chore(deps): bump the python-dependencies group across 1 directory with 56 updates

[dependabot]

Bumps the python-dependencies group with 56 updates in the / directory:

Package	From	To
pyrotgfork	2.2.18	2.2.21
peewee	4.0.0	4.0.2
scrapling	0.4.1	0.4.2
spacy	3.8.11	3.8.13
json-repair	0.58.1	0.58.6
redis	7.2.1	7.3.0
chromadb	1.5.2	1.5.5
sentence-transformers	5.2.3	5.3.0
onnxruntime	1.24.2	1.24.4
fastapi	0.135.0	0.135.2
torch	2.10.0	2.11.0
transformers	5.2.0	5.3.0
yt-dlp	2026.2.21	2026.3.17
charset-normalizer	3.4.4	3.4.6
numpy	2.4.2	2.4.3
preshed	3.0.12	3.0.13
pydantic-core	2.41.5	2.42.0
python-dotenv	1.2.1	1.2.2
srsly	2.5.2	2.5.3
thinc	8.3.10	8.3.13
tld	0.13.1	0.13.2
w3lib	2.4.0	2.4.1
wrapt	2.1.1	2.1.2
cuda-pathfinder	1.4.0	1.4.4
filelock	3.24.3	3.25.2
fonttools	4.61.1	4.62.1
googleapis-common-protos	1.72.0	1.73.0
hf-xet	1.3.2	1.4.2
huggingface-hub	1.5.0	1.7.2
jsonschema	4.24.1	4.26.0
mmh3	5.2.0	5.2.1
mpmath	1.3.0	1.4.1
nvidia-cublas-cu12	12.8.4.1	12.9.2.10
nvidia-cuda-cupti-cu12	12.8.90	12.9.79
nvidia-cuda-nvrtc-cu12	12.8.93	12.9.86
nvidia-cuda-runtime-cu12	12.8.90	12.9.79
nvidia-cudnn-cu12	9.10.2.21	9.20.0.48
nvidia-cufft-cu12	11.3.3.83	11.4.1.4
nvidia-cufile-cu12	1.13.1.3	1.14.1.1
nvidia-curand-cu12	10.3.9.90	10.3.10.19
nvidia-cusolver-cu12	11.7.3.90	11.7.5.82
nvidia-cusparse-cu12	12.5.8.93	12.5.10.65
nvidia-cusparselt-cu12	0.7.1	0.8.1
nvidia-nccl-cu12	2.27.5	2.29.7
nvidia-nvjitlink-cu12	12.8.93	12.9.86
nvidia-nvshmem-cu12	3.4.5	3.5.21
nvidia-nvtx-cu12	12.8.90	12.9.79
opentelemetry-api	1.39.1	1.40.0
opentelemetry-exporter-otlp-proto-common	1.39.1	1.40.0
opentelemetry-exporter-otlp-proto-grpc	1.39.1	1.40.0
opentelemetry-proto	1.39.1	1.40.0
opentelemetry-sdk	1.39.1	1.40.0
opentelemetry-semantic-conventions	0.60b1	0.61b0
sse-starlette	3.3.2	3.3.3
tinyhtml5	2.0.0	2.1.0
uvicorn	0.41.0	0.42.0

Updates pyrotgfork from 2.2.18 to 2.2.21

Commits

• 6faa5fa Update Pyrogram to v2.2.21
• 91fd584 fix: edge case in sending date_time_format
• cf41eb2 Change administrator title parameter to 'tag'
• 18f2d25 Update Pyrogram to v2.2.20
• 79dae45 Added the MessageEntity type “date_time”, allowing to show a formatted date a...
• 6bdf57a Added support for setting email during authorization
• d1528d0 Added CHAT_OWNER_LEFT, CHAT_OWNER_CHANGED, CHAT_HAS_PROTECTED_CONTENT_TOGGLED...
• 7cd5a8c Update Pyrogram to v2.2.19
• a91ab10 Update methods and types to Layer 223,
• 207f7f5 Update API scheme on Layer 223
• Additional commits viewable in compare view

Updates peewee from 4.0.0 to 4.0.2

Release notes

Sourced from peewee's releases.

4.0.2

• Remove all Python 2.x compatibility code.
• Add streaming result cursors to pwasyncio module via db.iterate(query).
• Better serialization and deserialization of datetimes and binary data in the DataSet module. Previously binary data was encoded as base64, going forward hex is the new default. For base64 specify base64_bytes=True.
• Improvements to Postgres BinaryJSONField, support atomic removal of sub-elements, as well as alternate helper for extracting sub-elements and querying array length.
• Pydantic integration

View commits

4.0.1

• Ensure gr_context is set on greenlet in greenlet_spawn so that contextvars will be operable in sync handlers.
• Removed SqliteExtDatabase (it basically served no purpose in 4.0). Use SqliteDatabase instead.
• Moved driver and extension-specific pooled implementations into the corresponding extension module rather than putting all into playhouse.pool.
• Restore custom dumps option for postgres JSON fields.
• Major docs rewrite / reorganization.

View commits

Changelog

Sourced from peewee's changelog.

4.0.2

• Remove all Python 2.x compatibility code.
• Add streaming result cursors to pwasyncio module via db.iterate(query).
• Better serialization and deserialization of datetimes and binary data in the DataSet module. Previously binary data was encoded as base64, going forward hex is the new default. For base64 specify base64_bytes=True.
• Improvements to Postgres BinaryJSONField, support atomic removal of sub-elements, as well as alternate helper for extracting sub-elements and querying array length.
• Pydantic integration

View commits

4.0.1

• Ensure gr_context is set on greenlet in greenlet_spawn so that contextvars will be operable in sync handlers.
• Removed SqliteExtDatabase (it basically served no purpose in 4.0). Use SqliteDatabase instead.
• Moved driver and extension-specific pooled implementations into the corresponding extension module rather than putting all into playhouse.pool.
• Restore custom dumps option for postgres JSON fields.
• Major docs rewrite / reorganization.

View commits

Commits

• a285042 4.0.2
• e7b3091 More idiomatic usage in doc examples.
• 7f85343 Fix misnamed method in examples.
• c505a13 Update flaky tests that were relying on async callback ordering.
• 90d4691 Small cleanups to pydantic doc.
• 2ee08ef Attempt fix for hung cursors w/postgres in tests.
• e87d2ad Doc cleanups
• afb6d8b Add additional server-side cursor concurrency test.
• 2f0b391 Update changelog as well.
• 3cf0b65 Update readme/doc index to mention pydantic integration.
• Additional commits viewable in compare view

Updates scrapling from 0.4.1 to 0.4.2

Release notes

Sourced from scrapling's releases.

Release v0.4.2

A new maintenance update with important changes

Bug fixes

• The function get_all_text() now captures tail text nodes. This will make the MCP server and commands see text that was missed before (#168). Thanks @​mhillebrand
• Referer now returns a bare Google url instead of a Google search URL. The previous logic was incorrect and may have produced a fingerprinting signal (#179). Thanks @​Bortlesboat
• Fixed an issue with extra flags concatenation in all browsers. Thanks @​rostchri
• Fixed a type hints issue with Python versions below 3.12 that caused it to crash. (Solves #163)

Other

• Added an Agent Skill for Claude Code / OpenClaw and other AI agentic tools.
• Added the Agent Skill to Clawhub.
• Updates all browsers and Playwright versions to the latest.
• Added a French translation to the main README file.

🙏 Special thanks to the community for all the continuous testing and feedback

---

Big shoutout to our Platinum Sponsors

Commits

• 19c21c1 v0.4.2 (#183)
• 6ec40ad docs: remove a sponsor
• f80743a style: remove unused import
• 66e0e7a fix(agent): update the agent skill zip file with the new version
• 73832f9 docs: update the website to reflect the google referer logic
• d48ac78 test: update tests accordingly
• 8e3bf89 fix(agent): update the agent skills docs and version
• a929de6 fix: update code and docstrings to remove the old google referer logic
• b547e04 ops: update playwright pinned version
• 2740992 build: pump up deps and browsers versions
• Additional commits viewable in compare view

Updates spacy from 3.8.11 to 3.8.13

Release notes

Sourced from spacy's releases.

v3.8.13: Pin confection to new version

The v3.8.12 release didn't update the confection pin, which meant that if you did an upgrade-install models wouldn't load.

v3.8.12

Use confection v1.3 and Thinc v8.3.13, which implement custom validation logic in place of Pydantic, allowing us to properly adopt Pydantic v2 and provide full Python 3.14 support.

Our dependency tree used Pydantic v1 in unusual ways, and relied on behaviours that Pydantic v2 reformed. In the time since Pydantic v2 was released there were a few attempts to migrate over to it, but the task has been complicated by the fact that the confection library has a fairly tangled implementation and I had reduced availability for open-source work in 2024 and 2025.

Specifically, our library confection provides the extensible configuration system we use in spaCy and Thinc. The config system allows you to refer to values that will be supplied by arbitrary functions, that e.g. define some neural network model or its sublayers. The functionality in confection is complicated because we aggressively prioritised user experience in the specification, even if it required increased implementation complexity.

Confection's original implementation built a dynamic Pydantic v1 schema for function-supplied values ("promises"). We validate the schema before calling any promises, and then validate the schema again after calling all the promises and substituting in their values. The variable-interpolation system adds further difficulties to the implementation, and we have to do it all subclassing the Python built-in configparser, which ties us to implementation choices I'd do differently if I had a clean slate.

Here's one summary of Pydantic v1-specific behaviours that the migration to v2 particularly difficult for us. This particular summary was produced during a session with Claude Code Opus 4.6, so nuances of it might be wrong. The full history of attempts at doing this spans over different refactors separated by a few months at a time, so I don't have a full record of all the things that I struggled with. It's possible some details of this summary are incorrect though.

The core problem we kept hitting: Pydantic v2 compiles validation schemas upfront and has much stricter immutability. The whole session has been a series of workarounds for this:

 1. Schema mutation — v1 let you mutate __fields__ in place; v2 needs model_rebuild() which loses forward ref namespaces, or create_model subclasses which don't propagate to parent schemas.
 2. model_dump vs dict — v2 converts dataclasses to dicts, breaking resolved objects. Needed a custom _model_to_dict helper.
 3. model_construct drops extras — v2 silently drops fields with extra="forbid", needed manual workarounds.
 4. Strict coercion — v2 coerces ndarray to List[Floats1d] via iteration, needed strict=True.
 5. Forward refs — Every schema with TYPE_CHECKING imports needs model_rebuild() with the right namespace, and that breaks when confection re-rebuilds later.
In order to adjust for behavioural differences like this, I'd refactored confection to build the different versions of the schema in multiple passes, instead of building all the representations together as we'd been doing. However this refactor itself had problems, further complicating the migration.

I've now bitten the bullet and rolled back the refactor I'd been attempting of confection, and instead replaced the Pydantic validation with custom logic. This allows Confection to remove Pydantic as a dependency entirely.~ Update: Actually I went back and got the refactor working. All much nicer now.

I've taken some lengths to explain this because migrating off a dependency after breaking changes can be a sensitive topic. I want to stress that the changes Pydantic made from v1 to v2 are very good, and I greatly appreciate them as a user of FastAPI in our services. It would be very bad for the ecosystem if Pydantic pinned themselves to exactly matching the behaviours they had in v1 just to avoid breaking support for the sort of thing we'd been doing. Instead users who were relying on those behaviours like us should just find some way to adapt --- either vendor the v1 version we need, or change our behaviours, or implement an alternative. I would have liked to do this sooner but we've ultimately gone with the third option.

Commits

• fdca647 Set version to 3.8.13
• 0d94a9d Pin confection>=1.3.2 — older versions crash with pydantic v2
• f175a51 Fully migrate to Pydantic v2 (#13940)
• 24255bd Fix import sorting for ruff isort compliance
• 8e6bd6d Apply ruff formatting to 8 files
• 47b5504 Autofix autofixable things from ruff
• 86f7ce3 Limit CI ruff lint to isort-only checks for now
• 79b5f81 Update CI validation workflow: replace black, isort, flake8 with ruff
• 32c4b63 Format with ruff
• a7f629b Fix ruff isort config: replace unsupported profile with equivalent settings
• Additional commits viewable in compare view

Updates json-repair from 0.58.1 to 0.58.6

Release notes

Sourced from json-repair's releases.

Release 0.58.6

Fixed

• Typing stubs were all over the place, fixed that and added tests so that mypy does not fail for developers with strict typing

Think about sponsoring this library!

This library is free for everyone and it's maintained and developed as a side project so, if you find this library useful for your work, consider offering me a beer via this link: https://github.com/sponsors/mangiucugna

Release 0.58.5

Fixed

• Improved parser performance, especially for common JSON containing ordinary quoted strings. Profiler indicates a 60% improvement in performance.
• Hardened schema-guided repair behavior, including safer salvage handling for mixed type unions.

Think about sponsoring this library!

This library is free for everyone and it's maintained and developed as a side project so, if you find this library useful for your work, consider offering me a beer via this link: https://github.com/sponsors/mangiucugna

Release 0.58.4

Fixed

• v0.58.3 added some regressions in which salvage mode could repair less than standard mode. Fixed that regression and some minor changes.

Think about sponsoring this library!

This library is free for everyone and it's maintained and developed as a side project so, if you find this library useful for your work, consider offering me a beer via this link: https://github.com/sponsors/mangiucugna

Release 0.58.3

Fixed

• Fix #181, fix another bug in duplicate-key dedup for array objects

Think about sponsoring this library!

This library is free for everyone and it's maintained and developed as a side project so, if you find this library useful for your work, consider offering me a beer via this link: https://github.com/sponsors/mangiucugna

Release 0.58.2

Fixed

• Fix #181, fix a corner in case in which duplicate keys won't be deduplicated and instead split inside an array.

Think about sponsoring this library!

This library is free for everyone and it's maintained and developed as a side project so, if you find this library useful for your work, consider offering me a beer via this link: https://github.com/sponsors/mangiucugna

Commits

• 9f01b6a Merge pull request #185 from mangiucugna/fix/overload-stubs
• 119e93e Bump version from 0.58.5 to 0.58.6
• 4e52343 Fix overload inference and clean pre-commit failures
• 9a2a3b7 Fix overload causing wrong return type inference
• 16e6b1a Bump patch version
• 0a7ad66 Improve parser hot-path performance
• 294e425 Tighten Ruff coverage and package boundaries
• b2486d7 Improve schema performance coverage and trim parser overhead
• a210ec4 Harden patternProperties matching without regex execution
• 158efed Bump 0.58.4 and harden schema salvage behavior
• Additional commits viewable in compare view

Updates redis from 7.2.1 to 7.3.0

Release notes

Sourced from redis's releases.

7.3.0

Changes

OpenTelemetry Native Metrics Support for asynchronous clients Added comprehensive OpenTelemetry metrics support for asynchronous clients following the OpenTelemetry Database Client Semantic Conventions. Metric groups include:

• Command metrics: Operation duration with retry tracking
• Connection basic: Connection count and creation time
• Resiliency: Errors, handoffs, timeout relaxation
• Connection advanced: Wait time and use time
• Pubsub metrics: Published and received messages
• Stream metrics: Processing duration and maintenance notifications

🚀 New Features

• Added OTel instrumentation and metrics export for async client (#3977)

🐛 Bug Fixes

• [async] Adding access to cluster client's nodes_manager and set_response_callback in ClusterPipeline objects (#3989)
• fix(connection): Ensure we have an initialized protocol in connection (#3981)

🧰 Maintenance

• fix: use KeysT for blpop and brpop keys parameter type annotation (#3987 #3990)
• Bump actions/upload-artifact from 6 to 7 (#3985)
• fix: replace 3 bare except clauses with except Exception (#3980)

We'd like to thank all the contributors who worked on this release! @​mitre88 @​turanalmammadov @​haosenwang1018 @​Medno @​vladvildanov @​petyaslavova

Commits

• 8ecbc7a Updating lib version to 7.3.0
• 11043df typing: accept single-key input for blpop and brpop (#3990)
• d958125 fix: use KeysT for blpop and brpop keys parameter type annotation (#3987)
• 75bf91b [async] Adding access to cluster client's nodes_manager and set_response_call...
• abf5bcb Bump actions/upload-artifact from 6 to 7 (#3985)
• 5b0303b fix: replace 3 bare except clauses with except Exception (#3980)
• e9fba86 Added OTel instrumentation and metrics export for async client (#3977)
• 7ce513d fix(connection): Ensure we have an initialized protocol in connection (#3981)
• 8e3a5b2 remove remaining imports of typing_extensions (#3873)
• 5b46430 Hold references to ClusterNode disconnect task (#3826)
• Additional commits viewable in compare view

Updates chromadb from 1.5.2 to 1.5.5

Release notes

Sourced from chromadb's releases.

1.5.5

Version: 1.5.5 Git ref: refs/tags/1.5.5 Build Date: 2026-03-10T09:30 PIP Package: chroma-1.5.5.tar.gz Github Container Registry Image: :1.5.5 DockerHub Image: :1.5.5

What's Changed

• [RELEASE] Rust v0.13.2 by @​HammadB in chroma-core/chroma#6583
• [ENH] Use buffer_unordered for lazy fragment fetch concurrency by @​rescrv in chroma-core/chroma#6584
• [DOC] chroma configuration reference by @​kylediaz in chroma-core/chroma#6592
• [PERF]: Dedup + filter out disbled collections before sysdb enrichment by @​sanketkedia in chroma-core/chroma#6566
• [TST] Fix test_cross_version_persist by @​kylediaz in chroma-core/chroma#6604
• [ENH] Warn on no API key set on JS EFs by @​itaismith in chroma-core/chroma#6599
• [ENH] Add a GoogleGemini EF name alias by @​itaismith in chroma-core/chroma#6620
• [RELEASE] Python 1.5.5 by @​itaismith in chroma-core/chroma#6602

Full Changelog: chroma-core/chroma@1.5.4...1.5.5

1.5.3

Version: 1.5.3 Git ref: refs/tags/1.5.3 Build Date: 2026-03-07T19:07 PIP Package: chroma-1.5.3.tar.gz Github Container Registry Image: :1.5.3 DockerHub Image: :1.5.3

What's Changed

• [ENH] Thread topology name through purge-dirty pipeline by @​rescrv in chroma-core/chroma#6503
• [CHORE] Tighten down k8s resources in test. by @​rescrv in chroma-core/chroma#6509
• [ENH] Purge dirty via Spanner when topology is specified by @​rescrv in chroma-core/chroma#6504
• [BUG]: Drop pydantic v1 compatibility layer for Python 3.14 support by @​basnijholt in chroma-core/chroma#6356
• [PERF] Parallelize segment reader initialization in filter and idf operators by @​HammadB in chroma-core/chroma#6522
• [ENH]: Preallocate during pull log parsing by @​tanujnay112 in chroma-core/chroma#6528
• [TST] Make pytest use importlib by @​kylediaz in chroma-core/chroma#6483
• [CLN] Make telemetry a no-op and remove posthog as a dependency by @​kylediaz in chroma-core/chroma#6489
• [DOC] fix forking numbers by @​kylediaz in chroma-core/chroma#6530
• BUG: retry batch fetch on channel closure by @​rescrv in chroma-core/chroma#6526
• [BUG] CAS on version during reassignment by @​Sicheng-Pan in chroma-core/chroma#6529
• [ENH] use ResourceExhausted error code for log backpressure by @​rescrv in chroma-core/chroma#6527
• [ENH] Ordered sparse vector writer by @​Sicheng-Pan in chroma-core/chroma#6495
• [DOC] update docs for s3 sync by @​philipithomas in chroma-core/chroma#6515
• [BUG] avoid redundant manifest load in pull_logs_inner by @​rescrv in chroma-core/chroma#6544
• [ENH] Skip record load when only id is requested by @​Sicheng-Pan in chroma-core/chroma#6540
• ENH add pointer-based log fetch via ScoutLogFragments by @​rescrv in chroma-core/chroma#6533
• [ENH] Add ReadLevel to count in be by @​HammadB in chroma-core/chroma#6539
• [ENH]: Add a gauge metric in sysdb to track compaction_failure_count by @​tanujnay112 in chroma-core/chroma#6550
• [DOC] Fix query param by @​kylediaz in chroma-core/chroma#6557

... (truncated)

Commits

• eca66b7 [RELEASE] Python 1.5.5 (#6602)
• ce0eede [ENH] Add a GoogleGemini EF name alias (#6620)
• 3604eea [ENH] Warn on no API key set on JS EFs (#6599)
• 9e7bd7f [TST] Fix test_cross_version_persist (#6604)
• 03a3169 [PERF]: Dedup + filter out disbled collections before sysdb enrichment (#6566)
• 475bbfc [DOC] chroma configuration reference (#6592)
• 02d2d8c [ENH] Use buffer_unordered for lazy fragment fetch concurrency (#6584)
• 1304490 [RELEASE] Rust v0.13.2 (#6583)
• e0525a2 [RELEASE] Python 1.5.4 (#6585)
• 8c70b3c [ENH] Exclude yanked versions from cross-version persist test (#6588)
• Additional commits viewable in compare view

Updates sentence-transformers from 5.2.3 to 5.3.0

Release notes

Sourced from sentence-transformers's releases.

v5.3.0 - Improved Contrastive Learning, New Losses, and Transformers v5 Compatibility

This minor version brings several improvements to contrastive learning: MultipleNegativesRankingLoss now supports alternative InfoNCE formulations (symmetric, GTE-style) and optional hardness weighting for harder negatives. Two new losses are introduced, GlobalOrthogonalRegularizationLoss for embedding space regularization and CachedSpladeLoss for memory-efficient SPLADE training. The release also adds a faster hashed batch sampler, fixes GroupByLabelBatchSampler for triplet losses, and ensures full compatibility with the latest Transformers v5 versions.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.3.0
Inference only, use one of:
pip install sentence-transformers==5.3.0
pip install sentence-transformers[onnx-gpu]==5.3.0
pip install sentence-transformers[onnx]==5.3.0
pip install sentence-transformers[openvino]==5.3.0

Updated MultipleNegativesRankingLoss (a.k.a. InfoNCE)

MultipleNegativesRankingLoss received two major upgrades: support for alternative InfoNCE formulations from the literature, and optional hardness weighting to up-weight harder negatives.

Support other InfoNCE variants (#3607)

MultipleNegativesRankingLoss now supports several well-known contrastive loss variants from the literature through new directions and partition_mode parameters. Previously, this loss only supported the standard forward direction (query → doc). You can now configure which similarity interactions are included in the loss:

• "query_to_doc" (default): For each query, its matched document should score higher than all other documents.
• "doc_to_query": The symmetric reverse — for each document, its matched query should score higher than all other queries.
• "query_to_query": For each query, all other queries should score lower than its matched document.
• "doc_to_doc": For each document, all other documents should score lower than its matched query.

The partition_mode controls how scores are normalized: "joint" computes a single softmax over all directions, while "per_direction" computes a separate softmax per direction and averages the losses.

These combine to reproduce several loss formulations from the literature:

Standard InfoNCE (default, unchanged behavior):

loss = MultipleNegativesRankingLoss(model)
# equivalent to directions=("query_to_doc",), partition_mode="joint"

Symmetric InfoNCE (Günther et al. 2024) — adds the reverse direction so both queries and documents are trained to find their match:

loss = MultipleNegativesRankingLoss(
    model,
    directions=("query_to_doc", "doc_to_query"),
    partition_mode="per_direction",
)

GTE improved contrastive loss (Li et al. 2023) — adds same-type negatives (query <-> query, doc <-> doc) for a stronger training signal, especially useful with pairs-only data:

loss = MultipleNegativesRankingLoss(
</tr></table> 

... (truncated)

Commits

• ce48ecc Merge branch 'main' into v5.3-release
• cec08f8 Fix citation for EmbeddingGemma paper (#3687)
• c29b3a6 Release v5.3.0
• 55c13de Prep docs main page for v5.3.0 (#3686)
• 72e75f7 [tests] Add slow reproduction tests for most common models (#3681)
• 237e441 [fix] Fix model card generation with set_transform with new column names (#...
• 7f180b4 [feat] Add hardness-weighted contrastive learning to losses (#3667)
• 5890086 Disallow query_to_query/doc_to_doc with partition_mode="per_direction" due to...
• 6518c36 CE trainer: Removed IterableDataset from train and eval dataset type hints (#...
• 1e0e84c Add tips for adjusting batch size to improve processing speed (#3672)
• Additional commits viewable in compare view

Updates onnxruntime from 1.24.2 to 1.24.4

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.24.4

This is a patch release for ONNX Runtime 1.24, containing bug fixes and execution provider updates.

Bug Fixes

• Core: Added PCI bus fallback for Linux GPU device discovery in containerized environments (e.g., AKS/Kubernetes) where nvidia-drm is not loaded but GPU PCI devices are still exposed via sysfs. (#27591)
• Plugin EP: Fixed null pointer dereference when iterating output spans in GetOutputIndex. (#27644)
• Plugin EP: Fixed bug that incorrectly assigned duplicate MetaDef IDs to fused nodes in different GraphViews (e.g., then/else branches of an If node), causing session creation to fail with a conflicting kernel error. (#27666)

Execution Provider Updates

• QNN EP: Enabled offline x64 compilation with memhandle IO type by deferring rpcmem library loading to inference time. (#27479)
• QNN EP: Reverted QNN SDK logging verbosity changes that caused segmentation faults on backend destruction. (#27650)

Build and Infrastructure

• Python: Updated python_requires from >=3.10 to >=3.11 to reflect dropped Python 3.10 support. (#27354)
• Build: Replaced __builtin_ia32_tpause with the compiler-portable _tpause intrinsic to fix cross-compiler portability issues between GCC and LLVM. (#27607)

Full Changelog: v1.24.3...v1.24.4

Contributors

@​derdeljan-msft, @​adrianlizarraga, @​apwojcik, @​baijumeswani, @​edgchen1, @​mocknen, @​tianleiwu, @​XXXXRT666

ONNX Runtime v1.24.3

This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.

Security Fixes

• Core: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (#27444)
• Core: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (#27543)
• Core: Prevent heap OOB from maliciously crafted Lora Adapters. (#27518)
• Core: Fixed out-of-bounds access for Resize operation. (#27419)

Bug Fixes

• Core: Fixed GatherND division by zero when batch dimensions mismatch. (#27090)
• Core: Fixed validation for external data paths for models loaded from bytes. (#27430)
• Core: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (#27459)
• Core: Fixed double-free in TRT EP custom op domain Release functions. (#27471)
• Core: Fixed QMoE CPU Operator. (#27360)
• Core: Fixed MatmulNBits prepacking scales. (#27412)
• Python: Fixed refcount bug in map input conversion that caused shutdown segfault. (#27413)
• NuGet: Fixed DllImportResolver. (#27397)
• NuGet: Added OrtEnv.DisableDllImportResolver to prevent fatal error on resolver conflict. (#27535)

Performance Improvements

• Core: QMoE CPU performance update (up to 4x on 4-bit). (#27364)
• Core: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (#27391)

Execution Provider Updates

• NvTensorRtRtx EP:
  • Avoid repetitive creation of fp4/fp8 native-custom-op domains. (#27192)
  • Added missing override specifiers to suppress warnings. (#27288)
  • DQ→MatMulNBits fusion transformer. (#27466)

... (truncated)

Commits

• 2d92497 ORT 1.24.4 release cherry pick round 1 (#27682)
• 3a728b7 ORT 1.24.3 release cherry pick round 4 (#27558)
• dd6a854 ORT 1.24.3 release cherry pick round 3 (#27501)
• 15c006b ORT 1.24.3 release cherry pick round 2 (#27492)
• ee26608 ORT 1.24.3 release cherry pick round 1 (#27476)
• See full diff in compare view

Updates fastapi from 0.135.0 to 0.135.2

Release notes

Sourced from fastapi's releases.

0.135.2

Upgrades

• ⬆️ Increase lower bound to pydantic >=2.9.0. and fix the test suite. PR #15139 by @​svlandeg.

Docs

• 📝 Add missing last release notes dates. PR #15202 by @​tiangolo.
• 📝 Update docs for contributors and team members regarding translation PRs. PR #15200 by @​YuriiMotov.
• 💄 Fix code blocks in reference docs overflowing table width. PR #15094 by @​YuriiMotov.
• 📝 Fix duplicated words in docstrings. PR #15116 by @​AhsanSheraz.
• 📝 Add docs for pyproject.toml with entrypoint. PR #15075 by @​tiangolo.
• 📝 Update links in docs to no longer use the classes external-link and internal-link. PR #15061 by @​tiangolo.
• 🔨 Add JS and CSS handling for automatic target=_blank for links in docs. PR #15063 by @​tiangolo.
• 💄 Update styles for internal and external links in new tab. PR #15058 by @​tiangolo.
• 📝 Add documentation for the FastAPI VS Code extension. PR #15008 by @​savannahostrowski.
• 📝 Fix doctrings for max_digits and decimal_places. PR #14944 by @​YuriiMotov.
• 📝 Add dates to release notes. PR #15001 by @​YuriiMotov.

Translations

• 🌐 Update translations for zh (update-outdated). PR #15177 by @​tiangolo.
• 🌐 Update translations for zh-hant (update-outdated). PR #15178 by @​tiangolo.
• 🌐 Update translations for zh-hant (add-missing). PR #15176 by @​tiangolo.
• 🌐 Update translations for zh (add-missing). PR #15175 by @​tiangolo.
• 🌐 Update translations for ja (update-outdated). PR #15171 by @​tiangolo.
• 🌐 Update translations for ko (update-outdated). PR #15170 by @​tiangolo.
• 🌐 Update translations for tr (update-outdated). PR #15172 by @​tiangolo.
• 🌐 Update translations for ko (add-missing). PR #15168 by @​tiangolo.
• 🌐 Update translations for ja (add-missing). PR #15167 by @​tiangolo.
• 🌐 Update translations for tr (add-missing). PR #15169 by @​tiangolo.
• 🌐 Update translations for fr (update-outdated). PR #15165 by @​tiangolo.
• 🌐 Update translations for fr (add-missing). PR #15163 by @​tiangolo.
• 🌐 Update translations for uk (update-outdated). PR #15160 by @​tiangolo.
• 🌐 Update translations for uk (add-missing). PR #15158 by @​tiangolo.
• 🌐 Update translations for pt (add-missing). PR #15157 by @​tiangolo.
• 🌐 Update translations for pt (update-outdated). PR #15159 by @​tiangolo.
• 🌐 Update translations for es (update-outdated). PR #15155 by @​tiangolo.
• 🌐 Update translations for es (add-missing). PR #15154 by @​tiangolo.
• 🌐 Update translations for de (update-outdated). PR #15156 by @​tiangolo.
• 🌐 Update translations for ru (update-and-add). PR #15152 by @​tiangolo.
• 🌐 Update translations for ...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.