scipy/scipy-stubs@v1.16.3.0...v1.17.1.4)

Updates `ipython` from 9.7.0 to 9.13.0
- [Release notes](https://github.com/ipython/ipython/releases)
- [Commits](ipython/ipython@9.7.0...9.13.0)

Updates `kaleido` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/plotly/kaleido/releases)
- [Changelog](https://github.com/plotly/Kaleido/blob/master/CHANGELOG.md)
- [Commits](plotly/Kaleido@v1.2.0...v1.3.0)

Updates `matplotlib` from 3.10.7 to 3.10.9
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.10.7...v3.10.9)

Updates `optuna` from 4.7.0 to 4.8.0
- [Release notes](https://github.com/optuna/optuna/releases)
- [Commits](optuna/optuna@v4.7.0...v4.8.0)

Updates `pydata-sphinx-theme` from 0.16.1 to 0.18.0
- [Release notes](https://github.com/pydata/pydata-sphinx-theme/releases)
- [Changelog](https://github.com/pydata/pydata-sphinx-theme/blob/main/RELEASE.md)
- [Commits](pydata/pydata-sphinx-theme@v0.16.1...v0.18.0)

Updates `sphinx-design` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/executablebooks/sphinx-design/releases)
- [Changelog](https://github.com/executablebooks/sphinx-design/blob/main/CHANGELOG.md)
- [Commits](executablebooks/sphinx-design@v0.6.1...v0.7.0)

Updates `sphinx-gallery` from 0.19.0 to 0.21.0
- [Release notes](https://github.com/sphinx-gallery/sphinx-gallery/releases)
- [Changelog](https://github.com/sphinx-gallery/sphinx-gallery/blob/master/CHANGES.rst)
- [Commits](sphinx-gallery/sphinx-gallery@v0.19.0...v0.21.0)

Updates `sphinx-prompt` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/sbrunner/sphinx-prompt/releases)
- [Commits](sbrunner/sphinx-prompt@1.10.1...1.10.2)

Updates `sphinx-autodoc-typehints` from 3.5.2 to 3.10.2
- [Release notes](https://github.com/tox-dev/sphinx-autodoc-typehints/releases)
- [Commits](tox-dev/sphinx-autodoc-typehints@3.5.2...3.10.2)

Updates `plotly` from 6.4.0 to 6.7.0
- [Release notes](https://github.com/plotly/plotly.py/releases)
- [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md)
- [Commits](plotly/plotly.py@v6.4.0...v6.7.0)

Updates `scoringrules` from 0.8.0 to 0.10.0
- [Release notes](https://github.com/frazane/scoringrules/releases)
- [Commits](frazane/scoringrules@v0.8.0...v0.10.0)

Updates `tqdm` from 4.67.1 to 4.67.3
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.67.1...v4.67.3)

Updates `joblib` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](joblib/joblib@1.5.2...1.5.3)

Updates `numpy` from 2.3.5 to 2.4.6
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.3.5...v2.4.6)

Updates `pydantic` from 2.12.4 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.4...v2.13.4)

Updates `pydantic-extra-types` from 2.10.6 to 2.11.1
- [Release notes](https://github.com/pydantic/pydantic-extra-types/releases)
- [Changelog](https://github.com/pydantic/pydantic-extra-types/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic-extra-types@v2.10.6...v2.11.1)

Updates `holidays` from 0.84 to 0.97
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.84...v0.97)

Updates `mlflow-skinny` from 3.6.0 to 3.12.0
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.6.0...v3.12.0)

Updates `pvlib` from 0.13.1 to 0.15.1
- [Release notes](https://github.com/pvlib/pvlib-python/releases)
- [Commits](pvlib/pvlib-python@v0.13.1...v0.15.1)

Updates `scikit-learn` from 1.7.2 to 1.8.0
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.7.2...1.8.0)

Updates `scipy` from 1.16.3 to 1.17.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.16.3...v1.17.1)

Updates `xgboost` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.1.1...v3.2.0)

Updates `xgboost-cpu` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/dmlc/xgboost/releases)
- [Changelog](https://github.com/dmlc/xgboost/blob/master/NEWS.md)
- [Commits](dmlc/xgboost@v3.1.1...v3.2.0)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: jupytext
  dependency-version: 1.19.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: poethepoet
  dependency-version: 0.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pyproject-fmt
  dependency-version: 2.21.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pyright
  dependency-version: 1.1.409
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: ruff
  dependency-version: 0.15.14
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy-stubs
  dependency-version: 1.17.1.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: ipython
  dependency-version: 9.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: kaleido
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: matplotlib
  dependency-version: 3.10.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: optuna
  dependency-version: 4.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pydata-sphinx-theme
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-design
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-gallery
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: sphinx-prompt
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: sphinx-autodoc-typehints
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: plotly
  dependency-version: 6.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scoringrules
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: tqdm
  dependency-version: 4.67.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: joblib
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-versions
- dependency-name: numpy
  dependency-version: 2.4.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pydantic-extra-types
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: holidays
  dependency-version: '0.97'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: mlflow-skinny
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: pvlib
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scikit-learn
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: scipy
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: xgboost
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
- dependency-name: xgboost-cpu
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 29, 2026
@dependabot dependabot Bot requested a review from a team May 29, 2026 04:58
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 29, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 29, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@egordm egordm mentioned this pull request May 29, 2026
Merged
2 tasks
egordm added a commit that referenced this pull request May 29, 2026
@egordm
chore(deps): upgrade dependencies to resolve all 74 security advisori…
ac0481f 
…es (#934)

## Summary

Refreshes `uv.lock` to clear **all 74 open Dependabot security
advisories** (31 high / 29 medium / 14 low). Every vulnerable package is
transitive (aiohttp ×18, pillow, jupyter-server, mistune, cryptography,
urllib3, tornado, GitPython, nbconvert, …) and reaches a patched version
within existing constraints — no ceiling-widening needed for security.

Supersedes the pile of individual Dependabot PRs (#915, #916,
#920–#930).

## Majors evaluated (per request) — adopted vs deferred

| Major | Verdict |
|---|---|
| pyarrow 24, s3fs 2026, pycountry 26 | ✅ adopted — suite green |
| numpy 2.4, scipy 1.17, xgboost 3.2, mlflow 3.12, pydantic 2.13 | ✅
adopted — suite green |
| scoringrules 0.10, ruff 0.15 | ✅ adopted + code adapted (below) |
| **pandas 3.0** | ⏸️ deferred — needs a Copy-on-Write migration
(read-only-array failures in the median forecaster). Held `<3`; tracked
in #935. |
| **pyproject-fmt 2.12+** | ⏸️ capped `<2.12` — 2.12+ reformats all
pyproject.toml (churn) and 1.3.x toml-fmt-common crashes it. |

## Code adapted to the upgrades

- **scoringrules 0.10**: stricter input validation. crps test drops
degenerate quantile levels 0.0/1.0 (zero pinball loss → value is 8/9);
rcrps tests give one forecast row per observation (no more single-row
broadcast). Expected values cross-checked by hand.
- **ruff 0.15** new rules: `math.isclose` for a ratio-sum check (real
float-fragility fix), integer percentile comparison in the plotter,
docstring section reorder (D420), justified noqas for two intentional
broad pipeline try-blocks and one exact-sentinel comparison. RUF069
ignored in tests (exact deterministic asserts), RUF067 ignored for
package `__init__` logging setup.
- **pandas-stubs 2.3.3** (pyright): comprehension instead of
`functools.reduce(iadd)`, drop a now-unnecessary cast, add casts/ignores
for stub-strictness changes.
- **jupytext 1.19.3**: notebook re-sync (header metadata).

## Verification

Local `poe all --check` is green except **two pre-existing,
platform-specific failures** in `test_openstef4.py`
(`test_fit_then_predict_returns_forecast`,
`test_fit_retains_previous_model_on_insufficient_data`). These fail
identically on pristine `main` on my macOS machine and **pass in CI**
(main is green) — they are a local macOS/pickle quirk, unrelated to this
change. Watching this PR's CI to confirm they stay green.

- ✅ ruff lint + format, pyright (src, 0 errors), uv lock check, reuse,
pyproject-fmt, doctests (107), notebooks-check
- ✅ 936 tests pass (the 4 scoringrules tests now green)

## Test plan

- [ ] CI green (especially the two openstef4 tests that fail only
locally on macOS).
- [ ] Confirm Dependabot security alerts drop to 0 after merge.

---------

Signed-off-by: Egor Dmitriev <egor.dmitriev@alliander.com>
@egordm
Copy link
Copy Markdown
Collaborator

egordm commented May 29, 2026

Superseded by #934, which refreshed uv.lock to current versions (cleared all 74 security advisories). Dependabot will track future bumps lockfile-only (#936).

@egordm egordm closed this May 29, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 29, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/uv/python-versions-999aabb7a9 branch May 29, 2026 12:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@egordm