Skip to content

Bump the pip group across 1 directory with 19 updates#113

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/py/sight/pip-57bff0bb8a
Open

Bump the pip group across 1 directory with 19 updates#113
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/py/sight/pip-57bff0bb8a

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 26, 2026

Bumps the pip group with 19 updates in the /py/sight directory:

Package From To
certifi 2023.11.17 2024.7.4
filelock 3.16.1 3.20.3
fonttools 4.47.2 4.60.2
grpcio 1.50.0 1.53.2
idna 3.6 3.7
jinja2 3.1.4 3.1.6
keras 2.8.0 3.13.2
pillow 10.2.0 12.1.1
protobuf 3.20.2 5.29.6
pyasn1 0.4.8 0.6.3
requests 2.31.0 2.33.0
scikit-learn 1.4.1.post1 1.5.0
tensorflow 2.8.0 2.12.1
tornado 6.4 6.5.5
tqdm 4.66.1 4.66.3
urllib3 1.26.20 2.6.3
virtualenv 20.26.6 20.36.1
werkzeug 3.0.1 3.1.6
zipp 3.17.0 3.19.1

Updates certifi from 2023.11.17 to 2024.7.4

Commits

Updates filelock from 3.16.1 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

3.20.1

What's Changed

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

3.20.0

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.19.1...3.20.0

3.19.1

What's Changed

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

3.25.2 (2026-03-11)

  • 🐛 fix(unix): suppress EIO on close in Docker bind mounts :pr:513

3.25.1 (2026-03-09)

  • [pre-commit.ci] pre-commit autoupdate :pr:510 - by :user:pre-commit-ci[bot]
  • 🐛 fix(win): restore best-effort lock file cleanup on release :pr:511
  • [pre-commit.ci] pre-commit autoupdate :pr:508 - by :user:pre-commit-ci[bot]
  • 📝 docs(logo): add branded project logo :pr:507

3.25.0 (2026-03-01)

  • ✨ feat(async): add AsyncReadWriteLock :pr:506
  • Standardize .github files to .yaml suffix
  • build(deps): bump actions/download-artifact from 7 to 8 :pr:503 - by :user:dependabot[bot]
  • build(deps): bump actions/upload-artifact from 6 to 7 :pr:502 - by :user:dependabot[bot]
  • Move SECURITY.md to .github/SECURITY.md
  • Add security policy
  • Add permissions to check workflow :pr:500
  • [pre-commit.ci] pre-commit autoupdate :pr:499 - by :user:pre-commit-ci[bot]

3.24.3 (2026-02-19)

  • 🐛 fix(unix): handle ENOENT race on FUSE/NFS during acquire :pr:495
  • 🐛 fix(ci): add trailing blank line after changelog entries :pr:492

3.24.2 (2026-02-16)

  • 🐛 fix(rw): close sqlite3 cursors and skip SoftFileLock Windows race :pr:491
  • 🐛 fix(test): resolve flaky write non-starvation test :pr:490
  • 📝 docs: restructure using Diataxis framework :pr:489

3.24.1 (2026-02-15)

... (truncated)

Commits

Updates fonttools from 4.47.2 to 4.60.2

Release notes

Sourced from fonttools's releases.

4.60.2

  • Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.60.1

  • [ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).
  • [ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).
  • [subset] Don't try to subset BASE table; pass it through by default instead (#3949).
  • [subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).
  • [subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).
  • [subset] Remove duplicate features when subsetting (#3945).
  • [Docs] Added documentation for the visitor module (#3944).

4.60.0

  • [pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

  • [filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

  • [cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

  • [varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

    • varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,
    • varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,
    • varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,
    • varLib.avar.plan module moved from varLib.avarPlanner.

    The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

  • [interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

  • [post] Speed up build_psNameMapping (#3923).

  • [ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

  • [varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).
  • [varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).
  • [subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).
  • [cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)
  • [varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).
  • [feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).
  • [cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

  • [featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).
  • [vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).
  • [feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).
  • [varLib] Deprecate varLib.mutator in favor of varLib.instancer. The latter provides equivalent full (static font) instancing in addition to partial VF instancing.
    CLI users should replace fonttools varLib.mutator with fonttools varLib.instancer. API users should migrate to fontTools.varLib.instancer.instantiateVariableFont (#2680).

4.59.0

  • Removed hard-dependency on pyfilesystem2 (fs package) from fonttools[ufo] extra. This is replaced by the fontTools.misc.filesystem package, a stdlib-only, drop-in replacement for the subset of the pyfilesystem2's API used by fontTools.ufoLib. The latter should continue to work with the upstream fs (we even test with/without). However, clients who wish to continue using fs can do so by depending on it directly instead of via the fonttools[ufo] extra (#3885, #3620).
  • [xmlWriter] Replace illegal XML characters (e.g. control or non-characters) with "?" when dumping to ttx (#3868, #71).
  • [varLib.hvar] Fixed vertical metrics fields copy/pasta error (#3884).
  • Micro optimizations in ttLib and sstruct modules (#3878, #3879).
  • [unicodedata] Add Garay script to RTL_SCRIPTS (#3882).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.60.2 (released 2025-12-09)

  • Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.61.0 (released 2025-11-28)

  • [varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.
  • [feaLib] Sort BaseLangSysRecords by tag (#3986).
  • Drop support for EOL Python 3.9 (#3982).
  • [instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).
  • [CFF2ToCFF] Add --remove-overlaps option (#3976).
  • [feaLib] Raise an error for rsub with NULL target (#3979).
  • [bezierTools] Fix logic bug in curveCurveIntersections (#3963).
  • [feaLib] Error when condition sets have the same name (#3958).
  • [cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).
  • [unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

  • [ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).
  • [ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).
  • [subset] Don't try to subset BASE table; pass it through by default instead (#3949).
  • [subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).
  • [subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).
  • [subset] Remove duplicate features when subsetting (#3945).
  • [Docs] Added documentation for the visitor module (#3944).

4.60.0 (released 2025-09-17)

  • [pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).
  • [filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).
  • [cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).
  • [varLib.avar] Refactored and added some new sub-modules and scripts (#3926).
    • varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,
    • varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

... (truncated)

Commits

Updates grpcio from 1.50.0 to 1.53.2

Commits
  • afb307f [v1.53.x][Interop] Backport Python image update (#33864)
  • 7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
  • fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
  • cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
  • ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
  • b24b6ea [release] Bump release version to 1.53.2 (#33709)
  • 1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
  • aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
  • 539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
  • 3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
  • Additional commits viewable in compare view

Updates idna from 3.6 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Commits
  • 1d365e1 Release v3.7
  • c1b3154 Merge pull request #172 from kjd/optimize-contextj
  • 0394ec7 Merge branch 'master' into optimize-contextj
  • cd58a23 Merge pull request #152 from elliotwutingfeng/dev
  • 5beb28b More efficient resolution of joiner contexts
  • 1b12148 Update ossf/scorecard-action to v2.3.1
  • d516b87 Update Github actions/checkout to v4
  • c095c75 Merge branch 'master' into dev
  • 60a0a4c Fix typo in GitHub Actions workflow key
  • 5918a0e Merge branch 'master' into dev
  • Additional commits viewable in compare view

Updates jinja2 from 3.1.4 to 3.1.6

Release notes

Sourced from jinja2's releases.

3.1.6

This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.6/ Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

  • The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. GHSA-cpwx-vrp4-4pq7

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. #2032
  • Calling sync render for an async template uses asyncio.run. #1952
  • Avoid unclosed auto_aiter warnings. #1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. #1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. #1960
  • The runtime uses the correct concat function for the current environment when calling block references. #1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
  • |int filter handles OverflowError from scientific notation. #1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
  • Fix copy/pickle support for the internal missing object. #2027
  • Environment.overlay(enable_async) is applied correctly. #2061
  • The error message from FileSystemLoader includes the paths that were searched. #1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
  • Improve annotations for methods returning copies. #1880
  • urlize does not add mailto: to values like @a@b. #1870
  • Tests decorated with @pass_context can be used with the |select filter. #1624
  • Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
  • Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253
Changelog

Sourced from jinja2's changelog.

Version 3.1.6

Released 2025-03-05

  • The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Version 3.1.5

Released 2024-12-21

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032
  • Calling sync render for an async template uses asyncio.run. :pr:1952
  • Avoid unclosed auto_aiter warnings. :pr:1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960
  • The runtime uses the correct concat function for the current environment when calling block references. :issue:1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781
  • |int filter handles OverflowError from scientific notation. :issue:1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025
  • Fix copy/pickle support for the internal missing object. :issue:2027
  • Environment.overlay(enable_async) is applied correctly. :pr:2061
  • The error message from FileSystemLoader includes the paths that were searched. :issue:1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705
  • Improve annotations for methods returning copies. :pr:1880
  • urlize does not add mailto: to values like @a@b. :pr:1870

... (truncated)

Commits

Updates keras from 2.8.0 to 3.13.2

Release notes

Sourced from keras's releases.

v3.13.2

Security Fixes & Hardening

This release introduces critical security hardening for model loading and saving, alongside improvements to the JAX backend metadata handling.

  • Disallow TFSMLayer deserialization in safe_mode (#22035)

    • Previously, TFSMLayer could load external TensorFlow SavedModels during deserialization without respecting Keras safe_mode. This could allow the execution of attacker-controlled graphs during model invocation.
    • TFSMLayer now enforces safe_mode by default. Deserialization via from_config() will raise a ValueError unless safe_mode=False is explicitly passed or keras.config.enable_unsafe_deserialization() is called.

  • Fix Denial of Service (DoS) in KerasFileEditor (#21880)

    • Introduces validation for HDF5 dataset metadata to prevent "shape bomb" attacks.
    • Hardens the .keras file editor against malicious metadata that could cause dimension overflows or unbounded memory allocation (unbounded numpy allocation of multi-gigabyte tensors).

  • Block External Links in HDF5 files (#22057)

    • Keras now explicitly disallows external links within HDF5 files during loading. This prevents potential security risks where a weight file could point to external system datasets.
    • Includes improved verification for H5 Groups and Datasets to ensure they are local and valid.

Backend-specific Improvements (JAX)

  • Set mutable=True by default in nnx_metadata (#22074)
    • Updated the JAX backend logic to ensure that variables are treated as mutable by default in nnx_metadata.
    • This makes Keras 3.13.2 compatible with Flax 0.12.3 when the Keras NNX integration is enabled.

Saving & Serialization

  • Improved H5IOStore Integrity (#22057)
    • Refactored H5IOStore and ShardedH5IOStore to remove unused, unverified methods.
    • Fixed key-ordering logic in sharded HDF5 stores to ensure consistent state loading across different environments.

Contributors

We would like to thank the following contributors for their security reports and code improvements: @​0xManan, @​HyperPS, @​hertschuh, and @​divyashreepathihalli.

Full Changelog: keras-team/keras@v3.13.1...v3.13.2

v3.13.1

Bug Fixes & Improvements

  • General
    • Removed a persistent warning triggered during import keras when using NumPy 2.0 or higher. (#21949)
  • Backends
    • JAX: Fixed an issue where CUDNN flash attention was broken when using JAX versions greater than 0.6.2. (#21970)
  • Export & Serialization
    • Resolved a regression in the export pipeline that incorrectly forced batch sizes to be dynamic. The export process now correctly respects static batch sizes when defined. (#21944)

Full Changelog: keras-team/keras@v3.13.0...v3.13.1

... (truncated)

Commits
  • e29d0ef Version bump and cherry picks for 3.13.2 (#22080)
  • 8914427 Patch release commits for 3.13.1 (#22005)
  • 986ff97 Update release version and comment orbax checkpoint (#21934)
  • ca23fce Refactors AbsMaxQuantizer to accept axis in call (#21931)
  • 1a9893f Adds Serialization Support for QuantizationConfig based quantized models (#21...
  • 86bfab4 More OpenVINO Numpy Operations (#21925)
  • f48f480 Add adaptive pooling (1D, 2D, 3D) support across JAX, NumPy, TensorFlow, and ...
  • 0771c80 Fix ops.tile shape inference issue on TensorFlow backend (#21860)
  • 024c96d Extended fix OOM Issue #21634 on Keras side (#21755)
  • 71f4997 Introduces QuantizationConfig for fine-grained quantization control (#21896)
  • Additional commits viewable in compare view

Updates pillow from 10.2.0 to 12.1.1

Release notes

Sourced from pillow's releases.

12.1.1

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html

Dependencies

Other changes

12.1.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html

Deprecations

Documentation

Dependencies

Testing

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

11.0.0 (2024-10-15)

  • Update licence to MIT-CMU #8460 [hugovk]

  • Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

  • Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

  • Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

  • Do not close provided file handles with libtiff when saving #8458 [radarhere]

  • Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

  • Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

  • Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

  • Use transparency when combining P frames from APNGs #8443 [radarhere]

  • Support all resampling filters when resizing I;16* images #8422 [radarhere]

  • Free memory on early return #8413 [radarhere]

  • Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits

Updates protobuf from 3.20.2 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

@dependabot
Bump the pip group across 1 directory with 19 updates
8aa9c1b 
Bumps the pip group with 19 updates in the /py/sight directory:

| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2023.11.17` | `2024.7.4` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.16.1` | `3.20.3` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.47.2` | `4.60.2` |
| [grpcio](https://github.com/grpc/grpc) | `1.50.0` | `1.53.2` |
| [idna](https://github.com/kjd/idna) | `3.6` | `3.7` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.4` | `3.1.6` |
| [keras](https://github.com/keras-team/keras) | `2.8.0` | `3.13.2` |
| [pillow](https://github.com/python-pillow/Pillow) | `10.2.0` | `12.1.1` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `3.20.2` | `5.29.6` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.4.8` | `0.6.3` |
| [requests](https://github.com/psf/requests) | `2.31.0` | `2.33.0` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.4.1.post1` | `1.5.0` |
| [tensorflow](https://github.com/tensorflow/tensorflow) | `2.8.0` | `2.12.1` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.4` | `6.5.5` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.66.1` | `4.66.3` |
| [urllib3](https://github.com/urllib3/urllib3) | `1.26.20` | `2.6.3` |
| [virtualenv](https://github.com/pypa/virtualenv) | `20.26.6` | `20.36.1` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.0.1` | `3.1.6` |
| [zipp](https://github.com/jaraco/zipp) | `3.17.0` | `3.19.1` |



Updates `certifi` from 2023.11.17 to 2024.7.4
- [Commits](certifi/python-certifi@2023.11.17...2024.07.04)

Updates `filelock` from 3.16.1 to 3.20.3
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.16.1...3.20.3)

Updates `fonttools` from 4.47.2 to 4.60.2
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.47.2...4.60.2)

Updates `grpcio` from 1.50.0 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.50.0...v1.53.2)

Updates `idna` from 3.6 to 3.7
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.6...v3.7)

Updates `jinja2` from 3.1.4 to 3.1.6
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.1.4...3.1.6)

Updates `keras` from 2.8.0 to 3.13.2
- [Release notes](https://github.com/keras-team/keras/releases)
- [Commits](keras-team/keras@v2.8.0...v3.13.2)

Updates `pillow` from 10.2.0 to 12.1.1
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@10.2.0...12.1.1)

Updates `protobuf` from 3.20.2 to 5.29.6
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pyasn1` from 0.4.8 to 0.6.3
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.4.8...v0.6.3)

Updates `requests` from 2.31.0 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.33.0)

Updates `scikit-learn` from 1.4.1.post1 to 1.5.0
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.4.1.post1...1.5.0)

Updates `tensorflow` from 2.8.0 to 2.12.1
- [Release notes](https://github.com/tensorflow/tensorflow/releases)
- [Changelog](https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md)
- [Commits](tensorflow/tensorflow@v2.8.0...v2.12.1)

Updates `tornado` from 6.4 to 6.5.5
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.4.0...v6.5.5)

Updates `tqdm` from 4.66.1 to 4.66.3
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.66.1...v4.66.3)

Updates `urllib3` from 1.26.20 to 2.6.3
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@1.26.20...2.6.3)

Updates `virtualenv` from 20.26.6 to 20.36.1
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.26.6...20.36.1)

Updates `werkzeug` from 3.0.1 to 3.1.6
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.0.1...3.1.6)

Updates `zipp` from 3.17.0 to 3.19.1
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst)
- [Commits](jaraco/zipp@v3.17.0...v3.19.1)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2024.7.4
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: filelock
  dependency-version: 3.20.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: fonttools
  dependency-version: 4.60.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-version: 1.53.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: idna
  dependency-version: '3.7'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: jinja2
  dependency-version: 3.1.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: keras
  dependency-version: 3.13.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: protobuf
  dependency-version: 5.29.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyasn1
  dependency-version: 0.6.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: scikit-learn
  dependency-version: 1.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tensorflow
  dependency-version: 2.12.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.5
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tqdm
  dependency-version: 4.66.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 20.36.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: werkzeug
  dependency-version: 3.1.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: zipp
  dependency-version: 3.19.1
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 26, 2026
@dependabot dependabot bot requested a review from bronevet-abc as a code owner March 26, 2026 04:37
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 26, 2026
@dependabot dependabot bot mentioned this pull request Mar 26, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bronevet-abc bronevet-abc bronevet-abc approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bronevet-abc