Skip to content

chore(deps): bump the backend-minor-patch group with 5 updates - #816

Merged
JArmandoAnaya merged 3 commits into
mainfrom
dependabot/uv/backend-minor-patch-03db83c0d6
Sep 2, 2026
Merged

chore(deps): bump the backend-minor-patch group with 5 updates#816
JArmandoAnaya merged 3 commits into
mainfrom
dependabot/uv/backend-minor-patch-03db83c0d6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-minor-patch group with 5 updates:

Package From To
mcp 2.0.0 2.1.1
transformers 5.15.1 5.16.1
huggingface-hub 1.28.0 1.29.0
ruff 0.16.4 0.16.5
ultralytics 8.4.124 8.4.131

Updates mcp from 2.0.0 to 2.1.1

Release notes

Sourced from mcp's releases.

v2.1.1

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v2.1.0...v2.1.1

v2.1.0

Highlights

  • Client accepts StdioServerParameters directly: Client(StdioServerParameters(command="uv", args=["run", "server.py"])) (#3321).
  • Prompt messages accept Image and Audio, prompt functions may return bare content blocks, and Message / UserMessage / AssistantMessage are exported from mcp.server.mcpserver (#3320).
  • The 4 MiB request body limit now also covers the SSE transport and the OAuth endpoints; SseServerTransport and MCPServer.sse_app() take max_request_body_size, and the SSE message endpoint answers 405 to non-POST requests (#3336).

Behaviour changes to be aware of

  • Handler exceptions (#3314): an unexpected exception from a tool, resource or prompt handler is logged once at ERROR with its traceback, and the client now sees only Error executing tool <name> (or the resource/prompt equivalent) rather than the exception text. Raise ToolError / ResourceError when the message is meant for the model; those still reach the client and are logged at INFO without a traceback.
  • Content-block return annotations (#3320): a tool annotated to return TextContent, EmbeddedResource, Image, Audio, or lists/unions of them no longer advertises outputSchema or returns structuredContent; its content is unchanged. Pass structured_output=True to keep the previous shape.

Fixes

  • TypedDict tool results: NotRequired keys are omitted instead of serialized as null, and registration no longer fails on Python 3.10 (#3224, #3227); recursive return types get an object-rooted outputSchema that pre-2026 clients accept (#3337).
  • 2026-07-28 over HTTP: a POSTed notification such as notifications/cancelled is acknowledged with 202 instead of rejected with 400 (#3324).
  • Pre-2026 sessions ignore cache-hint fields from later revisions instead of failing list_tools() (#3223), and accept boolean sub-schemas in tool schema properties (#3353).
  • mcp install reads and preserves a Claude Desktop config containing non-ASCII text on any Windows code page (#3296).

What's Changed

... (truncated)

Commits
  • 0921d94 Point imports of mcp.server.fastmcp at the migration guide (#3388)
  • 4d6f87e Build releases with the pinned hatchling and a publish action that accepts Me...
  • c5d7d0b docs: refresh translations for recent English changes (#3379)
  • d8b6383 Give recursive tool return types an object-rooted output schema (#3376)
  • 56af447 Log MCPServer handler exceptions by kind and keep crash details off the wire ...
  • f1c40b0 Accept boolean sub-schemas in 2025-11-25 tool schema properties (#3354)
  • 57394b0 Apply the request body limit to the SSE and OAuth endpoints (#3336)
  • 0cee624 Hand TypedDict tool results to pydantic natively (#3331)
  • 0d92192 Shorten stdio test comments (#3329)
  • b2025ab Acknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry (#3326)
  • Additional commits viewable in compare view

Updates transformers from 5.15.1 to 5.16.1

Release notes

Sourced from transformers's releases.

Release v5.16.1

This is a special release as we include GLM! (and a few small fixes)

GLM-5.3-Flash

GLM-5.3-Flash, the first natively multimodal model in the GLM-5 series. With 320B total parameters and just 18B active parameters, it outperforms GLM-5.2 across benchmarks and real-world workloads at one-tenth the price, while approaching Claude Opus 4.8 on coding and agentic benchmarks.

GLM-5.3-Flash starts from a newly trained base model, with its architecture and training recipe redesigned around capability and efficiency. For the first time in the GLM series, we introduce a hybrid architecture combining sparse and linear attention, sharply reducing long-context serving costs while preserving precise long-context capabilities. The model also adopts Manifold-Constrained Hyper-Connections (mHC) to further improve scaling efficiency. Together with our latest 30T-token multimodal pre-training corpus, these changes enable GLM-5.3-Flash to deliver more intelligence with less compute.

Links: Documentation

Small patch fixes

Mainly BC behavior for TP and pinning a hf kernel for security reasons 🤗

Full Changelog: huggingface/transformers@v5.16.0...v5.16.1

Release: v5.16.0

Release v5.16.0

New Model additions

Qwen4-Exp

Qwen4-Exp builds on Qwen3.5's hybrid text and multimodal architecture with three key components: GatedResidual (GR), Qwen Sparse Attention (QSA), and Per-Layer Embedding (PLE).

GR is a Qwen-developed residual architecture that combines Hyper-Connection with GatedNorm. It mixes multiple residual streams with fine-grained elementwise gating before each attention and Mixture-of-Experts (MoE) block, then controls how much of the block output is injected back into each stream.

QSA uses multiple query heads to score compressed key blocks, selects the most relevant contiguous token blocks, and keeps the incomplete trailing block uncompressed. This block-level selection reduces indexing overhead and improves memory locality for long sequences. Combined with Gated DeltaNet, QSA makes Qwen4-Exp the first hybrid architecture to integrate linear and sparse attention, substantially improving inference efficiency for long-context workloads.

PLE enriches selected decoder layers with layer-specific lexical features derived from hashed token n-grams and a dilated depthwise convolution.

Links: Documentation

GraniteSpeech5

... (truncated)

Commits

Updates huggingface-hub from 1.28.0 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

  • [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
  • Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

🖥️ CLI

... (truncated)

Commits
  • 4237d95 Release: v1.29.0
  • dd44abc Release: v1.29.0.rc1
  • 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
  • b1bf950 Release: v1.29.0.rc0
  • 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
  • c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
  • 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
  • 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
  • 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
  • c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
  • Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Updates ultralytics from 8.4.124 to 8.4.131

Release notes

Sourced from ultralytics's releases.

v8.4.131 - Add Apple Core AI export (#25926)

🌟 Summary

Ultralytics v8.4.131 adds Apple Core AI export and inference support for YOLO26, alongside important validation, training, model-configuration, and documentation improvements. 🚀

📊 Key Changes

  • 🍎 Apple Core AI export and inference

    • Export models with model.export(format="coreai") or the equivalent CLI command.
    • Creates Apple’s .aimodel asset format, which can be loaded again with YOLO("yolo26n.aimodel").
    • Supports FP32 and optional FP16 export through the new export-coreai dependency group.
    • Adds a dedicated Core AI backend, metadata handling, API references, export-table support, and continuous macOS CI coverage.
    • Supports YOLO26 models on Apple silicon with macOS 26 or later; exported assets target iOS 27 and macOS 27.
    • Core AI export currently has important limitations: fixed input size, no dynamic shapes or NMS export, and no support in the Ultralytics iOS or Flutter SDKs yet.

  • ⚡ Core AI deployment options

    • YOLO26’s end-to-end head is exported by default, returning finished detections directly.
    • Exporting with end2end=False produces raw predictions and can significantly reduce inference latency when post-processing is handled on the host.
    • Core AI export includes model metadata such as class names, stride, and task information inside the .aimodel asset.

  • ✅ More reliable validation with split=train

    • Validation now consistently uses the unaugmented validation pipeline instead of accidentally applying training augmentations such as Mosaic, MixUp, and Random Perspective.
    • Dataset fractions are now selected according to the requested split.
    • This fixes crashes and unreliable metrics for detection, segmentation, OBB, RT-DETR, and YOLOE validation workflows.

  • 🧮 Correct YOLO26 loss terminology

    • Documentation and logging now distinguish YOLO26’s l1_loss from dfl_loss used by models with distribution-based box regression.
    • Training guides, default configuration comments, tuning tables, experiment trackers, and tutorial output have been updated accordingly.

  • 🎯 Improved model configuration handling

    • Model-scale overrides in parse_model now match exact scale letters, preventing unscaled or dictionary-based configurations from taking the wrong architecture branch.
    • C3k2 configurations without an explicitly provided optional argument no longer fail for medium, large, or extra-large variants.
    • The architecture guide now explains these scale-dependent behaviors more accurately.

  • 🔤 YOLOE class reordering fixes

    • YOLOE.set_classes() now recognizes class-order changes and regenerates prompt embeddings when necessary.
    • Reordering classes therefore updates class IDs and names correctly instead of being treated as a no-op.

  • ⚖️ Training robustness improvements

    • Class weights are now preserved on the underlying model during DDP training and continue to target the student model correctly during knowledge distillation.
    • Fine-tuning guidance now recommends non-zero warmup while clarifying that the full three-epoch default is not always necessary.
    • Documentation now accurately describes automatic optimizer selection and module-name-based layer freezing.

  • 📟 Better progress bars in notebooks and narrow terminals

    • TQDM output no longer disappears in zero-width pseudo-terminals such as those used by Colab.
    • Notebook output is allowed to scroll naturally, while truncated terminal lines now show an ellipsis instead of being silently cut off.

  • 📚 Documentation and presentation updates

    • Corrects documented YOLOE and YOLOv5 run paths to match actual increment_path behavior.
    • Adds the missing OBB task header image.

... (truncated)

Commits
  • c9ecb42 Add Apple Core AI export (#25926)
  • 6422b82 Keep validation unaugmented on split=train and pick the fraction by split (#2...
  • 3a473db Fit the TQDM bar on zero-width and notebook terminals (#25958)
  • 4df68b2 Apply YOLOE class updates when only the order changes (#25956)
  • 42e8571 Preserve class_weights during DDP training (#25959)
  • c5d912a Correct training-argument documentation that disagrees with the trainer (#25957)
  • 4b39631 Correct the dfl loss description for DFL-free YOLO26 (#25941)
  • 22e603b Add the OBB task header image (#25947)
  • 46c1640 Match model scale letters exactly in parse_model and correct the architecture...
  • 016228d Match documented run paths to each product's own increment_path (#25942)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the backend-minor-patch group with 5 updates
2d3ae54 
Bumps the backend-minor-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `2.0.0` | `2.1.1` |
| [transformers](https://github.com/huggingface/transformers) | `5.15.1` | `5.16.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.28.0` | `1.29.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.5` |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.124` | `8.4.131` |


Updates `mcp` from 2.0.0 to 2.1.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.0.0...v2.1.1)

Updates `transformers` from 5.15.1 to 5.16.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.15.1...v5.16.1)

Updates `huggingface-hub` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.28.0...v1.29.0)

Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `ultralytics` from 8.4.124 to 8.4.131
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.124...v8.4.131)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: transformers
  dependency-version: 5.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: huggingface-hub
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
- dependency-name: ultralytics
  dependency-version: 8.4.131
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added backend visionset Python distribution — kernel, server, cli, mcp, formats dependencies Dependency updates (Dependabot) labels Aug 31, 2026
@JArmandoAnaya
JArmandoAnaya merged commit 91c0a2b into main Sep 2, 2026
15 checks passed
@JArmandoAnaya
JArmandoAnaya deleted the dependabot/uv/backend-minor-patch-03db83c0d6 branch September 2, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backend visionset Python distribution — kernel, server, cli, mcp, formats dependencies Dependency updates (Dependabot)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JArmandoAnaya