Skip to content

chore(deps): bump the arf-python group in /ARF with 10 updates - #49

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ARF/arf-python-9a941d0b46
Closed

chore(deps): bump the arf-python group in /ARF with 10 updates#49
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ARF/arf-python-9a941d0b46

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on numpy, sentence-transformers, torch, pytest, typer, rich, aiohttp, websockets, pynacl and blake3 to permit the latest version.
Updates numpy to 2.2.6

Release notes

Sourced from numpy's releases.

v2.2.6 (May 17, 2025)

NumPy 2.2.6 Release Notes

NumPy 2.2.6 is a patch release that fixes bugs found after the 2.2.5 release. It is a mix of typing fixes/improvements as well as the normal bug fixes and some CI maintenance.

This release supports Python versions 3.10-3.13.

Contributors

A total of 8 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Ilhan Polat
  • Joren Hammudoglu
  • Marco Gorelli +
  • Matti Picus
  • Nathan Goldbaum
  • Peter Hawkins
  • Sayed Adel

Pull requests merged

A total of 11 pull requests were merged for this release.

  • #28778: MAINT: Prepare 2.2.x for further development
  • #28851: BLD: Update vendor-meson to fix module_feature conflicts arguments...
  • #28852: BUG: fix heap buffer overflow in np.strings.find
  • #28853: TYP: fix NDArray[floating] + float return type
  • #28864: BUG: fix stringdtype singleton thread safety
  • #28865: MAINT: use OpenBLAS 0.3.29
  • #28889: MAINT: from_dlpack thread safety fixes
  • #28913: TYP: Fix non-existent CanIndex annotation in ndarray.setfield
  • #28915: MAINT: Avoid dereferencing/strict aliasing warnings
  • #28916: BUG: Fix missing check for PyErr_Occurred() in _pyarray_correlate.
  • #28966: TYP: reject complex scalar types in ndarray.__ifloordiv__

Checksums

MD5

259343f056061f6eadb2f4b8999d06d4  numpy-2.2.6-cp310-cp310-macosx_10_9_x86_64.whl
16fa85488e149489ce7ee044d7b0d307  numpy-2.2.6-cp310-cp310-macosx_11_0_arm64.whl
f01b7aea9d2b76b1eeb49766e615d689  numpy-2.2.6-cp310-cp310-macosx_14_0_arm64.whl
f2ddc2b22517f6e31caa1372b12c2499  numpy-2.2.6-cp310-cp310-macosx_14_0_x86_64.whl
52190e22869884f0870eb3df7a283ca9  numpy-2.2.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
8f382b9ca6770db600edd5ea2447a925  numpy-2.2.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
e604aae2ef6e01fb92ecc39aca0424d9  numpy-2.2.6-cp310-cp310-musllinux_1_2_aarch64.whl

... (truncated)

Commits
  • 2b686f6 Merge pull request #28980 from charris/prepare-2.2.6
  • ed41828 REL: Prepare for the NumPy 2.2.6 release [wheel build]
  • 83e4e7f Merge pull request #28966 from charris/backport-28958
  • 248f0cb TYP: add rejection-tests for complex ndarray floordiv
  • 5bad9da TYP: reject complex scalar types in ndarray.__ifloordiv__
  • 6c42775 Merge pull request #28915 from charris/backport-28892
  • 4277e7c Merge pull request #28916 from charris/backport-28898
  • bd1c863 BUG: Fix missing check for PyErr_Occurred() in _pyarray_correlate. (#28898)
  • 87d1d8a MAINT: Avoid dereferencing/strict aliasing warnings during complex casts in `...
  • 9e50659 Merge pull request #28913 from charris/backport-28908
  • Additional commits viewable in compare view

Updates sentence-transformers to 6.0.0

Release notes

Sourced from sentence-transformers's releases.

v6.0.0 - MultiVectorEncoder for ColBERT & late interaction models, transformers v5, float32 scoring, faster training & encoding

This major release introduces Multi-Vector Embedding models, also known as late interaction or ColBERT-style models, as a fourth model type alongside SentenceTransformer, CrossEncoder, and SparseEncoder. Going forward, you'll be able to use Sentence Transformers for training, inferencing, and interpreting Multi-Vector Embedding models.

It also modernizes the dependency floors to transformers v5, fixes a class of silent scoring bugs caused by half precision, and speeds up both training and encoding.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.0.0
Inference only, use one of:
pip install sentence-transformers==6.0.0
pip install sentence-transformers[onnx-gpu]==6.0.0
pip install sentence-transformers[onnx]==6.0.0
pip install sentence-transformers[openvino]==6.0.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.0.0
pip install sentence-transformers[audio]==6.0.0
pip install sentence-transformers[video]==6.0.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.0.0

[!TIP] Our Multi-Vector (Late Interaction) Embedding Models with Sentence Transformers blogpost is an excellent place to learn about multi-vector models: loading the various checkpoint formats, encoding and scoring, plugging them into a search stack, running them on page images, and keeping the index affordable.

[!WARNING] This is a major release with breaking changes. Upgrading from v5.x to v6.0 may require code updates. The changes marked 🚨 below are the ones most likely to affect you, and the Migration Guide has the full list. If you run into issues when upgrading, feel free to open an issue.

MultiVectorEncoder: ColBERT-style late interaction models (#3794)

Sentence Transformers v6.0 introduces MultiVectorEncoder, for ColBERT-style late interaction retrieval. Where a regular embedding model compresses a whole text into one vector, a multi-vector model keeps one vector per token and scores query against document with the MaxSim operator. That preserves token-level matching information that a single vector has to average away, which usually means stronger retrieval at the cost of a bigger index. It is also the state of the art for visual document retrieval, where a text query is matched against page images directly, with no OCR step in between.

Any PyLate checkpoint and any Stanford-NLP ColBERT checkpoint loads straight into it, and colpali-engine models for visual document retrieval work too, through the same familiar API you already use for dense, sparse, and reranker models.

from sentence_transformers import MultiVectorEncoder
Download from the 🤗 Hub
model = MultiVectorEncoder("lightonai/LateOn")
query_embeddings = model.encode_query(["Which planet is known as the Red Planet?"])
document_embeddings = model.encode_document([
"Venus is often called Earth's twin because of its similar size and proximity.",
"Mars, known for its reddish appearance, is often referred to as the Red Planet.",
"Jupiter, the largest planet in our solar system, has a prominent red spot.",
"Saturn, famous for its rings, is sometimes mistaken for the Red Planet.",
</tr></table>

... (truncated)

Commits
  • 56c9548 [docs] Remove revision from EVIE now that it's integrated (#3951)
  • aa791eb Release v6.0.0
  • 8b332d1 tests: Fix the pretrained MultiVectorEncoder tests for device tensors and Hub...
  • a03cfd6 docs: Point cross-references at their documented targets (#3947)
  • 310ed7b docs: Rank the pretrained MultiVectorEncoder models by NanoBEIR and NanoViDoR...
  • 345c538 Speed up multi-vector padding and numpy to tensor conversion (#3942)
  • 8d62fa2 [v6] Return tensors on the model device from MultiVectorEncoder encoding (#...
  • 8a73e35 [v6] Keep the prompt-excluded mask out of the feature dicts (#3944)
  • c8d2c0c [v6] Extend the merged column forward to the SentenceTransformer losses (#3...
  • adc09fc [v6] Fix XTR input validation, padding masks, and integer embedding support...
  • Additional commits viewable in compare view

Updates torch to 2.13.0

Release notes

Sourced from torch's releases.

PyTorch 2.13.0 Release Notes

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Tracked Regressions

ROCm wheels break torch.compile on CPU in environments without a GPU

Running a torch==2.13.0+rocm7.2 wheel in an environment where no GPU is available (torch.cuda.is_available() is False) breaks torch.compile on the CPU path: the first compile raises RuntimeError: Can't detect vectorized ISA for CPU (#189194). This is a regression from torch==2.12.1+rocm7.2, which compiles CPU code fine (detecting e.g. VecAVX2) in the same setup. The 2.13 ROCm wheel appears to rely on something present in the ROCm builder image to detect the CPU vectorized ISA, so it works when run on a ROCm image but fails on a plain CPU-only image.

Workaround: run the +rocm wheel on a ROCm image, or install a standard CPU/CUDA build for GPU-less environments.

Backwards Incompatible Changes

  • Stop building CPython 3.13t (free-threaded) binaries (#182951)

    Upstream pypa/manylinux removed CPython 3.13t (free-threaded) on 2026-05-07, because 3.13t was experimental and has been superseded by the now-non-experimental CPython 3.14t. As a result, PyTorch 2.13 no longer ships cp313t wheels (Linux, Triton, and related artifacts). Users on the free-threaded interpreter should move to Python 3.14t.

    PyTorch 2.12:

    # cp313t (free-threaded 3.13) wheels were available
    python3.13t -m pip install torch

    PyTorch 2.13:

... (truncated)

Changelog

Sourced from torch's changelog.

Releasing PyTorch

Release Compatibility Matrix

Following is the Release Compatibility Matrix for PyTorch releases:

... (truncated)

Commits
  • cf30153 [release/2.13] Strip +PTX from CUDA arch list on release/RC builds (#188914) ...
  • 3e3e24b [release/2.13] Restrict cuda-bindings to Python < 3.15 for CUDA 12.9 builds (...
  • 7986b06 [release/2.13] Bump binary build timeout 280 -> 400 minutes (#188551)
  • 0bdbc26 [release/2.13] Add CUDA 12.9 to TORCH_CUDA_ARCH_LIST tables (#188443)
  • 9cabb45 [release/2.13] Update manywheel docker image pin to 78e737ad (#188409)
  • 78e737a [release/2.13] Revert "Tighten generalized scatter graph target (#184075)" (#...
  • 0bb9b5b [release/2.13] Revert "dynamo: round-trip torch.cuda.stream ctx mgr across gr...
  • aaac2bf [release/2.13] Revert "[Reland] Port D104346887/PR 182675 for index_add fast ...
  • 9330813 Fix build_with_debinfo.py broken by CONFIGURE_DEPENDS globbing (#188192)
  • 4e077a7 Remove setuptools upper bound (#188190)
  • Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.
Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates typer to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

Changelog

Sourced from typer's changelog.

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0 (2026-07-15)

Breaking Changes

Internal

0.26.8 (2026-06-25)

Fixes

  • 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #1410 by @​svlandeg.
  • 🐛 Fix formatting in NoSuchOption.format_message(). PR #1843 by @​foomunleong.

Docs

  • 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #1850 by @​tiangolo.
  • 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #1826 by @​phalberg.

... (truncated)

Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates rich to 15.0.0

Release notes

Sourced from rich's releases.

The So Long 3.8 Release

A few fixes. The major version bump is to honor the passing of 3.8 support which reached its EOL in October 7, 2024

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

Changelog

Sourced from rich's changelog.

[15.0.0] - 2026-04-12

Changed

  • Breaking change: Dropped support for Python3.8

Fixed

[14.3.4] - 2026-04-11

Changed

[14.3.3] - 2026-02-19

Fixed

[14.3.2] - 2026-02-01

Fixed

[14.3.1] - 2026-01-24

Fixed

[14.3.0] - 2026-01-24

Fixed

Added

... (truncated)

Commits

Updates aiohttp to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.


3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates websockets to 16.1.1

Release notes

Sourced from websockets's releases.

16.1.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 01df1e4 Revert "Decode non-ASCII header values with iso-8859-1."
  • 2d61f74 Clarify restriction on headers in 16.1.
  • 4df6f90 Release version 16.1.
  • 7c69eca Increase timeout for building wheels.
  • 493864e Complete and review changelog.
  • 73ff538 Temporarily remove the trio implementation (again).
  • 77f7d71 Shorten changelog and docstring for previous commit.
  • 84859e1 Add text argument to broadcast() to force the frame type
  • 1a38f5a Document research on removing a workaround.
  • 99431ee Apply code style to docs/conf.py.
  • Additional commits viewable in compare view

Updates pynacl to 1.6.2

Changelog

Sourced from pynacl's changelog.

1.6.2 (2026-01-01)

  • Updated libsodium to 1.0.20-stable (2025-12-31 build) to resolve CVE-2025-69277.

1.6.1 (2025-11-10)

  • The MAKE environment variable can now be used to specify the make binary that should be used in the build process.

1.6.0 (2025-09-11)

  • BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and 3.7.
  • Added support for the low level AEAD AES bindings.
  • Added support for crypto_core_ed25519_from_uniform.
  • Update libsodium to 1.0.20-stable (2025-08-27 build).
  • Added support for free-threaded Python 3.14.
  • Added support for Windows on ARM wheels.

1.5.0 (2022-01-07)

  • BACKWARDS INCOMPATIBLE: Removed support for Python 2.7 and Python 3.5.
  • BACKWARDS INCOMPATIBLE: We no longer distribute manylinux1 wheels.
  • Added manylinux2014, manylinux_2_24, musllinux, and macOS universal2 wheels (the latter supports macOS arm64).
  • Update libsodium to 1.0.18-stable (July 25, 2021 release).
  • Add inline type hints.

1.4.0 (2020-05-25)

  • Update libsodium to 1.0.18.
  • BACKWARDS INCOMPATIBLE: We no longer distribute 32-bit manylinux1 wheels. Continuing to produce them was a maintenance burden.
  • Added support for Python 3.8, and removed support for Python 3.4.
  • Add low level bindings for extracting the seed and the public key from crypto_sign_ed25519 secret key
  • Add low level bindings for deterministic random generation.
  • Add wheel and setuptools setup_requirements in setup.py (#485)
  • Fix checks on very slow builders (#481, #495)
  • Add low-level bindings to ed25519 arithmetic functions
  • Update low-level blake2b state implementation
  • Fix wrong short-input behavior of SealedBox.decrypt() (#517)
  • Raise CryptPrefixError exception instead of InvalidkeyError when trying to check a password against a verifier stored in a unknown format (#519)
  • Add support for minimal builds of libsodium. Trying to call functions not available in a minimal build will raise an UnavailableError exception. To compile a minimal build of the bundled libsodium, set

... (truncated)

Commits

Updates blake3 to 1.0.9

Release notes

Sourced from blake3's releases.

version 1.0.9

Changes since v1.0.8:

  • Update pyo3 to v0.29. This version drops support for Python 3.13t, so we no longer build those wheels.
  • Add riscv64 wheels.
Commits
  • 873bede version 1.0.9
  • 2b15761 remove Python 3.13t wheels
  • 8ad36f4 update Cargo.lock
  • bf6993a update pyo3 to 0.29
  • c08f627 update the installation instructions in the README
  • a2a4bc0 ci: add riscv64 target to wheel build matrix (#103)
  • 62b3abe Bump blake3 from 1.8.3 to 1.8.4 (#105)
  • bb7ccca Bump softprops/action-gh-release in the github-actions group (#106)
  • 90b0ac5 Commit Cargo.lock for downstream packagers
  • b96587f Bump the github-actions group with 3 updates
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Updates the requirements on [numpy](https://github.com/numpy/numpy), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [torch](https://github.com/pytorch/pytorch), [pytest](https://github.com/pytest-dev/pytest), [typer](https://github.com/fastapi/typer), [rich](https://github.com/Textualize/rich), [aiohttp](https://github.com/aio-libs/aiohttp), [websockets](https://github.com/python-websockets/websockets), [pynacl](https://github.com/pyca/pynacl) and [blake3](https://github.com/oconnor663/blake3-py) to permit the latest version.

Updates `numpy` to 2.2.6
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v1.24.0...v2.2.6)

Updates `sentence-transformers` to 6.0.0
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v2.2.0...v6.0.0)

Updates `torch` to 2.13.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@ciflow/torchtitan/166063...v2.13.0)

Updates `pytest` to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@7.0.0...9.1.1)

Updates `typer` to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.9.0...0.27.1)

Updates `rich` to 15.0.0
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/main/CHANGELOG.md)
- [Commits](Textualize/rich@v13.0.0...v15.0.0)

Updates `aiohttp` to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.13.0...v3.14.3)

Updates `websockets` to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@10.0...16.1.1)

Updates `pynacl` to 1.6.2
- [Changelog](https://github.com/pyca/pynacl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pynacl@1.6.0...1.6.2)

Updates `blake3` to 1.0.9
- [Release notes](https://github.com/oconnor663/blake3-py/releases)
- [Changelog](https://github.com/oconnor663/blake3-py/blob/master/release.md)
- [Commits](oconnor663/blake3-py@1.0.8...1.0.9)

---
updated-dependencies:
- dependency-name: numpy
  dependency-version: 2.2.6
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: sentence-transformers
  dependency-version: 6.0.0
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: torch
  dependency-version: 2.13.0
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: typer
  dependency-version: 0.27.1
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: rich
  dependency-version: 15.0.0
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: pynacl
  dependency-version: 1.6.2
  dependency-type: direct:production
  dependency-group: arf-python
- dependency-name: blake3
  dependency-version: 1.0.9
  dependency-type: direct:production
  dependency-group: arf-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 22, 2026
@dependabot
dependabot Bot requested a review from kalisam as a code owner August 22, 2026 22:35
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 22, 2026
@vercel

vercel Bot commented Aug 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
floss Ready Ready Preview, v0 Aug 22, 2026 10:35pm

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 22, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs
floss c70d4bf Aug 22 2026, 10:37 PM

kalisam added a commit that referenced this pull request Aug 23, 2026
…check

Codex, P1, and correct. I documented this exact trap on python-ci.yml's trigger
and then reproduced it one file over.

`Compile check (wasm32)` and `Format` are meant to be required. GitHub leaves a
required check PENDING -- not passing -- when its workflow is skipped by path
filtering, so the `pull_request` paths filter would hang every PR that touches
no Rust.

Measured against the PRs actually open right now, rather than argued:

    #43  26 files  0 rust-matching
    #45   2 files  0
    #49   2 files  0
    #51   2 files  0
    #53   2 files  0
    #54   1 file   0

Six of seven. Every one of them would have sat pending forever the moment the
check was marked required.

Fixed the way Codex suggested, which is better than simply dropping the filter:
run on every pull request and skip the expensive work, rather than skipping the
workflow. A `changes` job diffs against the base ref and sets one output; `fmt`
and `wasm-check` always run and always report, but their toolchain setup, cargo
cache and actual cargo invocation are gated on it. A non-Rust PR gets a green
check in seconds with an explicit "No Rust changes" step saying why, and no
cache write.

The detector is plain git plus grep -- no third-party action, which matters in a
workflow whose other change this cycle was pinning a third-party action to a
SHA. Non-pull_request events (push, schedule, merge_group, workflow_dispatch)
always take the full path.

Regex verified against real paths: ARF/src/lib.rs, ARF/Cargo.toml,
ARF/Cargo.lock and .github/workflows/rust-ci.yml match; requirements-ci.txt,
docs/x.md and packages/y.py do not.

The held clippy/test/clippy-sarif jobs are untouched and still dispatch-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RRe5kvLPeiJetoM7xUHFNW
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #58.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/ARF/arf-python-9a941d0b46 branch August 23, 2026 23:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants