Skip to content

MAINT: Bump the minor-and-patch group with 12 updates#2253

Merged
jsong468 merged 3 commits into
mainfrom
dependabot/uv/minor-and-patch-7e01df0ab5
Jul 23, 2026
Merged

MAINT: Bump the minor-and-patch group with 12 updates#2253
jsong468 merged 3 commits into
mainfrom
dependabot/uv/minor-and-patch-7e01df0ab5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026 •
edited by jsong468
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates:

Package From To
fastapi 0.139.0 0.139.2
openai 2.45.0 2.46.0
tqdm 4.68.4 4.69.0
transformers 5.13.1 5.14.1
websockets 16.1 16.1.1
azure-cognitiveservices-speech 1.50.0 1.51.0
litellm 1.91.3 1.91.4
jupytext 1.19.4 1.19.5
ty 0.0.59 0.0.62
pre-commit 4.6.0 4.6.1
diff-cover 10.3.0 10.4.0
ruff 0.15.21 0.15.22

Updates fastapi from 0.139.0 to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

0.139.1

Fixes

  • 🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @​tiangolo.

Docs

  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @​YuriiMotov.

Translations

Internal

Commits
  • 866b7a3 🔖 Release version 0.139.2 (#16014)
  • 7b3effe 📝 Update release notes
  • 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
  • c48e67b 🔖 Release version 0.139.1 (#16012)
  • 2acc4fb 📝 Update release notes
  • eb75fd0 🐛 Fix frontend fallback support for doted paths like /users/john.doe (#16011)
  • 9b8410b 📝 Update release notes
  • e24d44c 📝 Fix topic repository list not being displayed and skip_users not being ap...
  • 93b78f8 📝 Update release notes
  • b959b44 📝 Update release notes
  • Additional commits viewable in compare view

Updates openai from 2.45.0 to 2.46.0

Release notes

Sourced from openai's releases.

v2.46.0

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

  • api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (5a00941)
  • api: add owner_project_access to APIKeyListParams (f589d04)
  • api: manual updates (980f176)
  • api: manual updates (2eae984)

Bug Fixes

  • api: preserve generated type compatibility (00bd72a)
  • api: remove beta annotation compatibility aliases (99dbd15)
Changelog

Sourced from openai's changelog.

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

  • api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (5a00941)
  • api: add owner_project_access to APIKeyListParams (f589d04)
  • api: manual updates (980f176)
  • api: manual updates (2eae984)

Bug Fixes

  • api: preserve generated type compatibility (00bd72a)
  • api: remove beta annotation compatibility aliases (99dbd15)
Commits

Updates tqdm from 4.68.4 to 4.69.0

Release notes

Sourced from tqdm's releases.

tqdm v4.69.0 stable

  • add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
  • misc minor framework updates
    • bump workflow actions & pre-commit hooks
Commits

Updates transformers from 5.13.1 to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

Release v5.14.0

New Model additions

Inkling (fresh from Thinking Machines): 975B total, 41B active

Inkling is a general-purpose multimodal model that accepts text, image and audio inputs and generates text outputs. It is intended for use in English and other languages, and across multiple coding languages. The model is designed to be used by developers building AI- powered applications, including agentic and tool-use systems, coding assistants, chatbots, and retrieval-augmented generation systems, and is suitable for general-purpose conversational use, instruction-following, and other natural language and multimodal tasks. It is released with open weights to support research, fine-tuning and integration into third-party products by downstream developers.

TIPSv2

Links: Documentation

TIPSv2 DPT

Links: Documentation

🚨 Breaking changes

... (truncated)

Commits

Updates websockets from 16.1 to 16.1.1

Release notes

Sourced from websockets's releases.

16.1.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 01df1e4 Revert "Decode non-ASCII header values with iso-8859-1."
  • 2d61f74 Clarify restriction on headers in 16.1.
  • See full diff in compare view

Updates azure-cognitiveservices-speech from 1.50.0 to 1.51.0

Updates litellm from 1.91.3 to 1.93.0

Release notes

Sourced from litellm's releases.

v1.93.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.93.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 052b5a2 Merge pull request #33904 from BerriAI/litellm_models_listing_malformed_cost_...
  • db190ba fix(proxy): treat malformed cost-map token limits as absent on /v1/models
  • 3510494 chore(release): backport #33853 and #33864 onto patch-1.93.0rc2 to complete t...
  • 2530e32 chore(release): backport 11 staging PRs onto patch-1.93.0rc2 for the 1.93.0 s...
  • b5cd431 Merge pull request #33499 from BerriAI/litellm_backport_1930rc2
  • fba058b Merge pull request #32956 from BerriAI/litellm_fix_lit3859_wif_bridge
  • 10d5804 Merge pull request #32884 from BerriAI/litellm_internal_staging
  • d37ba79 refactor(ui): convert projects page chart to shadcn/recharts (#32722)
  • 4baeb28 chore: update Next.js build artifacts (2026-07-11 23:35 UTC, node v20.20.2) (...
  • ca877c7 refactor(ui): colocate the usage view, keeping the shared usage components (#...
  • Additional commits viewable in compare view

Updates jupytext from 1.19.4 to 1.19.5

Release notes

Sourced from jupytext's releases.

Version 1.19.5

Changed

  • Harden the github action (#1569). Thanks to Peyton Murray for this PR
  • The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
  • zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
  • Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

  • Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
  • Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

  • marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!
Changelog

Sourced from jupytext's changelog.

1.19.5 (2026-07-21)

Changed

  • Harden the github action (#1569). Thanks to Peyton Murray for this PR
  • The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
  • zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
  • Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

  • Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
  • Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

  • marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!
Commits
  • 3132c6c Version 1.19.5
  • d8d4d14 build(deps): bump axios from 1.16.0 to 1.18.1 in /jupyterlab in the jupytext-...
  • 1a6fde9 build(deps): bump the actions-dependencies group with 3 updates
  • 0068463 build(deps): bump astro
  • 58c1eb9 build(deps): bump the jupytext-extension-dependencies group across 2 director...
  • af6134e Migrate to jupyter-builder for building frontend extension (#1590)
  • bb0de16 build(deps): bump the actions-dependencies group across 1 directory with 8 up...
  • 555b4c2 avoid quadratic backtracking in help/bash magic regex
  • f24a3b7 reuse secure temp files in marimo_py_to_notebook
  • d53e2f1 Require zizmor and precommit on ci (#1594)
  • Additional commits viewable in compare view

Updates ty from 0.0.59 to 0.0.62

Release notes

Sourced from ty's releases.

0.0.62

Release Notes

Released on 2026-07-21.

Bug fixes

  • Guard recursive Protocol and TypedDict relations (#26990)
  • Prevent stack overflows in recursive type relation checks (#26503)
  • Recover from cancelled file indexing (#26876)

Diagnostics

  • Avoid editing ignore comments with trailing reasons (#26939)
  • Prefer innermost inline suppressions (#26940)
  • Remove unused own-line ignore comments (#27013)
  • Reuse applicable own-line suppressions in --add-ignore (#26925)

Configuration

  • Respect rules and analysis in PEP 723 script metadata configurations (#26671)

Core type checking

  • Accept gradual constrained TypeVar solutions (#26965)
  • Avoid recursive TypeVarTuple alias expansion (#27032)
  • Check inherited method conflicts via the MRO (#27019)
  • Contextually infer custom __setattr__ assignments (#27015)
  • Fix Callable isinstance reachability (#26970)
  • Fix Just[float] protocol matching (#27053)
  • Fix Self binding for classmethod __new__ constructors (#27030)
  • Fix nested short-circuit flow snapshots (#26956)
  • Gate TypedDict PEP 728 parameters by Python version (#26968)
  • Improve match reachability inference around value-pattern branches (#26979)
  • Make membership and equality narrowing consistent (#26982)
  • Preserve constrained TypeVar equality narrowing (#26988)
  • Preserve constrained TypeVar inequality narrowing (#26995)
  • Preserve unsatisfiable generic call constraints (#26964)
  • Respect bounded typevars in union inference (#27023)
  • Respect metaclass __setattr__ for class attributes (#27000)

Performance

  • Cache non-terminal-call reachability prefixes (#26810)
  • Cache protocol Self binding (#26997)
  • Cache sparse reachability checkpoints (#26811)
  • Defer statement-call narrowing gates (#26793)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.62

Released on 2026-07-21.

Bug fixes

  • Guard recursive Protocol and TypedDict relations (#26990)
  • Prevent stack overflows in recursive type relation checks (#26503)
  • Recover from cancelled file indexing (#26876)

Diagnostics

  • Avoid editing ignore comments with trailing reasons (#26939)
  • Prefer innermost inline suppressions (#26940)
  • Remove unused own-line ignore comments (#27013)
  • Reuse applicable own-line suppressions in --add-ignore (#26925)

Configuration

  • Respect rules and analysis in PEP 723 script metadata configurations (#26671)

Core type checking

  • Accept gradual constrained TypeVar solutions (#26965)
  • Avoid recursive TypeVarTuple alias expansion (#27032)
  • Check inherited method conflicts via the MRO (#27019)
  • Contextually infer custom __setattr__ assignments (#27015)
  • Fix Callable isinstance reachability (#26970)
  • Fix Just[float] protocol matching (#27053)
  • Fix Self binding for classmethod __new__ constructors (#27030)
  • Fix nested short-circuit flow snapshots (#26956)
  • Gate TypedDict PEP 728 parameters by Python version (#26968)
  • Improve match reachability inference around value-pattern branches (#26979)
  • Make membership and equality narrowing consistent (#26982)
  • Preserve constrained TypeVar equality narrowing (#26988)
  • Preserve constrained TypeVar inequality narrowing (#26995)
  • Preserve unsatisfiable generic call constraints (#26964)
  • Respect bounded typevars in union inference (#27023)
  • Respect metaclass __setattr__ for class attributes (#27000)

Performance

  • Cache non-terminal-call reachability prefixes (#26810)
  • Cache protocol Self binding (#26997)
  • Cache sparse reachability checkpoints (#26811)
  • Defer statement-call narrowing gates (#26793)

Contributors

... (truncated)

Commits

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates diff-cover from 10.3.0 to 10.4.0

Release notes

Sourced from diff-cover's releases.

Version 10.4.0

What's Changed

Dependency bumps

New Contributors

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Changelog

Sourced from diff-cover's changelog.

7/21/2026 v10.4.0

  • Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

  • Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

  • Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

01/08/2026 v10.2.0

12/30/2025 v10.1.0

  • Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

  • Remove python 3.9 support
  • Add python 3.14 support
  • Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

09/25/2025 v9.7.1

  • Revert the change to attempt to support ruff >=0.12.9 (@​YeeaahMan caught the error)

09/23/2025 v9.7.0

Some internal items

... (truncated)

Commits

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruf...

    Description has been truncated

@dependabot
MAINT: Bump the minor-and-patch group with 12 updates
f434f2f 
Bumps the minor-and-patch group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.139.2` |
| [openai](https://github.com/openai/openai-python) | `2.45.0` | `2.46.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.4` | `4.69.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.13.1` | `5.14.1` |
| [websockets](https://github.com/python-websockets/websockets) | `16.1` | `16.1.1` |
| azure-cognitiveservices-speech | `1.50.0` | `1.51.0` |
| [litellm](https://github.com/BerriAI/litellm) | `1.91.3` | `1.93.0` |
| [jupytext](https://github.com/jupytext/jupytext) | `1.19.4` | `1.19.5` |
| [ty](https://github.com/astral-sh/ty) | `0.0.59` | `0.0.62` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` |
| [diff-cover](https://github.com/Bachmann1234/diff-cover) | `10.3.0` | `10.4.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.15.22` |


Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.139.2)

Updates `openai` from 2.45.0 to 2.46.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v2.45.0...v2.46.0)

Updates `tqdm` from 4.68.4 to 4.69.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.4...v4.69.0)

Updates `transformers` from 5.13.1 to 5.14.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.13.1...v5.14.1)

Updates `websockets` from 16.1 to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.1...16.1.1)

Updates `azure-cognitiveservices-speech` from 1.50.0 to 1.51.0

Updates `litellm` from 1.91.3 to 1.93.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.91.3...v1.93.0)

Updates `jupytext` from 1.19.4 to 1.19.5
- [Release notes](https://github.com/jupytext/jupytext/releases)
- [Changelog](https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md)
- [Commits](jupytext/jupytext@v1.19.4...v1.19.5)

Updates `ty` from 0.0.59 to 0.0.62
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.59...0.0.62)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `diff-cover` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/Bachmann1234/diff-cover/releases)
- [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG)
- [Commits](Bachmann1234/diff_cover@v10.3.0...v10.4.0)

Updates `ruff` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.15.22)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: openai
  dependency-version: 2.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tqdm
  dependency-version: 4.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: azure-cognitiveservices-speech
  dependency-version: 1.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: jupytext
  dependency-version: 1.19.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.62
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: diff-cover
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 22, 2026
Copilot AI review requested due to automatic review settings July 22, 2026 13:00
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 22, 2026
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the allowed litellm dependency range in pyproject.toml to permit newer releases.

Changes:

  • Bumped litellm upper bound from <1.92.0 to <1.94.0 in the litellm dependency group.
  • Bumped litellm upper bound from <1.92.0 to <1.94.0 in the all dependency group.

Comment thread pyproject.toml
Comment thread pyproject.toml
Copilot AI review requested due to automatic review settings July 22, 2026 23:02
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

pyproject.toml:142

  • The litellm extra is documented here as intentionally capped below 1.92.0 due to missing wheels on Windows/macOS/Python 3.14 and CI lacking a Rust toolchain, but the constraint was widened to <1.94.0. This allows (and in uv.lock selects) litellm 1.93.0, which only ships manylinux wheels and will likely fall back to building from sdist on win/mac/py3.14, breaking pyrit[litellm]/pyrit[all] installs for those platforms.
litellm = [
    # Cap below 1.92.0: 1.92.0+ replaced the universal py3-none-any wheel with a
    # Rust (PyO3) extension and only publishes manylinux wheels for CPython
    # 3.10-3.13 (Linux only). On Windows, macOS, or Python 3.14 there is no
    # matching wheel, so pip/uv falls back to building the Rust extension from the
    # sdist, which fails (no Rust toolchain in CI; PyO3 <=3.13 has no 3.14 support).
    # 1.91.x is the last line with a universal wheel that installs on every OS and
    # Python version we support. Revisit once litellm ships win/mac/py3.14 wheels.
    "litellm>=1.83.0,<1.94.0",
]

pyproject.toml:153

  • The all extra also widened the litellm cap to <1.94.0, which conflicts with the inline rationale (<1.92.0 due to Linux-only wheels) and can break pip install pyrit[all] on Windows/macOS/Python 3.14 by forcing an sdist build.
    "azure-cognitiveservices-speech>=1.44.0",
    "flask>=3.1.3",
    "ipykernel>=6.29.5",
    "jupyter>=1.1.1",
    "litellm>=1.83.0,<1.94.0",  # <1.92.0: 1.92.0+ ships Linux-only Rust wheels (no win/mac/py3.14); see litellm group above
    "ollama>=0.5.1",

jsong468
jsong468 approved these changes Jul 23, 2026
View reviewed changes

@jsong468 jsong468 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

litellm minor version not upgraded to 1.92+ to maintain compatibility with windows/mac

@jsong468
jsong468 enabled auto-merge July 23, 2026 19:50
@jsong468
jsong468 added this pull request to the merge queue Jul 23, 2026
Merged via the queue into main with commit 77b90e4 Jul 23, 2026
55 checks passed
@jsong468
jsong468 deleted the dependabot/uv/minor-and-patch-7e01df0ab5 branch July 23, 2026 20:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@jsong468 jsong468 jsong468 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsong468