chore(deps): bump the python group across 1 directory with 82 updates

[dependabot]

Bumps the python group with 78 updates in the / directory:

Package	From	To
reactivex	4.1.0	5.1.0
pydantic	2.12.5	2.13.4
packaging	25.0	26.3
filelock	3.23.0	3.32.3
plum-dispatch	2.5.7	2.9.0
gitpython	3.1.52	3.1.59
structlog	25.5.0	26.1.0
opencv-contrib-python	4.13.0.92	5.0.0.93
pydantic-settings	2.12.0	2.15.0
textual	3.7.1	8.2.8
terminaltexteffects	0.12.2	0.15.0
typer	0.23.1	0.27.1
ipython	8.38.0	8.39.0
numba	0.63.1	0.67.0
rerun-sdk	0.32.0	0.36.0
protobuf	6.33.5	7.35.1
cryptography	46.0.5	50.0.0
python-multipart	0.0.27	0.0.32
ipykernel	7.2.0	7.3.0
timm	1.0.24	1.0.28
open-clip-torch	3.2.0	3.3.0
gdown	6.0.0	6.1.0
tensorboard	2.20.0	2.21.0
xarm-python-sdk	1.17.3	1.18.4
portal	3.7.4	3.8.1
bosdyn-client	5.1.4	5.1.9
pyarrow	23.0.0	25.0.1
langchain-core	1.3.3	1.5.4
langchain-openai	1.1.6	1.5.0
langchain-huggingface	1.2.0	1.2.2
langchain-ollama	1.0.1	1.1.0
ollama	0.6.1	0.6.2
fastapi	0.129.0	0.141.1
sse-starlette	3.2.0	3.4.8
uvicorn	0.40.0	0.52.3
soundfile	0.13.1	0.14.0
ultralytics	8.4.14	8.4.120
pillow	12.2.0	12.3.0
lap	0.5.12	0.5.13
transformers[torch]	4.53.3	5.15.0
moondream	0.2.0	2.0.1
omegaconf	2.3.0	2.3.1
hydra-core	1.3.2	1.3.5
cyclonedds	0.10.5	11.0.1
mcap	1.3.1	1.4.0
piper-sdk	0.6.1	0.6.2
pyrealsense2-extended	2.58.1.10581.post1	2.58.3.10794.post1
matplotlib	3.10.8	3.10.9
onnxruntime	1.24.1	1.24.3
cupy-cuda12x	13.6.0	14.1.1
mujoco	3.10.0	3.11.0
gtsam-extended	4.3a1.post1	4.3a2.post202608130654
aiortc	1.14.0	1.15.0
aiohttp	3.14.1	3.14.3
reportlab	4.5.0	5.0.0
manifold3d	3.5.1	3.5.2
coacd	1.0.11	1.0.12
usd-core	26.5	26.8
huggingface-hub	0.36.2	1.27.0
ruff	0.14.3	0.16.3
pytest	8.3.5	9.1.1
pytest-asyncio	0.26.0	1.4.0
pytest-mock	3.15.0	3.15.1
pytest-env	1.1.5	1.7.0
pytest-rerunfailures	16.4	16.5
coverage	7.13.4	7.15.4
pre-commit	4.2.0	4.6.2
py-spy	0.4.1	0.4.2
maturin	1.13.3	1.14.1
python-lsp-server[all]	1.14.0	1.15.0
python-lsp-ruff	2.3.0	2.3.1
playwright	1.61.0	1.62.0
mypy	1.19.0	2.3.0
python-socketio	5.16.1	5.16.4
types-pyyaml	6.0.12.20250915	6.0.12.20260724
types-reportlab	4.5.0.20260509	4.5.1.20260807
types-requests	2.32.4.20260107	2.33.0.20260712
pybind11	3.0.4	3.1.0

Updates reactivex from 4.1.0 to 5.1.0

Release notes

Sourced from reactivex's releases.

v5.1.0

See CHANGELOG.md for details.

v5.0.0

See CHANGELOG.md for details.

v5.0.0rc2

See CHANGELOG.md for details.

v5.0.0a2

What's Changed

• Fix title header by @​dbrattli in ReactiveX/RxPY#744

Full Changelog: ReactiveX/RxPY@v5.0.0a1...v5.0.0a2

v5.0.0a1

What's Changed

• Give run a scheduler parameter by @​rmahfoud in ReactiveX/RxPY#731
• Avoid use of asyncio.get_event_loop (3.14) by @​traylenator in ReactiveX/RxPY#728
• Migrate to uv by @​dbrattli in ReactiveX/RxPY#738
• Migrate to ruff by @​dbrattli in ReactiveX/RxPY#739
• Upgrade pyright by @​dbrattli in ReactiveX/RxPY#740
• Fix subscribe_on not forwarding scheduler to the source by @​jcafhe in ReactiveX/RxPY#726
• Upgrade deps by @​dbrattli in ReactiveX/RxPY#741
• Clarify what you can do with the .subscribe Disposable by @​tmewett in ReactiveX/RxPY#686
• RxPY v5 by @​dbrattli in ReactiveX/RxPY#743

New Contributors

• @​rmahfoud made their first contribution in ReactiveX/RxPY#731
• @​tmewett made their first contribution in ReactiveX/RxPY#686

Full Changelog: ReactiveX/RxPY@v4.1.0...v5.0.0a1

Changelog

Sourced from reactivex's changelog.

5.1.0 - 2026-07-27

🚀 Features

• (operators) Add tap as an alias for do_action (#804) (95c54ac3)

🐞 Bug Fixes

• (gtk) Call gi.require_version before importing gi.repository (#749) (2b9e3f33)
• (operators) Accept concurrent.futures.Future wherever futures are accepted (#806) (19da6ac1)
• (scheduler) Use wall clock time for now() in event loop schedulers (#809) (361951c7)

View changes on Github

5.0.0 - 2026-07-20

🐞 Bug Fixes

• (scripts) Keep uv.lock in sync and scope the version sed to [project] (#802) (10ccc0a3)

View changes on Github

5.0.0-rc.2 - 2026-07-20

🐞 Bug Fixes

• (operators) Reset retry budget per subscription to fix retry+repeat (#765) (c3f19d5e)

View changes on Github

5.0.0-rc.1 - 2026-04-20

View changes on Github

• Typing: Added Action and StartableFactory to reactivex.typing.__all__, making them part of the explicit public API surface.
• Docs: Added missing docstring to on_error_resume_next operator.
• Operators: Fixed scheduler forwarding in pairwise, to_marbles, and delay_with_mapper (subscription-delay path). These operators now pass the scheduler argument through to source.subscribe(...) and, in the case of delay_with_mapper, to the subscription-delay observable, consistent with all other pipeable operators. Closes #480 (partial — the operators listed in the issue that were not yet fixed).
• CI: Skip tests/test_scheduler/test_mainloop/test_tkinterscheduler.py on PyPy (all platforms). The module creates a Tk root at import time; PyPy's _tkinter finalizer calls threading.notify_all during interpreter shutdown and aborts the xdist worker, failing whichever unrelated test was running. Previously guarded only on macOS+PyPy.
• Fix: reactivex.timer(duetime, period) now correctly resets the initial delay on each resubscription (e.g. via repeat()). Previously `nonlocal

... (truncated)

Commits

• bbfecfb chore: release reactivex@5.1.0 (#805)
• b286407 docs: correct and expand the GIL free-threading note (#811)
• 93a4f04 docs: explain how to parallelize work within a single stream (#810)
• 2271867 Revise GIL section for Python 3.13 updates (#742)
• 361951c fix(scheduler): use wall clock time for now() in event loop schedulers (#809)
• b809222 docs: read version from pyproject instead of git tags (#808)
• 19e8080 ci(deps): bump the github-actions group with 2 updates (#807)
• dd9b8ec refactor(combine-latest): simplify logic by removing redundant loops … (#736)
• 19da6ac fix(operators): accept concurrent.futures.Future wherever futures are accepte...
• 2b9e3f3 fix(gtk): call gi.require_version before importing gi.repository (#749)
• Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

v2.13.1 (2026-04-15)

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #13079

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0 2026-04-13

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #13079

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• Additional commits viewable in compare view

Updates packaging from 25.0 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates filelock from 3.23.0 to 3.32.3

Release notes

Sourced from filelock's releases.

3.32.3

What's Changed

• 🧪 test(strict): deflake close-fault injections on graalpy by @​gaborbernat in tox-dev/filelock#697
• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/filelock#700
• 🐛 fix(fork): survive audit events during interpreter shutdown by @​gaborbernat in tox-dev/filelock#703

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

3.32.2

What's Changed

• Fix test failures on NetBSD (#689) by @​gaborbernat in tox-dev/filelock#693
• 🧪 test(soft-rw): deflake writer phase-2 peer-marker test by @​gaborbernat in tox-dev/filelock#694
• hand back the claim when a heartbeat thread fails to start by @​dxbjavid in tox-dev/filelock#691
• 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by @​gaborbernat in tox-dev/filelock#695

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

3.32.0

What's Changed

• 👷 ci: add Python 3.15 to the test matrix by @​gaborbernat in tox-dev/filelock#683
• 🐛 fix(packaging): let an unpacked sdist run the test suite by @​gaborbernat in tox-dev/filelock#685

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

3.31.2

What's Changed

• 🐛 fix(strict): tolerate an errno without ENOTSUP by @​gaborbernat in tox-dev/filelock#681

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

3.31.1

What's Changed

• ♻️ refactor(coverage): key exclusions on probed capability by @​gaborbernat in tox-dev/filelock#679
• scope a lease's claim to the context that acquired it by @​dxbjavid in tox-dev/filelock#680

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.32.3 (2026-08-13)

---

• The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

---

3.32.2 (2026-07-29)

---

• A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

---

3.32.1 (2026-07-26)

---

• Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

---

3.32.0 (2026-07-21)

---

• SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
• Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
• The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

---

3.31.2 (2026-07-21)

---

• filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

---

... (truncated)

Commits

• 4aa742c Release 3.32.3
• fb5ab3e 🐛 fix(fork): survive audit events during interpreter shutdown (#703)
• 35f759c 📄 docs: publish llms.txt from the docs build (#700)
• 4b6e966 [pre-commit.ci] pre-commit autoupdate (#699)
• 0e0f666 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#698)
• 6689d82 🧪 test(strict): deflake close-fault injections on graalpy (#697)
• df67bf7 [pre-commit.ci] pre-commit autoupdate (#696)
• 9a6cc43 Release 3.32.2
• 56879c7 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (#695)
• ecf5be0 hand back the claim when a heartbeat thread fails to start (#691)
• Additional commits viewable in compare view

Updates plum-dispatch from 2.5.7 to 2.9.0

Release notes

Sourced from plum-dispatch's releases.

v2.9.0

• Support union aliases in Python 3.14 and later (@​nstarman).

v2.8.0

Starting this release, Plum will be available on PyPI as both plum-dispatch and plum.

v2.7.1

• Add faithful keyword to ModuleType.

v2.7.0

Note: All imports should now go through plum directly! That is, not plum.signature.Signature, but plum.Signature. Please do open an issue if this release breaks something that shouldn't break.

Changes:

• Significantly improve typing of the internals (#179 and #242 by @​nstarman).
• Switch to uv (#218 by @​nstarman).
• Make modules private for public/private separation (#241 by @​nstarman).
• Switch to src layout (#249 by @​nstarman).
• Improve config (#248 by @​nstarman).
• Enable mypyc builds for better performance (#247 by @​nstarman)!

v2.6.1

This release features numerous very helpful contributions and improvements by @​nstarman!

• Use dependency groups (#195).
• Treat typing_extensions as standard library and make more use of it (#226 and #232).
• Complete deprecation cycles (#230 and #236).
• Turn various arguments into positional-only (#229).
• Remove unnecessary path manipulation (#233).
• Rework tests with a dispatch fixture (#234).
• Avoid using a deprecated NumPy module (#231).
• Drops support for Python 3.9 (#228).
• Import exports from methods.py (#237).
• Fixes an incorrect overload (#238).
• Use nox for testing (#235 and #240).

#228 also fixes an important bug to do with the handling of unions (CC @​davidwyld).

v2.6.0

• Add keyword argument condition to ModuleType.

v2.5.8

• Fix precedence keyword argument (thanks @​nstarman!).
• Fix complex method override.
• Drop support for Python 8 and use e.g. list instead of typing.List (thanks @​nstarman!).

Commits

• 485380d Minor style and linter changes
• 28f5a4a Minor style changes
• b85f8e7 Remove duplicate sections
• 863138d Enable py3.14 and deprecate some alias functionality (#225)
• ad54d37 build(deps-dev): bump uv from 0.9.16 to 0.11.6 (#265)
• 562f3e2 build(deps-dev): bump pytest from 9.0.2 to 9.0.3 (#267)
• 6b239db build(deps): bump cryptography from 46.0.6 to 46.0.7 (#264)
• 0ddc2db Potential fix for code scanning alert no. 3: Workflow does not contain permis...
• d4581ce Potential fix for code scanning alert no. 2: Workflow does not contain permis...
• 3dd2386 Potential fix for code scanning alert no. 8: Workflow does not contain permis...
• Additional commits viewable in compare view

Updates gitpython from 3.1.52 to 3.1.59

Release notes

Sourced from gitpython's releases.

3.1.59 - Security

What's Changed

• prepare changelog for upcoming release by @​Byron in gitpython-developers/GitPython#2207
• Block file-reading Git options by @​Byron in gitpython-developers/GitPython#2208
• index: write blobs via git hash-object, not gitdb's odb.store by @​caroescm in gitpython-developers/GitPython#2209
• Block separate git directories during clone by @​Byron in gitpython-developers/GitPython#2210
• fix: harden config parsing boundaries by @​Byron in gitpython-developers/GitPython#2211
• repo.index.add() now respects worktree filters gitpython-developers/GitPython#2209

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

• test: allow Python startup before timeout by @​Byron in gitpython-developers/GitPython#2195
• Resolve Windows hook Bash through PATH by @​Byron in gitpython-developers/GitPython#2199
• Revert "Resolve Windows hook Bash through PATH" by @​Byron in gitpython-developers/GitPython#2200
• test: focus pytest summary on unexpected failures by @​raisulchowdhury in gitpython-developers/GitPython#2203
• Validate submodule names before filesystem operations by @​Byron in gitpython-developers/GitPython#2202
• Handle invalid submodule names during recursive updates by @​Byron in gitpython-developers/GitPython#2205
• Fix Windows path handling on Python 3.13+ by @​Byron in gitpython-developers/GitPython#2196
• fixup 2202 by @​Byron in gitpython-developers/GitPython#2206
• Correct Windows hook Bash precedence by @​Byron in gitpython-developers/GitPython#2201
• Harden config and Git option validation by @​Byron in gitpython-developers/GitPython#2204
• Skip tests that need symlink privileges instead of erroring by @​Cyrus580529 in gitpython-developers/GitPython#2197

New Contributors

• @​raisulchowdhury made their first contribution in gitpython-developers/GitPython#2203
• @​Cyrus580529 made their first contribution in gitpython-developers/GitPython#2197

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

• Merge gitdb and smmap into the GitPython repository by @​Byron in gitpython-developers/GitPython#2179
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in gitpython-developers/GitPython#2185
• build(deps): bump the pre-commit group with 2 updates by @​dependabot[bot] in gitpython-developers/GitPython#2186
• Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by @​dependabot[bot] in gitpython-developers/GitPython#2124
• Render protected Traversable methods in the reference by @​pick7 in gitpython-developers/GitPython#2192
• Use standard prefixes for parsed patch diffs by @​pick7 in gitpython-developers/GitPython#2191
• Honor kill_after_timeout with output streams by @​pick7 in gitpython-developers/GitPython#2189
• Redact Authorization extra headers from command errors by @​pick7 in gitpython-developers/GitPython#2188
• Improve RemoteProgress parse return typing by @​pick7 in gitpython-developers/GitPython#2187
• Adopt basedpyright with a legacy baseline by @​Byron in gitpython-developers/GitPython#2194
• Block unsafe Git file and URL options by @​Byron in gitpython-developers/GitPython#2193

New Contributors

• @​pick7 made their first contribution in gitpython-developers/GitPython#2192

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

... (truncated)

Commits

• 66340d7 prepare changelog prior to release
• a5e047d Merge pull request #2211 from gitpython-developers/config-sanitize-more
• ef7568e fix: ignore includes in submodule configuration
• 4b4e47f fix: preserve multiline config values when writing
• b473abb Merge pull request #2210 from gitpython-developers/fix-clone-unsafe-option
• 5ff52cc Merge pull request #2209 from caroescm/fix-index-add-chmod
• b68afff Block separate git directories during clone
• 93677a0 fix: index.add() now supports filters (#2021)
• 9729ed3 Merge pull request #2208 from gitpython-developers/security-fixes
• ce9d8e8 prepare next release
• Additional commits viewable in compare view

Updates structlog from 25.5.0 to 26.1.0

Release notes

Sourced from structlog's releases.

26.1.0

Highlights

Given how long this release took, it's pretty thicc with nice things all over the board! Apologies for the long release cycle; it's been a victim of the slopocalypse and me trying to navigate my way thru the new normal. Extra big thanks to my sponsors for not abandoning me in these unironically trying times. ❤️

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above...

Description has been truncated

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
dimensional	🟢 Ready	View Preview	Aug 21, 2026, 6:24 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[greptile-apps]

Greptile Summary

This change updates the Python dependency graph, including widening the supported Transformers range to include version 5 releases. The ResNet image-embedding constructor works with Transformers 4.53.0 but fails with both Transformers 5.0.0 and the newly pinned 5.15.0 because microsoft/resnet-50 is no longer recognized by the legacy feature-extractor mapping.

The originally reported missing-import mechanism was disproved: AutoFeatureExtractor still imports successfully in the tested Transformers 5 releases. The ResNet provider regression remains and must be addressed by migrating to a compatible image-processor API or by retaining a pre-5 Transformers constraint.

Merge safety: not safe to merge while the dependency range permits versions that prevent the supported ResNet embedding option from initializing.

Confidence Score: 4/5

The dependency upgrade breaks initialization of the supported ResNet embedding provider in the newly permitted Transformers 5 releases.

The exact provider initialization path was run against the former supported baseline and two permitted Transformers 5 versions. The failure reproduced consistently in both 5.x checks and was absent with Transformers 4.53.0.

Files Needing Attention: Update dimos/perception/experimental/image_embedding.py to use a Transformers 5-compatible processor, or narrow the Transformers constraint in pyproject.toml until that compatibility work is complete.

T-Rex Logs

What T-Rex did

• T-Rex produced a finding-comment-proof for a posted P1 finding.
• T-Rex produced a second finding-comment-proof for another posted P1 finding.
• T-Rex ran general-contract-validation across Transformers versions 4.53, 5.0, and 5.15 and observed OK auto_feature_extractor_import for 4.53 and 5.15 while resnet_provider_init failed with a ValueError for 5.0 and 5.15.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   ResNet embedding provider fails with the permitted Transformers 5.x line

   • Bug
     • ImageEmbeddingProvider(model_name='resnet') succeeds with the allowed floor, Transformers 4.53.0, but fails under tested permitted 5.x releases 5.0.0 and 5.15.0. The failure is not the suspected missing-symbol error: from transformers import AutoFeatureExtractor succeeds. The failure occurs when AutoFeatureExtractor.from_pretrained('microsoft/resnet-50') rejects the model as an unrecognized feature extractor.
   • Cause
     • The implementation at dimos/perception/experimental/image_embedding.py:97 uses the legacy AutoFeatureExtractor auto mapping for a ResNet vision model. In tested Transformers 5.x releases this class still exists, but its mapping no longer identifies microsoft/resnet-50 as a supported feature extractor.
   • Fix
     • Use the Transformers 5-compatible image processor API (for example, load the model's compatible image processor through AutoImageProcessor) and validate the ResNet embedding path against the permitted 5.x versions; alternatively constrain Transformers below 5 until the provider is migrated.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

[greptile-apps]

ResNet processor mapping breaks under Transformers 5

This widened constraint now permits—and the test dependency group pins—Transformers 5.15. ImageEmbeddingProvider(model_name="resnet") still loads microsoft/resnet-50 through AutoFeatureExtractor.from_pretrained, but Transformers 5.0 and 5.15 reject that model with ValueError: Unrecognized feature extractor. The same provider initializes successfully with the prior supported 4.53 release, so users selecting the ResNet embedding option cannot construct embeddings after this upgrade. Migrate this path to the Transformers 5-compatible image-processor API, or keep Transformers below 5 until that migration is complete.

Artifacts

Isolated ResNet provider repro script

• Loads the target source file with narrow stubs and constructs the ResNet provider so the exact initialization path is exercised; it isolates the relevant dependency surface.

Transformers 5.15 isolated-environment setup script

• Creates a temporary virtual environment and installs Transformers 5.15 with the focused dependencies required for the runtime repro; it avoids full project dependencies.

ResNet provider output with Transformers 5.15

• The executed repro reports `auto_feature_extractor_import=OK` for Transformers 5.15 and then records the ResNet provider's ValueError from an unrecognized feature extractor; the suspected missing import is disproved while the provider failure is confirmed.

AutoFeatureExtractor import output with Transformers 5.15

• Runs only `from transformers import AutoFeatureExtractor` in the isolated 5.15 environment and exits successfully; the symbol exists in the PR-pinned permitted version.

Transformers 4.53 comparison script

• Installs the lower bound of the declared dependency range and executes the same exact repro path; it provides the comparable pre-5 behavior.

ResNet provider output with Transformers 4.53

• The executed lower-bound comparison reports `auto_feature_extractor_import=OK` and `resnet_provider_init=OK`; it establishes that the observed break is specific to the 5.x line.

Transformers 5.0 comparison script

• Installs the first major-5 release and executes the same exact provider repro; it checks that the failure is not restricted to 5.15.

ResNet provider output with Transformers 5.0

• The executed 5.0 repro reports `auto_feature_extractor_import=OK` then the same unrecognized-feature-extractor ValueError; the provider regression is present at the start of the allowed 5.x range.

_{Ran code and verified through T-Rex}