Skip to content

chore(deps): bump the python-runtime group across 1 directory with 7 updates#4

Merged
HuguesSib merged 2 commits intomainfrom
dependabot/uv/python-runtime-64ad7af641
May 7, 2026
Merged

chore(deps): bump the python-runtime group across 1 directory with 7 updates#4
HuguesSib merged 2 commits intomainfrom
dependabot/uv/python-runtime-64ad7af641

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 6, 2026

Updates the requirements on imageio[ffmpeg], typer, transformers, huggingface-hub, pycolmap, viser and mypy to permit the latest version.
Updates imageio[ffmpeg] to 2.37.3

Release notes

Sourced from imageio[ffmpeg]'s releases.

v2.37.3 (2026-03-09)

This release is published under the BSD-2-Clause License.

Bug

Maint

  • Bump psf/black (dev dependency) to fix security vulnerability (#1171, 30a8bab)

Detailed Changes: v2.37.2...v2.37.3

Changelog

Sourced from imageio[ffmpeg]'s changelog.

v2.37.3 (2026-03-09)

Bug

Maint

  • Bump psf/black (dev dependency) to fix security vulnerability (#1171, 30a8bab)

v2.37.2 (2025-11-04)

Bug

  • Gracefully handle reading of invalid EXIF orientation in Pillow plugin (#1159, 8b9d78d)

  • Prevent OverflowError for FPS in pyav plugin (#1121, e03963c)

Maint

v2.37.1 (2025-10-22)

Bug

... (truncated)

Commits
  • f3fdd40 REL: Release imageio v2.37.3
  • 30a8bab MAINT: Bump psf/black (dev dependency) to fix security vulnerability (#1171)
  • 971b83e BUG: Update dependencies (#1172)
  • 761929c REL: Release imageio v2.37.2
  • 0d20b85 MAINT: allow github actions to push to master in CD (#1163)
  • 6f76a11 make master the release branch (#1162)
  • e03963c BUG: Prevent OverflowError for FPS in pyav plugin (#1121)
  • 8b9d78d BUG: Gracefully handle reading of invalid EXIF orientation in Pillow plugin (...
  • 0b93c57 MAINT: fix publishing to GH and PyPI in CD (#1161)
  • 4fc3034 MAINT: Remove obsolete code for Python <= 3.4 (#1156)
  • Additional commits viewable in compare view

Updates typer from 0.25.0 to 0.25.1

Release notes

Sourced from typer's releases.

0.25.1

Features

Internal

Changelog

Sourced from typer's changelog.

0.25.1 (2026-04-30)

Features

Internal

Commits

Updates transformers from 5.6.2 to 5.8.0

Release notes

Sourced from transformers's releases.

Release 5.8.0

Release v5.8.0

New Model additions

DeepSeek-V4

DeepSeek-V4 is the next-generation MoE (Mixture of Experts) language model from DeepSeek that introduces several architectural innovations over DeepSeek-V3. The architecture replaces Multi-head Latent Attention (MLA) with a hybrid local + long-range attention design, swaps residual connections for Manifold-Constrained Hyper-Connections (mHC), and bootstraps the first few MoE layers with a static token-id → expert-id hash table. This implementation covers DeepSeek-V4-Flash, DeepSeek-V4-Pro, and their -Base pretrained variants, which share the same architecture but differ in width, depth, expert count and weights.

Links: Documentation | Paper

Gemma 4 Assistant

Gemma 4 Assistant is a small, text-only model that enables speculative decoding for Gemma 4 models using the Multi-Token Prediction (MTP) method and associated candidate generator. The model shares the same Gemma4TextModel backbone as other Gemma 4 models but uses KV sharing throughout the entire model, allowing it to reuse the KV cache populated by the target model and skip the pre-fill phase entirely. This architecture includes cross-attention to make the most of the target model's context, allowing the assistant to accurately predict more drafted tokens per drafting round.

Links: Documentation

GraniteSpeechPlus

Granite Speech Plus is a variant of Granite Speech that enhances the projector by consuming the concatenation of the encoder's final hidden states with an arbitrary subset of its intermediate hidden states along the feature dimension. It is a multimodal speech-to-text model that can transcribe audio, provide speaker annotation and word level timestamps by responding to text prompts. The model inherits the same architecture components as Granite Speech including the speech encoder, query transformer projector, language model, and optional LoRA adapter.

Links: Documentation

Granite4Vision

Granite Vision 4.1 is a vision-language model from IBM Research designed for enterprise-grade document data extraction. It specializes in chart extraction (Chart2CSV, Chart2Summary, Chart2Code), table extraction (JSON, HTML, OTSL), and semantic key-value pair extraction. The model builds on LLaVA-NeXT with architectural innovations including SigLIP2 Vision Encoder, Window Q-Former Projectors, and DeepStack Feature Injection with 8 vision-to-LLM injection points.

Links: Documentation

EXAONE-4.5

EXAONE 4.5 is the first open-weight vision language model developed by LG AI Research, integrating a dedicated visual encoder into the existing EXAONE 4.0 framework to expand multimodal capabilities. The model features 33 billion parameters in total, including 1.2 billion parameters from the vision encoder, and achieves competitive performance in general benchmarks while outperforming similar-sized models in document understanding and Korean contextual reasoning. It builds on EXAONE 4.0 with key enhancements including an expanded vocabulary of 153,600 tokens, support for up to 256K token context windows, and a Multi-Token Prediction (MTP) mechanism.

Links: Documentation | Paper | Blog Post

PP-FormulaNet

... (truncated)

Commits

Updates huggingface-hub from 1.12.0 to 1.14.0

Release notes

Sourced from huggingface-hub's releases.

[v1.14.0] Handle Spaces secrets & variables from CLI and other improvements

🖥️ Manage Space secrets and variables from the CLI

You can now manage Space secrets and environment variables directly from the command line with two new hf spaces subgroups: secrets and variables. Use hf spaces secrets to add, list, and delete write-only secrets, and hf spaces variables to add, list, and delete readable environment variables. Both add commands support multiple -s/-e flags and --secrets-file/-env-file for loading from dotenv files. On the Python side, HfApi.get_space_secrets() returns secret metadata (key, description, updated timestamp) without ever revealing values.

# List secrets (values are write-only — only keys and timestamps are shown)
$ hf spaces secrets ls username/my-space
Add secrets
$ hf spaces secrets add username/my-space -s OPENAI_API_KEY=sk-...
$ hf spaces secrets add username/my-space --secrets-file .env.secrets
Delete a secret (confirmation prompt, use --yes to skip)
$ hf spaces secrets delete username/my-space OPENAI_API_KEY --yes
List, add, and delete variables (values are readable)
$ hf spaces variables ls username/my-space
$ hf spaces variables add username/my-space -e MODEL_ID=gpt2 -e MAX_TOKENS=512
$ hf spaces variables delete username/my-space MAX_TOKENS --yes

📚 Documentation: CLI guide · Manage your Space

🪣 Rsync-style trailing slash for bucket folder copies

hf buckets cp now supports rsync-style trailing slash semantics when copying folders. A trailing / on the source path copies only the folder's contents to the destination, while omitting it nests the folder itself — matching the behavior you'd expect from rsync. This makes it possible to flatten directory structures during copies, which was not possible before. Additionally, copy_files now raises an explicit EntryNotFoundError when the source path resolves to no files, instead of silently succeeding with zero operations.

# Without trailing slash: "logs" dir is nested => dst/logs/...
$ hf buckets cp hf://buckets/username/src-bucket/logs hf://buckets/username/dst/
With trailing slash: only contents of "logs" are copied => dst/...
$ hf buckets cp hf://buckets/username/src-bucket/logs/ hf://buckets/username/dst/

  • [Buckets] Support rsync-style trailing slash in copy_files by @​Wauplin in #4187
  • [CLI] Raise error when copy_files source doesn't exist by @​Wauplin in #4186

📚 Documentation: Buckets guide · CLI guide

💔 Breaking Change

  • [CLI] Rename hf skills upgrade -> hf skills update by @​hanouticelina in #4176 — hf skills upgrade no longer exists; use hf skills update instead.
  • [CLI] Add out.status() by @​hanouticelina in #4171 — status updates (spinners/progress) on hf extensions install and hf spaces dev-mode are now suppressed when using --format json, --quiet, or --format agent.

🖥️ CLI

... (truncated)

Commits
  • 2ea0c83 Release: v1.14.0
  • f7cffc7 Release: v1.14.0.rc0
  • ac0156b style
  • 32476d9 Update typer dependency version in setup.py (#4193)
  • fadab7a [CLI] Raise error when copy_files source doesn't exist (#4186)
  • 7c0abeb [CLI] Add get_space_secrets + hf spaces secrets ls (#4182)
  • 51adb8f [Buckets] Support rsync-style trailing slash in copy_files to copy folder con...
  • 22eaf89 [internal] Untrack useless files (#4191)
  • 2774771 Update unit test warnings check to ignore unrelated deprecation warnings (#4188)
  • 3d19907 [CLI] Support hf -v to print version (#4185)
  • Additional commits viewable in compare view

Updates pycolmap from 3.13.0 to 4.0.4

Release notes

Sourced from pycolmap's releases.

4.0.4

Bug Fixes

  • Log an error instead of crash on unknown EXIF orientation
  • Fix crash in AdjustGlobalBundle after aggressive frame filtering
  • Change std::filesystem::relative to lexically_relative for NormalizePath
  • Fix onnxruntime DLL copy error under Windows in Findonnxruntime.cmake

4.0.3

Bug Fixes

  • Fix various issues in incremental mapper's reg_stats bookkepping
  • Fix reading of dynamic matrices in SQLite3 database
  • Fix optional access in guided matching
  • Fix conditional Eigen alignment for 3.4.0 pre-release version
  • Fix ceres::GradientChecker constructor for older Ceres versions
  • Fix for pycolmap installation related to ONNX
  • Fix bug where num_reg_images was not cleared
  • Fix mask usage log never printing in feature writer thread
  • Fix undefined behavior in PoissonRecon
  • Fix locale-dependent float parsing/formatting
  • Fix empty PatchMatch results on Blackwell GPUs (sm_100+)
  • Fix pyceres .problem attribute on CeresBundleAdjuster returned by factory functions
  • Fix missing rotation averaging options to global mapper
  • Fix piping of bundle adjustment options in global mapper

Improvements

  • Handle CHOLMOD includes not being in a subdirectory
  • Use non-deprecated SQLite3::SQLite3 CMake target
  • Reduce thread oversubscription in hierarchical mapper

4.0.2

  • Fix ALIKED keypoint score filtering
  • Fix ALIKED extraction with pycolmap
  • Fix missing reset of mesh simplification options

4.0.1

Bug Fixes

  • Add missing LightGlue matcher type to GUI
  • Fix checks in GpuMat constructor
  • Add destructor to ModelViewerWidget to call makeCurrent()

4.0.0

New Features

  • Integrated GLOMAP global SfM pipeline into COLMAP as a first-class alternative to the incremental/hierarchical mappers, available via the global_mapper and automatic_reconstructor --mapper GLOBAL commands. Many fixes and improvements have been applied to the GLOMAP codebase as part of this migration.

... (truncated)

Changelog

Sourced from pycolmap's changelog.

COLMAP 4.0.4 (04/27/2026)

Bug Fixes

  • Log an error instead of crash on unknown EXIF orientation
  • Fix crash in AdjustGlobalBundle after aggressive frame filtering
  • Change std::filesystem::relative to lexically_relative for NormalizePath
  • Fix onnxruntime DLL copy error under Windows in Findonnxruntime.cmake

COLMAP 4.0.3 (04/06/2026)

Bug Fixes

  • Fix various issues in incremental mapper's reg_stats bookkeeping
  • Fix reading of dynamic matrices in SQLite3 database
  • Fix optional access in guided matching
  • Fix conditional Eigen alignment for 3.4.0 pre-release version
  • Fix ceres::GradientChecker constructor for older Ceres versions
  • Fix for pycolmap installation related to ONNX
  • Fix bug where num_reg_images was not cleared
  • Fix mask usage log never printing in feature writer thread
  • Fix undefined behavior in PoissonRecon
  • Fix locale-dependent float parsing/formatting
  • Fix empty PatchMatch results on Blackwell GPUs (sm_100+)
  • Fix pyceres .problem attribute on CeresBundleAdjuster returned by factory functions
  • Fix missing rotation averaging options to global mapper
  • Fix piping of bundle adjustment options in global mapper

Improvements

  • Handle CHOLMOD includes not being in a subdirectory
  • Use non-deprecated SQLite3::SQLite3 CMake target
  • Reduce thread oversubscription in hierarchical mapper

COLMAP 4.0.2 (03/18/2026)

Bug Fixes

  • Fix ALIKED keypoint score filtering
  • Fix ALIKED extraction with pycolmap
  • Fix missing reset of mesh simplification options

COLMAP 4.0.1 (03/15/2026)

... (truncated)

Commits

Updates viser from 1.0.26 to 1.0.27

Release notes

Sourced from viser's releases.

v1.0.27

New features:

  • Added SceneApi.add_arrows()
  • Added experimental scene-node drag callbacks on raycastable scene handles: on_drag_start(), on_drag_update(), on_drag_end(), and matching remove methods.
  • Added modifier filtering to scene-node on_click() callbacks; SceneNodePointerEvent now includes modifier.
  • Added SceneApi.on_click() and SceneApi.on_rect_select() with typed SceneClickEvent and SceneRectSelectEvent. Legacy on_pointer_event(), remove_pointer_callback(), and on_pointer_callback_removed() are deprecated.
  • Added experimental command palette API via GuiApi.add_command().
  • Added GuiApi.add_form() and GuiFormHandle for grouped GUI submit semantics via on_submit().
  • Added GuiApi.add_divider() and GuiDividerHandle for horizontal GUI dividers.

Updates:

  • Changed GuiApi.add_folder() to accept label=None for borderless/headerless layout groups.
  • Changed GuiTabGroupHandle.add_tab() to accept an optional icon=.
  • Changed GuiApi.add_plotly() to accept a Plotly config dict.
  • Changed GuiApi.add_uplot() to accept fixed height and padding.
  • Changed SceneApi.add_point_cloud() to accept point_shading="flat" | "gradient"; default is "gradient".

What's Changed

New Contributors

Full Changelog: viser-project/viser@v1.0.26...v1.0.27

... (truncated)

Commits
  • eac22c5 1.0.27
  • 45df144 Fix uPlot scaling when range tuple is specified (#712)
  • 3af9627 Type-aware prop editor for scene tree (#710)
  • ec81f4e Consistent modifier support for clicks and pointer events, break `on_pointer_...
  • 5b40dc6 More consistent API for hotkey and drag modifiers (#708)
  • 42c5842 Visual adjustments for tab handles (#707)
  • f3da9bd Fix hover outline transform for GLB geometries (#706)
  • 2bc8dad Add missing names to docs, test (#705)
  • 40982ee Add WebGL detection with user-friendly notifications (#695)
  • d9d452d Hide tooltip when dragging sliders (#703)
  • Additional commits viewable in compare view

Updates mypy from 1.20.2 to 2.0.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.0

We’ve just uploaded mypy 2.0.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. There are also changes to options and defaults. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Enable --local-partial-types by Default

This flag affects the inference of types based on assignments in other scopes. For now, explicitly disabling this continues to be supported, but this support will be removed in the future as the legacy behaviour is hard to support with other current and future features in mypy, like the daemon or the new implementation of flexible redefinitions.

Contributed by Ivan Levkivskyi, Jukka Lehtosalo, Shantanu in PR 21163.

Enable --strict-bytes by Default

Per PEP 688, mypy no longer treats bytearray and memoryview values as assignable to the bytes type.

Contributed by Shantanu in PR 18371.

New Behavior for --allow-redefinition

The --allow-redefinition flag now behaves like --allow-redefinition-new in mypy 1.20 and earlier. The new behavior is generally more flexible. For example, you can have different types for a variable in different blocks:

# mypy: allow-redefinition
def foo(cond: bool) -> None:
if cond:
for x in ["a", "b"]:
# Type of "x" is "str" here
...
else:
for x in [1, 2]:
# Type of "x" is "int" here
...

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-runtime group across 1 directory with 7 …
bfad398 
…updates

Updates the requirements on [imageio[ffmpeg]](https://github.com/imageio/imageio), [typer](https://github.com/fastapi/typer), [transformers](https://github.com/huggingface/transformers), [huggingface-hub](https://github.com/huggingface/huggingface_hub), [pycolmap](https://github.com/colmap/colmap), [viser](https://github.com/viser-project/viser) and [mypy](https://github.com/python/mypy) to permit the latest version.

Updates `imageio[ffmpeg]` to 2.37.3
- [Release notes](https://github.com/imageio/imageio/releases)
- [Changelog](https://github.com/imageio/imageio/blob/master/CHANGELOG.md)
- [Commits](imageio/imageio@v2.37.0...v2.37.3)

Updates `typer` from 0.25.0 to 0.25.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.25.0...0.25.1)

Updates `transformers` from 5.6.2 to 5.8.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.6.2...v5.8.0)

Updates `huggingface-hub` from 1.12.0 to 1.14.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.12.0...v1.14.0)

Updates `pycolmap` from 3.13.0 to 4.0.4
- [Release notes](https://github.com/colmap/colmap/releases)
- [Changelog](https://github.com/colmap/colmap/blob/main/CHANGELOG.rst)
- [Commits](colmap/colmap@3.13.0...4.0.4)

Updates `viser` from 1.0.26 to 1.0.27
- [Release notes](https://github.com/viser-project/viser/releases)
- [Commits](viser-project/viser@v1.0.26...v1.0.27)

Updates `mypy` from 1.20.2 to 2.0.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.2...v2.0.0)

---
updated-dependencies:
- dependency-name: imageio[ffmpeg]
  dependency-version: 2.37.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: typer
  dependency-version: 0.25.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: transformers
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: huggingface-hub
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: pycolmap
  dependency-version: 4.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-runtime
- dependency-name: viser
  dependency-version: 1.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: mypy
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 6, 2026

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@HuguesSib HuguesSib merged commit cf2206c into main May 7, 2026
3 checks passed
@HuguesSib HuguesSib deleted the dependabot/uv/python-runtime-64ad7af641 branch May 7, 2026 22:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@HuguesSib HuguesSib HuguesSib approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HuguesSib