Skip to content

security(deps): bump the training-dependencies group in /training/rl with 14 updates#394

Merged
WilliamBerryiii merged 2 commits into
mainfrom
dependabot/pip/training/rl/training-dependencies-5f55c3f85b
Apr 6, 2026
Merged

security(deps): bump the training-dependencies group in /training/rl with 14 updates#394
WilliamBerryiii merged 2 commits into
mainfrom
dependabot/pip/training/rl/training-dependencies-5f55c3f85b

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026

Bumps the training-dependencies group in /training/rl with 14 updates:

Package From To
marshmallow 4.2.3 4.3.0
azure-monitor-opentelemetry-exporter 1.0.0b49 1.0.0b50
charset-normalizer 3.4.6 3.4.7
click 8.3.1 8.3.2
cuda-pathfinder 1.5.0 1.5.1
fastapi 0.135.2 0.135.3
orjson 3.11.7 3.11.8
pandas 3.0.1 3.0.2
pillow 12.1.1 12.2.0
pydantic-core 2.44.0 2.45.0
sqlalchemy 2.0.48 2.0.49
tzdata 2025.3 2026.1
uvicorn 0.42.0 0.43.0
werkzeug 3.1.7 3.1.8

Updates marshmallow from 4.2.3 to 4.3.0

Changelog

Sourced from marshmallow's changelog.

4.3.0 (2026-04-03)

Features:

  • Add pre_load and post_load parameters to marshmallow.fields.Field for field-level pre- and post-processing (:issue:2787).
  • Typing: improvements to marshmallow.validate (:pr:2940).

4.2.4 (2026-04-02)

Bug fixes:

  • marshmallow.validate.URL and marshmallow.validate.Email accept Internationalized Domain Names (IDNs) (:issue:2821, :issue:2936). marshmallow.validate.Email also correctly rejects IDN domains with leading/trailing hyphens. Thanks :user:touhidurrr for the report.
  • Typing: Fix typing of nested in marshmallow.fields.Nested (:pr:2935).
Commits

Updates azure-monitor-opentelemetry-exporter from 1.0.0b49 to 1.0.0b50

Release notes

Sourced from azure-monitor-opentelemetry-exporter's releases.

azure-monitor-opentelemetry-exporter_1.0.0b50

1.0.0b50 (2026-04-03)

Bugs Fixed

  • Fix duplicate authentication policy in live metrics exporter causing Unauthorized errors for authenticated Application Insights resources (#46024)
  • Suppress internal sdkstats HTTP pipeline logs from appearing in user's logs (#45966)
  • Kubernetes pod name takes precedence when populating cloud_RoleInstance (#45884)

Other Changes

  • Revert custom properties limit to 8kb (#46066)
Commits
  • 24212d1 Exporter release 1.0.0b50 (#46054)
  • 087778f Revert custom properties limit to 8kb (#46066)
  • d8bed7e [monitor-opentelemetry] Fix duplicate auth policy in live metrics exporter (#...
  • de23b45 Suppress internal sdkstats HTTP pipeline logs from appearing in user's traces...
  • ce28bf7 Modify logic to ensure that the cloud_RoleInstance gets populated with the k8...
  • 5fe509b Remove deprecated events package and methods (#45684)
  • faf2a72 Increment package version after release of azure-monitor-opentelemetry (#45811)
  • 77b2899 Distro release 1.8.7 (#45801)
  • 4b5be11 Change import path for LoggingHandler to accommodate upstream breaking change...
  • 9950092 Increment package version after release of azure-monitor-opentelemetry-export...
  • See full diff in compare view

Updates charset-normalizer from 3.4.6 to 3.4.7

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.7

3.4.7 (2026-04-02)

Changed

  • Pre-built optimized version using mypy[c] v1.20.
  • Relax setuptools constraint to setuptools>=68,<82.1.

Fixed

  • Correctly remove SIG remnant in utf-7 decoded string. (#718) (#716)
Changelog

Sourced from charset-normalizer's changelog.

3.4.7 (2026-04-02)

Changed

  • Pre-built optimized version using mypy[c] v1.20.
  • Relax setuptools constraint to setuptools>=68,<82.1.

Fixed

  • Correctly remove SIG remnant in utf-7 decoded string. (#718) (#716)
Commits
  • 0f07891 Merge pull request #729 from jawah/release-3.4.7
  • fdbeb29 chore: update dev, and ci requirements
  • b66f922 chore: add ft classifier
  • f94249d chore: add test cases for utf_7 recent fix
  • 95c866f chore: bump version to 3.4.7
  • 4f429bb chore: bump mypy pre-commit to v1.20
  • b579cd6 fix: correctly remove SIG remnant in utf-7 decoded string
  • 58bf944 ⬆️ Bump github/codeql-action from 4.32.4 to 4.35.1 (#728)
  • 44cf8a1 ⬆️ Bump actions/download-artifact from 8.0.0 to 8.0.1 (#726)
  • 362bc20 ⬆️ Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 (#725)
  • Additional commits viewable in compare view

Updates click from 8.3.1 to 8.3.2

Release notes

Sourced from click's releases.

8.3.2

This is the Click 8.3.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.3.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-2 Milestone: https://github.com/pallets/click/milestone/29

  • Fix handling of flag_value when is_flag=False to allow such options to be used without an explicit value. #3084 #3152
  • Hide Sentinel.UNSET values as None when using lookup_default(). #3136 #3199 #3202 #3209 #3212 #3224
  • Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer. #824 #2991 #2993 #3110 #3139 #3140
  • Add comprehensive tests for CliRunner stream lifecycle, covering logging interaction, multi-threaded safety, and sequential invocation isolation. Add high-iteration stress tests behind a stress marker with a dedicated CI job. #3139
  • Fix callable flag_value being instantiated when used as a default via default=True. #3121 #3201 #3213 #3225
Changelog

Sourced from click's changelog.

Version 8.3.2

Released 2026-04-02

  • Fix handling of flag_value when is_flag=False to allow such options to be used without an explicit value. :issue:3084 :pr:3152
  • Hide Sentinel.UNSET values as None when using lookup_default(). :issue:3136 :pr:3199 :pr:3202 :pr:3209 :pr:3212 :pr:3224
  • Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer. :issue:824 :issue:2991 :issue:2993 :issue:3110 :pr:3139 :pr:3140
  • Add comprehensive tests for CliRunner stream lifecycle, covering logging interaction, multi-threaded safety, and sequential invocation isolation. Add high-iteration stress tests behind a stress marker with a dedicated CI job. :pr:3139
  • Fix callable flag_value being instantiated when used as a default via default=True. :issue:3121 :pr:3201 :pr:3213 :pr:3225
Commits

Updates cuda-pathfinder from 1.5.0 to 1.5.1

Release notes

Sourced from cuda-pathfinder's releases.

cuda-pathfinder v1.5.1

Release notes

Documentation

PyPI

Conda

Commits
  • 1c8f297 docs(pathfinder): prepare 1.5.1 release notes (#1854)
  • 1476822 [FEA]: Add support for pathfinder.find_bitcode_lib("nvshmem_device") (#1828)
  • 900cd2e Claim cuda-python repository in context7 (#1757)
  • 6a7d08c pathfinder: extended bin search paths with nvidia/cu13/bin (#1846)
  • 64b8c07 bench: Initial cuda.bindings latency benchmarks structure (#1736)
  • 56edbb0 Extract requires() test mark to eliminate repeated numpy version checks (#1844)
  • fa25626 build(deps): bump the actions-monthly group with 5 updates (#1848)
  • 66a687c Enhance Graph.update() and add whole-graph update tests (#1843)
  • 6211c5a pathfinder: support cusolverMp dynamic loading and header searching (#1845)
  • 682182b Improve cuda_bindings examples (#1842)
  • Additional commits viewable in compare view

Updates fastapi from 0.135.2 to 0.135.3

Release notes

Sourced from fastapi's releases.

0.135.3

Features

Docs

  • ✏️ Fix typo for client_secret in OAuth2 form docstrings. PR #14946 by @​bysiber.

Internal

Commits

Updates orjson from 3.11.7 to 3.11.8

Release notes

Sourced from orjson's releases.

3.11.8

Changed

  • Build and compatibility improvements.
Changelog

Sourced from orjson's changelog.

3.11.8 - 2026-03-31

Changed

  • Build and compatibility improvements.
Commits

Updates pandas from 3.0.1 to 3.0.2

Release notes

Sourced from pandas's releases.

pandas 3.0.2

We are pleased to announce the release of pandas 3.0.2. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • ab90747 RLS: 3.0.2 (#64934)
  • 6f27013 Backport PR #64931 on branch 3.0.x (DOC/BLD: temporary disable upload of docs...
  • 48ddc60 Backport PR #64664 on branch 3.0.x (BUG: DataFrame.sum() crashes on empty Dat...
  • 8774488 [backport 3.0.x] PERF: fix slow python loop in validation for ArrowStringArra...
  • 33af6cc Backport PR #64133 on branch 3.0.x (BUG: str.find returns byte offset instead...
  • 4ef49d8 [backport 3.0.x] BUG: fix convert_dtypes dropping values from sliced mixed-dt...
  • 0668f34 [backport 3.0.x] BUG: Fix HDFStore.put with StringDtype columns and compressi...
  • 23f2f44 [backport 3.0.x] BUG: Suppress unnecessary RuntimeWarning in to_datetime with...
  • 83ba804 Backport PR #64886: BUG: Compute Variance of Complex Numbers Correctly (#64892)
  • bb5ca1a Backport PR #64386 on branch 3.0.x (BUG: fix sort_index AssertionError with R...
  • Additional commits viewable in compare view

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Dependencies

Testing

Other changes

... (truncated)

Commits

Updates pydantic-core from 2.44.0 to 2.45.0

Commits

Updates sqlalchemy from 2.0.48 to 2.0.49

Release notes

Sourced from sqlalchemy's releases.

2.0.49

Released: April 3, 2026

orm

  • [orm] [bug] Fixed issue where _orm.Session.get() would bypass the identity map and emit unnecessary SQL when with_for_update=False was passed, rather than treating it equivalently to the default of None. Pull request courtesy of Joshua Swanson.

    References: #13176

  • [orm] [bug] Fixed issue where chained _orm.joinedload() options would not be applied correctly when the final relationship in the chain is declared on a base mapper and accessed through a subclass mapper in a _orm.with_polymorphic() query. The path registry now correctly computes the natural path when a property declared on a base class is accessed through a path containing a subclass mapper, ensuring the loader option can be located during query compilation.

    References: #13193

  • [orm] [bug] [inheritance] Fixed issue where using _orm.Load.options() to apply a chained loader option such as _orm.joinedload() or _orm.selectinload() with _orm.PropComparator.of_type() for a polymorphic relationship would not generate the necessary clauses for the polymorphic subclasses. The polymorphic loading strategy is now correctly propagated when using a call such as joinedload(A.b).options(joinedload(B.c.of_type(poly))) to match the behavior of direct chaining e.g. joinedload(A.b).joinedload(B.c.of_type(poly)).

    References: #13202

  • [orm] [bug] [inheritance] Fixed issue where using chained loader options such as _orm.selectinload() after _orm.joinedload() with _orm.PropComparator.of_type() for a polymorphic relationship would not properly apply the chained loader option. The loader option is now correctly applied when using a call such as joinedload(A.b.of_type(poly)).selectinload(poly.SubClass.c) to eagerly load related objects.

    References: #13209

typing

  • [typing] [bug] Fixed a typing issue where the typed members of :data:.func would return the appropriate class of the same name, however this creates an issue for

... (truncated)

Commits

Updates tzdata from 2025.3 to 2026.1

Release notes

Sourced from tzdata's releases.

2026.1: Release of upstream tzdata 2026a

Version 2026.1

Upstream version 2026a released 2026-03-02T06:59:49+00:00

Briefly:

Moldova has used EU transition times since 2022. The "right" TZif files are no longer installed by default. -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. TZif files are no longer limited to 50 bytes of abbreviations. zic is no longer limited to 50 leap seconds. Several integer overflow bugs have been fixed.

Changes to past and future timestamps

Since 2022 Moldova has observed EU transition times, that is, it has sprung forward at 03:00, not 02:00, and has fallen back at 04:00, not 03:00. (Thanks to Heitor David Pinto.)

Changes to data

Remove Europe/Chisinau from zonenow.tab, as it now agrees with Europe/Athens for future timestamps.

Changelog

Sourced from tzdata's changelog.

Version 2026.1

Upstream version 2026a released 2026-03-02T06:59:49+00:00

Briefly:

Moldova has used EU transition times since 2022. The "right" TZif files are no longer installed by default. -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. TZif files are no longer limited to 50 bytes of abbreviations. zic is no longer limited to 50 leap seconds. Several integer overflow bugs have been fixed.

Changes to past and future timestamps

Since 2022 Moldova has observed EU transition times, that is, it has sprung forward at 03:00, not 02:00, and has fallen back at 04:00, not 03:00. (Thanks to Heitor David Pinto.)

Changes to data

Remove Europe/Chisinau from zonenow.tab, as it now agrees with Europe/Athens for future timestamps.

Commits

Updates uvicorn from 0.42.0 to 0.43.0

Release notes

Sourced from uvicorn's releases.

Version 0.43.0

Changed

  • Emit http.disconnect ASGI receive() event on server shutting down for streaming responses (#2829)
  • Use native context parameter for create_task on Python 3.11+ (#2859)
  • Drop cast in ASGI types (#2875)

Full Changelog: Kludex/uvicorn@0.42.0...0.43.0

Changelog

Sourced from uvicorn's changelog.

0.43.0 (April 3, 2026)

You can quit Uvicorn now. We heard you, @​pamelafox - all 47 of your Ctrl+C's (thanks for flagging it, and thanks to @​tiangolo for the fix 🙏). See the tweet.

Changed

  • Emit http.disconnect ASGI receive() event on server shutting down for streaming responses (#2829)
  • Use native context parameter for create_task on Python 3.11+ (#2859)
  • Drop cast in ASGI types (#2875)
Commits

Updates werkzeug from 3.1.7 to 3.1.8

Release notes

Sourced from werkzeug's releases.

3.1.8

This is the Werkzeug 3.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.8/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-8 Milestone: https://github.com/pallets/werkzeug/milestone/45?closed=1

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. #3142
Changelog

Sourced from werkzeug's changelog.

Version 3.1.8

Released 2026-04-02

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. :issue:3142
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the training-dependencies group
37630a4 
Bumps the training-dependencies group in /training/rl with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `4.2.3` | `4.3.0` |
| [azure-monitor-opentelemetry-exporter](https://github.com/Azure/azure-sdk-for-python) | `1.0.0b49` | `1.0.0b50` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.6` | `3.4.7` |
| [click](https://github.com/pallets/click) | `8.3.1` | `8.3.2` |
| [cuda-pathfinder](https://github.com/NVIDIA/cuda-python) | `1.5.0` | `1.5.1` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.135.2` | `0.135.3` |
| [orjson](https://github.com/ijl/orjson) | `3.11.7` | `3.11.8` |
| [pandas](https://github.com/pandas-dev/pandas) | `3.0.1` | `3.0.2` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |
| [pydantic-core](https://github.com/pydantic/pydantic-core) | `2.44.0` | `2.45.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.48` | `2.0.49` |
| [tzdata](https://github.com/python/tzdata) | `2025.3` | `2026.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.42.0` | `0.43.0` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.7` | `3.1.8` |


Updates `marshmallow` from 4.2.3 to 4.3.0
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.2.3...4.3.0)

Updates `azure-monitor-opentelemetry-exporter` from 1.0.0b49 to 1.0.0b50
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-monitor-opentelemetry-exporter_1.0.0b49...azure-monitor-opentelemetry-exporter_1.0.0b50)

Updates `charset-normalizer` from 3.4.6 to 3.4.7
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.6...3.4.7)

Updates `click` from 8.3.1 to 8.3.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst)
- [Commits](pallets/click@8.3.1...8.3.2)

Updates `cuda-pathfinder` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/NVIDIA/cuda-python/releases)
- [Commits](NVIDIA/cuda-python@cuda-pathfinder-v1.5.0...cuda-pathfinder-v1.5.1)

Updates `fastapi` from 0.135.2 to 0.135.3
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.135.2...0.135.3)

Updates `orjson` from 3.11.7 to 3.11.8
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.11.7...3.11.8)

Updates `pandas` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.1...v3.0.2)

Updates `pillow` from 12.1.1 to 12.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.1.1...12.2.0)

Updates `pydantic-core` from 2.44.0 to 2.45.0
- [Release notes](https://github.com/pydantic/pydantic-core/releases)
- [Commits](https://github.com/pydantic/pydantic-core/commits)

Updates `sqlalchemy` from 2.0.48 to 2.0.49
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `tzdata` from 2025.3 to 2026.1
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2025.3...2026.1)

Updates `uvicorn` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.42.0...0.43.0)

Updates `werkzeug` from 3.1.7 to 3.1.8
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.7...3.1.8)

---
updated-dependencies:
- dependency-name: marshmallow
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: azure-monitor-opentelemetry-exporter
  dependency-version: 1.0.0b50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: click
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: cuda-pathfinder
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: fastapi
  dependency-version: 0.135.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: orjson
  dependency-version: 3.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: pandas
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: pillow
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: pydantic-core
  dependency-version: 2.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.0.49
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: tzdata
  dependency-version: '2026.1'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: training-dependencies
- dependency-name: uvicorn
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: werkzeug
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency version updates python Pull requests that update python code training labels Apr 6, 2026
@github-actions github-actions Bot changed the title chore(deps): bump the training-dependencies group in /training/rl with 14 updates security(deps): bump the training-dependencies group in /training/rl with 14 updates Apr 6, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 6, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 13 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 225ecd6.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

training/rl/pyproject.toml

PackageVersionLicenseIssue Type
marshmallow>= 3.5,< 4.4.0NullUnknown License

training/rl/requirements.txt

PackageVersionLicenseIssue Type
charset-normalizer3.4.7NullUnknown License
click8.3.2NullUnknown License
cuda-pathfinder1.5.1NullUnknown License
fastapi0.135.3NullUnknown License
marshmallow4.3.0NullUnknown License
orjson3.11.8NullUnknown License
pandas3.0.2NullUnknown License
pillow12.2.0NullUnknown License
sqlalchemy2.0.49NullUnknown License
uvicorn0.43.0NullUnknown License
werkzeug3.1.8NullUnknown License
tzdata2026.1NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/marshmallow >= 3.5,< 4.4.0 UnknownUnknown
pip/azure-monitor-opentelemetry-exporter 1.0.0b50 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices🟢 5badge detected: Passing
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 8binaries present in source code
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
pip/charset-normalizer 3.4.7 UnknownUnknown
pip/click 8.3.2 UnknownUnknown
pip/cuda-pathfinder 1.5.1 UnknownUnknown
pip/fastapi 0.135.3 UnknownUnknown
pip/marshmallow 4.3.0 UnknownUnknown
pip/orjson 3.11.8 UnknownUnknown
pip/pandas 3.0.2 UnknownUnknown
pip/pillow 12.2.0 UnknownUnknown
pip/pydantic-core 2.45.0 UnknownUnknown
pip/sqlalchemy 2.0.49 UnknownUnknown
pip/tzdata 2026.1 🟢 5.2
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 7Found 16/22 approved changesets -- score normalized to 7
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/uvicorn 0.43.0 UnknownUnknown
pip/werkzeug 3.1.8 UnknownUnknown

Scanned Files

  • training/rl/pyproject.toml
  • training/rl/requirements.txt

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 6, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.46%. Comparing base (176d9c9) to head (225ecd6).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #394   +/-   ##
=======================================
  Coverage   50.46%   50.46%           
=======================================
  Files         267      267           
  Lines       18098    18098           
  Branches     1903     1855   -48     
=======================================
  Hits         9134     9134           
  Misses       8674     8674           
  Partials      290      290
Flag Coverage Δ *Carryforward flag
pester 81.96% <ø> (ø)
pytest 6.89% <ø> (ø) Carriedforward from 37630a4
pytest-dataviewer 61.97% <ø> (ø)
vitest 50.72% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@WilliamBerryiii WilliamBerryiii merged commit acfe20d into main Apr 6, 2026
29 checks passed
@WilliamBerryiii WilliamBerryiii deleted the dependabot/pip/training/rl/training-dependencies-5f55c3f85b branch April 6, 2026 22:01
WilliamBerryiii added a commit that referenced this pull request Apr 7, 2026
@WilliamBerryiii
fix(build): resolve merge conflict in training/rl/pyproject.toml
519811e 
- keep equality-pinned versions over Dependabot range operators from #394

🔀 - Generated by Copilot
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamBerryiii WilliamBerryiii WilliamBerryiii approved these changes

Assignees

No one assigned

Labels

dependencies Dependency version updates python Pull requests that update python code training

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @WilliamBerryiii