Skip to content

chore(deps): bump the pip group across 1 directory with 4 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/refs/nexent/pip-7383ce51ef
Open

chore(deps): bump the pip group across 1 directory with 4 updates#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/refs/nexent/pip-7383ce51ef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown

Bumps the pip group with 4 updates in the /refs/nexent directory: smolagents, mem0ai, orjson and pypdf.

Updates smolagents from 1.23.0 to 1.25.0

Release notes

Sourced from smolagents's releases.

v1.25.0

What's Changed

New Contributors

Full Changelog: huggingface/smolagents@v1.24.0...v1.25.0

v1.24.0

What's Changed

... (truncated)

Commits

Updates mem0ai from 0.1.117 to 2.0.0b2

Release notes

Sourced from mem0ai's releases.

Mem0 Python SDK (v2.0.0b2)

Redacted

Mem0 Python SDK (v2.0.0b1)

Redacted

Mem0 Python SDK (v2.0.0b0)

Beta release for the next major version of the Python SDK. (Still has missing features)

Breaking Changes

  • Removed deprecated enable_graph parameter from MemoryConfig and related APIs (#4776)
  • Removed deprecated parameters across LLMs, embeddings, vector stores, and graphs (#4740)

Bug Fixes

  • client: Prevent TypeError in feedback telemetry when response attributes are missing (#4795)
  • memory: Guard temp_uuid_mapping lookups against LLM-hallucinated IDs, fixing crashes during memory operations (#4674, fixes #3931)
  • azure_openai: Forward response_format parameter to Azure OpenAI API for structured output support (#4689)

Refactors

  • telemetry: Sample OSS hot-path events at 10% to reduce PostHog volume (#4771)

Previous Release

  • v1.0.11 (2026-04-06)

Mem0 OpenClaw Plugin (v1.0.14)

Improvements:

  • Sharper tool descriptions: Every memory tool (memory_search, memory_get, memory_list, memory_add, memory_update, memory_delete) now states what it does and when to use it. memory_search nudges proactive, multi-hop retrieval; memory_add nudges proactive saves; and the delete tools carry explicit irreversible-action warnings.

Mem0 OpenClaw Plugin (v1.0.13)

Fixes:

  • Custom categories payload: customCategories (a Record<string, string> map) is now converted via the new customCategoryMapToList() helper into the Array<Record<string, string>> shape the Mem0 SDK expects on add calls — previously the raw object was passed as custom_categories and silently ignored (#5345)
  • Skip runtime setup during metadata registration: register() now detects registrationMode === "cli-metadata", registers only the CLI commands, and returns early — avoiding backend initialization, service/tool registration, and hook installation during OpenClaw's metadata-only registration pass (#5383)

Security:

  • Bumped mem0ai from 3.0.3 to 3.0.7 (latest Node SDK) — includes the transitive axios CVE remediation shipped in 3.0.6 (#5460)
  • Added pnpm override uuid@<11.1.1 → >=11.1.1 to resolve an open MEDIUM Dependabot alert (#5489)

Improvements:

  • Repo consolidation: Plugin moved from repo-root openclaw/ to integrations/openclaw/; package.json repository.directory updated to match so npm provenance links to the correct subdirectory (#5491)

Tests:

... (truncated)

Commits
  • 50db9e4 chore(release): bump SDK versions to next beta (#4859)
  • fb87349 fix(oss): v3 entity cleanup, filter fixes, and QA hardening (TS + Python) (#4...
  • 8827553 fix: adopt new v3 memory endpoints in Python + TS clients (#4856)
  • c8e20a9 fix(docs): resolve duplicate operationIds and expiration_date type in openapi...
  • 93a51f4 test: update integration tests for v1.1 output_format (#4847)
  • 86fe275 fix(ts): entity store isolation, backward compat, pgvector + redis init fixes...
  • e6d6276 refactor: add entity ID and search param validation, rename textLemmatized fi...
  • 9692726 fix(ts-oss): isolate entity store from memory store by default (#4829)
  • d8d7766 fix(v3): migration crashes + entity linking on OSS (#4836)
  • a5a6882 fix: prevent arbitrary code execution via pickle in FAISS vector store (#4833)
  • Additional commits viewable in compare view

Updates orjson from 3.10 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

  • orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
  • Drop support for Python 3.9.
  • ABI compatibility with CPython 3.15 alpha 5.
  • Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

  • Fix sporadic crash serializing deeply nested list of dict.

3.11.5

Changed

  • Show simple error message instead of traceback when attempting to build on unsupported Python versions.

3.11.4

Changed

  • ABI compatibility with CPython 3.15 alpha 1.
  • Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux ppc64le, manylinux s390x.
  • Build now requires a C compiler.

3.11.3

Fixed

  • Fix PyPI project metadata when using maturin 1.9.2 or later.

3.11.2

Fixed

  • Fix build using Rust 1.89 on amd64.

Changed

  • Build now depends on Rust 1.85 or later instead of 1.82.

3.11.1

Changed

  • Publish PyPI wheels for CPython 3.14.

Fixed

  • Fix str on big-endian architectures.

3.11.0

... (truncated)

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

  • orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
  • Drop support for Python 3.9.
  • ABI compatibility with CPython 3.15 alpha 5.
  • Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

  • Fix sporadic crash serializing deeply nested list of dict.

3.11.5 - 2025-12-06

Changed

  • Show simple error message instead of traceback when attempting to build on unsupported Python versions.

3.11.4 - 2025-10-24

Changed

  • ABI compatibility with CPython 3.15 alpha 1.
  • Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux ppc64le, manylinux s390x.
  • Build now requires a C compiler.

3.11.3 - 2025-08-26

Fixed

  • Fix PyPI project metadata when using maturin 1.9.2 or later.

3.11.2 - 2025-08-12

Fixed

  • Fix build using Rust 1.89 on amd64.

Changed

  • Build now depends on Rust 1.85 or later instead of 1.82.

... (truncated)

Commits

Updates pypdf from 6.9.1 to 6.14.2

Release notes

Sourced from pypdf's releases.

Version 6.14.2, 2026-06-23

What's new

Security (SEC)

Full Changelog

Version 6.14.1, 2026-06-23

What's new

Security (SEC)

Full Changelog

Version 6.14.0, 2026-06-22

What's new

Security (SEC)

New Features (ENH)

Robustness (ROB)

Full Changelog

Version 6.13.3, 2026-06-17

What's new

Security (SEC)

Performance Improvements (PI)

Robustness (ROB)

Maintenance (MAINT)

Full Changelog

Version 6.13.2, 2026-06-10

What's new

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.14.2, 2026-06-23

Security (SEC)

  • Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#3892)

Full Changelog

Version 6.14.1, 2026-06-23

Security (SEC)

  • Detect end of stream during inline image end marker detection (#3891)

Full Changelog

Version 6.14.0, 2026-06-22

Security (SEC)

  • Apply general limit for requested image size (#3888)
  • Speed up recovery when reading broken cross-reference table (#3887)

New Features (ENH)

  • Check whether image is displayed on a given page (#3738)

Robustness (ROB)

  • Several fixes

Full Changelog

Version 6.13.3, 2026-06-17

Security (SEC)

  • Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871)

Performance Improvements (PI)

  • Avoid per-pixel getpixel loop for 1-bit indexed images (#3854)

Robustness (ROB)

  • Several fixes

Maintenance (MAINT)

  • Make mypy assert messages consistent (#3849)

Full Changelog

Version 6.13.2, 2026-06-10

Security (SEC)

  • Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#3847)

Robustness (ROB)

... (truncated)

Commits
  • 2266ee8 REL: 6.14.2
  • 5a33a46 SEC: Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (...
  • 1ee4e58 REL: 6.14.1
  • ec3b145 SEC: Detect end of stream during inline image end marker detection (#3891)
  • c6cd82e ROB: Tolerate malformed inline image settings in _read_inline_image (#3889)
  • 0ae42ba ROB: Tolerate malformed page label entries in get_label_from_nums (#3884)
  • 50617b5 ROB: Tolerate malformed Tm operand count in extract_text (#3877)
  • 86e5a82 MAINT: Improve readability (#3874)
  • 83cb25f DEV: Fix sample files commit
  • 06588ec REL: 6.14.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the pip group across 1 directory with 4 updates
991d4b9 
Bumps the pip group with 4 updates in the /refs/nexent directory: [smolagents](https://github.com/huggingface/smolagents), [mem0ai](https://github.com/mem0ai/mem0), [orjson](https://github.com/ijl/orjson) and [pypdf](https://github.com/py-pdf/pypdf).


Updates `smolagents` from 1.23.0 to 1.25.0
- [Release notes](https://github.com/huggingface/smolagents/releases)
- [Commits](huggingface/smolagents@v1.23.0...v1.25.0)

Updates `mem0ai` from 0.1.117 to 2.0.0b2
- [Release notes](https://github.com/mem0ai/mem0/releases)
- [Commits](mem0ai/mem0@0.1.117...v2.0.0b2)

Updates `orjson` from 3.10 to 3.11.6
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.10.0...3.11.6)

Updates `pypdf` from 6.9.1 to 6.14.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.9.1...6.14.2)

---
updated-dependencies:
- dependency-name: smolagents
  dependency-version: 1.25.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mem0ai
  dependency-version: 2.0.0b2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: orjson
  dependency-version: 3.11.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pypdf
  dependency-version: 6.14.2
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 26, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jul 26, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@socket-security

socket-security Bot commented Jul 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​orjson@​3.10.0 ⏵ 3.11.6100 +1100 +1610010070 -30
Updatedpypi/​smolagents@​1.23.0 ⏵ 1.25.096100 +75100100100
Updatedpypi/​mem0ai@​0.1.117 ⏵ 2.0.0b298 +8100 +20100100100
Updatedpypi/​pypdf@​6.9.1 ⏵ 6.14.299 +1100 +50100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants