[dependabot]

Bumps the python group with 16 updates in the / directory:

Package	From	To
faiss-cpu	1.15.0	1.15.1
openai	3.8.0	3.35.1
build	1.6.0	1.6.1
certifi	2026.7.22	2026.10.18
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
httpcore2	2.12.0	2.14.0
httpx2	2.12.0	2.14.0
iniconfig	2.3.0	2.3.1
jiter	0.16.0	0.17.0
pluggy	1.6.0	1.7.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
truststore	0.10.4	0.10.5
ruff	0.16.6	0.17.1
build	1.6.0	1.6.1
certifi	2026.7.22	2026.10.18
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
setuptools	84.0.0	``
faiss-cpu	1.15.0	1.15.1
httpcore2	2.12.0	2.14.0
httpx2	2.12.0	2.14.0
iniconfig	2.3.0	2.3.1
jiter	0.16.0	0.17.0
openai	3.8.0	3.35.1
pluggy	1.6.0	1.7.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
truststore	0.10.4	0.10.5
ruff	0.16.6	0.17.1

Bumps the python group with 19 updates in the /requirements directory:

Package	From	To
pillow	12.3.0	13.0.0
setuptools	84.0.0	``
numpy	2.4.6	2.5.4
faiss-cpu	1.15.0	1.15.1
openai	3.8.0	3.35.1
pyarrow	25.0.1	26.0.0
build	1.6.0	1.6.1
certifi	2026.7.22	2026.10.18
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
httpcore2	2.12.0	2.14.0
httpx2	2.12.0	2.14.0
iniconfig	2.3.0	2.3.1
jiter	0.16.0	0.17.0
pluggy	1.6.0	1.7.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
truststore	0.10.4	0.10.5
ruff	0.16.6	0.17.1
build	1.6.0	1.6.1
certifi	2026.7.22	2026.10.18
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
setuptools	84.0.0	``
faiss-cpu	1.15.0	1.15.1
httpcore2	2.12.0	2.14.0
httpx2	2.12.0	2.14.0
iniconfig	2.3.0	2.3.1
jiter	0.16.0	0.17.0
numpy	2.4.6	2.5.3
openai	3.8.0	3.35.1
pillow	12.3.0	13.0.0
pluggy	1.6.0	1.7.0
pyarrow	25.0.1	26.0.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
truststore	0.10.4	0.10.5
ruff	0.16.6	0.17.1

Updates faiss-cpu from 1.15.0 to 1.15.1

Release notes

Sourced from faiss-cpu's releases.

v1.15.1

See CHANGELOG.md for the full list of changes.

Changelog

Sourced from faiss-cpu's changelog.

[1.15.1] - 2026-09-15

Added

• 3b3711c112fbf7dfb9c64b6fcf90ffc3ca412548 Add explicit IVFPQ scanner distance modes (#5632)
• 4fdbc9dc18adbfef3cd410a2446aa4c757320a8a Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a14632a6f2bfdc824c86d683b9d6e9205c2604 Run the eight SIMD kernel tests that no build executed (#5620)
• e6bd1d252caa5b9315a04390269d382845984ae2 Add AVX512 VPOPCNT dynamic dispatch level (#5531)
• 7f4cedda9c384de652c7bd5690db0f808d668216 Add staged RaBitQ storage to HNSW (#5526)
• cfbf4ec5ff68d0bca4701d0b24b8a0736e110932 SVS: allow option to disable vector storing (#5525)
• cda4f6e7133c629e502c2ea9bc51e0ef51847ab1 Expose IndexBinaryIVF.set_direct_map_type via the C API (#5451)
• 256980cb6ea6610e4b0edf497a038086df8bbfce Add SVE low-dimensional nearest fast path and spherical SuperKMeans support (#5530)
• 3a716ead1a3c4562fe6e96d982d26789c58e19ed Add Windows ARM64 support to CI (#5544)
• 7059eaf7da7eddda62e71367e684d4bdedd7f94f Add AVX512 bitplane kernel for multi-bit RaBitQ inner product (#5522)
• a424dcb809fd725c44dd976d9063febd4837d16a faiss HNSW: add opt-in deterministic lock-free graph build (faiss::hnsw_deterministic_build) (#5486)
• da3191e754b49ca67b6503a9262e96ce5a3d8ed8 IDSelectorWithContext: extend context hook to IVFPQ/PQR, multibit RaBitQ, and Panorama scanners (#5491)
• edddbc998e858f16330f9b226dfd72f73d4d1d46 IDSelectorWithContext: scan-context hook for locality-aware selectors (#5490)

Changed

• 3bb48643ab8ea9e50162b354d2463270acd6ed9c Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 6bbb068ad8dab612b84304400846da1b14539085 Measure 20-byte Hamming codes eight at a time (#5587)
• 3c7042f17a467c38d99f490ef39e4dfa615dc510 Let the binary Hamming paths reach the VPOPCNT kernels
• 9f993087b07e83f026248addb01dd99e99b15a3e Name the SIMD level masks after what they hold (#5600)
• e2cf9e1ebf24c14b888fa69eee96713aa6d64b1a Accept ragged code sizes in faiss::hammings(), and fix the vectorization axis for wide codes (#5520)
• 545550f6a27031c2269881d97237fd6a5bef15df Use unittest assertions and f-strings in test_index_composite (#5571)
• af9eeffcf70d7795107c2b0511bdba507ac45339 Reserve cs vector capacity in hammings_knn_mc_impl to avoid reallocations (#5548)
• 317a207bcacfcfa695d98289c3f4ea562b782837 ARM SVE optimization for L2 distance kernels adapted to new simd_impl structure (#5098)
• 2027d3b33144dbf19674b540ec0e31b2f842b1cc Make cuVS dispatch opt-in rather than build-implied (#5529)
• a39e2606887bbacc6c8f54e783c4b42da00cf4b3 Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5521)
• 1f93154314afbef210f0ebebeab840da22f9ec7d Revert D114685755: Fold multi-GPU CAGRA build into train(), delete trainMultiGpu
• 6644dcfa5576221b1a4417fd766a8b2af71d869e Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5500)
• 80a16564f86530dbf0bfaf96c2b71feffeb5093f Enable Faiss dynamic dispatch for OVIS and VeST fbpkgs (#5515)
• 2688c34f942c8462d97c8632c720a53653456270 Parallelize the k-means++ D^2 seeding update (#5457)
• 76c67b7b736ca80c2b3ea29528434d6583adc88b Update default Panorama batch size to 1024 (#5441)
• 3b50babc5914570576b09da043f64dfd7d62a075 Optimize RVV batch-4 distance kernels (#5469)

Fixed

• 7c3b55c01b8418dc044881625a260fceae9c712b Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a3121c073828d2ed7d04ccf09d8bea771c Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• fc13c81fb8b22f76e4c2c7bd2f027bd049b9a207 Stop aarch64 falling back to SIMDLevel::NONE in faiss dispatch (#5572)
• 00928e3f7628b8288c17cfece5ee9600a8287f56 Fix ROCm CI: build in a dedicated conda env instead of the runner's broken base (#5545)
• 1e5780fbbfbe191f3ed3517f93ace8301239e9b2 Fix OOB read in Panorama::reconstruct via IndexPreTransform (T287094917) (#5562)
• 2ed4c106e9fb9686e7727e5daf8ad6ad1e164109 Fix: Windows SIMD detection (#5497)
• b4c66ba6031d1f659163e43430f8ce745b0dbe79 Fix reverse_index_factory/get_code_size round-trip for HNSW, IMI and IVFPQR (#5564)
• c0084f5cd2534236acda05cf7b8e0fc8062ddec3 Clamp EDEN unbiased L2 distances to be non-negative (#5569)
• 6457e941f5f4808303bb480679cb78df0df51934 Contain DirectoryArchiver entries within the extraction root (#5561)
• ac60182fc009476c91a2788e639191d1f624157f RaBitQ: Fix zero residual sign convention (#5553)
• 1a0cfa64e015923d5009d8c7d917aa591e9eac9a Apply the deserialization byte limit to SVS IVF (#5568)
• 718002f7cf269f3f3752dde04a4cc3f8eabb0050 Fix distance conversion in IndexBinaryFromFloat for non-L2 metrics (#5549)
• 02ea14372c9983f3eaa15698512180dc62ea234d Fix range_search_max_results to respect all similarity metrics (#5533)
• bd7087453e6d2262b6e6c76ab0cfa1e2dfeddebf fix(faiss): use is_similarity_metric for IndexShardsIVF merge (#5541)

... (truncated)

Commits

• 75c755c Add missing CHANGELOG entry for #5632 in v1.15.1 (#5651)
• d63faea Increment to next release, v1.15.1 (#5645)
• 3b3711c Add explicit IVFPQ scanner distance modes (#5632)
• 3bb4864 Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 7c3b55c Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• a74867c faiss HNSW: delete the flag and the lock-based graph build (#5611)
• 4fdbc9d Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a1463 Run the eight SIMD kernel tests that no build executed (#5620)
• 6bbb068 Measure 20-byte Hamming codes eight at a time (#5587)
• Additional commits viewable in compare view

Updates openai from 3.8.0 to 3.35.1

Release notes

Sourced from openai's releases.

v3.35.1

3.35.1 (2026-10-18)

Bug Fixes

• preserve beta Realtime byte reads on websockets 13 (#4102) (5766349)

v3.35.0

3.35.0 (2026-10-17)

Features

• api: add typed Live sideband events (#4099) (8d5cbf0)
• api: add ultrafast service tier for Agents (#4101) (100bf8f)

Bug Fixes

• realtime: preserve byte receives with websockets 13 (#4098) (309916e)

v3.34.0

3.34.0 (2026-10-17)

Features

• api: add degraded external storage status (#4097) (b216cb2)
• api: add Realtime Translation WebSocket sessions (#4095) (bfada50)

v3.33.0

3.33.0 (2026-10-16)

Features

• api: add safety identifiers to image requests and responses (#4093) (c969e32)
• api: share Decisions cache breakpoint parameter type (#4092) (f7cefda)

v3.32.0

3.32.0 (2026-10-16)

Features

• api: add cache settings and key options [2/2] (#4087) (325da45)
• api: add prompt-based voice creation (#4091) (2e39db7)
• api: add regional processing residency options (#4081) (21ce0c2)
• api: add response error diagnostics and model notices (#4086) (e71d781)

... (truncated)

Changelog

Sourced from openai's changelog.

3.35.1 (2026-10-18)

Bug Fixes

• preserve beta Realtime byte reads on websockets 13 (#4102) (5766349)

3.35.0 (2026-10-17)

Features

• api: add typed Live sideband events (#4099) (8d5cbf0)
• api: add ultrafast service tier for Agents (#4101) (100bf8f)

Bug Fixes

• realtime: preserve byte receives with websockets 13 (#4098) (309916e)

3.34.0 (2026-10-17)

Features

• api: add degraded external storage status (#4097) (b216cb2)
• api: add Realtime Translation WebSocket sessions (#4095) (bfada50)

3.33.0 (2026-10-16)

Features

• api: add safety identifiers to image requests and responses (#4093) (c969e32)
• api: share Decisions cache breakpoint parameter type (#4092) (f7cefda)

3.32.0 (2026-10-16)

Features

• api: add cache settings and key options [2/2] (#4087) (325da45)
• api: add prompt-based voice creation (#4091) (2e39db7)
• api: add regional processing residency options (#4081) (21ce0c2)
• api: add response error diagnostics and model notices (#4086) (e71d781)
• api: support audio fixture playback in Live sessions (#4085) (9998c1a)
• api: support Decisions in Live sessions (#4088) (230a923)

Bug Fixes

... (truncated)

Commits

• 547ecb1 release: 3.35.1 (#4103)
• 5766349 fix: preserve beta Realtime byte reads on websockets 13 (#4102)
• ab91400 release: 3.35.0 (#4100)
• 100bf8f feat(api): add ultrafast service tier for Agents (#4101)
• 8d5cbf0 feat(api): add typed Live sideband events (#4099)
• 309916e fix(realtime): preserve byte receives with websockets 13 (#4098)
• 3eb0837 release: 3.34.0 (#4096)
• b216cb2 feat(api): add degraded external storage status (#4097)
• bfada50 feat(api): add Realtime Translation WebSocket sessions (#4095)
• b7c5e5d release: 3.33.0 (#4094)
• Additional commits viewable in compare view

Updates build from 1.6.0 to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

• chore[v1]: prepare for v1.6.1 by @​henryiii in pypa/build#1181

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

---

Bugfixes

---

• Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

---

Documentation

---

• Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

---

Miscellaneous

---

• :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

---

Features

---

• Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
• The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
• The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
• Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
• Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
  • by :user:gaborbernat (:issue:655)
• Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
• On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

---

Bugfixes

---

... (truncated)

Commits

• 89cccef chore: prepare for 1.6.1
• a6f707a ci: support releases from v* branches (#1178)
• 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
• 244b250 fix: always use copies for the isolated venv on Windows (#1176)
• c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
• e02ffd3 pre-commit: bump repositories (#1173)
• aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
• 5c3fd46 docs: use PyPI ref directly (#1172)
• 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
• 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
• See full diff in compare view

Updates certifi from 2026.7.22 to 2026.10.18

Commits

• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates httpcore2 from 2.12.0 to 2.14.0

Release notes

Sourced from httpcore2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).
• Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

• Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).
• Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).
• Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

... (truncated)

Commits

• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• 53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
• 6a2c032 Map anyio.EndOfStream to WriteError on write (#1263)
• 81e58ad Handle HTTP/2 stream limit reductions without blocking reads (#1217)
• a712efd Exclude destination targets from proxy-generated requests (#1262)
• d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
• 76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.14.0

Release notes

Sourced from httpx2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).
• Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

• Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).
• Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).
• Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.14.0 (October 18th, 2026)

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
• Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

2.13.1 (September 23rd, 2026)

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position. (#1214)
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown. (#1228)

2.13.0 (September 14th, 2026)

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
• Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Commits

• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• 53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
• d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
• 76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• df9783d Respect file cursor positions when calculating raw content length (#1214)
• 04d152b docs: correct stale URL.query example (#1222)
• Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig...

  Description has been truncated

[gloryfromca]

Blocking: restore installable CI constraints for supported Python versions and the setuptools build backend.

I reviewed the full diff, its generated inputs and consuming workflows, relevant lockfile history, the declared Python compatibility range, test changes (there are none), and the repository's architecture/release guidance; no AGENTS.md, CLAUDE.md, or CONTEXT*.md files are present. The two concrete failures are marked inline.

Verification: repository asset, size, inventory, and release-version gates passed; a fresh Python 3.12 environment passed 86 core/repository tests, 177 engine tests, and 20 Raven tests (6 skipped), plus Ruff checks/formatting. A fresh no-isolation package build failed with the missing setuptools backend, matching the GitHub package jobs; GitHub's Python 3.10 job also fails while installing the CI lock.

[gloryfromca]

Blocking: restore Python-version-specific pins for the supported 3.10/3.11 environments.

This universal lock now pins pillow==13.0.0 and pyarrow==26.0.0 unconditionally even though both require Python 3.11+, so make install-ci on the project's supported Python 3.10 fails before tests can run (the current GitHub job reports No matching distribution found for pillow==13.0.0). It also assigns numpy==2.5.4 to Python 3.11 even though that release requires Python 3.12+, breaking installation on the other supported interpreter. Regenerate this file so these packages retain version markers compatible with every declared Python version.

[gloryfromca]

Blocking: keep the setuptools backend in the build constraints.

requirements/build.in still directly requests setuptools, and every package uses setuptools.build_meta, but this regenerated file removes the setuptools pin. Both make package and the plugin/release artifact jobs install this file and invoke python -m build --no-isolation; in a fresh environment they now fail with Backend 'setuptools.build_meta' is not available. Please restore setuptools to the generated output (and preserve the universal platform markers when regenerating).