chore(deps): bump the dataviewer-backend-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the dataviewer-backend-dependencies group with 5 updates in the /data-management/viewer/backend directory:

Package	From	To
python-multipart	0.0.26	0.0.27
hypothesis	6.152.3	6.152.4
schemathesis	4.16.1	4.17.0
huggingface-hub	1.12.0	1.13.0
ultralytics	8.4.41	8.4.46

Updates python-multipart from 0.0.26 to 0.0.27

Release notes

Sourced from python-multipart's releases.

0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

Commits

• 6d1d689 Version 0.0.27 (#272)
• 0b10220 Run CI on main branch pull requests (#271)
• 3e64f5f Add multipart header limits (#267)
• eb109cc Pass parse offsets via constructors (#268)
• 78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
• b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
• See full diff in compare view

Updates hypothesis from 6.152.3 to 6.152.4

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.4

This patch fixes a rare internal error during "Phase.explain" introduced in version 6.149.0 for certain strategies (issue #4708).

The canonical version of these notes (with links) is on readthedocs.

Commits

• 84f92dc Bump hypothesis-python version to 6.152.4 and update changelog
• c6814df Merge pull request #4717 from HypothesisWorks/DRMacIver/issue4708
• 82e9446 Address PR review feedback
• c77d7e7 Merge pull request #4719 from Liam-DeVoe/fix-mobile-word-wrapping
• 4d6a7f0 fix footnote overflow on mobile
• 4b554b0 Fix AssertionError in Shrinker.explain() for unstable span labels
• See full diff in compare view

Updates schemathesis from 4.16.1 to 4.17.0

Release notes

Sourced from schemathesis's releases.

Release 4.17.0

🚀 Added

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing.
• Capture request-body field values from successful 2xx requests for reuse during fuzzing.
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases.
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase.
• Use captured body-field values to fill resource-bound fields in the examples phase.
• Enable the runtime resource pool for producers that return empty response bodies.
• Chain st fuzz scenarios via inferred and schema Links, biased 80% toward link-driven steps.
• Pick correlated identifiers for nested-resource operations during the coverage phase.
• Dependency inference recognizes <resource>Name-style body fields on collection paths (e.g. POST /products {productName: ...}).
• Dependency inference recognizes more identifier-style path parameters (e.g. username, containerGroupName).
• Dependency inference treats POST /resource/{name} as a producer when the response has no body.
• Dependency inference treats POST /collection {idField: ...} as a producer when the response has no body.
• Dependency inference recognizes GET /collection returning an array of identifier strings.
• Dependency inference recognizes plural {ids} path parameters (e.g. GET /persons/{ids}).
• Seed the runtime resource pool with identifier values from a Bearer JWT or HTTP Basic username.

🐛 Fixed

• False positive negative_data_rejection for body-level type mutations on multipart/form-data endpoints. #3801
• False positive negative_data_rejection for body fields with format: binary or format: byte.
• Crash on schemas with non-schema values inside properties (e.g. an integer where a sub-schema is expected).
• Cascading generation failures after one schema corrupted shared hypothesis-jsonschema constants in the same process.
• Crash on $ref with sibling keywords when exploring the Python API outside the pytest runner.
• HypothesisRefResolutionError when a $ref and its target both have distinct anyOf lists.
• Report malformed sub-schemas (e.g. description: null) as a clean schema error.
• Unsatisfiable for arrays with allOf of multiple contains requiring distinct const values.
• Operation scheduling respects RESTful method priority even when all operations collapse into one layer.
• Draft-03 schemas surface as a clean InvalidSchema instead of a generic InvalidArgument from the strategy generator.
• False InfiniteRecursiveReference on cycles breakable through patternProperties.
• False InfiniteRecursiveReference on cycles breakable through oneOf/anyOf, top-level allOf, or unused definitions.
• False positives from \p{X} Unicode property escapes inside character classes (e.g. [\p{Alnum}_]+).
• Translate POSIX character classes (e.g. [[:alnum:]_]) to Python equivalents instead of misparsing them.
• Silent character-set widening when \p{X} patterns combine with PCRE class-set operators (||, &&) or nested classes.
• Runtime Error in negative generation for OpenAPI 3.1 schemas with prefixItems. #3842
• Honor discriminator pin in oneOf/anyOf validation under Draft 4 (OpenAPI 2.0/3.0).
• Spurious FlakyStrategyDefinition from st fuzz when the time limit trips mid-scenario.
• Crash in the examples phase when a body example contained format: binary data alongside captured pool values.
• Resource-pool variants for path/query/header parameters skip values that violate the destination schema.
• Bodies missing required fields when a captured value is overlaid on a schema without type: object.
• Boolean path parameters rewritten to integer 1 when the path also contains an integer parameter.
• Examples violating their own schema surfacing as POSITIVE generation cases.
• Duplicate required header entries when a spec parameter and a security scheme share a header name.
• NDJSON reports truncated after the first event from a threaded requests import race in the writer.

🔧 Changed

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.17.0 - 2026-04-30

🚀 Added

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing.
• Capture request-body field values from successful 2xx requests for reuse during fuzzing.
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases.
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase.
• Use captured body-field values to fill resource-bound fields in the examples phase.
• Enable the runtime resource pool for producers that return empty response bodies.
• Chain st fuzz scenarios via inferred and schema Links, biased 80% toward link-driven steps.
• Pick correlated identifiers for nested-resource operations during the coverage phase.
• Dependency inference recognizes <resource>Name-style body fields on collection paths (e.g. POST /products {productName: ...}).
• Dependency inference recognizes more identifier-style path parameters (e.g. username, containerGroupName).
• Dependency inference treats POST /resource/{name} as a producer when the response has no body.
• Dependency inference treats POST /collection {idField: ...} as a producer when the response has no body.
• Dependency inference recognizes GET /collection returning an array of identifier strings.
• Dependency inference recognizes plural {ids} path parameters (e.g. GET /persons/{ids}).
• Seed the runtime resource pool with identifier values from a Bearer JWT or HTTP Basic username.

🐛 Fixed

• False positive negative_data_rejection for body-level type mutations on multipart/form-data endpoints. #3801
• False positive negative_data_rejection for body fields with format: binary or format: byte.
• Crash on schemas with non-schema values inside properties (e.g. an integer where a sub-schema is expected).
• Cascading generation failures after one schema corrupted shared hypothesis-jsonschema constants in the same process.
• Crash on $ref with sibling keywords when exploring the Python API outside the pytest runner.
• HypothesisRefResolutionError when a $ref and its target both have distinct anyOf lists.
• Report malformed sub-schemas (e.g. description: null) as a clean schema error.
• Unsatisfiable for arrays with allOf of multiple contains requiring distinct const values.
• Operation scheduling respects RESTful method priority even when all operations collapse into one layer.
• Draft-03 schemas surface as a clean InvalidSchema instead of a generic InvalidArgument from the strategy generator.
• False InfiniteRecursiveReference on cycles breakable through patternProperties.
• False InfiniteRecursiveReference on cycles breakable through oneOf/anyOf, top-level allOf, or unused definitions.
• False positives from \p{X} Unicode property escapes inside character classes (e.g. [\p{Alnum}_]+).
• Translate POSIX character classes (e.g. [[:alnum:]_]) to Python equivalents instead of misparsing them.
• Silent character-set widening when \p{X} patterns combine with PCRE class-set operators (||, &&) or nested classes.
• Runtime Error in negative generation for OpenAPI 3.1 schemas with prefixItems. #3842
• Honor discriminator pin in oneOf/anyOf validation under Draft 4 (OpenAPI 2.0/3.0).
• Spurious FlakyStrategyDefinition from st fuzz when the time limit trips mid-scenario.
• Crash in the examples phase when a body example contained format: binary data alongside captured pool values.
• Resource-pool variants for path/query/header parameters skip values that violate the destination schema.
• Bodies missing required fields when a captured value is overlaid on a schema without type: object.
• Boolean path parameters rewritten to integer 1 when the path also contains an integer parameter.
• Examples violating their own schema surfacing as POSITIVE generation cases.
• Duplicate required header entries when a spec parameter and a security scheme share a header name.
• NDJSON reports truncated after the first event from a threaded requests import race in the writer.

🔧 Changed

... (truncated)

Commits

• 5662c32 chore: Release 4.17.0
• 6767844 test: Update inference metrics
• 7cd1963 test: Show more context on snapshot mismatches for st fuzz
• c6120f2 feat: Dependency inference recognizes plural {ids} path parameters
• 2cdff14 fix: False positive negative_data_rejection for body fields with `format: b...
• cdc04f9 test: Skip influxdata.com/2.0.0.json in corpus tests
• 3270d87 fix: Honor discriminator pin in oneOf/anyOf validation under Draft 4 (O...
• bc4202b test: Show more context on cassette loading failure
• 7eba5ad chore: Improve typing
• e896ab6 chore: Probe each path with undeclared HTTP methods once per path instead of ...
• Additional commits viewable in compare view

Updates huggingface-hub from 1.12.0 to 1.13.0

Release notes

Sourced from huggingface-hub's releases.

[v1.13.0] new CLI commands and formatting, and HF URI parsing

🖥️ New CLI commands: repo cards, file listings, and dataset leaderboards

This release adds three new CLI capabilities for exploring Hub content. hf models card, hf datasets card, and hf spaces card fetch the README of any repo and print it to stdout, with --metadata (YAML frontmatter as JSON) and --text (prose only) flags for splitting the card into its structured and unstructured parts. Calling hf models ls <repo_id>, hf datasets ls <repo_id>, or hf spaces ls <repo_id> now switches from listing repos to listing files inside that repo, with --tree, -R, -h, and --revision options mirroring the existing hf buckets ls behavior. And hf datasets leaderboard <dataset_id> surfaces model scores submitted to a benchmark dataset, making it easy to compare models by score from the terminal.

# Get model card metadata as JSON
hf models card google/gemma-4-31B-it --metadata --format json
List files in a model repo (tree view with sizes)
hf models ls meta-llama/Llama-3.2-1B-Instruct --tree -h
Show top 5 models on SWE-bench
hf datasets leaderboard SWE-bench/SWE-bench_Verified --limit 5

📚 Documentation: CLI guide

• [CLI] Add hf models card and hf datasets card commands by @​davanstrien in #4118
• [CLI] Add file listing to models/datasets/spaces ls by @​Wauplin in #4166
• [CLI] add hf datasets leaderboard by @​hanouticelina in #4154

🚀 Manage Spaces from the CLI

Three new hf spaces subcommands bring full lifecycle control to the terminal. hf spaces pause and hf spaces restart stop or rebuild a Space (with --factory-reboot for a clean rebuild), and hf spaces settings lets you configure sleep time and hardware in one call. A companion hf spaces hardware command lists all available hardware flavors with pricing, so you can discover options before changing settings. Pause and restart include a confirmation prompt (-y to skip) since they tear down the running container.

# Pause a Space when not in use (not billed while paused)
hf spaces pause username/my-space
Restart with a GPU
hf spaces settings username/my-space --hardware t4-medium --sleep-time 3600
List available hardware options
hf spaces hardware

📚 Documentation: CLI guide — Spaces

• [CLI] Add spaces lifecycle commands: pause, restart, sleep by @​davanstrien in #4155
• [CLI] Add hf spaces hardware command by @​Wauplin in #4169
• [CLI] Add --hardware flag to hf spaces settings by @​davanstrien in #4163

🔃 hf update replaces the auto-update prompt

The blocking interactive Y/n auto-update prompt at CLI startup is gone. It was catching too many non-interactive contexts (CI runners, Homebrew post-install hooks, Jupyter notebooks) and hanging automation. In its place, a single yellow stderr warning suggests running hf update — a new command that detects how hf was installed (Homebrew, standalone installer, or pip) and runs the right upgrade command. Set HF_HUB_DISABLE_UPDATE_CHECK=1 to silence the startup check entirely, for example in offline CI.

hf update

... (truncated)

Commits

• 3790483 Release: v1.13.0
• b648072 Release: v1.13.0.rc0
• 6e89ade [CLI] Make --format / --json / -q global (#4162)
• 6a57790 [CLI] Add hf spaces hardware command (#4169)
• 5fb553d Centralize hf:// URI parsing (#4158)
• bc4069b [CLI] Add file listing to models/datasets/spaces ls (#4166)
• 81e04b3 [CLI] Add --hardware flag to hf spaces settings (#4163)
• c1775a5 Avoid reuploading preuploaded LFS files (#4165)
• 1b2bce2 [Release] Mark minor releases as "latest" on GitHub (#4167)
• 47437a6 Add bucket+mount transport for Jobs script upload (#4025)
• Additional commits viewable in compare view

Updates ultralytics from 8.4.41 to 8.4.46

Commits

• 0ca0b6d ultralytics 8.4.46 Fix multiscale minimum train size (#24394)
• 1c68a1e Fix docs strict validation warnings (#24389)
• b4cf7c4 Improve export results path to point to actual artifact path (#24316)
• 670237c Improve data and fraction args across export formats (#24382)
• 4da693f Add https://youtu.be/FvWl00sD4rc to docs (#24370)
• 5840258 Fix: stop resume when training is already finished (#24386)
• 08edc82 Improve RKNN exports to highlight non-int8 supported chips (#24384)
• 79b2086 ultralytics 8.4.45 Fix pretrained checkpoint training regression (#24378)
• a8ff07a ultralytics 8.4.44 Apply pretrained arg across model trainers (#24374)
• 62bd0e0 Docs: Datasets Clustering (#24376)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 6 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 007802f.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

data-management/viewer/backend/uv.lock

Package	Version	License	Issue Type
huggingface-hub	1.13.0	Null	Unknown License
hypothesis	6.152.4	Null	Unknown License
jsonschema-rs	0.46.4	Null	Unknown License
python-multipart	0.0.27	Null	Unknown License
schemathesis	4.17.0	Null	Unknown License
ultralytics	8.4.46	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/huggingface-hub	1.13.0	Unknown	Unknown
pip/hypothesis	6.152.4	Unknown	Unknown
pip/jsonschema-rs	0.46.4	Unknown	Unknown
pip/python-multipart	0.0.27	Unknown	Unknown
pip/schemathesis	4.17.0	Unknown	Unknown
pip/ultralytics	8.4.46	Unknown	Unknown

Scanned Files

• data-management/viewer/backend/uv.lock

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.27%. Comparing base (10ab980) to head (007802f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #602   +/-   ##
=======================================
  Coverage   77.27%   77.27%           
=======================================
  Files         272      272           
  Lines       18140    18140           
  Branches     2452     2452           
=======================================
  Hits        14018    14018           
  Misses       3698     3698           
  Partials      424      424           

Flag	Coverage Δ		*Carryforward flag
pester	83.13% <ø> (ø)		Carriedforward from 10ab980
pytest-data-pipeline	100.00% <ø> (ø)		Carriedforward from 10ab980
pytest-dataviewer	93.60% <ø> (ø)
pytest-dm-tools	100.00% <ø> (ø)		Carriedforward from 10ab980
pytest-evaluation	99.51% <ø> (ø)
pytest-fuzz	4.89% <ø> (ø)		Carriedforward from 10ab980
pytest-inference	100.00% <ø> (ø)		Carriedforward from 10ab980
pytest-training	93.32% <ø> (ø)		Carriedforward from 10ab980
vitest	53.02% <ø> (ø)		Carriedforward from 10ab980

*This pull request uses carry forward flags. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Advisory Review Summary

Ecosystems / surfaces touched: uv / pip — python-runtime (dataviewer backend at data-management/viewer/backend/)

Both pyproject.toml (manifest) and uv.lock (lockfile) are modified. All five packages are scoped to the dataviewer backend; three are optional-extra dependencies ([huggingface], [yolo], [dev]).

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	None known	python-runtime (dataviewer)
hypothesis	6.152.3	6.152.4	None known	python-runtime (dataviewer, dev-only)
schemathesis	4.16.1	4.17.0	None known	python-runtime (dataviewer, dev-only)
huggingface-hub	1.12.0	1.13.0	None known	python-runtime (dataviewer, optional)
ultralytics	8.4.41	8.4.46	None known	python-runtime (dataviewer, optional)

---

python-multipart

No CVE or GHSA advisory identified. This is a patch bump. Notable change: adds multipart header limits (#267) — a security hardening addition that caps header counts in multipart parsing. The security(deps): PR title prefix from Dependabot likely reflects this hardening.

Release notes (0.0.27, 2026-04-27):

• Add multipart header limits #267
• Pass parse offsets via constructors #268

Source: Kludex/python-multipart@0.0.26...0.0.27

Repo-specific risk: python-multipart is a direct runtime dependency used by FastAPI for multipart form parsing. The header-limits hardening is beneficial and has no reported compatibility issues with FastAPI 0.136.1 pinned in this project.

Validation Signal

Deterministic CI: PR_VALIDATION_CONCLUSION = in_progress:in_progress

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

Relevant check runs for python-runtime (dataviewer) surface: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint. Results pending at: https://github.com/microsoft/physical-ai-toolchain/actions/runs/25231383504

Static impact reasoning: No ABI-sensitive packages (numpy, torch, tensordict, onnxruntime-gpu) were changed. The existing numpy==2.4.4 and pyarrow==24.0.0 pins in pyproject.toml are unchanged by this PR. No Isaac Sim training paths are touched.

---

hypothesis

No CVE or GHSA advisory identified. Patch bump; dev-only dependency with no runtime impact.

Release: HypothesisWorks/hypothesis@hypothesis-python-6.152.3...hypothesis-python-6.152.4

Validation Signal

Deterministic CI: pending (see above). Static impact: dev-only, no ABI concerns.

---

schemathesis

No CVE or GHSA advisory identified. Minor bump (4.16.1 → 4.17.0); dev-only API fuzzing tool.

Release notes (4.17.0, 2026-04-30):

• Capture path-parameter values from successful 2xx requests for reuse during fuzzing
• Capture request-body field values from successful 2xx requests for reuse during fuzzing
• Coverage phase records request identifiers into the runtime resource pool for reuse in later phases
• Use identifiers from the runtime resource pool for resource-bound parameters and body fields during the coverage phase
• Chain st fuzz scenarios via inferred steps

Source: schemathesis/schemathesis@v4.16.1...v4.17.0

Repo-specific risk: Feature additions for smarter fuzzing. No breaking changes visible. Dev-only dependency.

Validation Signal

Deterministic CI: pending (see above). Static impact: dev-only, no ABI concerns.

---

huggingface-hub

No CVE or GHSA advisory identified. Minor bump (1.12.0 → 1.13.0); optional [huggingface] extra.

Release notes (1.13.0, 2026-04-30):

• New hf spaces hardware CLI command
• Centralized hf:// URI parsing
• Avoid re-uploading pre-uploaded LFS files
• Added bucket+mount transport for Jobs script upload
• [CLI] Add file listing to models/datasets/spaces ls

Source: huggingface/huggingface_hub@v1.12.0...v1.13.0

Repo-specific risk: Minor feature additions; no breaking API changes visible. Optional dependency, only active when [huggingface] extras are installed.

Validation Signal

Deterministic CI: pending (see above). Static impact: no ABI-sensitive packages changed.

---

ultralytics

No CVE or GHSA advisory identified. Patch bump spanning five releases (8.4.41 → 8.4.46); optional [yolo] extra.

Release notes (8.4.42 – 8.4.46):

• 8.4.46: Fix multiscale minimum train size
• 8.4.45: Fix pretrained checkpoint training regression
• 8.4.44: Apply pretrained arg across model trainers
• Additional: Improved export results path, RKNN export improvements, stop resume when training is already finished

Source: ultralytics/ultralytics@v8.4.41...v8.4.46

Repo-specific risk: Bug-fix releases; no major version change. Optional dependency, only active when [yolo] extras are installed. No CUDA/GPU ABI changes detected.

Validation Signal

Deterministic CI: pending (see above). Static impact: no ABI-sensitive packages (torch, onnxruntime-gpu) changed by this PR.

---

Advisory verdict: COMMENT — CI conclusion is in_progress; all five bumps are patch/minor with no identified CVE or GHSA advisories and no high-risk ABI triggers. Review again once Dataviewer Backend Pytest and Python Lint check runs complete.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #602 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #602 · ● 1.7M

[github-actions]

Advisory Review Summary

Ecosystems / surfaces touched:

• python-runtime (dataviewer) — data-management/viewer/backend/pyproject.toml + uv.lock

Package table:

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	None	python-runtime (dataviewer)
hypothesis	6.152.3	6.152.4	None	python-runtime (dataviewer)
schemathesis	4.16.1	4.17.0	None	python-runtime (dataviewer)
huggingface-hub	1.12.0	1.13.0	None	python-runtime (dataviewer)
ultralytics	8.4.41	8.4.46	None	python-runtime (dataviewer)

No GHSA or CVE identifiers were found in the PR body. No advisory enrichment chain hits (GHSA / OSV / NVD) for any of the bumped versions. No ABI-sensitive packages (numpy, torch, tensordict, onnxruntime-gpu) are present. No major version bumps.

All five packages are exact-pinned in pyproject.toml (not transitive-only); uv.lock is updated in tandem.

---

python-multipart

Release notes — 0.0.27 (source):

• Add multipart header limits (#267)
• Pass parse offsets via constructors (#268)

Patch bump. The header-limits addition hardens multipart parsing against oversized headers — a net security improvement. No breaking API change. No advisory.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
2. Static impact reasoning: Package is not ABI-sensitive. No Isaac Sim guard applies. Exact pin in pyproject.toml, consistent with existing pinning style.

---

hypothesis

Release notes — 6.152.4: Patch bump. No public changelog excerpt in PR body; upstream patch history indicates minor internal test-generator refinements. No advisory.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — conclusion pending.
2. Static impact reasoning: Test-only dependency. No ABI sensitivity. No Isaac Sim guard applies.

---

schemathesis

Release notes — 4.17.0 (source):

• Fixed false InfiniteRecursiveReference on cycles breakable through patternProperties, oneOf/anyOf, top-level allOf, or unused definitions
• Fixed false positives from \p{X} Unicode property escapes inside character classes
• Fixed FlakyStrategyDefinition from st fuzz when time limit trips mid-scenario
• Fixed NDJSON reports truncated after first event from threaded requests import race

Minor bump. All changes are bug fixes; no breaking API changes noted. Relevant surfaces: Dataviewer Backend Pytest (exercises schemathesis-based API schema tests). No advisory.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — conclusion pending.
2. Static impact reasoning: Test/validation library only. No ABI sensitivity. No Isaac Sim guard applies.

---

huggingface-hub

Release notes — 1.13.0 (source):

• New CLI commands: hf models card, hf datasets card, hf spaces card, file listings, hf datasets leaderboard
• New hf spaces lifecycle subcommands: pause, restart, settings, hardware
• hf update replaces the blocking interactive Y/N auto-update prompt (removed startup hang in non-interactive contexts)
• Centralized hf:// URI parsing

Minor bump with new CLI features and URI parsing improvements. No breaking changes to the Python API noted. No advisory.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — conclusion pending.
2. Static impact reasoning: Used in the dataviewer backend for HuggingFace Hub dataset access. Minor bump; no ABI sensitivity. No Isaac Sim guard applies.

---

ultralytics

Release notes — 8.4.41 → 8.4.46 (source):

• Fix multiscale minimum train size

Patch bump across 5 micro-versions. The primary fix addresses multiscale training. Ultralytics is used in the dataviewer backend for YOLO inference (mocked in tests). No advisory.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — conclusion pending.
2. Static impact reasoning: Not ABI-sensitive relative to CUDA/Isaac Sim. Training-related fix is internal to the model engine; no impact on inference API surface used by the dataviewer.

---

Validation Signal (overall)

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

• PR Validation: in_progress:in_progress — run link
• Relevant check runs for python-runtime (dataviewer): Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint — conclusions not yet available.
• Run npm run validate:backend in data-management/viewer/ once CI completes to confirm.

---

Advisory verdict: COMMENT — CI is still in progress; all five bumps are minor/patch with no known advisories and no ABI-sensitive changes. Re-review is not required once CI passes.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #602 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #602 · ● 586.1K

[github-actions]

Advisory Review Summary

• Ecosystem: uv / PyPI
• Surface: python-runtime — data-management/viewer/backend/
• Manifest: data-management/viewer/backend/pyproject.toml + data-management/viewer/backend/uv.lock
• Files changed: 2 (1 manifest + 1 lockfile)

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	None	python-runtime
hypothesis	6.152.3	6.152.4	None	python-runtime (dev)
schemathesis	4.16.1	4.17.0	None	python-runtime (dev)
huggingface-hub	1.12.0	1.13.0	None	python-runtime (huggingface extra)
ultralytics	8.4.41	8.4.46	None	python-runtime (yolo extra)
jsonschema-rs (transitive)	0.46.2	0.46.4	None	python-runtime (via schemathesis)

---

python-multipart

Release notes: Adds multipart header limits (#267) and passes parse offsets via constructors (#268). Full changelog: Kludex/python-multipart@0.0.26...0.0.27

Advisory context: GHSA-mj87-hwqh-73pj (CVE-2026-40347, CWE-400/CWE-834, CVSS 3.1: 5.3 MODERATE) — DoS via large multipart preamble/epilogue data. Fixed at 0.0.26. This PR bumps from an already-patched version; 0.0.27 adds further header-limit hardening.

No advisories affect 0.0.26→0.0.27.

Validation Signal

1. Deterministic CI: PR_VALIDATION_CONCLUSION: in_progress:in_progress — orchestrator has not completed. Relevant check runs: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint — conclusions not yet available.
   • ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
2. Static impact reasoning: python-multipart is not an ABI-sensitive package; no Isaac Sim or GPU-path constraints apply. The patch bump has no known peer-dependency conflicts.

---

hypothesis

Release notes: Fixes a rare internal error during Phase.explain for certain strategies introduced in 6.149.0 (issue #4708). Source: (hypothesis.readthedocs.io/redacted)

No GHSA/CVE advisories found for hypothesis in this patch range. Dev dependency only.

Validation Signal

1. Deterministic CI: in_progress:in_progress — pending.
2. Static impact reasoning: Patch bugfix release; no ABI sensitivity.

---

schemathesis

Release notes: Minor version release (4.16.1 → 4.17.0) with 15 new additions (resource-pool fuzzing, link chaining, runtime pool seeding from JWT credentials, dependency inference improvements) and ~25 bug fixes (false-positive results, crash fixes, Unicode pattern corrections). Source: schemathesis/schemathesis@v4.16.1...v4.17.0

No GHSA/CVE advisories found. Dev dependency (API test runner only). Minor bump with extensive changes — confirm test suite passes locally before merge.

Transitive note: jsonschema-rs bumped 0.46.2 → 0.46.4 in uv.lock as a transitive dependency of schemathesis. This is a lockfile-only change with no manifest edit. No published advisories found.

Validation Signal

1. Deterministic CI: in_progress:in_progress — pending.
2. Static impact reasoning: Test-only dependency; no runtime surface exposure. The minor bump is extensive but carries no known breaking API changes.

---

huggingface-hub

Release notes: v1.13.0 adds new CLI commands (hf models card, hf datasets card, hf spaces card, hf datasets leaderboard), Space lifecycle commands, HF URI parsing centralisation, and replaces the blocking auto-update prompt with a non-blocking warning. Source: https://github.com/huggingface/huggingface_hub/releases/tag/v1.13.0

No GHSA/CVE advisories found. Optional extra (huggingface); not loaded in default runtime. Minor version bump with additive CLI and API changes.

Validation Signal

1. Deterministic CI: in_progress:in_progress — pending.
2. Static impact reasoning: Optional extra, not a core runtime dep. No ABI sensitivity.

---

ultralytics

Release notes: Five patch versions (8.4.41 → 8.4.46) covering: fix multiscale minimum train size, fix pretrained checkpoint training regression, improve data/fraction args across export formats, stop resume when training is already finished. Source: ultralytics/ultralytics@v8.4.41...v8.4.46

Advisory check: GHSA-7x29-qqmq-v6qc is a GitHub Actions script injection advisory for the ultralytics/actions GitHub Action — not the ultralytics PyPI package. Not applicable here.

No GHSA/CVE advisories found affecting the ultralytics PyPI package in this range. Optional extra (yolo); not loaded in default runtime.

Validation Signal

1. Deterministic CI: in_progress:in_progress — pending.
2. Static impact reasoning: Optional YOLO extra; no ABI-sensitive packages involved (no numpy, torch, or onnxruntime changes).

---

Risk Assessment

No high-risk triggers apply:

• No numpy, torch, tensordict, onnxruntime-gpu, scipy, scikit-learn, pyarrow, or opencv* bumps.
• No major version boundaries crossed.
• No Isaac Sim ABI constraints implicated (training/rl/requirements.txt not in diff).
• schemathesis and hypothesis are dev/test dependencies with no production surface.
• huggingface-hub and ultralytics are optional extras.

Advisory verdict: COMMENT — CI is still in progress (in_progress:in_progress); verdict will remain advisory until Dataviewer Backend Pytest, Pytest Data Management Tools, and Python Lint check runs complete.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #602 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #602 · ● 1.4M