Skip to content

security(deps): bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates#566

Merged
bindsi merged 2 commits into
mainfrom
dependabot/uv/data-management/viewer/backend/dataviewer-backend-dependencies-5b19d53d70
Apr 27, 2026
Merged

security(deps): bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates#566
bindsi merged 2 commits into
mainfrom
dependabot/uv/data-management/viewer/backend/dataviewer-backend-dependencies-5b19d53d70

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates:

Package From To
fastapi 0.136.0 0.136.1
uvicorn[standard] 0.44.0 0.46.0
pyarrow 23.0.1 24.0.0
ruff 0.15.11 0.15.12
hypothesis 6.152.1 6.152.3
schemathesis 4.15.2 4.16.1
huggingface-hub 1.11.0 1.12.0
ultralytics 8.4.40 8.4.41

Updates fastapi from 0.136.0 to 0.136.1

Release notes

Sourced from fastapi's releases.

0.136.1

Upgrades

Internal

Commits

Updates uvicorn[standard] from 0.44.0 to 0.46.0

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.46.0

What's Changed

Full Changelog: Kludex/uvicorn@0.45.0...0.46.0

Version 0.45.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.44.0...0.45.0

Changelog

Sourced from uvicorn[standard]'s changelog.

0.46.0 (April 23, 2026)

Added

  • Support ws_max_size in wsproto implementation (#2915)
  • Support ws_ping_interval and ws_ping_timeout in wsproto implementation (#2916)

Changed

  • Use bytearray for incoming WebSocket message buffer in websockets-sansio (#2917)

0.45.0 (April 21, 2026)

Added

  • Add --reset-contextvars flag to isolate ASGI request context (#2912)
  • Accept os.PathLike for log_config (#2905)
  • Accept log_level strings case-insensitively (#2907)

Changed

  • Revert "Emit http.disconnect on server shutdown for streaming responses" (#2913)
  • Revert "Explicitly start ASGI run with empty context" (#2911)

Fixed

  • Preserve forwarded client ports in proxy headers middleware (#2903)
  • Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)
Commits
  • b224045 Version 0.46.0 (#2918)
  • 7375b5b Use bytearray for incoming WebSocket message buffer in websockets-sansio (#...
  • d438fb1 Support ws_ping_interval and ws_ping_timeout in wsproto implementation ...
  • 3e6b964 Support ws_max_size in wsproto implementation (#2915)
  • 2c423bd Version 0.45.0 (#2914)
  • 7f027f8 Revert "Emit http.disconnect on server shutdown for streaming responses" (#...
  • 73a80c3 Add --reset-contextvars flag to isolate ASGI request context (#2912)
  • 45c0b56 Revert empty context for ASGI runs (#2911)
  • 850d926 Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)
  • fdcacb4 Accept log_level strings case-insensitively (#2907)
  • Additional commits viewable in compare view

Updates pyarrow from 23.0.1 to 24.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 24.0.0

Release Notes URL: https://arrow.apache.org/release/24.0.0.html

Apache Arrow 24.0.0 RC0

Release Notes: Release Candidate: 24.0.0 RC0

Commits
  • 31b4b6c MINOR: [Release] Update versions for 24.0.0
  • 06dbc17 MINOR: [Release] Update .deb/.rpm changelogs for 24.0.0
  • a021d80 MINOR: [Release] Update CHANGELOG.md for 24.0.0
  • 2d6b12c GH-49716: [C++] FixedShapeTensorType::Deserialize should strictly validate se...
  • a74cb6a GH-49697: [C++][CI] Check IPC file body bounds are in sync with decoder outco...
  • 871a0c6 GH-49676: [Python][Packaging] Fix gRPC docker image layer being too big for h...
  • f9203b3 GH-49586: [C++][CI] StructToStructSubset test failure with libc++ 22.1.1 (#49...
  • fe298b4 GH-49628: [Python][Interchange protocol] Suppress warnings for pandas 4.0.0 a...
  • 1f94910 GH-49252: [GLib] Deprecate Feather features (#49673)
  • 5ba5c3c GH-49671: [CI][Docs] Don't run jobs for push by Dependabot (#49672)
  • Additional commits viewable in compare view

Updates ruff from 0.15.11 to 0.15.12

Release notes

Sourced from ruff's releases.

0.15.12

Release Notes

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Install ruff 0.15.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.12

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Commits
  • 66f93cf Bump 0.15.12 (#24815)
  • 476a4d0 [ty] Complete support for more detailed diagnostics on possibly unbound error...
  • ed669ea Implement #ruff:file-ignore file-level suppressions (#23599)
  • e73d952 [ty] Include inferred type in invalid-key concise diagnostic for union/inte...
  • 80feb29 [ty] report only dead annotation-only locals as unused (#24811)
  • 0fbf2bc Drop deprecated license classifier (#24808)
  • 43b174c [ty] Infer lambda parameter types with Callable type context (#24317)
  • 4f449ae [ty] Add error context for intersection types (#24772)
  • 5b4e753 [ty] Add support for goto in literal enum member inlay hint (#24792)
  • e7cc762 [ty] Add error context for TypedDict assignments (#24790)
  • Additional commits viewable in compare view

Updates hypothesis from 6.152.1 to 6.152.3

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.3

The "hypothesis-urandom" backend now reads from "/dev/urandom" with buffering disabled, which improves the control of those hooking "/dev/urandom" to change or read Hypothesis's random decisions.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.2

This release further improves printing of generated values, building on the changes in version 6.151.11.

Principle changes:

  • In many cases where we would have printed a complex expression producing a value, we now print the repr (or a pretty-printed version of it).

  • Additionally, in some cases where we would print a complex expression that involved a lambda, we are now able to simplify that expression into a more readable one.

The canonical version of these notes (with links) is on readthedocs.

Commits
  • 609de04 Bump hypothesis-python version to 6.152.3 and update changelog
  • 902f1ba Merge pull request #4720 from Liam-DeVoe/urandom-disable-buffering
  • da81118 claude: open /dev/urandom with buffering=0 in URandomProvider
  • 80fada3 Merge pull request #4714 from HypothesisWorks/DRMacIver/uv
  • 634e2be Let tox auto-provision tox-uv instead of pinning it in tools.txt
  • 5265564 Seed pip into tox-uv envs
  • d6caeb8 Use uv instead of pyenv for build-time Python installs and tox
  • c727ead Bump hypothesis-python version to 6.152.2 and update changelog
  • 36d74b7 Merge pull request #4711 from HypothesisWorks/DRMacIver/is-code-owner
  • bbc8963 Merge pull request #4712 from HypothesisWorks/DRMacIver/fix-build
  • Additional commits viewable in compare view

Updates schemathesis from 4.15.2 to 4.16.1

Release notes

Sourced from schemathesis's releases.

Release 4.16.1

🐛 Fixed

  • auth API on LazySchema to match BaseSchema. #3797

Release 4.16.0

🚀 Added

  • schemathesis.openapi.require_security_scheme() for scoping auth providers to specific OpenAPI security schemes. #3745

🐛 Fixed

  • Query parameters not serialized when style/explode are omitted from the spec, ignoring OpenAPI 3.0 defaults.
  • Use the matching registered serializer for multipart fields with encoding.contentType. #3785
  • before_call hook setting a missing required header in the coverage phase had no effect. #3784
  • Request timeouts reported as a check failure when a replay made them flaky.

positive_data_acceptance false positives

  • example values violating constraints (examples phase):

    • When an object schema-level example has a property violating a nested format constraint (e.g. date-time without timezone).
    • When a parameter-level example value violates its declared schema type.
    • When a schema-level parameter example violates the parameter's own constraints (e.g. pattern).
    • When a response-derived parameter example violates the parameter's schema constraints.
    • When a response-derived parameter example violates the parameter's format constraint.
    • When a property example violates its field's own type (also applies to the coverage phase).
    • For content-encoded header parameters with object examples.
    • For property examples violating anyOf/oneOf constraints via bundled $refs.
    • For array body properties with minItems > 1 and object items.
    • When assembled body violates the schema (e.g. allOf with additionalProperties: false).
    • When a required property has an unsatisfiable schema.

  • Composition (allOf / oneOf / anyOf / $ref) in the coverage phase:

    • For oneOf branches with nested multi-$ref allOf.
    • For oneOf body schemas where generated values satisfy multiple branches simultaneously.
    • For oneOf body schemas where a branch requires fields only defined in the parent schema.
    • When an anyOf branch has const: null but a sibling type constraint excludes null.
    • When a multi-level allOf chain causes required properties from a base schema to be generated as null.
    • For body schemas with $ref + additionalProperties: false and pattern/minLength/maxLength constraints.

  • enum vs sibling constraints (coverage phase):

    • For required array properties with an unsatisfiable enum constraint.
    • For body properties where all enum values violate a sibling constraint (e.g. maxLength).
    • When an enum contains values violating the declared type (e.g. YAML-parsed false for type: string).
    • When enum contains values violating the declared type in template body generation.

  • Structural required / properties mismatches:

    • When a nested required field is unsatisfiable, making the parent object invalid (coverage phase).

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.16.1 - 2026-04-26

🐛 Fixed

  • auth API on LazySchema to match BaseSchema. #3797

4.16.0 - 2026-04-26

🚀 Added

  • schemathesis.openapi.require_security_scheme() for scoping auth providers to specific OpenAPI security schemes. #3745

🐛 Fixed

  • Query parameters not serialized when style/explode are omitted from the spec, ignoring OpenAPI 3.0 defaults.
  • Use the matching registered serializer for multipart fields with encoding.contentType. #3785
  • before_call hook setting a missing required header in the coverage phase had no effect. #3784
  • Request timeouts reported as a check failure when a replay made them flaky.

positive_data_acceptance false positives

  • example values violating constraints (examples phase):

    • When an object schema-level example has a property violating a nested format constraint (e.g. date-time without timezone).
    • When a parameter-level example value violates its declared schema type.
    • When a schema-level parameter example violates the parameter's own constraints (e.g. pattern).
    • When a response-derived parameter example violates the parameter's schema constraints.
    • When a response-derived parameter example violates the parameter's format constraint.
    • When a property example violates its field's own type (also applies to the coverage phase).
    • For content-encoded header parameters with object examples.
    • For property examples violating anyOf/oneOf constraints via bundled $refs.
    • For array body properties with minItems > 1 and object items.
    • When assembled body violates the schema (e.g. allOf with additionalProperties: false).
    • When a required property has an unsatisfiable schema.

  • Composition (allOf / oneOf / anyOf / $ref) in the coverage phase:

    • For oneOf branches with nested multi-$ref allOf.
    • For oneOf body schemas where generated values satisfy multiple branches simultaneously.
    • For oneOf body schemas where a branch requires fields only defined in the parent schema.
    • When an anyOf branch has const: null but a sibling type constraint excludes null.
    • When a multi-level allOf chain causes required properties from a base schema to be generated as null.
    • For body schemas with $ref + additionalProperties: false and pattern/minLength/maxLength constraints.

  • enum vs sibling constraints (coverage phase):

    • For required array properties with an unsatisfiable enum constraint.
    • For body properties where all enum values violate a sibling constraint (e.g. maxLength).
    • When an enum contains values violating the declared type (e.g. YAML-parsed false for type: string).
    • When enum contains values violating the declared type in template body generation.

  • Structural required / properties mismatches:

    • When a nested required field is unsatisfiable, making the parent object invalid (coverage phase).

... (truncated)

Commits
  • 99fb9b6 chore: Release 4.16.1
  • f0b7e3e fix: auth API on LazySchema to match BaseSchema
  • e23062c docs: Fix selective auth example
  • b1ec7b0 chore: Update pre-commit
  • b314cb4 build: Remove unneeded files from source distribution
  • 2edad15 chore: Release 4.16.0
  • 07d749e fix: Query parameters not serialized when style/explode are omitted from ...
  • 71a1b8e test: Add more tests
  • 5b6308c fix: Request timeouts reported as a check failure when a replay made them flaky
  • a37cd2c fix: False positive in negative_data_rejection for `application/x-www-form-...
  • Additional commits viewable in compare view

Updates huggingface-hub from 1.11.0 to 1.12.0

Release notes

Sourced from huggingface-hub's releases.

[v1.12.0] Unified CLI output, bucket search, and more

🖥️ Unified output format for hf buckets commands

All hf buckets commands now use the unified --format [auto|human|agent|json|quiet] flag and the out singleton for consistent, scriptable output. The previous --quiet and --format table|json flags have been replaced by a single --format option that works across create, list, info, delete, rm, move, and cp. Success messages use out.result(), detail views use out.dict(), and listings use out.table() with proper empty-results handling — making the buckets CLI consistent with the rest of the hf command suite.

# Quiet mode: print only bucket IDs
hf buckets list --format quiet
JSON output for scripting
hf buckets create my-bucket --format json
Agent-friendly structured output
hf buckets info username/my-bucket --format agent

📚 Documentation: Buckets guide · CLI guide

🪣 Search buckets by name

You can now filter buckets by name when listing them, both from the Python API and the CLI. Pass search="checkpoint" to list_buckets() or --search "checkpoint" to hf buckets list to find buckets matching a name pattern, without having to list and filter client-side.

# Filter buckets by name
hf buckets list --search "checkpoint"
# Filter buckets by name in Python
for bucket in list_buckets(search="checkpoint"):
    print(bucket.id)

📚 Documentation: Buckets guide · CLI guide

🖥️ CLI

🐛 Bug and typo fixes

🔧 Other QoL Improvements

... (truncated)

Commits
  • 16dd546 Release: v1.12.0
  • 43c20f4 Release: v1.12.0.rc1
  • a9a4ef8 Release: v1.12.0.rc0
  • 9104623 Apply fsspec config in HfFileSystem metaclass (#4062)
  • c3b04aa chore: bump doc-builder SHA for main doc build workflow (#4137)
  • 871f54e [HfApi] Add mainSize to ExpandDatasetProperty_T (#4136)
  • 50444e5 [Release] Add social media draft generation to release workflow (#4132)
  • 6e9e383 [Buckets] Skip local walk for download sync without delete (#4123)
  • f1cd149 [CLI] Migrate buckets commands to out singleton (#4111)
  • 50013bd [Buckets] Add search param to list_buckets (#4130)
  • Additional commits viewable in compare view

Updates ultralytics from 8.4.40 to 8.4.41

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dataviewer-backend-dependencies group
b5a832a 
Bumps the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.0` | `0.136.1` |
| [uvicorn[standard]](https://github.com/Kludex/uvicorn) | `0.44.0` | `0.46.0` |
| [pyarrow](https://github.com/apache/arrow) | `23.0.1` | `24.0.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.11` | `0.15.12` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.152.1` | `6.152.3` |
| [schemathesis](https://github.com/schemathesis/schemathesis) | `4.15.2` | `4.16.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.11.0` | `1.12.0` |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.40` | `8.4.41` |


Updates `fastapi` from 0.136.0 to 0.136.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.0...0.136.1)

Updates `uvicorn[standard]` from 0.44.0 to 0.46.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.44.0...0.46.0)

Updates `pyarrow` from 23.0.1 to 24.0.0
- [Release notes](https://github.com/apache/arrow/releases)
- [Commits](apache/arrow@apache-arrow-23.0.1...apache-arrow-24.0.0)

Updates `ruff` from 0.15.11 to 0.15.12
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.11...0.15.12)

Updates `hypothesis` from 6.152.1 to 6.152.3
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@hypothesis-python-6.152.1...hypothesis-python-6.152.3)

Updates `schemathesis` from 4.15.2 to 4.16.1
- [Release notes](https://github.com/schemathesis/schemathesis/releases)
- [Changelog](https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md)
- [Commits](schemathesis/schemathesis@v4.15.2...v4.16.1)

Updates `huggingface-hub` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.11.0...v1.12.0)

Updates `ultralytics` from 8.4.40 to 8.4.41
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.40...v8.4.41)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.136.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: uvicorn[standard]
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
- dependency-name: pyarrow
  dependency-version: 24.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dataviewer-backend-dependencies
- dependency-name: ruff
  dependency-version: 0.15.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: hypothesis
  dependency-version: 6.152.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: schemathesis
  dependency-version: 4.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
- dependency-name: huggingface-hub
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
- dependency-name: ultralytics
  dependency-version: 8.4.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dataviewer dependencies Dependency version updates python Pull requests that update python code labels Apr 27, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 27, 2026 03:34
@dependabot dependabot Bot added dataviewer dependencies Dependency version updates python Pull requests that update python code labels Apr 27, 2026
@github-actions github-actions Bot changed the title chore(deps): bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates security(deps): bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates Apr 27, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 8 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 788de5a.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

data-management/viewer/backend/uv.lock

PackageVersionLicenseIssue Type
fastapi0.136.1NullUnknown License
hypothesis6.152.3NullUnknown License
jsonschema-rs0.46.2NullUnknown License
pyarrow24.0.0NullUnknown License
ruff0.15.12NullUnknown License
schemathesis4.16.1NullUnknown License
ultralytics8.4.41NullUnknown License
uvicorn0.46.0NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
pip/fastapi 0.136.1 UnknownUnknown
pip/huggingface-hub 1.12.0 🟢 6.2
Details
CheckScoreReason
Code-Review🟢 9Found 27/29 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
pip/hypothesis 6.152.3 UnknownUnknown
pip/jsonschema-rs 0.46.2 UnknownUnknown
pip/pyarrow 24.0.0 UnknownUnknown
pip/ruff 0.15.12 UnknownUnknown
pip/schemathesis 4.16.1 UnknownUnknown
pip/ultralytics 8.4.41 UnknownUnknown
pip/uvicorn 0.46.0 UnknownUnknown

Scanned Files

  • data-management/viewer/backend/uv.lock

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026 •
edited
Loading

✅ AW Dependabot PR Review completed successfully!

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 27, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.56%. Comparing base (a652dba) to head (788de5a).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #566      +/-   ##
==========================================
+ Coverage   63.91%   66.56%   +2.65%     
==========================================
  Files         250      262      +12     
  Lines       15409    16639    +1230     
  Branches     2122     2260     +138     
==========================================
+ Hits         9848    11076    +1228     
  Misses       5274     5274              
- Partials      287      289       +2
Flag Coverage Δ *Carryforward flag
pester 83.13% <ø> (ø) Carriedforward from b5a832a
pytest-data-pipeline 100.00% <ø> (ø) Carriedforward from b5a832a
pytest-dataviewer 65.12% <ø> (ø)
pytest-dm-tools 100.00% <ø> (ø) Carriedforward from b5a832a
pytest-evaluation 99.83% <ø> (?)
pytest-fuzz 4.97% <ø> (ø) Carriedforward from b5a832a
pytest-inference 0.00% <ø> (ø) Carriedforward from b5a832a
pytest-training 82.14% <ø> (ø) Carriedforward from b5a832a
vitest 51.08% <ø> (ø) Carriedforward from b5a832a

*This pull request uses carry forward flags. Click here to find out more.
see 12 files with indirect coverage changes

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions[bot]
github-actions Bot reviewed Apr 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Maintainer review recommended

Advisory Review Summary

Surfaces touched: python-runtime (uv ecosystem under data-management/viewer/backend/)
Manifests: data-management/viewer/backend/pyproject.toml (manifest) + data-management/viewer/backend/uv.lock (companion lockfile — not a transitive-only pin)

Package From To Severity Surface
fastapi 0.136.0 0.136.1 None identified python-runtime
uvicorn[standard] 0.44.0 0.46.0 None identified python-runtime
pyarrow 23.0.1 24.0.0 ⚠️ High-risk (major bump) python-runtime
ruff 0.15.11 0.15.12 None identified python-runtime (dev)
hypothesis 6.152.1 6.152.3 None identified python-runtime (dev)
schemathesis 4.15.2 4.16.1 None identified python-runtime (dev)
huggingface-hub 1.11.0 1.12.0 None identified python-runtime (optional)
ultralytics 8.4.40 8.4.41 None identified python-runtime (optional)

fastapi

uvicorn[standard]

  • No advisory identifiers; no GHSA/CVE found.
  • v0.46.0: WebSocket ws_max_size, ws_ping_interval, ws_ping_timeout support in wsproto implementation.
  • v0.45.0: Proxy headers middleware now preserves forwarded client ports; new --reset-contextvars flag; case-insensitive log_level strings; PyYAML-absent ImportError clarity.
  • Repo-specific note: The forwarded-port change in v0.45.0 may interact with slowapi rate-limiting if client identity is derived from proxy headers. Confirm key functions remain correct.
  • Source: Kludex/uvicorn@0.44.0...0.46.0

pyarrow

  • No explicit GHSA/CVE identifier cited in the PR body. Advisory enrichment via OSV/NVD could not be completed due to network restrictions in this environment; maintainers should independently verify at (osv.dev/redacted) and (arrow.apache.org/redacted)
  • v24.0.0 release notes: Full details at (arrow.apache.org/redacted) Commit range: apache/arrow@apache-arrow-23.0.1...apache-arrow-24.0.0
  • ⚠️ High-risk trigger: pyarrow is in the python-runtime ABI-sensitivity inventory for this repo. A major version increment (23 → 24) in Apache Arrow can introduce breaking Parquet/IPC serialization changes, C++ extension ABI shifts, and removed deprecated APIs. The data-viewer backend uses pyarrow as a runtime dependency.
  • Validation advice: Run ruff check and pytest tests/ in data-management/viewer/backend; validate that Parquet files produced by v23 consumers are still readable under v24.

ruff

hypothesis

schemathesis

huggingface-hub

ultralytics

Advisory verdict: COMMENT — pyarrow crosses a major version boundary (23 → 24), triggering the python-runtime high-risk flag; maintainers should validate ABI and Parquet/IPC data format compatibility before merging. All other seven packages are patch or minor bumps with no advisory identifiers identified.

Note

🔒 Integrity filter blocked 1 item

The following item was blocked because it doesn't meet the GitHub integrity level.

  • #566 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #566 · ● 1.5M

Comment thread data-management/viewer/backend/pyproject.toml
Comment thread data-management/viewer/backend/pyproject.toml
Comment thread data-management/viewer/backend/pyproject.toml
Comment thread data-management/viewer/backend/pyproject.toml
Comment thread data-management/viewer/backend/pyproject.toml
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026 •
edited
Loading

✅ AW Dependabot PR Review completed successfully!

@bindsi bindsi merged commit d6e7869 into main Apr 27, 2026
42 checks passed
@bindsi bindsi deleted the dependabot/uv/data-management/viewer/backend/dataviewer-backend-dependencies-5b19d53d70 branch April 27, 2026 07:57
@physical-ai-toolchain-release physical-ai-toolchain-release Bot mentioned this pull request Apr 27, 2026
Merged
github-actions[bot]
github-actions Bot reviewed Apr 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Maintainer review recommended

One high-risk signal fires: pyarrow major version bump (23.0.1 → 24.0.0) on the python-runtime surface — a surface that explicitly flags pyarrow as ABI-sensitive.

Advisory Review Summary

Ecosystems and surfaces touched:

  • Ecosystem: pip / uv
  • Surface: python-runtime — data-management/viewer/backend/
  • Manifests changed: data-management/viewer/backend/pyproject.toml, data-management/viewer/backend/uv.lock

No explicit GHSA or CVE identifiers were found in the Dependabot PR body. The security(deps): title prefix indicates Dependabot classified this update as security-relevant, but no advisory IDs were attached. External advisory APIs were unreachable from the review environment; all risk assessments below are based on version-range and surface analysis only.

Package Table

Package From To Severity Surface
pyarrow 23.0.1 24.0.0 ⚠️ High-risk (major bump) python-runtime
uvicorn[standard] 0.44.0 0.46.0 Low python-runtime
fastapi 0.136.0 0.136.1 Low python-runtime
schemathesis 4.15.2 4.16.1 Low python-runtime
huggingface-hub 1.11.0 1.12.0 Low python-runtime
ruff 0.15.11 0.15.12 None python-runtime (dev)
hypothesis 6.152.1 6.152.3 None python-runtime (dev)
ultralytics 8.4.40 8.4.41 None python-runtime

pyarrow

  • Bump: 23.0.1 → 24.0.0 (major version).
  • Surface trigger: pyarrow is explicitly listed as high-risk on the python-runtime surface due to Isaac Sim / CUDA ABI sensitivity and frequent API changes across major versions.
  • Risk: Apache Arrow major releases routinely include C++ ABI and Python API changes (schema inference, IPC, Parquet serialisation). Code paths that use pyarrow.Table, pyarrow.Schema, or pyarrow.parquet should be validated.
  • Validation advice: Run ruff check and the targeted pytest suite in data-management/viewer/backend/ before merging.
  • Source: Apache Arrow releases — no advisory ID in PR body.

uvicorn[standard]

  • Bump: 0.44.0 → 0.46.0 (skips one minor release).
  • Release highlights:
    • 0.45.0: Reverted http.disconnect emit on shutdown; new --reset-contextvars flag; proxy-header client-port fix.
    • 0.46.0: WebSocket buffer now uses bytearray; ws_max_size / ping interval/timeout added for wsproto.
  • Risk: The context-vars revert could affect request-isolation in streaming endpoints. Low overall risk.
  • Source: uvicorn release notes

fastapi

  • Bump: 0.136.0 → 0.136.1 (patch).
  • Release highlights: Updates Pydantic v2 code to address deprecations (#15101). Internal/doc changes only.
  • Risk: Negligible. Patch-only, no API changes.
  • Source: fastapi releases

schemathesis

  • Bump: 4.15.2 → 4.16.1 (minor).
  • Risk: Dev/test dependency only. No production impact.
  • Transitive lockfile note: jsonschema-rs is bumped 0.45.0 → 0.46.2 in uv.lock as a transitive dependency of schemathesis. This is a lockfile-only change with no direct manifest pin.

huggingface-hub

  • Bump: 1.11.0 → 1.12.0 (minor).
  • Risk: Low. Monitor for any cache-layout or download-API changes if the backend uses model hub endpoints.
  • Source: huggingface_hub releases

ruff

  • Bump: 0.15.11 → 0.15.12 (patch). Dev linting tool only. No runtime impact.

hypothesis

  • Bump: 6.152.1 → 6.152.3 (patch). Dev/test dependency only. No runtime impact.

ultralytics

  • Bump: 8.4.40 → 8.4.41 (patch). Minimal risk; patch-level update.

Transitive-only pin note

jsonschema-rs bumps 0.45.0 → 0.46.2 in uv.lock without a corresponding manifest change — this is a transitive-only lockfile pin pulled in by schemathesis. No direct action required.

Advisory verdict: COMMENT — pyarrow crosses a major version boundary on the python-runtime high-risk surface; maintainer validation via pytest in data-management/viewer/backend/ is recommended before merge.

Note

🔒 Integrity filter blocked 1 item

The following item was blocked because it doesn't meet the GitHub integrity level.

  • #566 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #566 · ● 809.7K

Comment thread data-management/viewer/backend/pyproject.toml
"fastapi==0.136.0",
"uvicorn[standard]==0.44.0",
"fastapi==0.136.1",
"uvicorn[standard]==0.46.0",
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two minor versions skipped (0.44.0 → 0.46.0)

uvicorn[standard] skips 0.45.0. Notable changes across both versions include:

  • 0.45.0: Reversed http.disconnect emit on shutdown (#2913 revert); added --reset-contextvars flag; proxy-header client-port preservation fix.
  • 0.46.0: WebSocket buffer switched to bytearray; ws_max_size / ws_ping_interval / ws_ping_timeout now supported in wsproto.

The context-vars revert in 0.45.0 could affect request-isolation behaviour in streaming endpoints. Verify streaming / WebSocket handlers after upgrade.

Source: uvicorn release notes

Comment thread data-management/viewer/backend/pyproject.toml
"hypothesis==6.152.1",
"schemathesis==4.15.2",
"hypothesis==6.152.3",
"schemathesis==4.16.1",
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

schemathesis bumped 4.15.2 → 4.16.1. The lockfile also bumps the transitive dependency jsonschema-rs from 0.45.0 → 0.46.2 — this is a lockfile-only transitive change (no direct manifest pin). No breaking changes are expected for this dev/test dependency, but validate with pytest in tests/.

Comment thread data-management/viewer/backend/pyproject.toml
]
huggingface = [
"huggingface-hub==1.11.0",
"huggingface-hub==1.12.0",
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

huggingface-hub bumped 1.11.0 → 1.12.0 (minor). No security advisories identified in the PR body. Monitor the HuggingFace Hub changelog for any changes to model-download or cache-layout APIs used by the backend.

Comment thread data-management/viewer/backend/pyproject.toml
"aiofiles==25.1.0",
"numpy==2.4.4",
"pyarrow==23.0.1",
"pyarrow==24.0.0",
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Major version bump — high-risk surface trigger

pyarrow is bumped from 23.0.1 to 24.0.0 (major version). pyarrow is explicitly listed as an ABI-sensitive dependency on the python-runtime surface for this repository.

Apache Arrow major releases commonly include breaking C++ ABI and Python API changes. Review the [Apache Arrow 24 migration guide]((arrow.apache.org/redacted) and verify that:

  • Any code using pyarrow APIs still functions correctly (schema inference, IPC, Parquet read/write).
  • No import-time or serialization errors occur after upgrade.

Validation: Run ruff check and the targeted pytest suite in data-management/viewer/backend/ before merging.

WilliamBerryiii pushed a commit that referenced this pull request May 8, 2026
@physical-ai-toolchain-release @github-actions
chore(main): release 0.8.0 (#450)
f906f37 
🤖 I have created a release *beep* *boop*
---


##
[0.8.0](v0.7.4...v0.8.0)
(2026-05-08)


### ⚠ BREAKING CHANGES

* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))

### ✨ Features

* **agents:** add automated validation for high-risk Dependabot bumps
([#574](#574))
([8c3686a](8c3686a)),
closes
[#573](#573)
* **data:** add camera selector to annotation workspace and fix AV1
frame extraction
([#591](#591))
([c809d2f](c809d2f))
* **data:** seed dataviewer frontend test foundation and per-section
codecov flags
([#594](#594))
([c06c4e3](c06c4e3))
* **dataviewer:** add OWASP security middleware stack
([#439](#439))
([239edb9](239edb9))
* **infrastructure:** add conversion pipeline Terraform module
([#542](#542))
([244531e](244531e))
* **infrastructure:** upgrade OSMO to chart 1.2.1 / image 6.2 with
secure auth and skrl 2.0.0 compatibility
([#492](#492))
([edfd7a5](edfd7a5))
* **pipeline:** add ACSA setup for ROS2 bag sync to Blob
([#451](#451))
([c271a54](c271a54))
* **workflows:** add advisory Dependabot PR reviewer agentic workflow
([#498](#498))
([d4bb140](d4bb140))
* **workflows:** trigger AW Dependabot PR reviewer after PR Validation
([#580](#580))
([7ab3d16](7ab3d16))


### 🐛 Bug Fixes

* **ci:** correct stale version comment for
actions/create-github-app-token
([#506](#506))
([b2e9a54](b2e9a54))
* **ci:** restore data-pipeline and training broken tests by domain
folder restructure
([#547](#547))
([06d8472](06d8472))
* **docs:** update remaining stale 'Coming soon' labels in
docs/README.md
([#507](#507))
([02439d6](02439d6))
* **docs:** update stale coming soon label for Training section
([#472](#472))
([46db49b](46db49b))
* **evaluation:** scope SIL AzureML validation code path and script
reference
([#387](#387))
([9f138a9](9f138a9))
* **infrastructure:** OSMO workflow execution, PostgreSQL public access,
and quickstart corrections
([#477](#477))
([9ed2da6](9ed2da6))
* **scripts:** exclude CHANGELOG.md from changed-files msdate check
([#644](#644))
([8133bdc](8133bdc))
* **workflows:** allow dependabot[bot] to activate AW Dependabot PR
Review
([#586](#586))
([39dc022](39dc022))
* **workflows:** correct branches filter on AW Dependabot PR Review
workflow_run trigger
([#584](#584))
([fe06b52](fe06b52))
* **workflows:** normalize validate.yaml placeholder env/compute values
([#510](#510))
([340ff44](340ff44))
* **workflows:** recompile aw-dependabot-pr-review lock file
([#576](#576))
([d77c167](d77c167))
* **workflows:** switch AW Dependabot PR Review to pull_request_target
([#589](#589))
([3f1edd1](3f1edd1))


### 📚 Documentation

* **docs:** Fix deployment guide links
([#614](#614))
([0070b04](0070b04))
* document dependency-pinning-artifacts directory purpose
([#508](#508))
([50e0010](50e0010))


### 📦 Build System

* **training:** standardize on Python 3.12 across manifests, containers,
and runtime scripts
([#541](#541))
([7ad014a](7ad014a))


### 🔧 Operations

* **build:** add Copilot cloud agent setup-steps workflow
([#593](#593))
([c912668](c912668))


### 🔧 Miscellaneous

* **build:** exclude auto-generated CHANGELOG.md from cspell and seed
dictionary
([#582](#582))
([de1dd57](de1dd57))
* **build:** redesign codecov flags and split pytest CI per component
([#520](#520))
([357e745](357e745))
* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))
([50f8ad4](50f8ad4))
* **dataviewer:** repoint stale src/dataviewer references to
data-management/viewer
([#504](#504))
([88fa1b4](88fa1b4)),
closes
[#503](#503)
* **deps-dev:** bump basic-ftp from 5.3.0 to 5.3.1
([#618](#618))
([ca10f2a](ca10f2a))
* **deps-dev:** bump globals from 15.15.0 to 17.5.0 in
/data-management/viewer/frontend
([#527](#527))
([0e0b2ae](0e0b2ae))
* **deps-dev:** bump ip-address from 10.1.0 to 10.2.0
([#616](#616))
([816c9cf](816c9cf))
* **deps-dev:** bump lint-staged from 16.4.0 to 17.0.2 in the
root-npm-dependencies group across 1 directory
([#626](#626))
([0e2f293](0e2f293))
* **deps-dev:** bump pydantic from 2.13.3 to 2.13.4 in the
python-dependencies group across 1 directory
([#629](#629))
([c24f1c1](c24f1c1))
* **deps-dev:** bump the python-dependencies group across 1 directory
with 2 updates
([#514](#514))
([8410f4b](8410f4b))
* **deps:** bump azure-core from 1.39.0 to 1.40.0 in /evaluation in the
inference-dependencies group across 1 directory
([#597](#597))
([6141db4](6141db4))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer
([#424](#424))
([5fb6d58](5fb6d58))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer/backend
([#423](#423))
([b516ad5](b516ad5))
* **deps:** bump lucide-react from 0.469.0 to 1.8.0 in
/data-management/viewer/frontend
([#528](#528))
([1bdfc1e](1bdfc1e))
* **deps:** bump nginx from `8aa63af` to `5616878` in
/data-management/viewer/frontend
([#511](#511))
([9e7e20e](9e7e20e))
* **deps:** bump nginx from 1.27-alpine to 1.29-alpine in
/data-management/viewer/frontend
([#484](#484))
([0e5c3dd](0e5c3dd))
* **deps:** bump node from `435f353` to `e49fd70` in
/data-management/viewer/frontend
([#560](#560))
([2884649](2884649))
* **deps:** bump react-is from 18.3.1 to 19.2.5 in
/data-management/viewer/frontend
([#530](#530))
([d51318c](d51318c))
* **deps:** bump tensordict from 0.11.0 to 0.12.1 in /evaluation in the
inference-dependencies group across 1 directory
([#456](#456))
([b24e733](b24e733))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 2 updates
([#531](#531))
([171a1da](171a1da))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#516](#516))
([4f9a577](4f9a577))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#602](#602))
([6c27ab5](6c27ab5))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 2 updates
([#529](#529))
([8646971](8646971))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#601](#601))
([d28fb50](d28fb50))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#632](#632))
([4ca5f3e](4ca5f3e))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#515](#515))
([109ee81](109ee81))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 6 updates
([#630](#630))
([04d5dfd](04d5dfd))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 9 updates
([#563](#563))
([c08f450](c08f450))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 4 updates
([#627](#627))
([f5825fc](f5825fc))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 6 updates
([#599](#599))
([b859344](b859344))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#459](#459))
([2609c52](2609c52))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#517](#517))
([f54bf5d](f54bf5d))
* **deps:** bump the inference-dependencies group across 1 directory
with 11 updates
([#562](#562))
([087f53a](087f53a))
* **deps:** bump the inference-dependencies group across 1 directory
with 2 updates
([#628](#628))
([4a3be47](4a3be47))
* **deps:** bump the pip group across 2 directories with 1 update
([#494](#494))
([a14b6b0](a14b6b0))
* **docs:** update stale Python 3.11 references to 3.12
([#575](#575))
([6f85c95](6f85c95))
* **scripts:** remove redundant SC1091 disables in OSMO deploy scripts
([#509](#509))
([ae1cb82](ae1cb82))


### 🔒 Security

* **build:** pin dependencies and hash-verify downloads
([#465](#465))
([0289f49](0289f49))
* **build:** remediate dependency security advisories
([#479](#479))
([7196d6d](7196d6d))
* **deps-dev:** bump basic-ftp from 5.2.1 to 5.2.2
([#454](#454))
([cb158f1](cb158f1))
* **deps-dev:** bump basic-ftp from 5.2.2 to 5.3.0
([#495](#495))
([e983b8b](e983b8b))
* **deps-dev:** bump hypothesis from 6.152.3 to 6.152.4 in the
python-dependencies group
([#598](#598))
([83384d2](83384d2))
* **deps-dev:** bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the
root-npm-dependencies group
([#559](#559))
([32bde35](32bde35))
* **deps-dev:** bump picomatch from 2.3.1 to 2.3.2 in /docs/docusaurus
([#455](#455))
([66f86ca](66f86ca))
* **deps-dev:** bump postcss from 8.5.10 to 8.5.12 in
/data-management/viewer/frontend
([#569](#569))
([a652dba](a652dba))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#457](#457))
([749d231](749d231))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#485](#485))
([71b44fd](71b44fd))
* **deps-dev:** bump the python-dependencies group with 3 updates
([#564](#564))
([9fc52fd](9fc52fd))
* **deps-dev:** bump typescript from 6.0.2 to 6.0.3 in /docs/docusaurus
in the docusaurus-dependencies group
([#513](#513))
([5694dbc](5694dbc))
* **deps:** bump azureml/openmpi4.1.0-ubuntu22.04 from 20260303.v5 to
20260409.v4 in /evaluation/sil/docker
([#480](#480))
([25d4df8](25d4df8))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in /evaluation in
the uv group across 1 directory
([#538](#538))
([92c5b2e](92c5b2e))
* **deps:** bump diffusers from 0.35.2 to 0.38.0 in /training/il/lerobot
([#638](#638))
([6261d19](6261d19))
* **deps:** bump follow-redirects from 1.15.11 to 1.16.0 in
/docs/docusaurus
([#469](#469))
([0458908](0458908))
* **deps:** bump gitpython and mako for lerobot IL training
([#623](#623))
([9f8022b](9f8022b))
* **deps:** bump node from 24.14.1-slim to 25.9.0-slim in
/data-management/viewer/frontend
([#482](#482))
([1532d09](1532d09))
* **deps:** bump packaging from 26.0 to 26.1 in /evaluation in the
inference-dependencies group
([#483](#483))
([f4afb6c](f4afb6c))
* **deps:** bump pillow from 12.1.1 to 12.2.0
([#467](#467))
([39fb663](39fb663))
* **deps:** bump python from 3.11-slim to 3.14-slim in
/data-management/viewer/backend
([#481](#481))
([7af9dfc](7af9dfc))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 15 updates
([#428](#428))
([e4446a2](e4446a2))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 4 updates
([#487](#487))
([0f57c5b](0f57c5b))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 8 updates
([#566](#566))
([d6e7869](d6e7869))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#464](#464))
([24c208d](24c208d))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 2 updates
([#486](#486))
([90149f3](90149f3))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 6 updates
([#565](#565))
([f0bb36b](f0bb36b))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 10 updates
([#613](#613))
([e481f83](e481f83))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#534](#534))
([5478ab6](5478ab6))
* **deps:** bump the github-actions group with 2 updates
([#488](#488))
([4e6ce98](4e6ce98))
* **deps:** bump the github-actions group with 3 updates
([#567](#567))
([48c38dc](48c38dc))
* **deps:** bump the github-actions group with 3 updates
([#634](#634))
([00cfb49](00cfb49))
* **deps:** bump the github-actions group with 6 updates
([#603](#603))
([73eb79a](73eb79a))
* **deps:** bump the training-dependencies group across 1 directory with
23 updates
([#463](#463))
([d5a8656](d5a8656))
* **deps:** bump yaml from 2.8.2 to 2.8.3 in
/data-management/viewer/frontend
([#453](#453))
([10449df](10449df))
* pytest harness, dependabot advisories, and OSSF Scorecard remediations
([#501](#501))
([e8756e8](e8756e8))
* **scripts:** pin and hash-verify all shell script downloads
([#468](#468))
([0c2bb9c](0c2bb9c))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: physical-ai-toolchain-release[bot] <267194360+physical-ai-toolchain-release[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

@bindsi bindsi bindsi approved these changes

Assignees

No one assigned

Labels

dataviewer dependencies Dependency version updates python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @bindsi