Skip to content

Bump the setup-deps group across 1 directory with 4 updates - #44

Open
dependabot[bot] wants to merge 1 commit into
testfrom
dependabot/pip/setup/test/setup-deps-590384cee7
Open

Bump the setup-deps group across 1 directory with 4 updates#44
dependabot[bot] wants to merge 1 commit into
testfrom
dependabot/pip/setup/test/setup-deps-590384cee7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on lxml, httpx2, bitsandbytes and scipy to permit the latest version.
Updates lxml to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

  • GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

  • Some minor corrections for error handling cases.

Other changes

  • Built with Cython 3.2.9.

6.1.1 (2026-05-18)

Bugs fixed

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

  • GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

  • The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

  • LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)

... (truncated)

Commits
  • f2874e9 Update release date.
  • 687a295 Build: Exclude Py3.8 from windows-arm builds.
  • acadc56 Build: Remove outdated build target.
  • 59f93eb Build: Split old-Linux and other-Py3.8 builds.
  • 923df83 Build: Fix manylinux2014 build.
  • 975cc83 Build: Fix Px3.8 build setup.
  • 09e5d3e Build: Fix cibuildwheel version.
  • 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
  • 5567037 Build: Exclude Py3.15 from 32bit builds.
  • 904db40 Build: Update cibuildwheel to include Py3.15.
  • Additional commits viewable in compare view

Updates httpx2 to 2.12.0

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

Fixed

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

  • Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

  • Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

  • Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

  • Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

  • Restore deprecated status code aliases. (#1135)
  • Extract HTTP/2 release notes from changelog headings correctly. (#1136)
  • Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
  • Validate multipart part header names and values before serialization. (#1142)

2.10.0 (August 9th, 2026)

Added

  • Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
  • Add max_event_size to cap SSE event buffering. (#1071)
  • Add RFC 9110 status code constants. (#1069)
  • Add support for Python 3.15. (#1090)

Changed

  • Improve SSE chunk buffering performance. (#1117)
  • Skip cookie extraction for responses without Set-Cookie headers. (#1107)
  • Return str | None instead of Any from Headers.get. (#1121)

Fixed

... (truncated)

Commits

Updates bitsandbytes to 0.50.2

Release notes

Sourced from bitsandbytes's releases.

0.50.2

Highlights

  • ROCm 10.0 build is now included for both Linux and Windows.
  • Additional AMD GPU targets are included in our prebuilt wheels.
  • Performance improvement for certain 4bit GEMM shapes on NVIDIA GB10.

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.1...0.50.2

Changelog

Sourced from bitsandbytes's changelog.

v0.45.1

Improvements:

  • Compatibility for triton>=3.2.0
  • Moved package configuration to pyproject.toml
  • Build system: initial support for NVIDIA Blackwell B100 GPUs, RTX 50 Blackwell series GPUs and Jetson Thor Blackwell.
    • Note: Binaries built for these platforms are not included in this release. They will be included in future releases upon the availability of the upcoming CUDA Toolkit 12.7 and 12.8.

Bug Fixes:

  • Packaging: wheels will no longer include unit tests. (#1478)

Dependencies:

  • Sets the minimum PyTorch version to 2.0.0.

0.45.0

This is a significant release, bringing support for LLM.int8() to NVIDIA Hopper GPUs such as the H100.

As part of the compatibility enhancements, we've rebuilt much of the LLM.int8() code in order to simplify for future compatibility and maintenance. We no longer use the col32 or architecture-specific tensor layout formats while maintaining backwards compatibility. We additionally bring performance improvements targeted for inference scenarios.

Performance Improvements

This release includes broad performance improvements for a wide variety of inference scenarios. See this X thread for a detailed explanation.

Breaking Changes

🤗PEFT users wishing to merge adapters with 8-bit weights will need to upgrade to peft>=0.14.0.

Packaging Improvements

  • The size of our wheel has been reduced by ~43.5% from 122.4 MB to 69.1 MB! This results in an on-disk size decrease from ~396MB to ~224MB.
  • Binaries built with CUDA Toolkit 12.6.2 are now included in the PyPI distribution.
  • The CUDA 12.5.0 build has been updated to CUDA Toolkit 12.5.1.

Deprecations

  • A number of public API functions have been marked for deprecation and will emit FutureWarning when used. These functions will become unavailable in future releases. This should have minimal impact on most end-users.
  • The k-bit quantization features are deprecated in favor of blockwise quantization. For all optimizers, using block_wise=False is not recommended and support will be removed in a future release.
  • As part of the refactoring process, we've implemented many new 8bit operations. These operations no longer use specialized data layouts.

Full Changelog

0.44.1

Bug fixes:

... (truncated)

Commits
  • 08a9956 Release 0.50.2
  • 4f1fc6c [ROCm] Add CI for ROCm 10.0 (#2061)
  • 906ff4d ci: expand ROCm architecture coverage (#2046)
  • d9e4440 Restore Wave64 warp size for all gfx9 targets (#2059)
  • 3fe95b5 Revert "[ROCm] Rework ROCm build to use ROCm version instead of HIP version (...
  • 3ac90c4 [ROCm] Rework ROCm build to use ROCm version instead of HIP version (#1888)
  • 95f9af3 chore(deps): bump the actions group across 1 directory with 2 updates (#2036)
  • d2d08f6 Add sm121 (GB10) to the wide_n_simt 4-bit GEMM dispatch rule (#2039)
  • d8ccdd9 Mask the absmax store in the Triton 4-bit quantize kernels (#2043)
  • 2b6cfb7 Bump dev version
  • See full diff in compare view

Updates scipy to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

  • Name (commits)
  • Wasim Akram (2) +
  • Jake Bowhay (1)
  • Michael Bratsch (1)
  • Dietrich Brunn (1)
  • Evgeni Burovski (1)
  • Aadya Chinubhai (1)
  • Lucas Colley (3)
  • Tekin Ertekin (1) +
  • Fuyugithub (2) +
  • Ralf Gommers (11)
  • Joren Hammudoglu (1)
  • Ijtihed Kilani (1) +
  • Andrew Nelson (2)
  • Ilhan Polat (1)
  • Tyler Reddy (39)
  • romao05 (1) +
  • Michael Simacek (1) +
  • Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits
  • e4e854e REL: SciPy 1.18.1 rel commit
  • 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
  • 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
  • 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
  • a717e28 DOC: PR 25884 revisions
  • bb489c0 DOC: PR 25884 revisions
  • 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
  • 095fe56 DOC, BLD: PR 25884 revisions
  • e66ea64 DOC: update minimum GCC version in toolchain roadmap
  • c021653 TST: tolerance bumps and skips on 32-bit platforms
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the setup-deps group across 1 directory with 4 updates
0f5d0bb 
Updates the requirements on [lxml](https://github.com/lxml/lxml), [httpx2](https://github.com/pydantic/httpx2), [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes) and [scipy](https://github.com/scipy/scipy) to permit the latest version.

Updates `lxml` to 6.1.2
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.1...lxml-6.1.2)

Updates `httpx2` to 2.12.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.10.0...v2.12.0)

Updates `bitsandbytes` to 0.50.2
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.50.1...0.50.2)

Updates `scipy` to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 6.1.2
  dependency-type: direct:production
  dependency-group: setup-deps
- dependency-name: httpx2
  dependency-version: 2.12.0
  dependency-type: direct:production
  dependency-group: setup-deps
- dependency-name: bitsandbytes
  dependency-version: 0.50.2
  dependency-type: direct:production
  dependency-group: setup-deps
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  dependency-group: setup-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants