Skip to content

build(deps): Bump the pip-sidecar-patch-minor group across 1 directory with 11 updates - #446

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/sidecar/pip-sidecar-patch-minor-688b91652a
Open

build(deps): Bump the pip-sidecar-patch-minor group across 1 directory with 11 updates#446
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/sidecar/pip-sidecar-patch-minor-688b91652a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip-sidecar-patch-minor group with 11 updates in the /sidecar directory:

Package From To
kokoro-onnx 0.5.0 0.6.1
onnxruntime 1.28.0 1.29.0
scipy 1.18.0 1.18.1
huggingface-hub 1.26.0 1.28.0
filelock 3.32.2 3.32.4
idna 3.18 3.19
numpy 2.5.1 2.5.2
platformdirs 4.11.0 4.11.4
protobuf 7.35.1 7.36.0
pygments 2.20.0 2.21.0
nvidia-cudnn-cu12 9.24.0.43 9.25.0.15

Updates kokoro-onnx from 0.5.0 to 0.6.1

Release notes

Sourced from kokoro-onnx's releases.

model-files

kokoro-v0_19.onnx: (310MB): optimized f32 version from taylorchu/kokoro-onnx kokoro-v0_19.fp16.onnx: (169MB): optimized f16 version from taylorchu/kokoro-onnx kokoro-v0_19.int8.onnx: (88MB): optimized int8 version from taylorchu/kokoro-onnx voices.bin: npz (numpy) key value pairs of style vectors contains the following voices (26):

af_alloy, af_aoede, af_bella, af_jessica, af_kore, af_nicole, af_nova, af_river, af_sarah, af_sky, am_adam, am_echo, am_eric, am_fenrir, am_liam, am_michael, am_onyx, am_puck, bf_alice, bf_emma, bf_isabella, bf_lily, bm_daniel, bm_fable, bm_george, bm_lewis
Commits

Updates onnxruntime from 1.28.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates scipy from 1.18.0 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

  • Name (commits)
  • Wasim Akram (2) +
  • Jake Bowhay (1)
  • Michael Bratsch (1)
  • Dietrich Brunn (1)
  • Evgeni Burovski (1)
  • Aadya Chinubhai (1)
  • Lucas Colley (3)
  • Tekin Ertekin (1) +
  • Fuyugithub (2) +
  • Ralf Gommers (11)
  • Joren Hammudoglu (1)
  • Ijtihed Kilani (1) +
  • Andrew Nelson (2)
  • Ilhan Polat (1)
  • Tyler Reddy (39)
  • romao05 (1) +
  • Michael Simacek (1) +
  • Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits
  • e4e854e REL: SciPy 1.18.1 rel commit
  • 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
  • 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
  • 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
  • a717e28 DOC: PR 25884 revisions
  • bb489c0 DOC: PR 25884 revisions
  • 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
  • 095fe56 DOC, BLD: PR 25884 revisions
  • e66ea64 DOC: update minimum GCC version in toolchain roadmap
  • c021653 TST: tolerance bumps and skips on 32-bit platforms
  • Additional commits viewable in compare view

Updates huggingface-hub from 1.26.0 to 1.28.0

Release notes

Sourced from huggingface-hub's releases.

[v1.28.0] Hardware discovery and managed engine images for Inference Endpoints and more

🔎 Discover deployable hardware with hf endpoints hardware

Deploying an Inference Endpoint requires five hardware flags (--vendor, --region, --accelerator, --instance-type, --instance-size) whose valid values depend on each other, and until now there was no way to learn them from the CLI. The new hf endpoints hardware command lists the valid combinations along with the price per replica per hour and your namespace's accelerator quota, filtered by default to the hardware you can deploy on right now. The same data is available in the SDK via list_inference_endpoints_hardware(), which flattens the API response into InferenceEndpointHardware objects you can filter programmatically.

>>> hf endpoints hardware --vendor aws --region eu-west-1
VENDOR REGION    ACCELERATOR INSTANCE_TYPE INSTANCE_SIZE MEMORY_GB GPU_MEMORY_GB PRICE_PER_HOUR QUOTA STATUS
------ --------- ----------- ------------- ------------- --------- ------------- -------------- ----- ---------
aws    eu-west-1 cpu         intel-spr     x1                  2.0                        0.033 0/60  available
aws    eu-west-1 cpu         intel-spr     x2                  4.0                        0.067 0/60  available
aws    eu-west-1 gpu         nvidia-a10g   x1                 30.0            24            1.0 0/16  available
aws    eu-west-1 gpu         nvidia-t4     x1                 15.0            16            0.5 1/30  available

🚀 Managed engine images and multi-accelerator parallelism for Inference Endpoints

custom_image now accepts the engine-specific container types supported by the API: key the dictionary with the engine name (vLLM, sGLang, tgi, tei, llamacpp, hfServe, ...) instead of leaving it flat, and each engine takes the usual container fields plus its own tuning options. Any dict without a top-level url is forwarded to the API untouched, so engines added to the API later will work without upgrading huggingface_hub, and update_inference_endpoint now handles the same payload shapes as create_inference_endpoint. On the CLI, hf endpoints deploy and hf endpoints update gain --engine, --tensor-parallel-size and --data-parallel-size, and update also accepts --custom-image, --health-route and --port. This matters because vLLM and SGLang default to a single accelerator while an endpoint is allocated every accelerator of its instance — the API now rejects that misconfiguration, and these flags are how you set things right.

$ hf endpoints deploy gpt-oss-120b-vllm --repo openai/gpt-oss-120b --framework custom \
    --accelerator gpu --instance-size x8 --instance-type nvidia-h200 --region us-east-1 --vendor aws \
    --engine vllm --custom-image vllm/vllm-openai:v0.23.0 --tensor-parallel-size 8
Retune a running endpoint
$ hf endpoints update gpt-oss-120b-vllm --tensor-parallel-size 4 --data-parallel-size 2

💔 Breaking change: huggingface_hub.constants.INFERENCE_ENDPOINT_IMAGE_KEYS is removed. It was never exported at the package root nor documented, but code reading it directly will now get an AttributeError.

  • [Inference Endpoints] Support managed engine images in custom_image by @​hanouticelina in #4671
  • [CLI] Add --tensor-parallel-size / --data-parallel-size to hf endpoints deploy and update by @​moon-bot-app[bot] in #4661

🤖 Inference

  • [Inference Providers] deepinfra: add text-to-speech support by @​ovuruska in #4559
  • [Inference Providers] deepinfra: add feature-extraction support by @​ovuruska in #4656

🖥️ CLI

🐛 Bug and typo fixes

... (truncated)

Commits
  • b2da2d4 Release: v1.28.0
  • a718e44 Release: v1.28.0.rc0
  • 7105c3d [CLI] Add --tensor-parallel-size / --data-parallel-size to `hf endpoints depl...
  • a3d9d8a [Inference Endpoints] Omit model.task instead of sending null on create (#4...
  • 909b162 [Inference Endpoints] Add hf endpoints hardware to list available instances...
  • 5ac9711 Do not use a redirect's Content-Length as file size in get_hf_file_metadata (...
  • 99aba55 [Docs] Normalize malformed docstring parameter entries (#4623)
  • 2e6c67d [Inference Providers] deepinfra: add feature-extraction (embeddings) support ...
  • 7a522f0 docs: remove obsolete Repository guide references (#4679)
  • aa40a65 [Download] Fix ResolvedRevision string value after pickle/copy (#4692)
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 3.32.4

Release notes

Sourced from filelock's releases.

3.32.4

What's Changed

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683

... (truncated)

Commits
  • cb493d6 Release 3.32.4
  • fe07a11 escape the hostname every marker publishes (#709)
  • 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
  • 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
  • 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
  • f12a52f build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#711)
  • 54c7b6c [pre-commit.ci] pre-commit autoupdate (#710)
  • 49f8035 🧪 test: cover a reclaimed private record for real (#706)
  • bb16d39 🧪 test: deflake six scheduled-run failures (#704)
  • 13b82a6 🐛 fix: retry transient denials on open and claim read (#705)
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • 03a9a11 Release 3.19
  • 2d2a7ef Pre-release 3.19rc0
  • 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
  • 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
  • ce9fd98 Merge pull request #267 from kjd/housekeeping
  • 809240c Fail CI when the license copyright year is behind the current year
  • d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
  • ef30fee Remove dead code and pare back superfluous comments
  • b907913 Tighten the version support and Unicode notes in the README
  • 6204cbe Ignore local build artifacts and stop packaging stray tooling config
  • Additional commits viewable in compare view

Updates numpy from 2.5.1 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Abhijeetsingh Meena +
  • Charalampos Stratakis
  • Charles Harris
  • Chris Ninham +
  • David Woods
  • Geonho +
  • Gopu Yeshwanth Reddy +
  • Iason Krommydas
  • Ijtihed Kilani
  • Jelle Zijlstra +
  • Joren Hammudoglu
  • Kumar Aditya
  • Mike Boyle
  • Nathan Goldbaum
  • Raghuveer Devulapalli
  • Sebastian Berg

... (truncated)

Commits
  • 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
  • ecf599c Merge pull request #32221 from charris/backport-32151
  • 3c7ac97 Merge pull request #32220 from charris/backport-32205
  • 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
  • 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
  • c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
  • 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
  • d8262bc MAINT: Update cibuildwheel to v4.2.0
  • 988d94d Merge pull request #32158 from charris/backport-32133
  • b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.11.4

Release notes

Sourced from platformdirs's releases.

4.11.4

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.3...4.11.4

4.11.3

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.2...4.11.3

4.11.2

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.1...4.11.2

4.11.1

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.0...4.11.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
  • Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

4.11.4 (2026-08-24)

  • Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
  • Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

4.11.3 (2026-08-13)

  • python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
  • Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

4.11.2 (2026-08-10)

... (truncated)

Commits
  • e5fd9ea Release 4.11.4
  • 4bf9228 docs: fix merge order in the config how-to (#529)
  • c653668 fix: stop iter_*_dirs yielding the same directory twice (#524)
  • f18ebaf 🔧 chore: batch dependency updates weekly on Tuesday (#528)
  • b2f29d8 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 in the all group (...
  • 272f340 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 in the all group (#...
  • d3cf61c [pre-commit.ci] pre-commit autoupdate (#525)
  • 7f3960a Release 4.11.3
  • c8af984 fix: don't crash when an XDG dirs variable holds only separators (#523)
  • 6d2105a 📄 docs: publish llms.txt from the docs build (#522)
  • Additional commits viewable in compare view

Updates protobuf from 7.35.1 to 7.36.0

Commits

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
    • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (Description has been truncated

@dependabot
build(deps): Bump the pip-sidecar-patch-minor group across 1 director…
16498dd 
…y with 11 updates

Bumps the pip-sidecar-patch-minor group with 11 updates in the /sidecar directory:

| Package | From | To |
| --- | --- | --- |
| [kokoro-onnx](https://github.com/thewh1teagle/kokoro-onnx) | `0.5.0` | `0.6.1` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.28.0` | `1.29.0` |
| [scipy](https://github.com/scipy/scipy) | `1.18.0` | `1.18.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.26.0` | `1.28.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.4` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.19` |
| [numpy](https://github.com/numpy/numpy) | `2.5.1` | `2.5.2` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.11.4` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.1` | `7.36.0` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [nvidia-cudnn-cu12](https://developer.nvidia.com/cuda-zone) | `9.24.0.43` | `9.25.0.15` |



Updates `kokoro-onnx` from 0.5.0 to 0.6.1
- [Release notes](https://github.com/thewh1teagle/kokoro-onnx/releases)
- [Commits](https://github.com/thewh1teagle/kokoro-onnx/commits)

Updates `onnxruntime` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.28.0...v1.29.0)

Updates `scipy` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

Updates `huggingface-hub` from 1.26.0 to 1.28.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.26.0...v1.28.0)

Updates `filelock` from 3.32.2 to 3.32.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.4)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `numpy` from 2.5.1 to 2.5.2
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.1...v2.5.2)

Updates `platformdirs` from 4.11.0 to 4.11.4
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.0...4.11.4)

Updates `protobuf` from 7.35.1 to 7.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `nvidia-cudnn-cu12` from 9.24.0.43 to 9.25.0.15

---
updated-dependencies:
- dependency-name: kokoro-onnx
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: onnxruntime
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-sidecar-patch-minor
- dependency-name: huggingface-hub
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: filelock
  dependency-version: 3.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-sidecar-patch-minor
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: numpy
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-sidecar-patch-minor
- dependency-name: platformdirs
  dependency-version: 4.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-sidecar-patch-minor
- dependency-name: protobuf
  dependency-version: 7.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
- dependency-name: nvidia-cudnn-cu12
  dependency-version: 9.25.0.15
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-sidecar-patch-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: area:ci, type:chore. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants