Skip to content

chore(deps): update all non-major dependencies - #235

Open
laurigates-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#235
laurigates-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@laurigates-renovate

@laurigates-renovate laurigates-renovate Bot commented Sep 26, 2026

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
Connorrmcd6/surface action minor v0.8.0 → v0.9.0
safetensors dependencies minor 0.7 → 0.8
sentry (source) dependencies minor 0.46 → 0.49
sha2 dev-dependencies minor 0.10 → 0.11
sha2 dependencies minor 0.10 → 0.11
tokenizers dependencies minor 0.22 → 0.23

Release Notes

Connorrmcd6/surface (Connorrmcd6/surface)

v0.9.0

Compare Source

huggingface/safetensors (safetensors)

v0.8.0

Compare Source

News

safetensors joins the PyTorch foundation!

image

Read more on that: https://huggingface.co/blog/safetensors-joins-pytorch-foundation

What's changed

Safetensors 0.8.0 brings direct to Metal loading on Apple Silicon, GIL-free serialization, broader hardware and dtype coverage, and a stronger Python API.

Breaking

The serialize and serialize_file functions now release the GIL during writes, enabling true multithreaded saves from Python. Their input contract has also changed: tensor metadata is now passed via a TensorSpec class (exported from safetensors) instead of plain dicts, making API more explicit and robust to misinputs. This is a breaking change for anyone calling the low-level serialize / serialize_file API directly; the high-level wrappers (safetensors.torch, safetensors.numpy, safetensors.paddle) are updated internally and their public API is unchanged.

The minimum supported Python version is now 3.10 (was 3.9). Python 3.9 reached end-of-life in October 2025.

TensorIndexer::Narrow now carries a step: NonZeroUsize parameter, so a slice is now start:stop:step. This is a fix as this silent error was hidden behind the Storage::Torch variant which offloaded slicing logic to torch directly.

CI

On the platform side, this release adds Windows ARM64 wheel builds, riscv64 Linux wheels, and CI has been hardened with pinned GitHub Actions SHAs.

Also dropped the anaconda CI we had as there's already an automatic tracker via conda-forge.

New features
  • Direct MPS load on Apple Silicon: tensors are directly loaded in an MTLBuffer and handed to the frameworks that support it (only torch atm) via DLPack, skipping needless copies.
  • New backend parameter introduced, for the addition of the pread backend. We now support loading files via pread(2) syscall instead of just mmap. Useful for specific archs/platforms.
  • get_slice now handles ellipsis [...] and strided slices [:, ::8] wherever safetensors does the slicing itself (pread for any framework, MPS, and mmap outside torch/paddle), which silently dropped the step or rejected ... before.
  • MUSA device support for MooreThreads GPUs.
  • New dtype support includes float8_e4m3fnuz and float8_e5m2fnuz (AMD FNUZ FP8 formats).
  • The reader is now explicitly lenient about leading whitespace in the JSON header, which keeps the door open for future page-aligned writes.
Improvements/perf
  • File writes on macOS now use F_NOCACHE for direct I/O, yielding roughly 30% faster save_file on Apple Silicon.
  • The packaging dependency has been dropped from the [torch] extra, replaced by a simple hasattr probe for efficiency.

What's Changed

New Contributors

Full Changelog: safetensors/safetensors@v0.7.0...v0.8.0

getsentry/sentry-rust (sentry)

v0.49.3

Compare Source

Features
Deprecations
Fixes
  • Corrected disabled tracing behavior: transactions and spans are ignored without generating discarded-data client reports, and locally started traces leave the sampling decision unset rather than marking the trace as unsampled. Incoming sampling decisions are preserved in outgoing sentry-trace headers without enabling local capture. An explicit 0.0 trace sample rate remains distinct from disabled tracing and continues to generate client reports for locally unsampled transactions (#​1286).

v0.49.2

Compare Source

Fixes
  • Fix a bug that prevented the Curl transport from respecting Sentry rate limits (#​1279).
Deprecations
  • Deprecated ClientOptions::enable_logs. The option no longer disables manually captured logs (via the logging APIs); it now only disables automatic log capture by the log-capturing integrations (tracing and log with the logs feature). To stop an integration from sending logs, configure it via its own options (#​1299).
  • Deprecated ClientOptions::enable_metrics. The option is now a no-op; metrics are always enabled. To stop sending metrics, stop calling the metrics APIs (#​1300).

v0.49.1

Compare Source

Fixes
  • Preserve floating-point fields in tracing logs as numeric attributes (#​1278).

v0.49.0

Compare Source

Breaking Changes

  • ClientOptions is now #[non_exhaustive] (#​1230). The struct must now be constructed with the builder-style setters:

    // Before
let options = sentry::ClientOptions {
    dsn: "https://examplePublicKey@o0.ingest.sentry.io/0",
    debug: true,
    release: Some("my-app@1.0.0".into()),
    ..Default::default()
};

// After
let options = sentry::ClientOptions::new()
    .dsn("https://examplePublicKey@o0.ingest.sentry.io/0")
    .debug(true)
    .release("my-app@1.0.0");

  • Updated the sentry-opentelemetry integration to support OpenTelemetry 0.32. Users of the integration must update their OpenTelemetry dependencies from 0.29 to 0.32 (#​1262).

  • The logs and metrics features are now enabled by default in the sentry crate. This does not break the API, but may cause new telemetry to be sent to Sentry: log and tracing integrations can send structured logs, and applications can send metrics without adding the feature flags. Disable these features explicitly if this additional telemetry is not desired (#​1251).

  • Removed the public ClientOptions::sample_rate field. Use ClientOptions::event_sampling_strategy to inspect the configured event sampling strategy, and use the existing ClientOptions::sample_rate(...) builder setter to configure fixed-rate sampling.

  • Removed the public ClientOptions::sample_rate field. Use ClientOptions::event_sampling_strategy to inspect the configured event sampling strategy, and use the existing ClientOptions::sample_rate(...) builder setter to configure fixed-rate sampling (#​1228).

  • Removed the public ClientOptions::traces_sample_rate and ClientOptions::traces_sampler fields. Use ClientOptions::traces_sampling_strategy to inspect the configured traces sampling strategy, and use the existing ClientOptions::traces_sample_rate(...) and ClientOptions::traces_sampler(...) builder setters to configure fixed-rate and callback-based sampling (#​1227).

  • EnvelopeItem now stores Event and Transaction payloads in Box values. Code that constructs or pattern-matches these variants must account for the additional indirection (#​1255).

  • The sentry_log::RecordMapping enum's Event now stores the event in a Box (#​1269).

  • sentry_slog::RecordMapping is now #[non_exhaustive] and the Event variant now stores a boxed Event<'static> (#​1270)

  • The sentry_tracing::EventMapping enum's Event variant is now stored in a Box (#​1272)

New Features
Improvements
Fixes
  • Restored the reqwest transport's pre-0.13 protocol features by disabling HTTP/2 and native-TLS ALPN (#​1258).
  • EnvelopeError is now #[non_exhaustive] to allow adding new error variants without a breaking change (#​1254).

v0.48.5

Compare Source

Fixes
  • Fixed a bug that could cause the SDK to panic and, in some cases, panic while handling the panic, aborting the process (#​1241).

v0.48.4

Compare Source

New Features

  • Added builder-style setters to ClientOptions (#​1221):

    // Before
let options = sentry::ClientOptions {
    dsn: "https://examplePublicKey@o0.ingest.sentry.io/0",
    debug: true,
    release: Some("my-app@1.0.0".into()),
    ..Default::default()
};

// After
let options = sentry::ClientOptions::new()
    .dsn("https://examplePublicKey@o0.ingest.sentry.io/0")
    .debug(true)
    .release("my-app@1.0.0");
Deprecations
  • Constructing ClientOptions with struct-literal syntax, including ..Default::default() functional update syntax, is deprecated and will stop compiling in the next breaking release, as we will mark ClientOptions as #[non_exhaustive] (#​1221). Reading and assigning individual public fields will remain supported. Please migrate to the builder-style setters introduced in this release.

v0.48.3

Compare Source

The Sentry Rust SDK now reports data discarded by the SDK to Sentry’s Stats page. The SDK reports approximate counts for drops from transports, queues, rate-limit backoff, sampling, event processors, and before_send* callbacks, including span counts for dropped transactions and byte counts for dropped logs and metrics.

New Features
Deprecations
Fixes
  • Fixed ureq transport handling for HTTP error statuses so 429 rate limits and 413 payload-too-large responses are processed correctly (#​1177).
Behavior Changes
  • Custom transport factories that implement TransportFactory::create_transport now receive ClientOptions reconstructed from TransportOptions. The reconstructed options include only transport-relevant fields, such as DSN, user agent, proxy settings, and TLS certificate validation settings. This may affect code that reads non-transport fields in create_transport, but the API remains source-compatible and this change is included in a minor/patch release (#​1142).

v0.48.2

Compare Source

New Features
  • Added rustls-no-provider feature flag in the sentry crate to allow using the rustls transport with a different crypto provider (#​1103).
Fixes
  • Serialize attachment envelope headers as JSON to correctly encode header values (#​1109).
  • Use checked arithmetic to handle possible overflows (#​1119, #​1121, #​1122).

v0.48.1

Compare Source

Fixes
  • Changed ClientOptions::enable_metrics to default to true, aligning metrics behavior with other Sentry SDKs (#​1106). Metric capture APIs still require the metrics feature flag at compile time.

v0.48.0

Compare Source

Breaking Changes
New Features

📊📈💯 The Sentry-Rust SDK now supports emitting Sentry Metrics (#​1073)!

To get started, you will need to add the metrics feature flag when compiling the sentry crate. You will also need to enable metrics when initializing the SDK, like so:

use sentry::ClientOptions;

let _guard = sentry::init((
    "(your DSN here)",
    ClientOptions {
        enable_metrics: true,
        // ... other options ...
        ..Default::default()
    },
));

You can then capture metrics as follows:

use sentry::metrics;
use sentry::types::protocol::latest::Unit;

// We support counter, gauge, and distribution metrics.
metrics::counter("example.counter", 1).capture();
metrics::gauge("connections", 20).capture();
metrics::distribution("response.time", 123.4)
    .unit(Unit::Millisecond) // units can also be set on gauges
    .attribute("http.status", 200) // attributes can be set on all metric types
    .capture();
Fixes
  • Fixed several feature additivity SemVer violations, where enabling a feature flag could have introduced breaking changes. All known violations are fixed now, so simply enabling an additional feature flag in any Sentry SDK crate should no longer cause any public API breakages. Fixing these issues required us to break the public API in some places; those breakages are detailed above.

v0.47.0

Compare Source

Breaking Changes
  • Update reqwest from 0.12.25 to 0.13.1 (#​998). This change is breaking for users who use the RequestHttpTransport::with_client method.
  • sentry_core::HubSwitchGuard is now !Send, preventing it from being moved across threads (#​957).
New Features
Fixes
  • Fixed thread corruption bug where HubSwitchGuard could be dropped on wrong thread (#​957).
  • We now fork the Hub every time a span is entered. This prevents data from leaking across spans (#​957).
RustCrypto/hashes (sha2)

v0.11.0

Compare Source

huggingface/tokenizers (tokenizers)

v0.23.2

Compare Source

This is the last v0 release, we are moving to v1!!

More details coming soon 👀

What's Changed

New Contributors

Full Changelog: huggingface/tokenizers@v0.23.1...v0.23.2

v0.23.1

Compare Source

TL;DR

tokenizers 0.23.1 is the first proper stable release in the 0.23 line — 0.23.0 only ever shipped as rc0 because the release pipeline itself was broken (Node side hadn't shipped multi-platform binaries since 2023, Python side was on pyo3 0.27 without free-threaded support). 0.23.1 is the version where everything actually goes out the door together: full Node multi-platform wheels for the first time in years, Python 3.14 (regular and free-threaded 3.14t), full type hints for every Python class, and a stack of measurable perf wins on the BPE / added-vocab hot paths.

There is no functional 0.23.0 published — we tag 0.23.1 directly so users don't accidentally pull a never-shipped version.

🚨 Breaking changes

  • Drop Python 3.9 (#​1952) — requires-python = ">=3.10"; 3.9 users stay on 0.22.x.
  • add_tokens normalizes content at insertion (#​1995) — re-saved tokenizer.json may differ in the added_tokens block. Existing files load unchanged.
  • Type stubs are precise (#​1928, #​1997) — methods that returned Any now return real types; mypy --strict may surface previously-hidden errors. Stub layout also moved from tokenizers/<sub>/__init__.pyi to tokenizers/<sub>.pyi. This breaks the surface of some of the processors like RobertaProcessign's __init__ .
  • 3.14t-only: setters/getters return PyResult<T> because of Arc<RwLock<Tokenizer>>; a poisoned lock surfaces as PyException instead of a panic.

⚡ Performance — measured locally on this Mac, not lifted from PRs

Run with cargo bench --bench <name> -- --save-baseline v0_22_2 on v0.22.2, then --baseline v0_22_2 on v0.23.1. Numbers are point-in-time wall clock on a single laptop; relative deltas are what matters, absolute numbers will differ on CI hardware.

Added-vocabulary deserialize — the headline win (#​1995, #​1999)

bench: improve added_vocab_deserialize to reflect real-world workloads (#​2000) is now representative of how transformers actually loads tokenizer.json files. The combined effect of daachorse for the matching automaton plus the normalize-on-insert refactor is enormous on this workload:

benchmark v0.22.2 v0.23.1 change
100k tokens, special, no norm ~410 ms 248 ms −40%
100k tokens, non-special, no norm ~7.1 s 273 ms −96%
100k tokens, special, NFKC ~395 ms 235 ms −40%
100k tokens, non-special, NFKC ~7.4 s 290 ms −96%
400k tokens, special, no norm ~15 s 980 ms −94%

Real-world impact: loading a Llama-3-style tokenizer with a large set of added tokens dropped from "noticeable pause" to "instant".

BPE encode
benchmark v0.22.2 v0.23.1 change
BPE GPT2 encode batch, no cache 530 ms 446 ms −16%
BPE GPT2 encode batch (cached) 690 ms 685 ms noise
BPE GPT2 encode (single) 1.95 s 1.94 s noise
BPE Train (small) 32.6 ms 31.5 ms −3%
BPE Train (big) 1.01 s 988 ms −2%

The BPE per-thread cache PR (#​2028) shows much larger wins on highly-parallel workloads (+47–62% at 88+ threads on a server box, per the PR's own measurements on Vera). Single-thread batch numbers above are flat or slightly improved because cache-hit overhead was already low without contention.

Llama-3 encode
benchmark v0.22.2 v0.23.1 change
llama3-encode (single) 2.10 s 2.02 s −4%
llama3-batch 438 ms 408 ms −7%
llama3-offsets 410 ms 395 ms −4%
Truncation early exit (#​1990)

Right-direction truncation no longer pre-tokenizes past max_length. The new truncation_benchmark doesn't exist on v0.22.2 so there's no apples-to-apples here, but the PR's own measurements on the same machine showed −20–28% across a range of max_length values for right-truncation; left-truncation unchanged.

Other perf improvements (no direct comparable bench)
  • BPE::Builder::build no longer formats strings in a hot loop (#​2010) — ~45% faster Tokenizer::from_file on Llama-3 in the PR's profile.
  • BPE per-thread cache (#​2028) — see Vera numbers in PR description for parallel scale-out.

🔄 Serialization / deserialization

The tokenizer.json format is forward-compatible: existing files load on 0.23 unchanged. Two things to know if you re-save:

  • added_tokens entries created via add_tokens(..., normalized=True) will have their content normalized at save time — see breaking-change note above.
  • tokenizer.train(...) no longer keeps a redundant added_tokens/special_tokens Vec separate from the added_tokens_map_r. Public API surface unchanged; only the internal struct shape moved.

bench: improve added_vocab_deserialize to reflect real-world workloads (#​2000) lands a more realistic micro-benchmark for this surface; if you're tracking deserialize perf in your own CI, the new bench is the one to compare against.

🐍 Python: free-threaded 3.14t support

Dedicated wheels for python3.14t (the free-threaded build introduced in PEP 703). The wheel:

  • Declares Py_MOD_GIL_NOT_USED, so importing tokenizers does not force the GIL back on.
  • Builds without the abi3 cargo feature (free-threaded Python doesn't expose the limited API).
  • Goes through Arc<RwLock<Tokenizer>> for the inner state so concurrent setters and encoders don't race PyO3's per-pyclass borrow check.

A new stress-test module tests/test_freethreaded.py exercises N-encoder × M-setter races on a single Tokenizer and asserts no RuntimeError: Already borrowed, no RwLock poisoning, and that sys._is_gil_enabled() is False post-import.

For the regular CPython wheel everything is unchanged.

📦 Node.js bindings: first proper multi-platform release since 2023

The npm package now ships 13 platforms (macOS x64/arm64/universal, Windows x64/i686/arm64, Linux x64/arm64/armv7 in both glibc and musl, Android arm64/armv7) — previous workflows only built 3 of those, leaving Apple Silicon / Linux ARM / Alpine users with package-not-found errors since 2023 (#​1365, #​1703, #​1922). Fixed via #​1970 + #​2034, which also bumps @napi-rs/cli to v3 and switches cross-builds to cargo-zigbuild.

🧷 Type hints & typing for all classes (#​1928, #​1997)

Every class in the python bindings now ships proper .pyi stubs — Tokenizer, AddedToken, Encoding, every decoder / model / normalizer / pre-tokenizer / processor / trainer. Editors and type checkers (mypy, pyright, ty) see real signatures with types and docstrings instead of falling back to Any.

The stubs are generated automatically from the compiled extension via tools/stub-gen (Rust binary using pyo3-introspection). Re-running make style regenerates them; CI guards against regenerated-vs-checked-in drift. If the generator ever returns 0 docstrings (e.g. because the [patch.crates-io] pin in .cargo/config.toml falls out of sync with the pyo3 dep version), it now hard-aborts with a precise diagnostic instead of silently emitting bare-

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Helsinki)

  • Branch creation
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@laurigates-renovate laurigates-renovate Bot added the dependencies Pull requests that update a dependency file label Sep 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants