build(deps): bump the python-dependencies group with 12 updates

[dependabot]

Updates the requirements on fastapi, numpy, opencv-python-headless, python-multipart, uvicorn, easyocr, ultralytics, httpx, pytest, pytest-cov, ruff and hatchling to permit the latest version.
Updates fastapi from 0.110.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates numpy from 1.26.4 to 2.4.6

Release notes

Sourced from numpy's releases.

v2.4.6 (May 18, 2026)

NumPy 2.4.6 Release Notes

NumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5 release.

This release supports Python versions 3.11-3.14

Contributors

A total of 4 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• !EarlMilktea
• Charles Harris
• Sebastian Berg
• Warren Weckesser

Pull requests merged

A total of 4 pull requests were merged for this release.

• #31444: MAINT: Prepare 2.4.x for further development
• #31453: BUG: Fix regression in arr.conj()
• #31459: BUG: np.linalg.svd(..., hermitian=True) returns non-unitary...
• #31460: BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator...

v2.4.5 (May 15, 2026)

NumPy 2.4.5 Release Notes

NumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4 release, has some typing improvements, and maintains infrastructure.

This release supports Python versions 3.11-3.14

Contributors

A total of 17 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Aleksei Nikiforov
• Anarion Zuo +
• Ankit Ahlawat
• Breno Favaretto +
• Charles Harris
• Igor Krivenko +
• Ijtihed Kilani +
• Joren Hammudoglu
• Maarten Baert +

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the requirements/*_requirements.txt files to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits

• b832a09 Merge pull request #31462 from charris/prepare-2.4.6
• 57cc147 REL: Prepare for the NumPy 2.4.6 release
• 0c72b0b Merge pull request #31459 from charris/backport-31347
• 9778d26 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
• e0e3876 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
• d1bffeb BUG: np.linalg.svd(..., hermitian=True) returns non-unitary vh (#31347)
• 8d8d7e5 Merge pull request #31453 from seberg/issue-31452
• bddaab7 BUG: Fix regression in arr.conj()
• 37a1ecc Merge pull request #31444 from charris/begin-2.4.6
• 3c0e043 MAINT: Prepare 2.4.x for further development
• Additional commits viewable in compare view

Updates opencv-python-headless from 4.11.0.86 to 5.0.0.93

Release notes

Sourced from opencv-python-headless's releases.

5.0.0.93

OpenCV 5.0.0 released!

OpenCV 5.0.0 overview: https://opencv.org/opencv-5 OpenCV 4.x -> 5.x migration guide: https://github.com/opencv/opencv/wiki/OpenCV-4-to-5-migration

4.13.0.92

Follow up release for 4.13.0 with X server dependency fix. See #28438 for details.

4.13.0.90

Complete OpenCV 4.13.0 changelog: https://github.com/opencv/opencv/wiki/OpenCV-Change-Logs#version4130

Python specific:

• Manylinux 2_28 support, Numpy 2.4 support, Python 3.14 support
• Tuned Python bindings for logging #27812
• Marked Feature2D.detectAndCompute mask as optional in Python type stubs #27544
• Marked distCoeffs/R/D as optional in calib3d functions #27564
• Added DLPACK support #27581, #27861
• Fixed memory leaks in pybindings #27738
• Add PathLike type hints for args annotated with CV_WRAP_FILE_PATH #27767
• Fixed memory leak in pyopencv_to for path-like objects #28047
• Tunned Python bindings: use export_name as resolved typename for AliasTypeNode #27997
• python: fix pytest-cov false warnings by using compile() with full file path in exec_file_wrapper #28093
• Fixed python scalar typing issues #27620
• Fixed bug in ifdef state machine in header parser for bindings #27393
• Wrap GridType field in cv::findCirclesGrid parameters structure #27689

4.12.0.88

Complete OpenCV 4.12.0 changelog: https://github.com/opencv/opencv/wiki/OpenCV-Change-Logs#version4120

Python:

• Added libavif to the package and corresponding image format support on Linux and Mac OS. Windows is in progress.
• Enabled GIF support by default.
• Updated Numpy dependency rules. Packages for Python 3.9+ are built with Numpy 2.x. Packages for older Python version are built with Numpy 1.x.
• Improved libjpeg-turbo performance in Windows builds (added NASM and assembly branches).
• Made DNN, FLANN, G-API modules optional during the package build (bindings generation and typing).

Commits

• See full diff in compare view

Updates python-multipart from 0.0.9 to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

• Replace per-byte partial-boundary scan with rfind lookbehind by @​Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Version 0.0.31

What's Changed

• Speed up multipart header parsing and callback dispatch by @​Kludex in Kludex/python-multipart#295
• Bound header field name size before validating by @​Kludex in Kludex/python-multipart#296
• Validate Content-Length is non-negative in parse_form by @​Kludex in Kludex/python-multipart#297

Full Changelog: Kludex/python-multipart@0.0.30...0.0.31

Version 0.0.30

What's Changed

• Treat only & as the urlencoded field separator by @​Kludex in Kludex/python-multipart#290
• Ignore RFC 2231 extended parameters in parse_options_header by @​Kludex in Kludex/python-multipart#291

Full Changelog: Kludex/python-multipart@0.0.29...0.0.30

Version 0.0.29

What's Changed

• Handle malformed RFC 2231 continuations in parse_options_header by @​manunio in Kludex/python-multipart#270

Full Changelog: Kludex/python-multipart@0.0.28...0.0.29

Version 0.0.28

What's Changed

• Speed up partial-boundary tail scan via bytes.find by @​Kludex in Kludex/python-multipart#281
• Cap multipart boundary length at 256 bytes by @​Kludex in Kludex/python-multipart#282

Full Changelog: Kludex/python-multipart@0.0.27...0.0.28

Version 0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Version 0.0.26

What's Changed

• Skip preamble before first multipart boundary by @​Kludex in Kludex/python-multipart#262
• Silently discard epilogue data after the closing boundary by @​Kludex in Kludex/python-multipart#259

... (truncated)

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

• Speed up partial-boundary scanning for CR/LF-dense part data #300.

0.0.31 (2026-06-04)

• Speed up multipart header parsing and callback dispatch #295.
• Bound header field name size before validating #296.
• Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

• Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
• Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

0.0.29 (2026-05-17)

• Handle malformed RFC 2231 continuations in parse_options_header #270.

0.0.28 (2026-05-10)

• Speed up partial-boundary tail scan via bytes.find #281.
• Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

• Skip preamble before the first multipart boundary more efficiently #262.
• Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

• Add MIME content type info to File #143.
• Handle CTE values case-insensitively #258.
• Remove custom FormParser classes #257.
• Add UPLOAD_DELETE_TMP to FormParser config #254.
• Emit field_end for trailing bare field names on finalize #230.
• Handle multipart headers case-insensitively #252.
• Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

• Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

... (truncated)

Commits

• 238ead6 Version 0.0.32 (#302)
• 8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
• 8190779 Bump the python-packages group with 7 updates (#301)
• 0d3c086 Use uv package ecosystem for Dependabot (#299)
• 4cffc68 Version 0.0.31 (#298)
• c814948 Reject negative Content-Length in parse_form (#297)
• 6b837d4 Bound header field name size before validating (#296)
• e0c4f9d Bump the github-actions group with 3 updates (#294)
• b8a01bb Bump the python-packages group with 3 updates (#293)
• 6732164 Speed up multipart header parsing and callback dispatch (#295)
• Additional commits viewable in compare view

Updates uvicorn from 0.27.1 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Version 0.51.0

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in Kludex/uvicorn#3025
• Remove colorama from the standard extra by @​Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @​Aayush7352 in Kludex/uvicorn#3019

New Contributors

• @​Aayush7352 made their first contribution in Kludex/uvicorn#3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

• Memoize trusted host checks to avoid re-parsing the client IP per request by @​Kludex in Kludex/uvicorn#2970
• Cache the asgi scope sub-dict per connection by @​Kludex in Kludex/uvicorn#2976
• Build a fresh asgi scope dict per request by @​Kludex in Kludex/uvicorn#2977
• Replace click.style with an internal ANSI style helper by @​Kludex in Kludex/uvicorn#2981
• Avoid copying single-frame WebSocket payloads in websockets-sansio by @​Kludex in Kludex/uvicorn#2983

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits

• ee8e45c Version 0.52.1 (#3056)
• b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
• 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
• 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
• 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
• e148451 Handle connection loss during WebSocket write backpressure (#3050)
• e16a69b Add missing write flow control to websockets-sansio (#3048)
• ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• Additional commits viewable in compare view

Updates easyocr from 1.7.1 to 1.7.2

Release notes

Sourced from easyocr's releases.

v1.7.2

• 24 September 2024 - Version 1.7.2
  • Fix several compatibilities

Changelog

Sourced from easyocr's changelog.

• 24 September 2024 - Version 1.7.2
  • Fix several compatibilities
• 4 September 2023 - Version 1.7.1
  • Fix several compatibilities
• 25 May 2023 - Version 1.7.0
  • Add Apple Silicon support (thanks@​rayeesoft and @​ArtemBernatskyy, see PR)
  • Fix several compatibilities
• 15 September 2022 - Version 1.6.2
  • Add CPU support for DBnet
  • DBNet will only be compiled when users initialize DBnet detector.
• 1 September 2022 - Version 1.6.1
  • Fix DBNet path bug for Windows
  • Add new built-in model cyrillic_g2. This model is a new default for Cyrillic script. (partial financial support by Alejandro Cabrerizo)
• 24 August 2022 - Version 1.6.0
  • Restructure code to support alternative text detectors.
  • Add detector DBNet, see paper. It can be used by initializing like this reader = easyocr.Reader(['en'], detect_network = 'dbnet18'). Currently, DBNet text detector requires running with GPU.
• 2 June 2022 - Version 1.5.0
  • Add trainer for CRAFT detection model (thanks@​gmuffiness, see PR)
• 9 April 2022 - Version 1.4.2
  • Update dependencies (opencv and pillow issues)
• 11 September 2021 - Version 1.4.1
  • Add trainer folder
  • Add readtextlang method (thanks@​arkya-art, see PR)
  • Extend rotation_info argument to support all possible angle (thanksabde0103, see PR)
• 29 June 2021 - Version 1.4
  • Instruction on training/using custom recognition model
  • Example dataset
  • Batched image inference for GPU (thanks @​SamSamhuns, see PR)
  • Vertical text support (thanks @​interactivetech). This is for rotated text, not to be confused with vertical Chinese or Japanese text. (see PR)
  • Output in dictionary format (thanks @​A2va, see PR)
• 30 May 2021 - Version 1.3.2
  • Faster greedy decoder (thanks @​samayala22)
  • Fix bug when text box's aspect ratio is disproportional (thanks iQuartic for bug report)
• 20 April 2021 - Version 1.3.1
  • Add support for PIL image (thanks @​prays)
  • Add Tajik language (tjk)
  • Update argument setting for command line
  • Add x_ths and y_ths to control merging behavior when paragraph=True
• 21 March 2021 - Version 1.3
  • Second-generation models: multiple times smaller size, multiple times faster inference, additional characters, comparable accuracy to the first generation models. EasyOCR will choose the latest model by default but you can also specify which model to use by passing recog_network argument when creating Reader instance. For example, reader = easyocr.Reader(['en','fr'], recog_network = 'latin_g1') will use the 1st generation Latin model.
  • List of all models: Model hub
• 22 February 2021 - Version 1.2.5
  • Add dynamic quantization for faster CPU inference (it is enabled by default for CPU mode)
  • More sensible confident score
• 7 February 2021 - Version 1.2.4
  • Faster CPU inference speed by using dynamic input shape (recognition rate increases by around 100% for images with a lot of text)
• 1 February 2021 - Version 1.2.3
  • Add setLanguageList method to Reader class. This is a convenient api for changing languages (within the same model) after creating class instance.

... (truncated)

Commits

• c4f3cd7 update v.1.7.2
• 3d3852d Merge pull request #1283 from Yepness/master
• 86094d6 Fix: import get_display
• See full diff in compare view

Updates ultralytics from 8.3.162 to 8.4.115

Release notes

Sourced from ultralytics's releases.

v8.4.115 - Deprecate HUB in favor of Ultralytics Platform (#25608)

🌟 Summary

v8.4.115 transitions Ultralytics from legacy HUB integrations to the streamlined Ultralytics Platform experience, with simpler authentication and a leaner training codebase. 🚀

📊 Key Changes

• 🔐 Introduced validated Platform CLI authentication

  • Log in with yolo login API_KEY
  • Remove credentials with yolo logout
  • API keys are checked against the Platform before being saved.

• 🔄 Added settings migration to schema 0.0.7

  • Existing compatible settings, such as custom dataset and run directories, are preserved.
  • Legacy HUB configuration and incompatible HUB API keys are removed automatically.
  • Users with old credentials are directed to create a Platform API key.

• 🧹 Removed the legacy ultralytics.hub package

  • HUB authentication, remote training sessions, model loading, exports, dataset utilities, callbacks, and HUB-specific exceptions have been retired.
  • HUB-related API references, documentation pages, navigation entries, and the HUB example notebook were also removed.

• 🧠 Simplified model and trainer workflows

  • Models no longer load directly from HUB URLs.
  • Training no longer manages HUB sessions, remote checkpoints, heartbeats, or HUB-specific training arguments.
  • Platform callbacks remain available for streaming training information.

• 📚 Updated documentation and examples

  • Guides, notebooks, CLI help, and API documentation now reference the Ultralytics Platform instead of HUB.
  • Platform authentication and login commands are included in the quickstart and CLI documentation.

• ✅ Expanded test coverage

  • Added tests for settings migration, API-key validation, login, and logout behavior.

🎯 Purpose & Impact

• ✨ A clearer user experience: Platform is now the primary destination for dataset management, training, and deployment, avoiding confusion between HUB and Platform services.
• ⚡ Simpler authentication: The new yolo login command validates credentials directly and provides a more intuitive alternative to manually editing settings.
• 🛠️ Cleaner and easier-to-maintain code: Removing obsolete HUB components reduces dependencies, integration complexity, and potential maintenance issues.
• 🔒 Safer upgrades: Existing user settings are migrated instead of being reset, while outdated or incompatible HUB keys are discarded.
• ⚠️ Compatibility consideration: Applications that import ultralytics.hub, use HUB training sessions, load models from HUB URLs, or rely on HUB-specific utilities must migrate to Ultralytics Platform workflows.
• 🚀 Recommended next step: Create a Platform API key and authenticate with:

yolo login YOUR_API_KEY

For no-code dataset annotation, training, and deployment, use the Ultralytics Platform.

What's Changed

• Deprecate HUB in favor of Ultralytics Platform by @​sergiuwaxmann in ultralytics/ultralytics#25608

... (truncated)

Commits

• 98a9cfd Deprecate HUB in favor of Ultralytics Platform (#25608)
• ee3fe3e Surface Platform error messages and stop the console-output retry loop (#25581)
• 5c99019 Fix TorchScript GPU inference device mismatch (#25569)
• 16d89ef fix Python syntax error in similarity-search solution (#25579)
• 74ee4ac Document depth loss gains and attribute semantic and depth in the argument ta...
• a41b69b Fix DDP error when total batch size is higher than validation images (#25576)
• 5954e8e Fix NCNN and Paddle export of prompt-free YOLOE models (#25568)
• 37b64d0 Fix: Analytics line chart total_counts resets before update_graph consumes it...
• 56afc74 Fix Annotator.kpts() dropping keypoints and limbs on image borders (#25565)
• f338491 Fix IndexError in class_activation_map with out-of-range classes (#25582)
• Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Version 0.28.0

0.28.0 (28th November, 2024)

The 0.28 release includes a limited set of deprecations.

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates pytest from 8.4.2 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.CollectionDescription has been truncated