Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 6 updates - #209

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/nlp-service/minor-and-patch-0dd1e763f9
Open

chore(deps): bump the minor-and-patch group across 1 directory with 6 updates#209
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/nlp-service/minor-and-patch-0dd1e763f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the /nlp-service directory:

Package From To
fastapi 0.139.0 0.141.1
uvicorn 0.51.0 0.52.4
markitdown 0.1.6 0.1.7
google-genai 2.11.0 2.19.0
spacy 3.8.14 3.8.15
nltk 3.10.0 3.10.3

Updates fastapi from 0.139.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates uvicorn from 0.51.0 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Version 0.52.1

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)
Commits

Updates markitdown from 0.1.6 to 0.1.7

Release notes

Sourced from markitdown's releases.

Version 0.1.7

What's Changed

New Contributors

Full Changelog: microsoft/markitdown@v0.1.6...v0.1.7

Commits
  • fd239d5 Bump version to 0.1.7 (#2258)
  • 007ea02 Fix omml template bugs. (#2257)
  • 2e42a01 fix: handle PPTX SVG images without a rasterized fallback (#2233)
  • 24c14c6 Fix typos and formatting in comments, docstrings, and markdown (#2223)
  • db144c4 Fix invalid LaTeX macros for mu, nu, tau, and down-arrow in equation conversi...
  • 9247794 fix: avoid O(n^2) value lookups in PPTX chart conversion (#2227)
  • See full diff in compare view

Updates google-genai from 2.11.0 to 2.19.0

Release notes

Sourced from google-genai's releases.

v2.19.0

2.19.0 (2026-08-19)

Features

  • Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (e8cd7d0)
  • Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (656da78)
  • Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (599d89f)
  • Add video resolution and extension task parameters (c3bdb88)

v2.18.1

2.18.1 (2026-08-13)

Bug Fixes

v2.18.0

2.18.0 (2026-08-12)

Features

  • Add interaction_status to LiveServerContent (66e224c)
  • api: Make the deferred service tier publicly available on Vertex (e1f7c40)
  • Enable json schema in FunctionDeclaration parser (62d50d6)
  • Make speech_config a structured object. (cc0d42e)
  • Support injecting httpx2 client. (012804d), refs #2680

Bug Fixes

  • Improve AFC(automatic function calling) in chat including fixing bugs in AFC for generate_content_stream. also log warnings in generate_content, generate_content_stream and their async variants that AFC is meant to be used in chat experience, not directly in models module. (fe6118e)

Performance Improvements

  • Build model validators on first use instead of at import (66bfe95), refs #2784
  • Lazily import the interactions API to speed up import google.genai (89dcfe5)
  • Stop importing the requests HTTP stack at module scope (3a44936)

v2.17.0

2.17.0 (2026-08-06)

Features

  • Add the Gemini Robotics ER 2 Preview model (61d4645)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.19.0 (2026-08-19)

Features

  • Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (e8cd7d0)
  • Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (656da78)
  • Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (599d89f)
  • Add video resolution and extension task parameters (c3bdb88)

2.18.1 (2026-08-13)

Bug Fixes

2.18.0 (2026-08-12)

Features

  • Add interaction_status to LiveServerContent (66e224c)
  • api: Make the deferred service tier publicly available on Vertex (e1f7c40)
  • Enable json schema in FunctionDeclaration parser (62d50d6)
  • Make speech_config a structured object. (cc0d42e)
  • Support injecting httpx2 client. (012804d), refs #2680

Bug Fixes

  • Improve AFC(automatic function calling) in chat including fixing bugs in AFC for generate_content_stream. also log warnings in generate_content, generate_content_stream and their async variants that AFC is meant to be used in chat experience, not directly in models module. (fe6118e)

Performance Improvements

  • Build model validators on first use instead of at import (66bfe95), refs #2784
  • Lazily import the interactions API to speed up import google.genai (89dcfe5)
  • Stop importing the requests HTTP stack at module scope (3a44936)

2.17.0 (2026-08-06)

Features

  • Add the Gemini Robotics ER 2 Preview model (61d4645)
  • Add TOO_MANY_TOOL_CALLS to FinishReason enum. (a8ec86e)
  • Add top-level errors array to Interaction resource (iAPI) (c74505b)

... (truncated)

Commits
  • c425b0b chore(main): release 2.19.0 (#2867)
  • fedd121 chore: Internal Changes
  • 599d89f feat: Add IDLE state to live connection status enum and mark REQUIRES_ACTION ...
  • e8cd7d0 feat: Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and...
  • 656da78 feat: Add enable_data_retention to ToolParallelAiSearch, Add step_count to Re...
  • c3bdb88 feat: add video resolution and extension task parameters
  • 2dd9537 chore(main): release 2.18.1 (#2866)
  • f898b61 fix: Add gemini 3.7
  • 65b1890 chore: refresh docs
  • 3d6b89b chore: Update GCS references to Cloud Storage in descriptions
  • Additional commits viewable in compare view

Updates spacy from 3.8.14 to 3.8.15

Release notes

Sourced from spacy's releases.

v3.8.15: Fix click requirement

Typer removed click as a dependency in favour of vendoring it, but spaCy imports from Click, so the requirement needs to be added.

Commits

Updates nltk from 3.10.0 to 3.10.3

Release notes

Sourced from nltk's releases.

v3.10.3

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

New Contributors

Full Changelog: nltk/nltk@v3.10.2...v3.10.3

v3.10.3-rc1

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • 303f6e2 Prepare release 3.10.3 (#3745)
  • cf2aaac Merge pull request #3744 from alvations/ci-guard-open
  • 6cd8320 test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)
  • e965330 fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...
  • df1bb4c test: make pathsec security tests platform-independent (fix Linux/Windows CI)
  • 0e5c7be ci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)
  • 5017826 Merge commit from fork
  • 40d0f06 Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...
  • 483c5fe Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...
  • 722778f Merge commit from fork
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 6…
b1f75ba 
… updates

Bumps the minor-and-patch group with 6 updates in the /nlp-service directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.141.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.51.0` | `0.52.4` |
| [markitdown](https://github.com/microsoft/markitdown) | `0.1.6` | `0.1.7` |
| [google-genai](https://github.com/googleapis/python-genai) | `2.11.0` | `2.19.0` |
| [spacy](https://github.com/explosion/spaCy) | `3.8.14` | `3.8.15` |
| [nltk](https://github.com/nltk/nltk) | `3.10.0` | `3.10.3` |



Updates `fastapi` from 0.139.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.141.1)

Updates `uvicorn` from 0.51.0 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.51.0...0.52.4)

Updates `markitdown` from 0.1.6 to 0.1.7
- [Release notes](https://github.com/microsoft/markitdown/releases)
- [Commits](microsoft/markitdown@v0.1.6...v0.1.7)

Updates `google-genai` from 2.11.0 to 2.19.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/python-genai@v2.11.0...v2.19.0)

Updates `spacy` from 3.8.14 to 3.8.15
- [Release notes](https://github.com/explosion/spaCy/releases)
- [Changelog](https://github.com/explosion/spaCy/blob/master/RELEASE_NOTES.md)
- [Commits](explosion/spaCy@release-v3.8.14...release-v3.8.15)

Updates `nltk` from 3.10.0 to 3.10.3
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@v3.10.0...v3.10.3)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: markitdown
  dependency-version: 0.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: google-genai
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: spacy
  dependency-version: 3.8.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: nltk
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from tuirk as a code owner August 24, 2026 09:19
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tuirk tuirk Awaiting requested review from tuirk tuirk is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants