Skip to content

build(deps): bump the uv group across 1 directory with 5 updates#26

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/benchmark/uv-515bedcb67
Open

build(deps): bump the uv group across 1 directory with 5 updates#26
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/benchmark/uv-515bedcb67

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps the uv group with 4 updates in the /benchmark directory: cbor2, gradio, pypdf and vllm.

Updates cbor2 from 5.8.0 to 5.9.0

Release notes

Sourced from cbor2's releases.

5.9.0

  • Added the max_depth decoder parameter to limit the maximum allowed nesting level of containers, with a default value of 400 levels (CVE-2026-26209)
  • Changed the default read_size from 4096 to 1 for backwards compatibility. The buffered reads introduced in 5.8.0 could cause issues when code needs to access the stream position after decoding. Users can opt-in to faster decoding by passing read_size=4096 when they don't need to access the stream directly after decoding. Added a direct read path for read_size=1 to avoid buffer management overhead. (#275; PR by @​andreer)
  • Fixed C encoder not respecting string referencing when encoding string-type datetimes (tag 0) (#254)
  • Fixed a missed check for an exception in the C implementation of CBOREncoder.encode_shared() (#287)
  • Fixed two reference/memory leaks in the C extension's long string decoder (#290 PR by @​killiancowan82)
  • Fixed C decoder ignoring the str_errors setting when decoding strings, and improved string decoding performance by using stack allocation for small strings and eliminating unnecessary conditionals. Benchmarks show 9-17% faster deserialization. (#255; PR by @​andreer)
Commits
  • 93c5988 Bumped up the version
  • d903d62 Updated the max_depth default value in the C function signature
  • 2b53b28 Stack allocate small strings (#270)
  • a7ac10d Upped the max_depth value to 400
  • 54c8ed5 Fixed reference/memory leaks in decode_definite_long_string (#290)
  • a8d92dc [pre-commit.ci] pre-commit autoupdate (#289)
  • c91aa00 [pre-commit.ci] pre-commit autoupdate (#288)
  • 53521e7 Fixed ssize_t to Py_ssize_t
  • 94e0d21 Added missing Python counterpart for max_depth
  • bcb6cea Added the max_depth decoder parameter
  • Additional commits viewable in compare view

Updates gradio from 5.49.1 to 6.7.0

Changelog

Sourced from gradio's changelog.

6.7.0

Features

Fixes

6.6.0

Features

Fixes

6.5.1

... (truncated)

Commits
  • 8b03393 chore: update versions (#12902)
  • c4b92e2 Fix skill generation check (#12931)
  • 978bc6e Add server functions support to gr.HTML (#12929)
  • 7c3fa2a Fix Loading Spinner Issue Caused by Events Targeting Components In Inactive T...
  • 6011b00 Fix absolute path issue in Windows (#12926)
  • e29e1cc Add Space-specific skill generation to gradio skills add (#12918)
  • 81482b5 Lazy load sub-tab and accordion components (#12906)
  • ccff8b8 Walkthrough Selected Bug (#12925)
  • dcfc429 Fix Button component ignoring scale parameter (#12911)
  • a0fff5c Add push_to_hub method to gr.HTML. Add a gallery to view notable custom HTML ...
  • Additional commits viewable in compare view

Updates pypdf from 6.9.1 to 6.9.2

Release notes

Sourced from pypdf's releases.

Version 6.9.2, 2026-03-23

What's new

Security (SEC)

Robustness (ROB)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.9.2, 2026-03-23

Security (SEC)

  • Avoid infinite loop in read_from_stream for broken files (#3693)

Robustness (ROB)

  • Resolve UnboundLocalError for xobjs in _get_image (#3684)

Full Changelog

Commits

Updates vllm from 0.11.0 to 0.14.1

Release notes

Sourced from vllm's releases.

v0.14.1

This is a patch release on top of v0.14.0 to address a few security and memory leak fixes.

v0.14.0

Highlights

This release features approximately 660 commits from 251 contributors (86 new contributors).

Breaking Changes:

  • Async scheduling is now enabled by default - Users who experience issues can disable with --no-async-scheduling.
    • Excludes some not-yet-supported configurations: pipeline parallel, CPU backend, non-MTP/Eagle spec decoding.
  • PyTorch 2.9.1 is now required and the default wheel is compiled against cu129.
  • Deprecated quantization schemes have been removed (#31688, #31285).
  • When using speculative decoding, unsupported sampling parameters will fail rather than being silently ignored (#31982).

Key Improvements:

  • Async scheduling enabled by default (#27614): Overlaps engine core scheduling with GPU execution, improving throughput without user configuration. Now also works with speculative decoding (#31998) and structured outputs (#29821).
  • gRPC server entrypoint (#30190): Alternative to REST API with binary protocol, HTTP/2 multiplexing.
  • --max-model-len auto (#29431): Automatically fits context length to available GPU memory, eliminating OOM startup failures.
  • Model inspection view (#29450): View the modules, attention backends, and quantization of your model in vLLM by specifying VLLM_LOG_MODEL_INSPECTION=1 or by simply printing the LLM object.
  • Model Runner V2 enhancements: UVA block tables (#31965), M-RoPE (#32143), logit_bias/allowed_token_ids/min_tokens support (#32163).
    • Please note that Model Runner V2 is still experimental and disabled by default.

Model Support

New Model Architectures:

LoRA Support Expansion:

Model Enhancements:

  • Qwen3-VL as reranker (#31890)
  • DeepSeek v3.2 chat prefix completion (#31147)
  • GLM-4.5/GLM-4.7 enable_thinking: false (#31788)
  • Ernie4.5-VL video timestamps (#31274)
  • Score template expansion (#31335)
  • LLaMa4 vision encoder compilation (#30709)

... (truncated)

Commits
  • d7de043 [CI] fix version comparsion and exclusion patterns in upload-release-wheels.s...
  • 4dc11b0 [Bugfix] Fix Whisper/encoder-decoder GPU memory leak (#32789)
  • 2bd95d8 [Misc] Bump opencv-python dependecy version to 4.13 (#32668)
  • f46d576 [Misc] Replace urllib's urlparse with urllib3's parse_url (#32746)
  • d682094 [build] fix cu130 related release pipeline steps and publish as nightly image...
  • b17039b [CI] Implement uploading to PyPI and GitHub in the release pipeline, enable r...
  • 48b67ba [Frontend] Standardize use of create_error_response (#32319)
  • 09f4264 [Bugfix] Fix ROCm dockerfiles (#32447)
  • 7f42dc2 [CI] Fix LM Eval Large Models (H100) (#32423)
  • c2a37a3 Cherry pick [ROCm] [CI] [Release] Rocm wheel pipeline with sccache #32264
  • Additional commits viewable in compare view

Updates xgrammar from 0.1.25 to 0.1.21

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the uv group across 1 directory with 5 updates
fcb1010 
Bumps the uv group with 4 updates in the /benchmark directory: [cbor2](https://github.com/agronholm/cbor2), [gradio](https://github.com/gradio-app/gradio), [pypdf](https://github.com/py-pdf/pypdf) and [vllm](https://github.com/vllm-project/vllm).


Updates `cbor2` from 5.8.0 to 5.9.0
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.8.0...5.9.0)

Updates `gradio` from 5.49.1 to 6.7.0
- [Release notes](https://github.com/gradio-app/gradio/releases)
- [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/gradio-app/gradio/compare/gradio@5.49.1...gradio@6.7.0)

Updates `pypdf` from 6.9.1 to 6.9.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.9.1...6.9.2)

Updates `vllm` from 0.11.0 to 0.14.1
- [Release notes](https://github.com/vllm-project/vllm/releases)
- [Changelog](https://github.com/vllm-project/vllm/blob/main/RELEASE.md)
- [Commits](vllm-project/vllm@v0.11.0...v0.14.1)

Updates `xgrammar` from 0.1.25 to 0.1.21
- [Release notes](https://github.com/mlc-ai/xgrammar/releases)
- [Commits](mlc-ai/xgrammar@v0.1.25...v0.1.21)

---
updated-dependencies:
- dependency-name: cbor2
  dependency-version: 5.9.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: gradio
  dependency-version: 6.7.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pypdf
  dependency-version: 6.9.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: vllm
  dependency-version: 0.14.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: xgrammar
  dependency-version: 0.1.21
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 25, 2026
This was referenced Mar 25, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants