[dependabot]

Updates the requirements on huggingface-hub, openai and uvicorn to permit the latest version.
Updates huggingface-hub to 2.1.1

Release notes

Sourced from huggingface-hub's releases.

v2.1.1

[CLI] Rename 'hf spaces zero-gpu-quota' to 'hf spaces zero-gpu quota'- #5055

Full Changelog: huggingface/huggingface_hub@v2.1.0...v2.1.1

Commits

• bd4a760 Release: v2.1.1
• cb1755f [CLI] Rename 'hf spaces zero-gpu-quota' to 'hf spaces zero-gpu quota' (#5055)
• 43372b6 Release: v2.1.0
• efa122c Release: v2.1.0.rc0
• 0b26b50 [Spaces] Add get_zero_gpu_quota and hf spaces zero-gpu-quota (#5040)
• 604252e [HfApi] Add visibility to create_bucket (#5053)
• 4c88ea6 [Repos] Warn when duplicated repo files are still being copied (#5041)
• 3bb08e2 [Endpoints] Migrate catalog to the new /api/v1 API (#4928)
• b5e3a12 [HfApi] Support resource_group_id in duplicate_repo (#5038)
• 60fdb08 [Docs] Fix duplicated words in docstring and comments (#5052)
• Additional commits viewable in compare view

Updates openai to 3.24.0

Release notes

Sourced from openai's releases.

v3.24.0

3.24.0 (2026-10-02)

Features

• api: add custom voice creation and agent session events (#4013) (e5de2e5)

Bug Fixes

• api: prioritize Python request routing fields (#4014) (ffcc4c4)
• api: prioritize routing fields in parse helpers (#4016) (ba53a10)

Changelog

Sourced from openai's changelog.

3.24.0 (2026-10-02)

Features

• api: add custom voice creation and agent session events (#4013) (e5de2e5)

Bug Fixes

• api: prioritize Python request routing fields (#4014) (ffcc4c4)
• api: prioritize routing fields in parse helpers (#4016) (ba53a10)

3.23.0 (2026-10-01)

Features

• agents: [1/n] return typed answers from session streams (#4007) (10f8816)
• agents: stage files and download turn artifacts (#4009) (4fc2438)
• api: Add session traces and Realtime translations (#4001) (138e3d1)
• beta: expose typed application actions as agent tools (#4006) (f219c55)
• collect final output from beta Agents streams (157ac4c)

Bug Fixes

• api: allow original image detail in Chat Completions (#4005) (8a136c2)
• api: correct the eval run cancellation endpoint (#4003) (28c5c9a)
• api: retain WebSocket endpoint paths and query parameters (#3999) (7f203fd)
• keep Castiron budget results valid when main advances (#4012) (73f189b)
• responses: avoid replaying uncertain typed sends on reconnect (#4011) (1dbbf61)
• responses: respect send queue limits during reconnect (#4000) (50f95ac)
• use monotonic clock for file processing timeout (#3748) (58aca1d)

Chores

• api: retain WebRTC Live session transport types (#4002) (5c9ace9)
• deps-dev: bump pyright from 1.1.413 to 1.1.414 (#3902) (a91d779)
• deps: bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (#3976) (f15f43c)
• deps: bump CodeQL actions to 4.38.1 (#3974) (fb70d66)

3.22.1 (2026-09-30)

Bug Fixes

• api: correct the missing authentication error message (#3993) (51692ed), closes #3962
• transform NotRequired typed dictionary fields (#3995) (5544c18)

... (truncated)

Commits

• 637f1b8 release: 3.24.0 (#4015)
• e5de2e5 feat(api): add custom voice creation and agent session events (#4013)
• ba53a10 fix(api): prioritize routing fields in parse helpers (#4016)
• ffcc4c4 fix(api): prioritize Python request routing fields (#4014)
• 93bd2aa release: 3.23.0 (#3996)
• 73f189b fix: keep Castiron budget results valid when main advances (#4012)
• 1dbbf61 fix(responses): avoid replaying uncertain typed sends on reconnect (#4011)
• 4fc2438 feat(agents): stage files and download turn artifacts (#4009)
• a91d779 chore(deps-dev): bump pyright from 1.1.413 to 1.1.414 (#3902)
• fb70d66 chore(deps): bump CodeQL actions to 4.38.1 (#3974)
• Additional commits viewable in compare view

Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.