[dependabot]

Bumps the python-packages group with 8 updates:

Package	From	To
numpy	2.5.1	2.5.2
lxml	6.1.1	6.1.2
mypy	2.3.0	2.3.1
protobuf	7.35.1	7.36.0
pyzmq	27.1.0	27.2.0
scipy	1.18.0	1.18.1
timm	1.0.28	1.0.29
numba	0.66.0	0.67.0

Updates numpy from 2.5.1 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Abhijeetsingh Meena +
• Charalampos Stratakis
• Charles Harris
• Chris Ninham +
• David Woods
• Geonho +
• Gopu Yeshwanth Reddy +
• Iason Krommydas
• Ijtihed Kilani
• Jelle Zijlstra +
• Joren Hammudoglu
• Kumar Aditya
• Mike Boyle
• Nathan Goldbaum
• Raghuveer Devulapalli
• Sebastian Berg

... (truncated)

Commits

• 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
• ecf599c Merge pull request #32221 from charris/backport-32151
• 3c7ac97 Merge pull request #32220 from charris/backport-32205
• 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
• 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
• c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
• 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
• d8262bc MAINT: Update cibuildwheel to v4.2.0
• 988d94d Merge pull request #32158 from charris/backport-32133
• b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
• Additional commits viewable in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• See full diff in compare view

Updates protobuf from 7.35.1 to 7.36.0

Commits

• See full diff in compare view

Updates pyzmq from 27.1.0 to 27.2.0

Release notes

Sourced from pyzmq's releases.

v27.2.0

See release notes, or pyzmq on PyPI.

Install with:

pip install 'pyzmq==27.2.0'

Commits

• c6bc8f2 Bump to 27.2.0
• 326d7d9 Merge pull request #2213 from minrk/2721
• cfcb1e0 changelog for 27.2
• 5e1bb1e Merge pull request #2212 from minrk/curve_keygen
• cd64002 add zmq.curve_keygen cli entrypoint
• 16891f2 Merge pull request #2211 from minrk/libsodium-1022
• 9e8cef1 put instructions in a comment
• 6652ccf bundle libsodium 1.0.22
• 95b77e1 Merge pull request #2183 from jorenham/typing/error/coverage
• 9c18dcb Merge pull request #2210 from zeromq/dependabot/pip/tools/cibuildwheel-eq-4.2...
• Additional commits viewable in compare view

Updates scipy from 1.18.0 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

• Name (commits)
• Wasim Akram (2) +
• Jake Bowhay (1)
• Michael Bratsch (1)
• Dietrich Brunn (1)
• Evgeni Burovski (1)
• Aadya Chinubhai (1)
• Lucas Colley (3)
• Tekin Ertekin (1) +
• Fuyugithub (2) +
• Ralf Gommers (11)
• Joren Hammudoglu (1)
• Ijtihed Kilani (1) +
• Andrew Nelson (2)
• Ilhan Polat (1)
• Tyler Reddy (39)
• romao05 (1) +
• Michael Simacek (1) +
• Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits

• e4e854e REL: SciPy 1.18.1 rel commit
• 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
• 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
• 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
• a717e28 DOC: PR 25884 revisions
• bb489c0 DOC: PR 25884 revisions
• 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
• 095fe56 DOC, BLD: PR 25884 revisions
• e66ea64 DOC: update minimum GCC version in toolchain roadmap
• c021653 TST: tolerance bumps and skips on 32-bit platforms
• Additional commits viewable in compare view

Updates timm from 1.0.28 to 1.0.29

Release notes

Sourced from timm's releases.

Release v1.0.29

August 27, 2026

• Add LowFormer model and weights
• Fix or merge a host of real but small or not commonly encountered bugs surfaced by agents
• Release 1.0.29

August 11, 2026

• Add model defs and pretrained weights for
  • CPUBone, an efficient vision backbone for devices with low parallelization capabilities.
  • PP-LCNetV2.
  • LingBot-Vision.
• Add per-batch image and batch size scheduling for non-NaFlex training, including progressive small-to-large resolution schedules.
• Improve NaFlexViT with key-only attention masks, compile-friendly and memory-efficient position sampling, and cached variable-patch interpolation.
• Improve model factory path and checkpoint handling; fix equal-token positional embedding resampling.

What's Changed

• Add optional key-only masks for NaFlexVit self-attention by @​chenghuichen in huggingface/pytorch-image-models#2719
• Make NaFlex position embedding sampling compile-friendly and memory-efficient by @​chenghuichen in huggingface/pytorch-image-models#2720
• Variable train image sizes by @​rwightman in huggingface/pytorch-image-models#2722
• Improved model factory path handling. Fix #2725 by @​rwightman in huggingface/pytorch-image-models#2727
• Naflex interp cache by @​rwightman in huggingface/pytorch-image-models#2728
• Cpubone by @​rwightman in huggingface/pytorch-image-models#2733
• Fix positional embedding resampling for equal-token grid changes by @​aswanth-07 in huggingface/pytorch-image-models#2737
• Add LingBot-Vision models by @​belfner in huggingface/pytorch-image-models#2730
• Add PP-LCNetV2 (lcnetv2_small / lcnetv2_base / lcnetv2_large) by @​developer0hye in huggingface/pytorch-image-models#2736
• Fix CutMix minmax border sampling by @​tandede in huggingface/pytorch-image-models#2739
• A few more mixup / cutmix / bbox range fixups by @​rwightman in huggingface/pytorch-image-models#2740
• Return the fused RMSNorm2d result directly by @​Robertboy18 in huggingface/pytorch-image-models#2741
• Fix custom input channels for pruned EfficientNet models by @​aswanth-07 in huggingface/pytorch-image-models#2742
• Preserve classifier head device and dtype on reset by @​aswanth-07 in huggingface/pytorch-image-models#2743
• Fix load_pretrained helper in NaFlexVit, make purpose clear by @​rwightman in huggingface/pytorch-image-models#2746
• Fix AttributeError in auto-augment factories when hparams is None by @​winklemad in huggingface/pytorch-image-models#2747
• Fix AdafactorBigVision dropping the factored row normalization for tall matrices by @​winklemad in huggingface/pytorch-image-models#2749
• Fix auto-augment 'inc' and 'b' config flags ignoring the documented 0 value by @​winklemad in huggingface/pytorch-image-models#2748
• Fix SGDW foreach path applying weight decay once per (device, dtype) group by @​winklemad in huggingface/pytorch-image-models#2750
• Fix OptimizerRegistry.create_optimizer crash on layer_decay without an explicit min scale by @​winklemad in huggingface/pytorch-image-models#2754
• Fix device / dtype change for all classifier resets by @​rwightman in huggingface/pytorch-image-models#2752
• Add LowFormer by @​brianhou0208 in huggingface/pytorch-image-models#2755

New Contributors

• @​chenghuichen made their first contribution in huggingface/pytorch-image-models#2719
• @​aswanth-07 made their first contribution in huggingface/pytorch-image-models#2737
• @​tandede made their first contribution in huggingface/pytorch-image-models#2739
• @​Robertboy18 made their first contribution in huggingface/pytorch-image-models#2741
• @​winklemad made their first contribution in huggingface/pytorch-image-models#2747

Full Changelog: huggingface/pytorch-image-models@v1.0.28...v1.0.29

Commits

• e617d17 Update README.md
• 542263d Add LowFormer (#2755)
• 3d6551d Update README version to 1.0.29 for a release
• 9a5261e Fix CI failures for reset_classifier() changes
• f578084 Restore training state for classifier reset layers
• 7d17fe6 Fix device / dtype change for all classifier resets
• a4075cd Fix OptimizerRegistry.create_optimizer crashing on layer_decay without min_scale
• 12b70ab Merge pull request #2750 from winklemad/fix-sgdw-multi-tensor-weight-decay
• 240e97d Merge pull request #2748 from winklemad/fix-auto-augment-bool-config-flags
• 11b7ca9 Fix AdafactorBigVision dropping the factored row normalization for tall matrices
• Additional commits viewable in compare view

Updates numba from 0.66.0 to 0.67.0

Release notes

Sourced from numba's releases.

0.67.0

Major Numba release, adding NumPy 2.5 support. Please view the release notes here: https://numba.readthedocs.io/en/0.67.0/release/0.67.0-notes.html

Commits

• 3190b91 Merge pull request #10772 from swap357/release0.67
• f68f603 add current pr on 0.67 pr list
• 86a975c update final release date for 0.67
• c7f14cf Merge pull request #10726 from swap357/pin_deps_0.67
• 123fa28 update test refs and pin dependencies for release0.67
• 0c89330 Merge pull request #10724 from swap357/changelog_0.67
• ffaa017 Merge pull request #10723 from swap357/update_version_support_table_0.67.0rc1
• af0d879 fix wrapping on release notes
• a5e4654 Update docs/source/release/0.67.0-notes.rst
• e85720e Update docs/source/release/0.67.0-notes.rst
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions