Skip to content

chore(deps): bump the minor-and-patch group with 10 updates#187

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/minor-and-patch-c5a244636f
Closed

chore(deps): bump the minor-and-patch group with 10 updates#187
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/minor-and-patch-c5a244636f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 6, 2026

Bumps the minor-and-patch group with 10 updates:

Package From To
typer 0.24.1 0.24.2
langchain 1.2.12 1.2.15
pytest 9.0.2 9.0.3
ruff 0.15.7 0.15.11
mypy 1.19.1 1.20.2
sentence-transformers 5.3.0 5.4.1
langchain-cohere 0.5.0 0.5.1
langchain-openai 1.1.12 1.1.16
langchain-anthropic 1.4.0 1.4.1
langchain-google-genai 4.2.1 4.2.2

Updates typer from 0.24.1 to 0.24.2

Release notes

Sourced from typer's releases.

0.24.2

Fixes

  • 🐛 Ensure that typer.launch forwards correctly when launching a file. PR #1708 by @​svlandeg.

Refactors

Docs

Internal

... (truncated)

Changelog

Sourced from typer's changelog.

0.24.2 (2026-04-22)

Fixes

  • 🐛 Ensure that typer.launch forwards correctly when launching a file. PR #1708 by @​svlandeg.

Refactors

Docs

Internal

... (truncated)

Commits

Updates langchain from 1.2.12 to 1.2.15

Release notes

Sourced from langchain's releases.

langchain-core==1.2.15

Changes since langchain-core==1.2.14

fix(core): improve error message for non-JSON-serializable tool schemas (#34376) fix(core): improve typing/docs for on_chat_model_start to clarify required positional args (#35324) perf(core): defer specific langsmith imports to reduce import time (#35298) revert: add ChatAnthropicBedrockWrapper (#35371) release(core): 1.2.15 (#35367) fix(anthropic): replace retired model IDs in tests and docstrings (#35365) feat(anthropic): add ChatAnthropicBedrock wrapper (#35091) style: fix some ruff noqa (#35321)

langchain==1.2.15

Changes since langchain==1.2.14

release: langchain v1.2.15 (#36496) chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/langchain_v1 (#36438)

langchain-core==1.2.14

Changes since langchain-core==1.2.13

release(core): 1.2.14 (#35328) chore(core): remove langserve from sys info util, add deepagents (#35325) fix(core): fix merge_lists incorrectly merging parallel tool calls (#35281) fix(core): accept int temperature in _get_ls_params for LangSmith tracing (#35302) revert: accept integer temperature values in _get_ls_params (#35319) fix(core): accept integer temperature values in _get_ls_params (#35317) docs(core): update load note to be precise (#35309) fix(core): prevent recursion error when args_schema is dict (#35260) fix(core): preserve index and timestamp fields when merging (#34731) docs(core): add security warnings and best practices for deserialization (#35282) docs: fix docstring inaccuracies and update outdated LangSmith URLs (#35283) fix(core): correct misleading jinja2 sandboxing comment (#35183) chore: bump the langchain-deps group across 3 directories with 8 updates (#35257)

langchain==1.2.14

Changes since langchain==1.2.13

release(langchain): 1.2.14 (#36396) chore: pygments>=2.20.0 across all packages (CVE-2026-4539) (#36385) test(langchain): cover runtime recursion limit override in create_agent (#36376) perf(langchain): reduce init speed by 15% (#36375) fix(langchain): update recursion limit for create_agent (#36351) fix(infra): correct lint_diff relative paths in package makefiles (#36333) chore: bump cryptography from 46.0.5 to 46.0.6 in /libs/langchain_v1 (#36324) fix(langchain): recognize ChatAnthropicVertex in _get_approximate_token_counter (#36320) chore(langchain): remove unnecessary description for toods list as a group (#36315) chore(langchain): add async implementation to todolist and test (#36313) chore(langchain): speed up todo list middleware init (#36311) chore: bump requests from 2.32.5 to 2.33.0 in /libs/langchain_v1 (#36241)

... (truncated)

Commits
  • dd63731 release: langchain v1.2.15 (#36496)
  • d1529dd fix(core): correct parameter names in filter_messages docstring example (#36462)
  • e89afed release(core): 1.2.25 (#36473)
  • 0b5f2c0 fix(core): harden check for txt files in deprecated prompt loading functions ...
  • c9f51ae fix(core): fixed typos in the documentation (#36459)
  • cd394b7 chore(model-profiles): refresh model profile data (#36455)
  • 34c4a2a chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/huggingface (#36436)
  • 914cef0 chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/xai (#36435)
  • 66ad4f7 chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/langchain (#36439)
  • 8fb12b8 chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/fireworks (#36437)
  • Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

Commits

Updates ruff from 0.15.7 to 0.15.11

Release notes

Sourced from ruff's releases.

0.15.11

Release Notes

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

Bug fixes

  • [flake8-async] Omit overridden methods for ASYNC109 (#24648)

Documentation

  • [flake8-async] Add override mention to ASYNC109 docs (#24666)
  • Update Neovim config examples to use vim.lsp.config (#24577)

Contributors

Install ruff 0.15.11

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.11/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.11/ruff-installer.ps1 | iex"

Download ruff 0.15.11

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.11

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

Bug fixes

  • [flake8-async] Omit overridden methods for ASYNC109 (#24648)

Documentation

  • [flake8-async] Add override mention to ASYNC109 docs (#24666)
  • Update Neovim config examples to use vim.lsp.config (#24577)

Contributors

0.15.10

Released on 2026-04-09.

Preview features

  • [flake8-logging] Allow closures in except handlers (LOG004) (#24464)
  • [flake8-self] Make SLF diagnostics robust to non-self-named variables (#24281)
  • [flake8-simplify] Make the fix for collapsible-if safe in preview (SIM102) (#24371)

Bug fixes

  • Avoid emitting multi-line f-string elements before Python 3.12 (#24377)
  • Avoid syntax error from E502 fixes in f-strings and t-strings (#24410)
  • Strip form feeds from indent passed to dedent_to (#24381)
  • [pyupgrade] Fix panic caused by handling of octals (UP012) (#24390)
  • Reject multi-line f-string elements before Python 3.12 (#24355)

Rule changes

  • [ruff] Treat f-string interpolation as potential side effect (RUF019) (#24426)

Server

... (truncated)

Commits

Updates mypy from 1.19.1 to 1.20.2

Changelog

Sourced from mypy's changelog.

Mypy 1.20.2

  • Use WAL with SQLite cache and fix close (Shantanu, PR 21154)
  • Adjust SQLite journal mode (Ivan Levkivskyi, PR 21217)
  • Correctly aggregate narrowing information on parent expressions (Shantanu, PR 21206)
  • Fix regression related to generic callables (Shantanu, PR 21208)
  • Fix regression by avoiding widening types in some contexts (Shantanu, PR 21242)
  • Fix slicing in non-strict optional mode (Shantanu, PR 21282)
  • mypyc: Fix match statement semantics for "or" pattern (Shantanu, PR 21156)
  • mypyc: Fix issue with module dunder attributes (Piotr Sawicki, PR 21275)
  • Initial support for Python 3.15.0a8 (Marc Mueller, PR 21255)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Aaron Wieczorek
  • Adam Turner
  • Ali Hamdan
  • asce
  • BobTheBuidler
  • Brent Westbrook
  • Brian Schubert
  • bzoracler
  • Chris Burroughs
  • Christoph Tyralla
  • Colin Watson
  • Donghoon Nam
  • E. M. Bray
  • Emma Smith
  • Ethan Sarp
  • George Ogden
  • getzze
  • grayjk
  • Gregor Riepl
  • Ivan Levkivskyi
  • James Hilliard
  • James Le Cuirot
  • Jeremy Nimmer
  • Joren Hammudoglu
  • Kai (Kazuya Ito)
  • kaushal trivedi
  • Kevin Kannammalil
  • Lukas Geiger
  • Łukasz Langa
  • Marc Mueller
  • Michael R. Crusoe
  • michaelm-openai
  • Neil Schemenauer
  • Piotr Sawicki

... (truncated)

Commits

Updates sentence-transformers from 5.3.0 to 5.4.1

Release notes

Sourced from sentence-transformers's releases.

v5.4.1 - Numpy string arrays

This patch release allows encode() and predict() to accept 1D numpy string arrays as inputs.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.4.1
Inference only, use one of:
pip install sentence-transformers==5.4.1
pip install sentence-transformers[onnx-gpu]==5.4.1
pip install sentence-transformers[onnx]==5.4.1
pip install sentence-transformers[openvino]==5.4.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.4.1
pip install sentence-transformers[audio]==5.4.1
pip install sentence-transformers[video]==5.4.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.4.1

Numpy string/object arrays as batches (#3720)

encode() and predict() now correctly recognize 1D numpy string/object arrays as batches rather than singular inputs. Previously, something like model.encode(df["text"].to_numpy()) was silently treated as a single input and produced incorrect output. 1D numpy arrays with dtype.kind in ("U", "O") are now unpacked like lists, and 2D+ arrays are treated as batches of pairs (for CrossEncoder).

import numpy as np
from sentence_transformers import SentenceTransformer
model = SentenceTransformer("all-MiniLM-L6-v2")
Previously treated as one input; now correctly encoded as 3 separate texts
embeddings = model.encode(np.array(["first", "second", "third"]))
print(embeddings.shape)
(3, 384)

For CrossEncoder, a 1D numpy string array is still treated as a single [query, document] pair to match the existing list behavior, while a 2D array of shape (N, 2) is a batch of N pairs.

Safer activation function loading in Dense (#3714)

The Dense module stores its activation function as a dotted import path in its saved config (e.g. "torch.nn.modules.activation.Tanh"), which was then resolved via import_from_string whenever the module was loaded. Because any importable Python callable could be referenced, a maliciously crafted config.json on the Hub could trigger arbitrary imports at model load time.

The loader now only resolves activation functions whose import path starts with torch.. Anything else is skipped with a warning and replaced by the default activation (Tanh). To load a model with a custom (non-torch) activation function, opt in explicitly with trust_remote_code=True:

from sentence_transformers import SentenceTransformer
</tr></table>

... (truncated)

Commits
  • 6dc2cb5 Release v5.4.1
  • a6a371c Merge branch 'main' into v5.4-release
  • c500af5 [fix] Treat numpy string/object arrays as batches in encode/predict (#3720)
  • 25f0694 Only load activation functions starting with 'torch' in the Dense module (#3714)
  • 9140444 Replace evaluation_strategy with eval_strategy in a few more places (#3713)
  • cec9077 No revision needed anymore for nvidia nemotron (#3712)
  • 5035ccd No revision needed anymore for nvidia nemotron (#3712)
  • abca5aa Increment dev version after v5.4 release (#3711)
  • d36232b [tests] Fix test_trainer_prompts for SE and ST after prompt handling moved ...
  • fe93612 Merge branch 'main' into v5.4-release
  • Additional commits viewable in compare view

Updates langchain-cohere from 0.5.0 to 0.5.1

Release notes

Sourced from langchain-cohere's releases.

libs/cohere/v0.5.1

What's Changed

New Contributors

Full Changelog: langchain-ai/langchain-cohere@libs/cohere/v0.5.0...libs/cohere/v0.5.1

Commits
  • 7263e52 Update tests to use command A. Fix failing int test after dependency upgrade....
  • 24cfdae chore(deps): bump aiohttp from 3.13.3 to 3.13.4 in /libs/cohere in the pip gr...
  • 4e55ded chore(deps): bump langchain-core from 1.2.16 to 1.2.22 in /libs/cohere in the...
  • 1316b49 chore(deps): bump the pip group across 1 directory with 2 updates (#176)
  • f708771 chore(deps-dev): bump langgraph from 1.0.9 to 1.0.10rc1 in /libs/cohere in th...
  • 9d0d394 Add support for Command A Reasoning (#174)
  • c4c0e20 Remove CODEOWNERS (#172)
  • 0fa8630 fix: patch 4 security alerts (urllib3 high+medium) (#171)
  • cfc1c7f chore(deps): bump the pip group across 1 directory with 2 updates (#170)
  • 3a99e42 fix: grant contents:read to test-release workflow call (#169)
  • Additional commits viewable in compare view

Updates langchain-openai from 1.1.12 to 1.1.16

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.1.16

Changes since langchain-openai==1.1.15

release(openai): 1.1.16 (#36927) fix(openai): tolerate prompt_cache_retention drift in streaming (#36925)

langchain-openai==1.1.15

Changes since langchain-openai==1.1.14

release(openai): 1.1.15 (#36901) fix(openai): accommodate dict response items in streaming (#36899) fix(openai): infer azure chat profiles from model name (#36858) chore(model-profiles): refresh model profile data (#36864)

langchain-openai==1.1.14

Changes since langchain-openai==1.1.13

release(openai): 1.1.14 (#36820) fix(openai): use SSRF-safe transport for image token counting (#36819) chore(deps): bump pytest to 9.0.3 (#36801) chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/partners/openai (

@dependabot
chore(deps): bump the minor-and-patch group with 10 updates
ec44121 
Bumps the minor-and-patch group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.24.1` | `0.24.2` |
| [langchain](https://github.com/langchain-ai/langchain) | `1.2.12` | `1.2.15` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.11` |
| [mypy](https://github.com/python/mypy) | `1.19.1` | `1.20.2` |
| [sentence-transformers](https://github.com/huggingface/sentence-transformers) | `5.3.0` | `5.4.1` |
| [langchain-cohere](https://github.com/langchain-ai/langchain-cohere) | `0.5.0` | `0.5.1` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.1.12` | `1.1.16` |
| [langchain-anthropic](https://github.com/langchain-ai/langchain) | `1.4.0` | `1.4.1` |
| [langchain-google-genai](https://github.com/langchain-ai/langchain-google) | `4.2.1` | `4.2.2` |


Updates `typer` from 0.24.1 to 0.24.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.24.1...0.24.2)

Updates `langchain` from 1.2.12 to 1.2.15
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain==1.2.12...langchain==1.2.15)

Updates `pytest` from 9.0.2 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.0.3)

Updates `ruff` from 0.15.7 to 0.15.11
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.7...0.15.11)

Updates `mypy` from 1.19.1 to 1.20.2
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.19.1...v1.20.2)

Updates `sentence-transformers` from 5.3.0 to 5.4.1
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.3.0...v5.4.1)

Updates `langchain-cohere` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/langchain-ai/langchain-cohere/releases)
- [Commits](langchain-ai/langchain-cohere@libs/cohere/v0.5.0...libs/cohere/v0.5.1)

Updates `langchain-openai` from 1.1.12 to 1.1.16
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.1.12...langchain-openai==1.1.16)

Updates `langchain-anthropic` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-anthropic==1.4.0...langchain-anthropic==1.4.1)

Updates `langchain-google-genai` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/langchain-ai/langchain-google/releases)
- [Commits](langchain-ai/langchain-google@libs/genai/v4.2.1...libs/genai/v4.2.2)

---
updated-dependencies:
- dependency-name: typer
  dependency-version: 0.24.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain
  dependency-version: 1.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.15.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mypy
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sentence-transformers
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: langchain-cohere
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-openai
  dependency-version: 1.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-anthropic
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-google-genai
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@saschagobel
Copy link
Copy Markdown
Collaborator

saschagobel commented May 7, 2026

Closing this PR without merging.

The dependency versions resolved in uv.lock are fine, but this PR also raises lower bounds in pyproject.toml even where the existing constraints already allow the new versions. For a library package, those lower bounds are part of our downstream compatibility contract, so we should not bump them as routine dependency maintenance.

This appears to match an open Dependabot uv issue: dependabot/dependabot-core#14908

@saschagobel saschagobel closed this May 7, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 7, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@saschagobel saschagobel deleted the dependabot/uv/minor-and-patch-c5a244636f branch May 7, 2026 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@saschagobel