Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 5 updates - #16

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/minor-and-patch-5e3dd5a0c3
Open

build(deps): bump the minor-and-patch group across 1 directory with 5 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/minor-and-patch-5e3dd5a0c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 5 updates in the / directory:

Package From To
uvicorn 0.52.1 0.52.4
pillow-heif 1.5.0 1.6.0
python-dotenv 1.2.2 1.2.3
bitsandbytes 0.49.2 0.50.2
peft 0.19.1 0.20.0

Updates uvicorn from 0.52.1 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)
Commits

Updates pillow-heif from 1.5.0 to 1.6.0

Release notes

Sourced from pillow-heif's releases.

v1.6.0

Added

  • Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
  • Python 3.15 and 3.15t wheels added.

Changed

  • libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

  • Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
  • Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455
Changelog

Sourced from pillow-heif's changelog.

[1.6.0 - 2026-08-31]

Added

  • Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
  • Python 3.15 and 3.15t wheels added.

Changed

  • libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

  • Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
  • Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455
Commits
  • 11a2a9f v1.6.0
  • 16be8c8 ci: fix leak tests failing the full Wheels matrix (#467)
  • 2a7240c chore(deps): update dependency strukturag/libheif to v1.23.2 (#466)
  • c4e4ec9 [pre-commit.ci] pre-commit autoupdate (#465)
  • 657f27d [pre-commit.ci] pre-commit autoupdate (#464)
  • a6d6e91 docs: fix the docs build and refresh the reference (#462)
  • 434e64d chore(deps): update dependency macos to v26 (#422)
  • f1e15a7 ci: rework flaky memory leak tests (#461)
  • 06dccd9 [pre-commit.ci] pre-commit autoupdate (#427)
  • 38c39bb chore(deps): update dependency python to 3.14 (#429)
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates bitsandbytes from 0.49.2 to 0.50.2

Release notes

Sourced from bitsandbytes's releases.

0.50.2

Highlights

  • ROCm 10.0 build is now included for both Linux and Windows.
  • Additional AMD GPU targets are included in our prebuilt wheels.
  • Performance improvement for certain 4bit GEMM shapes on NVIDIA GB10.

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.1...0.50.2

0.50.1: RTX Spark Support

This release adds support for additional hardware platforms and improves performance on RTX Spark / DGX Spark.

Highlights

  • Support added for NVIDIA RTX Spark products running Windows on ARM64 (#2038, #2037, #2032)
  • Improved 4bit GEMM dispatch heuristics for NVIDIA GB10 (#2030)
  • Support for AMD CDNA5 hardware (e.g. MI455X)

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.0...0.50.1

0.50.0: Faster 4-bit inference, CPU/ROCm/Apple Silicon improvements, and more!

This release brings a new fused 4-bit GEMM for inference on CUDA and ROCm, faster CPU ops on x86-64 and ARM64, reduced host-side overhead, and a much improved Apple Silicon backend. We've also added Windows on ARM CPU support, ROCm builds for Windows, additional ROCm and CUDA build variants, and new optimizer support on CPU and Intel XPU.

... (truncated)

Commits
  • 08a9956 Release 0.50.2
  • 4f1fc6c [ROCm] Add CI for ROCm 10.0 (#2061)
  • 906ff4d ci: expand ROCm architecture coverage (#2046)
  • d9e4440 Restore Wave64 warp size for all gfx9 targets (#2059)
  • 3fe95b5 Revert "[ROCm] Rework ROCm build to use ROCm version instead of HIP version (...
  • 3ac90c4 [ROCm] Rework ROCm build to use ROCm version instead of HIP version (#1888)
  • 95f9af3 chore(deps): bump the actions group across 1 directory with 2 updates (#2036)
  • d2d08f6 Add sm121 (GB10) to the wide_n_simt 4-bit GEMM dispatch rule (#2039)
  • d8ccdd9 Mask the absmax store in the Triton 4-bit quantize kernels (#2043)
  • 2b6cfb7 Bump dev version
  • Additional commits viewable in compare view

Updates peft from 0.19.1 to 0.20.0

Release notes

Sourced from peft's releases.

v0.20.0

Highlights

This release adds no less than nine new PEFT methods and puts a lot of work into the surrounding infrastructure, for example adding a new image generation benchmark for the method comparison suite and greatly improving the documentation structure.

New Methods

HiRA

@​hqsiswiliam added "HiRA: Parameter-Efficient Hadamard High-Rank Adaptation for Large Language Models" to PEFT (#2668). Instead of adding the low-rank product BA to the base weight, HiRA multiplies it elementwise (Hadamard product) with the frozen base weight. Because the base weight itself is full rank, the resulting update is no longer constrained to be low rank, while the trainable parameter count stays the same as LoRA's.

GLoRA

@​not-lain contributed GLoRA: "One-for-All: Generalized LoRA for Parameter-Efficient Fine-Tuning" in #3098. It is a flexible PEFT method that extends LoRA with configurable weight, activation, and bias adaptation, delivering richer fine-tuning with no extra inference cost. Use it when you need per-layer flexibility or stronger adaptation than vanilla LoRA. Skip it for non-Linear layers (e.g. Conv/Embedding) or when standard LoRA is already sufficient and simplicity matters.

BEFT

@​whubaichuan added "BEFT: Bias-Efficient Fine-Tuning of Language Models" in #3195. BEFT builds on the observation that fine-tuning bias terms alone can be competitive in low-data regimes, but goes further: rather than training all biases, it targets the value projection by default, as the authors found this to be most efficient. This brings the trainable parameter count down to roughly 0.01% of the total parameters.

MonteCLoRA

@​victor7246 integrated MonteCLoRA, "Robust and Efficient Fine-tuning of LLMs with Bayesian Reparameterization of Low-Rank Adaptation" in #2943. LoRA is known to be sensitive to hyperparameters like learning rate and batch size. This new LoRA variant addresses this by treating the low-rank parameters as a distribution rather than a point estimate, using Monte Carlo estimation to obtain a low-variance posterior estimate. This should make training noticeably more robust, at the cost of only O(rank) additional parameters.

VeLoRA

@​roymiles added VeLoRA: "Memory Efficient Training using Rank-1 Sub-Token Projections" in #3159. Unlike most PEFT methods, this LoRA variant targets activation memory rather than parameter count: intermediate activations are split into sub-tokens and compressed with a fixed rank-1 projection before being cached for the backward pass, then reconstructed during backpropagation. Conceptually, it is similar to gradient checkpointing, with a lower memory saving but running faster.

Uni-LoRA

@​KaiyangLi1992 contributed Uni-LoRA: "One Vector is All You Need" in #3257. The paper shows that parameter-efficient LoRA variants like VeRA and VB-LoRA can all be described as projecting the full LoRA parameter space down to a much smaller subspace, differing only in the choice of projection. Uni-LoRA uses a single global projection across the whole model instead of layer-wise ones, which allows cross-layer parameter sharing and thus very low parameter counts.

FRoD

@​Bane-Elvin added FRoD, "Full-Rank Efficient Fine-Tuning with Rotational Degrees for Fast Convergence", in #3270. Instead of adding low-rank deltas like LoRA, it reconstructs selected weights with shared rotational subspaces and sparse trainable coefficients. It is especially useful when fast convergence and a higher full-rank capacity ceiling are important, and its large sparse rotational subspace may also be promising for model merging. The main tradeoffs are the costly joint-decomposition initialization and slightly slower forward/backward passes than LoRA, so it may be less attractive for a one-off single-task fine-tune.

MiCA

@​sr-networks contributed MiCA, "MiCA Learns More Knowledge Than LoRA and Full Fine-Tuning", in #3260. MiCA is a LoRA variant that initializes B from the SVD of the base weight, taking the left singular vectors belonging to the smallest singular values, and then trains only A. The idea is that adapting these underused directions integrates new knowledge more effectively than adapting the dominant subspace, with less interference with existing capabilities.

DEFT

@​MAXNORM8650 added DEFT, "Decompositional Efficient Fine-Tuning for Text-to-Image Models", in #3342. This PEFT method splits a weight update into two learned low-rank parts: a projection that removes a sub-space of the frozen weight, and a low-rank update that injects new content in its place. Use DEFT for personalizing a text-to-image model from a few images while retaining the base model's instruction-following/editability with minimal forgetting. It is less of a fit if you don't need to preserve the base model's other capabilities (a plain additive adapter is simpler) or for layers beyond Linear/Conv1D. The PaRa method is also supported as a special case of DEFT.

Enhancements

Automatic LoRA target selection

@​oswaldoludwig added KappaTuneSelector in #3106 based on "The Condition Number as a Scale-Invariant Proxy for Information Encoding in Neural Units". The PR adds a new function, find_kappa_target_modules, which automatically identifies which modules best to target based on the condition number of the base weight matrices. This removes some of the guesswork from choosing target_modules when configuring LoRA or other PEFT methods.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 5…
fd431e7 
… updates

Bumps the minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.5.0` | `1.6.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes) | `0.49.2` | `0.50.2` |
| [peft](https://github.com/huggingface/peft) | `0.19.1` | `0.20.0` |



Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.1...0.52.4)

Updates `pillow-heif` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.5.0...v1.6.0)

Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `bitsandbytes` from 0.49.2 to 0.50.2
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.49.2...0.50.2)

Updates `peft` from 0.19.1 to 0.20.0
- [Release notes](https://github.com/huggingface/peft/releases)
- [Commits](huggingface/peft@v0.19.1...v0.20.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pillow-heif
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: bitsandbytes
  dependency-version: 0.50.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: peft
  dependency-version: 0.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants