build(deps): bump the pip-minor-patch group in /app/backend with 7 updates

[dependabot]

Bumps the pip-minor-patch group in /app/backend with 7 updates:

Package	From	To
fastapi	0.139.2	0.141.1
huggingface-hub	1.24.0	1.25.1
uvicorn	0.51.0	0.52.0
hypothesis	6.158.0	6.163.0
ruff	0.15.22	0.16.0
testcontainers	4.14.2	4.15.0
scipy	1.17.1	1.18.0

Updates fastapi from 0.139.2 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates huggingface-hub from 1.24.0 to 1.25.1

Release notes

Sourced from huggingface-hub's releases.

[v1.25.0] Auto-named Jobs, smarter progress bars & cache diagnostics

🏷️ Auto-named Jobs on creation

Jobs now get an automatic name when you don't provide one explicitly, derived from the Docker image (or UV script) plus a short hash of the command line. This means reruns of the same command share a consistent name, while different commands get distinct names — making it much easier to find and group related jobs in the UI or CLI. Names follow the server-side character rules: :, / and . in image tags are replaced with - so python:3.12 foo --truc becomes python-3-12-7c6db949. Explicit --name still takes precedence.

>>> hf jobs run --detach python:3.12 foo --truc
  id: 6a60b85c13e6ef894d54b949
Hint: Job auto-named 'python-3-12-7c6db949'. Pass `--name` or run `hf jobs labels <id> --name` to rename.

📚 Documentation: Jobs guide, CLI guide

• [Jobs] Auto-name Jobs on creation by @​Wauplin in #4566

🔧 Other QoL Improvements

• Add timeout parameter to safetensors metadata methods by @​go-bai in #4378
• [Download] [Fix] Update file-count progress bar on completion by @​Wauplin in #4560
• [Cache] Warn on inconsistency in cache by @​Wauplin in #4551 — docs

📖 Documentation

• Document the 150-character limit on collection descriptions by @​davanstrien in #4553 — docs
• [Docs] Fix compromised DO_NOT_TRACK URL by @​Wauplin in #4545
• Add SECURITY.md file by @​Wauplin in #4541

🐛 Bug and typo fixes

• [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK by @​sohumt123 in #4526
• Fix Windows crash when downloading into a deep local_dir by @​askalf in #4546
• [Fix] Do not fail on create space if exists_ok=True and 402 Payment required error by @​Wauplin in #4539
• [Repocard] Preserve order of appended keys in CardData.to_yaml by @​rahulrshetty45 in #4561
• [HfFileSystem] Raise FileNotFoundError when streaming a missing file by @​rahulrshetty45 in #4562
• [Upload] Forward token in _final_commit_info repo_info lookup by @​Wauplin in #4572

🏗️ Internal

• Post-release: bump version to 1.25.0.dev0 by @​huggingface-hub-bot[bot] in #4538
• [CI] Remove test_list_private_datasets flaky test by @​Wauplin in #4565

Commits

• 9bf0595 Release: v1.25.1
• aace894 [Sandbox] Don't inject the HF token in sandbox jobs as SBX_DL_TOKEN (#4583)
• 16fffe4 Release: v1.25.0
• 61a0164 Release: v1.25.0.rc0
• 922b819 [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK (#4526)
• e8bb319 [Upload] Forward token in _final_commit_info repo_info lookup (#4572)
• d5c4425 [HfFileSystem] Raise FileNotFoundError when streaming a missing file (#4562)
• 1ae04ff [Jobs] Auto-name Jobs on creation (#4566)
• 74213cb [Repocard] Preserve order of appended keys in CardData.to_yaml (#4561)
• 3a60f15 [Download] [Fix] Update file-count progress bar on completion (#4560)
• Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.52.0

Release notes

Sourced from uvicorn's releases.

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Commits

• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• d26c85c Prepare compatibility with websockets 17.0. (#3036)
• 7e11cc6 Clarify how limit_concurrency and backlog differ (#3029)
• See full diff in compare view

Updates hypothesis from 6.158.0 to 6.163.0

Commits

• 793e92d Bump hypothesis version to 6.163.0 and update changelog
• ba2899b Merge pull request #4830 from Liam-DeVoe/from-regex-alphabet-collections
• 5e3cae2 Bump hypothesis version to 6.162.0 and update changelog
• d92a798 Merge pull request #4811 from Zac-HD/claude/sleepy-keller-o5cUK
• f5e473a claude: support Collection[str] alphabet in from_regex, unify alphabet valida...
• cbf124b Skip non-ns dtype construction at import on pandas < 2
• 8d0a004 Address review: constrain constant-offset range, simplify tz classification
• 8852abe add new test
• 72d88bd simplify tests
• 0addb38 Support timezone-aware datetime dtypes in hypothesis.extra.pandas
• Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates testcontainers from 4.14.2 to 4.15.0

Release notes

Sourced from testcontainers's releases.

testcontainers: v4.15.0

4.15.0 (2026-07-24)

Bug Fixes

• cratedb: add CrateDB community module (#1051) (0976c7e)

testcontainers: v4.15.0-rc4

4.15.0-rc4 (2026-06-11)

Features

• extended configuration options for container.exec method (#1050) (7dee471)
• main: enable typing for complete package (237be27)
• main: make legacy imports available with deprecation notice (ab6cca8)
• test: start working on parallel-running tests (WIP!) (2d24429)

Bug Fixes

• arangodb: replace deprecated add_hash_index with add_persistent_index (50bb202)
• aws: wrong path of test (38089b0)
• ci: correct coverage paths (b21eccd)
• ci: fix community test selection (5287fc8)
• ci: ignore @​overload in coverage (592c6d1)
• ci: ignore TYPE_CHECKING block in coverage (3bdc561)
• core/registry: use relative import for _LocalRegistryContainer (961e3d1)
• core: make is_podman respect resolved docker host (#1048) (6018da3)
• docs: update docs reflecting new structure (9427055)
• doctests: Ensure paths are correct (f777673)
• k3s: replace tmpfs dict kwarg with with_tmpfs_mount() (4d1da0c)
• keycloak: disable SSL requirement for master realm after start (2a85595)
• main: adopt ci to new src structure (dae421d)
• main: adopt imports to new structure (9155677)
• rabbitmq: declare queue as durable (2622736)
• ruff: add **/*_example.py to per-file-ignores for T201 (01dbd16)
• sftp: remove redundant start() calls and fix SSH connection options (54cef56)
• trino: increase default startup timeout from 30s to 60s (2940501)
• weaviate: update and fix module (5dd2aa1)

testcontainers: v4.15.0-rc3

4.15.0-rc3 (2026-06-03)

Features

• core: add Podman compatibility (#1028) (37093ab)
• core: auto-detect DOCKER_HOST from current docker context (#1026) (d4b8ff6), closes #1025

... (truncated)

Changelog

Sourced from testcontainers's changelog.

4.15.0 (2026-07-24)

Bug Fixes

• cratedb: add CrateDB community module (#1051) (0976c7e)

4.15.0-rc4 (2026-06-11)

Features

• extended configuration options for container.exec method (#1050) (7dee471)
• main: enable typing for complete package (237be27)
• main: make legacy imports available with deprecation notice (ab6cca8)
• test: start working on parallel-running tests (WIP!) (2d24429)

Bug Fixes

• arangodb: replace deprecated add_hash_index with add_persistent_index (50bb202)
• aws: wrong path of test (38089b0)
• ci: correct coverage paths (b21eccd)
• ci: fix community test selection (5287fc8)
• ci: ignore @​overload in coverage (592c6d1)
• ci: ignore TYPE_CHECKING block in coverage (3bdc561)
• core/registry: use relative import for _LocalRegistryContainer (961e3d1)
• core: make is_podman respect resolved docker host (#1048) (6018da3)
• docs: update docs reflecting new structure (9427055)
• doctests: Ensure paths are correct (f777673)
• k3s: replace tmpfs dict kwarg with with_tmpfs_mount() (4d1da0c)
• keycloak: disable SSL requirement for master realm after start (2a85595)
• main: adopt ci to new src structure (dae421d)
• main: adopt imports to new structure (9155677)
• rabbitmq: declare queue as durable (2622736)
• ruff: add **/*_example.py to per-file-ignores for T201 (01dbd16)
• sftp: remove redundant start() calls and fix SSH connection options (54cef56)
• trino: increase default startup timeout from 30s to 60s (2940501)
• weaviate: update and fix module (5dd2aa1)

4.15.0-rc3 (2026-06-03)

Features

• core: add Podman compatibility (#1028) (37093ab)
• core: auto-detect DOCKER_HOST from current docker context (#1026) (d4b8ff6), closes #1025

Bug Fixes

... (truncated)

Commits

• 04267b3 chore(main): release testcontainers 4.15.0 (#1057)
• 0f23105 chore(deps): bump boto3 from 1.43.36 to 1.43.50 (#1077)
• bee755c chore(deps): bump kubernetes from 36.0.2 to 36.0.3 (#1078)
• 9b6837d chore(deps): bump docker from 7.1.0 to 7.2.0 (#1076)
• 7685f20 chore(deps): bump openfga-sdk from 0.10.3 to 0.10.4 (#1074)
• 007e5ac chore(deps): bump redis from 8.0.0 to 8.0.1 (#1072)
• 977279b chore(deps-dev): bump anyio from 4.14.0 to 4.14.1 (#1070)
• 1571ff2 chore(deps-dev): bump ruff from 0.15.17 to 0.15.20 (#1068)
• 1f683f9 chore(deps): bump wrapt from 2.2.1 to 2.2.2 (#1067)
• 230b3be chore(deps): bump selenium from 4.44.0 to 4.45.0 (#1066)
• Additional commits viewable in compare view

Updates scipy from 1.17.1 to 1.18.0

Release notes

Sourced from scipy's releases.

SciPy 1.18.0 Release Notes

SciPy 1.18.0 is the culmination of 6 months of hard work. It contains many new features, numerous bug-fixes, improved test coverage and better documentation. There have been a number of deprecations and API changes in this release, which are documented below. All users are encouraged to upgrade to this release, as there are a large number of bug-fixes and optimizations. Before upgrading, we recommend that users check that their own code does not use deprecated SciPy functionality (to do so, run your code with python -Wd and check for DeprecationWarning s). Our development attention will now shift to bug-fix releases on the 1.18.x branch, and on adding new features on the main branch.

This release requires Python 3.12-3.14 and NumPy 2.0.0 or greater.

Highlights of this release

• SciPy now supports three different build modes for BLAS and LAPACK LP64/ILP64 support, and machinery is provided for downstream cython_lapack consumers to gracefully handle LP64/ILP64 backend builds. ILP64 support has been substantially improved across the SciPy library.
• Remaining Fortran to C translations have been completed---an experimental Fortran-free build option is now available to developers for testing purposes. Developer feedback is welcome on Fortran-free builds.
• scipy.signal.whittaker_henderson now provides access to Whittaker-Henderson smoothing of a discrete signal.
• A large number of scipy.stats functions now support lazy arrays and JAX JIT. Array API support has been improved substantially in SciPy, with at least 21 functions gaining new support in this release. 16 scipy.stats functions have also gained support for MArray input.

New features

scipy.fft improvements

• SciPy's internal FFT backend has switched from pocketfft to its successor package ducc0.fft, which features several incremental improvements. The most significant of those from SciPy's perspective is probably that storage requirements for internally cached plans have been significantly reduced for most long 1D transforms. Plans that require more storage than 1MB will no longer be cached; this mainly affects huge 1D transforms of prime and near-prime sizes.

scipy.interpolate improvements

... (truncated)

Commits

• 54ef542 REL: 1.18.0 release commit
• a45e463 Merge pull request #25395 from tylerjereddy/treddy_prep_1.18.0_final
• ee2442e TYP, MAINT, TST: PR 25395 revisions
• 3225154 DOC: PR 25395 revisions
• 14c7bd7 TYP: Fix mypy errors with pytest==9.1.0 (#25410)
• 71522e9 DOC: revise SciPy 1.18.0 release notes
• 92f8482 MAINT: fix errors from pytest 9.1 (#25378)
• 7b27bf4 TST, MAINT: modernize spatial tests for pytest 10 (#25376)
• d05b640 Merge pull request #25347 from tylerjereddy/treddy_version_bump_1.18.0rc3
• e60fe8b REL: set to 1.18.0rc3 unreleased
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions