Skip to content

chore(deps): bump the uv group across 1 directory with 11 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/uv-29fd033c8c
Open

chore(deps): bump the uv group across 1 directory with 11 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/uv-29fd033c8c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 6, 2026

Copy link
Copy Markdown

Bumps the uv group with 11 updates in the /python directory:

Package From To
nltk 3.9.4 3.10.3
python-multipart 0.0.29 0.0.31
datamodel-code-generator 0.58.0 0.64.0
setuptools 81.0.0 83.0.0
aiohttp 3.13.5 3.14.3
cryptography 48.0.0 50.0.0
h2 4.3.0 4.4.1
hydra-core 1.3.2 1.3.4
msgpack 1.1.2 1.2.1
pillow 12.2.0 12.3.0
starlette 1.2.0 1.3.1

Updates nltk from 3.9.4 to 3.10.3

Release notes

Sourced from nltk's releases.

v3.10.3

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

New Contributors

Full Changelog: nltk/nltk@v3.10.2...v3.10.3

v3.10.3-rc1

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • 303f6e2 Prepare release 3.10.3 (#3745)
  • cf2aaac Merge pull request #3744 from alvations/ci-guard-open
  • 6cd8320 test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)
  • e965330 fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...
  • df1bb4c test: make pathsec security tests platform-independent (fix Linux/Windows CI)
  • 0e5c7be ci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)
  • 5017826 Merge commit from fork
  • 40d0f06 Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...
  • 483c5fe Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...
  • 722778f Merge commit from fork
  • Additional commits viewable in compare view

Updates python-multipart from 0.0.29 to 0.0.31

Release notes

Sourced from python-multipart's releases.

Version 0.0.31

What's Changed

Full Changelog: Kludex/python-multipart@0.0.30...0.0.31

Version 0.0.30

What's Changed

Full Changelog: Kludex/python-multipart@0.0.29...0.0.30

Changelog

Sourced from python-multipart's changelog.

0.0.31 (2026-06-04)

  • Speed up multipart header parsing and callback dispatch #295.
  • Bound header field name size before validating #296.
  • Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

  • Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
  • Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.
Commits

Updates datamodel-code-generator from 0.58.0 to 0.64.0

Release notes

Sourced from datamodel-code-generator's releases.

0.64.0

Breaking Changes

Code Generation Changes

  • Self-referencing fields are now quoted with --disable-future-imports - When --disable-future-imports is set (no from __future__ import annotations and no native PEP 649 deferred evaluation on Python < 3.14), self-referencing and forward-referencing field annotations in regular BaseModel classes are now emitted as quoted forward references instead of bare names. Previously such annotations were left unquoted, producing invalid code that raised NameError (Ruff F821) at class-evaluation time. Output for the common case (with from __future__ import annotations or Python 3.14 native deferred annotations) is unchanged. Users who snapshot/golden-file generated output for the --disable-future-imports configuration with self-referencing models will see the annotation change from unquoted to quoted, e.g. children: Optional[List[Node]] → children: Optional[List["Node"]]. (#3387)

What's Changed

... (truncated)

Changelog

Sourced from datamodel-code-generator's changelog.

0.64.0 - 2026-06-14

Breaking Changes

Code Generation Changes

  • Self-referencing fields are now quoted with --disable-future-imports - When --disable-future-imports is set (no from __future__ import annotations and no native PEP 649 deferred evaluation on Python < 3.14), self-referencing and forward-referencing field annotations in regular BaseModel classes are now emitted as quoted forward references instead of bare names. Previously such annotations were left unquoted, producing invalid code that raised NameError (Ruff F821) at class-evaluation time. Output for the common case (with from __future__ import annotations or Python 3.14 native deferred annotations) is unchanged. Users who snapshot/golden-file generated output for the --disable-future-imports configuration with self-referencing models will see the annotation change from unquoted to quoted, e.g. children: Optional[List[Node]] → children: Optional[List["Node"]]. (#3387)

What's Changed

... (truncated)

Commits

Updates setuptools from 81.0.0 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

  • Require Python 3.10 or later.

Bugfixes

  • MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

  • pypa/distutils#334

v82.0.1

Bugfixes

  • Fix the loading of launcher manifest.xml file. (#5047)
  • Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

  • Add advice about how to improve predictability when installing sdists. (#5168)

Misc

v82.0.0

... (truncated)

Commits

Updates aiohttp from 3.13.5 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates cryptography from 48.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates h2 from 4.3.0 to 4.4.1

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

  • Performance improvement: remove consumed frames in-place from data buffer.
  • Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

  • Support for Python 3.9 has been removed.
  • Support for PyPy 3.9 has been removed.
  • Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
  • Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
  • Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
  • backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

  • Support for Python 3.14 has been added.
  • H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
  • Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
  • Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

  • Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
  • Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.
Commits
  • bc239af v4.4.1
  • 92b925e add test for duplicate host headers
  • 292a408 reject duplicate Host headers in request headers
  • 04d3b87 update changelog
  • 439b970 prepare for next release cycle
  • 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
  • 6cce763 v4.4.0
  • dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
  • b45207c dependencies and packaging++
  • c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
  • Additional commits viewable in compare view

Updates hydra-core from 1.3.2 to 1.3.4

Release notes

Sourced from hydra-core's releases.

Hydra 1.3.4

Security patch release for the 1.3 line.

  • Add a blocklist to hydra.utils.instantiate() for security-sensitive _target_ callables.

Users on Hydra 1.3 should upgrade from hydra-core<=1.3.3 to hydra-core==1.3.4.

Hydra 1.3.3 fixes source builds with modern setuptools by removing the setup.py dependency on pkg_resources. Fixes #3207.

Changelog

Sourced from hydra-core's changelog.

1.3.4 (2026-07-05)

Bug Fixes

  • Add an instantiate target blocklist for security-sensitive callables. (#3259) 1.3.3 (2026-06-11) ==================

Bug Fixes

  • Remove the setup.py dependency on pkg_resources for source builds. (#3207)
Commits

Updates msgpack from 1.1.2 to 1.2.1

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

Full Changel...

Description has been truncated

@dependabot
chore(deps): bump the uv group across 1 directory with 11 updates
2a411ae 
Bumps the uv group with 11 updates in the /python directory:

| Package | From | To |
| --- | --- | --- |
| [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.3` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.29` | `0.0.31` |
| [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator) | `0.58.0` | `0.64.0` |
| [setuptools](https://github.com/pypa/setuptools) | `81.0.0` | `83.0.0` |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.5` | `3.14.3` |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.0` | `50.0.0` |
| [h2](https://github.com/python-hyper/h2) | `4.3.0` | `4.4.1` |
| [hydra-core](https://github.com/facebookresearch/hydra) | `1.3.2` | `1.3.4` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.1.2` | `1.2.1` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.2.0` | `1.3.1` |



Updates `nltk` from 3.9.4 to 3.10.3
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@3.9.4...v3.10.3)

Updates `python-multipart` from 0.0.29 to 0.0.31
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.29...0.0.31)

Updates `datamodel-code-generator` from 0.58.0 to 0.64.0
- [Release notes](https://github.com/koxudaxi/datamodel-code-generator/releases)
- [Changelog](https://github.com/koxudaxi/datamodel-code-generator/blob/main/CHANGELOG.md)
- [Commits](datamodel-code-generator/datamodel-code-generator@0.58.0...0.64.0)

Updates `setuptools` from 81.0.0 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v81.0.0...v83.0.0)

Updates `aiohttp` from 3.13.5 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.13.5...v3.14.3)

Updates `cryptography` from 48.0.0 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...50.0.0)

Updates `h2` from 4.3.0 to 4.4.1
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/h2@v4.3.0...v4.4.1)

Updates `hydra-core` from 1.3.2 to 1.3.4
- [Release notes](https://github.com/facebookresearch/hydra/releases)
- [Changelog](https://github.com/hydra-ecosystem/hydra/blob/v1.3.4/NEWS.md)
- [Commits](hydra-ecosystem/hydra@v1.3.2...v1.3.4)

Updates `msgpack` from 1.1.2 to 1.2.1
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.1.2...v1.2.1)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `starlette` from 1.2.0 to 1.3.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.2.0...1.3.1)

---
updated-dependencies:
- dependency-name: nltk
  dependency-version: 3.10.3
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.31
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: datamodel-code-generator
  dependency-version: 0.64.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h2
  dependency-version: 4.4.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: hydra-core
  dependency-version: 1.3.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: msgpack
  dependency-version: 1.2.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants