Bump the pip group across 72 directories with 5 updates

[dependabot]

Bumps the pip group with 5 updates in the /.aitk/requirements directory:

Package	From	To
aiohttp	3.14.0	3.14.3
cryptography	49.0.0	50.0.0
onnx	1.17.0	1.22.0
gitpython	3.1.50	3.1.57
nltk	3.9.4	3.10.0

Bumps the pip group with 3 updates in the /.aitk/requirements/AMD directory: aiohttp, onnx and nltk.
Bumps the pip group with 3 updates in the /.aitk/requirements/General directory: aiohttp, onnx and gitpython.
Bumps the pip group with 2 updates in the /.aitk/requirements/Intel directory: aiohttp and onnx.
Bumps the pip group with 1 update in the /Flux.2-Klein-4B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen1.5-7B-Chat/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen1.5-7B-Chat/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2-1.5B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2-7B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2-7B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-0.5B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-0.5B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-1.5B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-1.5B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-3B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-3B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-7B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-7B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-0.5B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-0.5B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-1.5B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-1.5B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-7B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /Qwen-Qwen2.5-Coder-7B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /amd-AMD-OLMo-1B-SFT-DPO/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /codellama-CodeLlama-7b-Instruct-hf/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Llama-8B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Llama-8B/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Qwen-1.5B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Qwen-1.5B/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Qwen-7B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /deepseek-ai-DeepSeek-R1-Distill-Qwen-7B/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /gpt-oss-20b/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /intel-bert-base-uncased-mrpc/oci/cpu directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-2-7b-chat-hf/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-2-7b-chat-hf/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-2-7b-hf/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-2-7b-hf/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B-Instruct/QNN directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-1B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-1B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-1B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-3B-Instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-3B-Instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.2-3B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Meta-Llama-3-8B/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /meta-llama-Meta-Llama-3-8B/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3-mini-128k-instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3-mini-128k-instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3-mini-4k-instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3-mini-4k-instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3.5-mini-instruct/QNN directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3.5-mini-instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-3.5-mini-instruct/VitisAI directory: onnx.
Bumps the pip group with 3 updates in the /microsoft-Phi-4-mini-instruct/QAIRT directory: aiohttp, cryptography and onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-4-mini-instruct/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-4-mini-instruct/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-4-mini-reasoning/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-4-mini-reasoning/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /microsoft-Phi-4-reasoning/QNN directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-Instruct-v0.1/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-Instruct-v0.2/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-Instruct-v0.2/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-Instruct-v0.3/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-Instruct-v0.3/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /mistralai-Mistral-7B-v0.3/RyzenAI directory: onnx.
Bumps the pip group with 1 update in the /sd-legacy-stable-diffusion-v1-5/VitisAI directory: onnx.
Bumps the pip group with 1 update in the /sd-legacy-stable-diffusion-v1-5/olive directory: aiohttp.

Updates aiohttp from 3.14.0 to 3.14.3
Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31

* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table> 

... (truncated)

Commits

• dcb7050 Prepare for 50.0.0 release (#15372)
• 53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
• d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
• 908773d Bump downstream dependencies in CI (#15368)
• 2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
• c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
• 67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
• 95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
• 6954733 Release the GIL during DH and DSA parameter generation (#15364)
• 6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
• Additional commits viewable in compare view

Updates onnx from 1.17.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

• Swap qk_matmul_output_mode 1 & 2 to match computation order by @​titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

• Fix number of pad modes in doc_strings.cc by @​assafpr in onnx/onnx#7803
• Add FlexAttention Op to ai.onnx.preview opset by @​mshr-h in onnx/onnx#7534
• Fix Attention op softcap ordering: apply before mask/bias by @​titaiwangms in onnx/onnx#7867
• Add LinearAttention and CausalConvWithState operators (Opset 27) by @​tadani3 in onnx/onnx#7950
• feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @​andife in onnx/onnx#7923

Reference Implementation

• Fix missing 'mul' reduction in ScatterElements reference implementation by @​zdryan in onnx/onnx#7842
• Fix QLinearMatMul output saturation by @​karimbaidar in onnx/onnx#7868
• Fixed more bugs in the Scan reference op by @​tadani3 in onnx/onnx#7964

Utilities and Tools

• Fix Slice shape inference crashes with SIGABRT on empty dimensions by @​titaiwangms in onnx/onnx#7738
• Rename misleading input_rank param to input_dim_value in processSlice… by @​titaiwangms in onnx/onnx#7739
• fix: Conv/Pool strides validation by @​edgchen1 in onnx/onnx#7764
• fix: add input/output bounds checks in version converter adapter by @​andife in onnx/onnx#7813
• Harden version conversion against malformed inputs by @​andife in onnx/onnx#7872
• fix: add input rank checks in Gemm version converter adapters by @​andife in onnx/onnx#7880
• Fix raw_data handling in version converter adapters by @​cyyever in onnx/onnx#7910
• Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @​OmarAzizi in onnx/onnx#7760
• Add version macros by @​cbourjau in onnx/onnx#7918
• Remove internal spec_to_yaml tool by @​cbourjau in onnx/onnx#7985
• Address shape inference shortcomings by @​yuslepukhin in onnx/onnx#7997
• Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @​gramalingam in onnx/onnx#7999
• Add operator+ and operator- for Dim by @​gramalingam in onnx/onnx#8000
• Fix KeepAspectRatioHelper precision for scaled output dimensions by @​elwhyjay in onnx/onnx#8007
• Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @​Copilot in onnx/onnx#8037

Build, CI and Tests

• Add update into main.yml by @​titaiwangms in onnx/onnx#7687
• Update check_urls.yml by @​andife in onnx/onnx#7716
• Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @​Shadows-of-Fire in onnx/onnx#7660
• Try to fix renovate by @​andife in onnx/onnx#7742
• fix upload; Update release_win.yml by @​andife in onnx/onnx#7728
• Allow release CIs to run when a labeled PR receives new commits by @​Copilot in onnx/onnx#7741
• Update pixi.{toml,lock} by @​cbourjau in onnx/onnx#7746
• hash for googletest by @​andife in onnx/onnx#7765
• Update RELEASE-MANAGEMENT.md by @​andife in onnx/onnx#7773
• Update doc CIPipeline by @​andife in onnx/onnx#7782
• use reviewdog to fix the pr_checks workflow by @​andife in onnx/onnx#7780
• Update copilot-setup-steps.yml; persist-credentials: false by @​andife in onnx/onnx#7768
• Update release_linux.yml; replace tag by hash by @​andife in onnx/onnx#7769

... (truncated)

Commits

• 2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
• eda0385 Update version number to 1.22.0 (#8086)
• b124e01 Bump version number to 1.22.0rc2 (#8071)
• 8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
• 53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
• bc3be77 Set version number to 1.22.0rc1 (#8024)
• e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
• 293ad62 Run lints also on Windows (#8014)
• 8847da4 Follow up for scikit-build-core migration (#8017)
• 882a5ef Fix/sdist missing SBOM cdx json (#8010)
• Additional commits viewable in compare view

Updates gitpython from 3.1.50 to 3.1.57

Release notes

Sourced from gitpython's releases.

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in gitpython-developers/GitPython#2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in gitpython-developers/GitPython#2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in gitpython-developers/GitPython#2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in gitpython-developers/GitPython#2124
• Render protected Traversable methods in the reference by @​pick7 in gitpython-developers/GitPython#2192
• Use standard prefixes for parsed patch diffs by @​pick7 in gitpython-developers/GitPython#2191
• Honor kill_after_timeout with output streams by @​pick7 in gitpython-developers/GitPython#2189
• Redact Authorization extra headers from command errors by @​pick7 in gitpython-developers/GitPython#2188
• Improve RemoteProgress parse return typing by @​pick7 in gitpython-developers/GitPython#2187
• Adopt basedpyright with a legacy baseline by @​Byron in gitpython-developers/GitPython#2194
• Block unsafe Git file and URL options by @​Byron in gitpython-developers/GitPython#2193

New Contributors

• @​pick7 made their first contribution in gitpython-developers/GitPython#2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

• Add support for Python 3.15 by @​hugovk in gitpython-developers/GitPython#2183
• fix: reject unsafe output options in Commit.count by @​Byron in gitpython-developers/GitPython#2184

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

• fix: prevent environment expansion in remote URLs by @​Byron in gitpython-developers/GitPython#2181

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

3.1.54 - Security

What's Changed

• Harden unsafe Git option validation by @​Byron in gitpython-developers/GitPython#2180

Full Changelog: gitpython-developers/GitPython@3.1.53...3.1.54

3.1.53 - Security

What's Changed

• feat(submodule): add deinit method to Submodule (#2014) by @​mvanhorn in gitpython-developers/GitPython#2129
• typing: introduce sensible basedpyright defaults by @​Byron in gitpython-developers/GitPython#2174
• fix: make submodule.update() after submodule.deinit() work by @​Byron in gitpython-developers/GitPython#2175
• Fix commit hooks respecting core.hooksPath by @​Siesta0217 in gitpython-developers/GitPython#2159
• fix: validate config section delimiters by @​Byron in gitpython-developers/GitPython#2176

New Contributors

... (truncated)

Commits

• ccbd573 prepare for new release
• d1a631d Merge pull request #2193 from gitpython-developers/more-unsafe-options
• ab33e33 Merge pull request #2194 from gitpython-developers/fix-basedpyright
• 52199b3 address review comments
• 60dec71 Adopt basedpyright with a legacy baseline
• 7a4f5dc Block unsafe archive additions and bundle URI
• 3af0c25 Block unsafe checkout-index and tag file options
• fb5d584 Merge pull request #2187 from pick7/codex/remote-progress-return-type
• 951cc44 Merge pull request #2188 from pick7/codex/redact-http-extraheader
• 2e5b13f Merge pull request #2189 from pick7/codex/output-stream-timeout
• Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

• CHILDES corpus reader: lazy loading (fixes #1340) by @​nschneid in nltk/nltk#1341
• Stanseg by @​casperlehmann in nltk/nltk#1350
• Add optional CCG semantics computation by @​tanin47 in nltk/nltk#1321
• address of free software foundation updated by @​Lightyagami1 in nltk/nltk#1347
• Added a verification for empty tokens by @​gnardari in nltk/nltk#1353
• use data.load for vader lexicon by @​afgiel in nltk/nltk#1303
• Ensure that proper exceptions are caught correctly by @​pombredanne in nltk/nltk#1343
• Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @​tanin47 in nltk/nltk#1354
• Add tanin as an author :) by @​tanin47 in nltk/nltk#1355
• framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @​nschneid in nltk/nltk#1360
• remove u because it doesn't work in Python 3.0 to 3.2 by @​tanin47 in nltk/nltk#1362
• moved the import for dispersion_plot out of the else block by @​dennisobrien in nltk/nltk#1364
• Raise warning for infinite recursion by @​alvations in nltk/nltk#1365
• Patch None TypeError in align_blocks() by @​alvations in nltk/nltk#1366
• Safer try-except for catching infinite recursion by @​alvations in nltk/nltk#1368
• Collections refactor by @​nschneid in nltk/nltk#1382
• Handles fringe cases in BLEU by @​alvations in nltk/nltk#1383
• Allow specifying substitution cost in edit distance by @​dnc1994 in nltk/nltk#1386
• Pl196x fixes by @​pkasprzyk in nltk/nltk#1359
• Docs/ngrams by @​ColCarroll in nltk/nltk#1403
• Fix conll.py by @​germanferrero in nltk/nltk#1402
• Aline by @​geoffbacon in nltk/nltk#1407
• Handle empty files in a corpus by @​alexisdimi in nltk/nltk#1411
• fixed bug: StackDecoder would throw exception if it's unable to finish… by @​hikui in nltk/nltk#1405
• add hikui to authors by @​hikui in nltk/nltk#1412
• removes download-cache pip flag from tox config by @​fievelk in nltk/nltk#1415
• Added three tokenizers, one detokenizer and two tokenizer-related word/char list corpora by @​alvations in nltk/nltk#1282
• Much faster Vader sentiment tagging by @​georgeberry in nltk/nltk#1409
• Fixes doctest in is_cjk() and REPP tokenizer wrapper by @​alvations in nltk/nltk#1420
• Fixed doctest for UnicharsCorpusReader and NonbreakingPrefixesCorpusReader by @​alvations in nltk/nltk#1422
• Updated senna version in docstring by @​alvations in nltk/nltk#1431
• Removes Python 2.6 and Python 3.1-3.3 code, Improves Python 3.5 syntax by @​adamn in nltk/nltk#1429
• Cleanup by @​dimazest in nltk/nltk#1432
• Fix zero division & log(0) in PunktTrainer._col_log_likelihood by @​mrecachinas in nltk/nltk#1247
• Update stanford_segmenter.py by @​janissl in nltk/nltk#1444
• explained data format for constructor by @​drevicko in nltk/nltk#1450
• Use a more efficient idiom for flattening nested lists by @​rmalouf in nltk/nltk#1447
• improved documentation of load_array() by @​drevicko in nltk/nltk#1452
• changed "list or iterator" to "sequence" by @​drevicko in nltk/nltk#1453
• Deal gracefully with degenerate cases. by @​drevicko in nltk/nltk#1454
• deal with (hopefully) all degenerate cases by @​drevicko in nltk/nltk#1455
• Enable unordered comparison for gaac clustering by @​alvations in nltk/nltk#1456
• Rewrite porter.py by @​ExplodingCabbage in nltk/nltk#1261
• Update naivebayes.py by @​andyreagan in nltk/nltk#1461
• Fixes bug where download status not returned. by @​nsfabina in nltk/nltk#1468
• Use lcon and rcon variables in conllned() when trace is False - Issue #1474 by @​timleslie in nltk/nltk#1475
• Use shutil.copyfileobj for unzipping by @​ikorolev93 in nltk/nltk#1478
• Fixing Chen&Cherry method 6 smoothing in BLEU score by @​alvations in nltk/nltk#1477

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.1 2026-07-29

• Expand ~ in env-var paths
• Validate types after WordNet app pickle deserialization
• Fix uncontrolled search path in HunposTagger
• Use exact thirds in masi_distance
• Avoid retaining bllip import exceptions
• Fix word_tokenize: pad opening single quote before multi-letter words.
• Implement Tree.pformat_latex_forest.
• Prevent module hijacking in inline imports.
• Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

• Enforce the stricter nltk.pathsec security policy by default
• Document the new security model and migration guidance
• Harden resource loading against path traversal and SSRF/DNS-rebinding
• Harden downloader path handling and block XML entity expansion
• Close remaining corpus-reader security edge cases
• Replace unsafe exec() usage in the utility CLI
• Warn on unpickling user-provided pickles
• Add HuggingFace datasets integration (nltk.huggingface)
• Align TnT with Brants (2000) specifications
• Fix PorterStemmer irregular-form lowercasing in NLTK mode
• Fix TransitionParser sparse index dtype for scikit-learn 1.9
• Fix TextCat tie handling
• Fix WordNet object comparisons for incompatible types
• Cache WordNet max depth lazily for lch_similarity()
• Fix CCG variable direction, substitution, and type-raising bugs
• Fix Jaro similarity for single-character and empty-string cases
• Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

• Support Python 3.14
• Fix bug in Levenshtein distance when substitution_cost > 2
• Fix bug in Treebank detokeniser re quote ordering
• Fix bug in Jaro similarity for empty strings
• Several security enhancements
• Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder

... (truncated)

Commits

• bd49f90 allow escaped brackets in Tree.fromstring (#3694)
• 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
• 52227d2 Use os.name for Windows path handling (#3605)
• 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
• a167389 Treat missing unzip output as stale (#3607)
• c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
• 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
• 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
• 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
• f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
• Additional commits viewable in compare view

Updates aiohttp from 3.14.0 to 3.14.3
Updates onnx from 1.18.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

• Swap qk_matmul_output_mode 1 & 2 to match computation order by @​titaiwangms in onnx/onnx#7913

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

• Fix number of pad modes in doc_strings.cc by @​assafpr in onnx/onnx#7803
• Add FlexAttention Op to ai.onnx.preview opset by @​mshr-h in onnx/onnx#7534
• Fix Attention op softcap ordering: apply before mask/bias by @​titaiwangms in onnx/onnx#7867
• Add LinearAttention and CausalConvWithState operators (Opset 27) by @​tadani3 in onnx/onnx#7950
• feat(generator): extend Range operator with float16 and bfloat16 support (opset 27) by @​andife in onnx/onnx#7923

Reference Implementation

• Fix missing 'mul' reduction in ScatterElements reference implementation by @​zdryan in onnx/onnx#7842
• Fix QLinearMatMul output saturation by @​karimbaidar in onnx/onnx#7868
• Fixed more bugs in the Scan reference op by @​tadani3 in onnx/onnx#7964

Utilities and Tools

• Fix Slice shape inference crashes with SIGABRT on empty dimensions by @​titaiwangms in onnx/onnx#7738
• Rename misleading input_rank param to input_dim_value in processSlice… by @​titaiwangms in onnx/onnx#7739
• fix: Conv/Pool strides validation by @​edgchen1 in onnx/onnx#7764
• fix: add input/output bounds checks in version converter adapter by @​andife in onnx/onnx#7813
• Harden version conversion against malformed inputs by @​andife in onnx/onnx#7872
• fix: add input rank checks in Gemm version converter adapters by @​andife in onnx/onnx#7880
• Fix raw_data handling in version converter adapters by @​cyyever in onnx/onnx#7910
• Fix checker to use len() instead of sys.getsizeof() for protobuf size check by @​OmarAzizi in onnx/onnx#7760
• Add version macros by @​cbourjau in onnx/onnx#7918
• Remove internal spec_to_yaml tool by @​cbourjau in onnx/onnx#7985
• Address shape inference shortcomings by @​yuslepukhin in onnx/onnx#7997
• Add unifyInputShape / unifyInputShapePrefix shape inference utilities by @​gramalingam in onnx/onnx#7999
• Add operator+ and operator- for Dim by @​gramalingam in onnx/onnx#8000
• Fix KeepAspectRatioHelper precision for scaled output dimensions by @​elwhyjay in onnx/onnx#8007
• Fix heap buffer over-read in Conv/Pool shape inference for weight rank mismatch by @​Copilot in onnx/onnx#8037

Build, CI and Tests

• Add update into main.yml by @​titaiwangms in onnx/onnx#7687
• Update check_urls.yml by @​andife in onnx/onnx#7716
• Update add_msvc_runtime_flag to work with MSVC_RUNTIME_LIBRARY by @​Shadows-of-Fire in onnx/onnx#7660
• Try to fix renovate by @​andife in onnx/onnx#7742
• fix upload; Update release_win.yml by @​andife in onnx/onnx#7728
• Allow release CIs to run when a labeled PR receives new commits by @​Copilot in onnx/onnx#7741
• Update pixi.{toml,lock} by @​cbourjau in onnx/onnx#7746
• hash for googletest by @​andife in onnx/onnx#7765
• Update RELEASE-MANAGEMENT.md by @​andife in onnx/onnx#7773
• Update doc CIPipeline by @​andife in onnx/onnx#7782
• use reviewdog to fix the pr_checks workflow by @​andife in onnx/onnx#7780
• Update copilot-setup-steps.yml; persist-credentials: false by @​andife in onnx/onnx#7768
• Update release_linux.yml; replace tag by hash by @​andife in onnx/onnx#7769

... (truncated)

Commits

• 2bb5046 Fix windows workflows on rel-1.22.0 branch (#8087)
• eda0385 Update version number to 1.22.0 (#8086)
• b124e01 Bump version number to 1.22.0rc2 (#8071)
• 8de2cf6 Cherrypicks for 1.22.0rc2 (#8066)
• 53d6120 Cherry-pick: Address shape inference issues in Conv (#8051) to rel-1.22.0 (#8...
• bc3be77 Set version number to 1.22.0rc1 (#8024)
• e945daf feat(generator): extend Range operator with float16 and bfloat16 support (ops...
• 293ad62 Run lints also on Windows (#8014)
• 8847da4 Follow up for scikit-build-core migration (#8017)
• 882a5ef Fix/sdist missing SBOM cdx json (#8010)
• Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

• CHILDES corpus reader: lazy loading (fixes #1340) by @​nschneid in nltk/nltk#1341
• Stanseg by @​casperlehmann in nltk/nltk#1350
• Add optional CCG semantics computation by @​tanin47 in nltk/nltk#1321
• address of free software foundation updated by @​Lightyagami1 in nltk/nltk#1347
• Added a verification for empty tokens by @​gnardari in nltk/nltk#1353
• use data.load for vader lexicon by @​afgiel in nltk/nltk#1303
• Ensure that proper exceptions are caught correctly by @​pombredanne in nltk/nltk#1343
• Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @​tanin47 in nltk/nltk#1354
• Add tanin as an author :) by @​tanin47 in nltk/nltk#1355
• framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @​nschneid in nltk/nltk#1360
• remove u because it doesn't work in Python 3.0 to 3.2 by @​tan...

  Description has been truncated

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR updates pinned dependency versions across multiple model/recipe requirement files (QNN, VitisAI, RyzenAI, and AITK envs), primarily to align on newer onnx and to refresh a handful of other commonly used packages.

Changes:

• Bump onnx pins broadly to 1.22.0 across many environments/recipes.
• Bump aiohttp pins to 3.14.3 in multiple requirement sets.
• Update a few additional pins (cryptography, gitpython, nltk) in select environments.

Reviewed changes

Copilot reviewed 82 out of 82 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sd-legacy-stable-diffusion-v1-5/olive/requirements_qnn.txt	Bumps aiohttp pin.
sd-legacy-stable-diffusion-v1-5/VitisAI/requirements_vitisai_sd.txt	Bumps onnx pin.
mistralai-Mistral-7B-v0.3/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
mistralai-Mistral-7B-Instruct-v0.3/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
mistralai-Mistral-7B-Instruct-v0.3/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
mistralai-Mistral-7B-Instruct-v0.2/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
mistralai-Mistral-7B-Instruct-v0.2/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
mistralai-Mistral-7B-Instruct-v0.1/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
microsoft-Phi-4-reasoning/QNN/requirements.txt	Bumps onnx pin.
microsoft-Phi-4-mini-reasoning/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
microsoft-Phi-4-mini-reasoning/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
microsoft-Phi-4-mini-instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
microsoft-Phi-4-mini-instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
microsoft-Phi-4-mini-instruct/QAIRT/requirements.txt	Bumps aiohttp, cryptography, onnx pins.
microsoft-Phi-3.5-mini-instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
microsoft-Phi-3.5-mini-instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
microsoft-Phi-3.5-mini-instruct/QNN/requirements.txt	Bumps onnx pin.
microsoft-Phi-3-mini-4k-instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
microsoft-Phi-3-mini-4k-instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
microsoft-Phi-3-mini-128k-instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
microsoft-Phi-3-mini-128k-instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Meta-Llama-3-8B/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Meta-Llama-3-8B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-3B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-3B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-3B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-1B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-1B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.2-1B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.1-8B/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.1-8B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.1-8B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.1-8B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-3.1-8B-Instruct/QNN/requirements.txt	Bumps onnx pin.
meta-llama-Llama-2-7b-hf/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-2-7b-hf/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
meta-llama-Llama-2-7b-chat-hf/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
meta-llama-Llama-2-7b-chat-hf/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
intel-bert-base-uncased-mrpc/oci/cpu/requirements.txt	Bumps onnx pin.
gpt-oss-20b/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Qwen-7B/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Qwen-7B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Qwen-1.5B/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Qwen-1.5B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Llama-8B/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
deepseek-ai-DeepSeek-R1-Distill-Llama-8B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
codellama-CodeLlama-7b-Instruct-hf/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
amd-AMD-OLMo-1B-SFT-DPO/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-7B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-7B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-1.5B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-1.5B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-0.5B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-Coder-0.5B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-7B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-7B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-3B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-3B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-1.5B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-1.5B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-0.5B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2.5-0.5B-Instruct/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2-7B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen2-7B-Instruct/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen2-1.5B/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Qwen-Qwen1.5-7B-Chat/VitisAI/requirements_vitisai_llm.txt	Bumps onnx pin.
Qwen-Qwen1.5-7B-Chat/RyzenAI/requirements_ryzenai_llm.txt	Bumps onnx pin.
Flux.2-Klein-4B/RyzenAI/requirements_ryzenai_sd.txt	Bumps onnx pin.
.aitk/requirements/requirements-WinMLCLI.txt	Bumps aiohttp, cryptography, onnx pins.
.aitk/requirements/requirements-WCR.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/requirements-WCR-QAI.txt	Bumps gitpython pin.
.aitk/requirements/requirements-QNN.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/requirements-Profiling.txt	Bumps onnx pin.
.aitk/requirements/requirements-NvidiaGPU.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/requirements-IntelNPU.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/requirements-IntelNPU-WP.txt	Bumps onnx pin.
.aitk/requirements/Intel/Test_py3.12.9.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/General/CUDA_py3.12.9.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/General/CUDA_py3.12.9-NVModelOptQuantization.txt	Bumps onnx pin.
.aitk/requirements/General/CPU_py3.12.9.txt	Bumps aiohttp, onnx pins.
.aitk/requirements/General/CPU_py3.12.9-QAI.txt	Bumps gitpython pin.
.aitk/requirements/AMD/Quark_py3.12.13.txt	Bumps aiohttp, nltk, onnx pins.

Suppressed comments (1)

microsoft-Phi-4-mini-instruct/QAIRT/requirements.txt:1

• cryptography==50.0.0 is not a version I can verify exists. If this is intended for a security refresh, consider pinning to a known released cryptography version (or a constrained range) to avoid breaking installs and to ensure OpenSSL compatibility on all target platforms.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.