Skip to content

Bump the python-deps group across 1 directory with 4 updates - #100

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/sdk/dev/python-deps-b075b2cd6e
Open

Bump the python-deps group across 1 directory with 4 updates#100
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/sdk/dev/python-deps-b075b2cd6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on transformers, mcp, gradio and unplug-ai to permit the latest version.
Updates transformers to 5.15.0

Release notes

Sourced from transformers's releases.

Release: v5.15.0

Release v5.15.0

New Model additions

Meta Muse Glimmer

Muse Glimmer, released today, is Meta’s new multimodal model, especially designed for agentic use cases. Distilled from Muse to 30B parameters, and released under the Apache 2.0 license, it can be deployed to local setups for privacy-aware applications such as coding, document analysis, personal assistants, Claw- or Hermes-like setups.

Muse Glimmer is a dense 30B parameter model consisting of:

  • 2B ViT-style encoder for vision (Perception Encoder)
  • 28B parameter text decoder

We're covering it in the following blogpost: http://hf.co/blog/muse-glimmer

GraniteMoeSWA & GraniteSWA

Links: Documentation

Links: Documentation

A.X-K1 & A.X-K2

Links: Documentation

Links: Documentation

Cosmos3 Edge

Links: Documentation

... (truncated)

Commits
  • 5eddc12 Release: v5.15.0
  • 7bfaf47 Add MuseGlimmer (#47867)
  • 4bd3150 Revert "Fix CodeLlama tokenizer dropping leading whitespace on decode (#47488...
  • fd12552 Fix cached_files silently returning stale file on read-only filesystem (EROFS...
  • e8ea728 Fix PhimoeIntegrationTest (#46539)
  • 9436284 make examples under doc device agnostic (#47812)
  • 87b0711 cancel deterministic for XPU in gemma4 tests (#47790)
  • 5d6dff8 Serialize post-mlinter-review after post-link to avoid PR description race (#...
  • 96869d7 Use content hash for mlinter review deduplication (#47830)
  • e1d50b2 Add new args in auto-docstring (#47737)
  • Additional commits viewable in compare view

Updates mcp to 2.0.0

Release notes

Sourced from mcp's releases.

v2.0.0

MCP Python SDK v2 Stable Release

This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server. pip install mcp now installs 2.x.

pip install "mcp[cli]"
# or
uv add "mcp[cli]"

Documentation Rewrite

The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.

V1 Maintenance mode

v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the v1.x branch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a <2 upper bound on your requirement (for example mcp>=1.28,<2).

Highlights

One SDK, both protocol eras

v2 speaks the 2026-07-28 revision (stateless requests with no handshake, server/discover, subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the same MCPServer, over Streamable HTTP and stdio, with nothing to configure. Client(target) negotiates the version automatically.

FastMCP is now MCPServer, and there is a first-class Client

The decorator API is unchanged; the low-level Server is rebuilt around a shared dispatcher engine, and one Client object replaces v1's transport-plus-ClientSession-plus-initialize() layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.

Multi-round-trip requests and resolver dependency injection

At 2026-07-28 the server can no longer call the client, so tools return the question instead. A Resolve(fn) parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.

Extension APIs, OpenTelemetry, and a standalone types package

Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package, mcp-types (imported as mcp_types), published in lock-step with mcp.

Hardened stdio and auth

stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.

Coming from a v2 pre-release

Since the last release candidate: the per-version wire packages are private (mcp_types._v*), mcp.types is a permanent alias for mcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas: Client(cache=False) is now cache=None with CacheConfig() the default; Context.client_id, RFC7523OAuthClientProvider, and OAuthClientProvider(timeout=) are removed; the client-credentials providers take scope=; message_handler receives notifications and exceptions only; FileResource(is_binary=) becomes encoding; MCP_* env vars are gone with pydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.

Known gaps

The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity jwt-bearer grant are not implemented; both are additive and can land in 2.x.

Feedback

... (truncated)

Commits
  • 6f69a37 Present v2 as the stable release across the README, docs, and policies (#3178)
  • 78e6fbb Serve v2 docs at the site root, with permanent per-major paths (#3176)
  • af06330 Remove unused StreamableHTTPTransport.get_session_id() (#3205)
  • 68ca87e Document the two-line release process for stable v2 (#3179)
  • c9c431b Expose the middleware chain on MCPServer and stop sending unrequested change ...
  • 528e366 Fail fast on server-to-client requests in JSON-response mode instead of hangi...
  • 27f5cc7 Remove unused mcpserver.exceptions.ValidationError (#3199)
  • 89c5e70 Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198)
  • b61ce38 docs: fix off-by-one hl_lines in apps.md (#3196)
  • b7c9a91 Add mcp.types as a permanent alias for mcp_types (#3190)
  • Additional commits viewable in compare view

Updates gradio to 6.22.0

Release notes

Sourced from gradio's releases.

gradio@6.22.0

Features

  • #13685 6302098 - gr.Workflow: auto-create input/output nodes for model nodes (as already happens for Space nodes), replace the "Input"/"Output" buttons with a single "Component" button whose direction is derived from wiring, rename "Data" to "Dataset", let node error messages be copied, and document the oauth_token parameter in the View API panel. Thanks @​abidlabs!
  • #13688 321361f - Workflow: resizable nodes, full-screen image view, and webcam/mic capture. Thanks @​abidlabs!
  • #13697 3ac9d5d - Fix release CI regressions for assets and bundles. Thanks @​abidlabs!

Fixes

  • #13692 3676c45 - publish the Prism global before its grammar files load, so the docs pages stop failing to hydrate with ReferenceError: Prism is not defined. Thanks @​abidlabs!
  • #13687 fd79d09 - Harden authentication and file redirect boundaries. Thanks @​abidlabs!
Changelog

Sourced from gradio's changelog.

6.22.0

Features

  • #13685 6302098 - gr.Workflow: auto-create input/output nodes for model nodes (as already happens for Space nodes), replace the "Input"/"Output" buttons with a single "Component" button whose direction is derived from wiring, rename "Data" to "Dataset", let node error messages be copied, and document the oauth_token parameter in the View API panel. Thanks @​abidlabs!
  • #13688 321361f - Workflow: resizable nodes, full-screen image view, and webcam/mic capture. Thanks @​abidlabs!
  • #13697 3ac9d5d - Fix release CI regressions for assets and bundles. Thanks @​abidlabs!

Fixes

  • #13692 3676c45 - publish the Prism global before its grammar files load, so the docs pages stop failing to hydrate with ReferenceError: Prism is not defined. Thanks @​abidlabs!
  • #13687 fd79d09 - Harden authentication and file redirect boundaries. Thanks @​abidlabs!

6.21.0

Features

  • #13601 0ee5cc8 - Preserve browser-visible proxy origins for frontend assets and API requests, and retain app-level FastAPI root paths. Thanks @​abidlabs!
  • #13620 5200235 - Fix chained events after cancellation and while the browser tab is hidden. Thanks @​abidlabs!
  • #13667 2d753d0 - oauth: let API callers supply a token for endpoints that take a gr.OAuthToken, via oauth_token on the Python and JS clients — sent only to endpoints that declare they need one. Thanks @​abidlabs!
  • #13329 7ac583a - Make builds go zoom zoom. Thanks @​pngwn!
  • #13650 8bdc643 - Fix gradio cc dev, gradio cc build, and gradio cc install to respect a custom FRONTEND_DIR set on the component class, instead of assuming the frontend code lives in the frontend directory. Thanks @​abidlabs!
  • #13558 d07af9d - workflow: add model endpoint integration. Thanks @​hannahblair!
  • #13681 eed6ebd - Report why the Node SSR server failed, and serve without SSR on the expected port. Thanks @​abidlabs!
  • #13654 2f6d04a - workflow: improve canvas authoring and examples. Thanks @​abidlabs!
  • #13606 04c5527 - Fix spurious separators from empty tokens in HighlightedText with combine_adjacent=True. Thanks @​hysts!
  • #13668 3473879 - workflow: add html modality. Thanks @​hannahblair!
  • #13666 d3c70fa - workflow: various UX improvements, including opening the write-access link in a browser tab automatically when a gr.Workflow is launched locally, and calling vision-language models through chat completions so image-text-to-text model nodes work. Thanks @​abidlabs!
  • #13590 d5ef897 - workflow: fix error banner and textarea visibility. Thanks @​hannahblair!
  • #13616 a2ddecf - workflow: ensure we handle trailing null values. Thanks @​hannahblair!

Fixes

... (truncated)

Commits
  • 45c11d5 chore: update versions (#13696)
  • 3ac9d5d Fix release CI regressions for assets and bundles (#13697)
  • fd79d09 Harden authentication and file redirect boundaries (#13687)
  • 6302098 Workflow: auto-create nodes for model nodes, Output button, copyable errors, ...
  • 3676c45 Publish the Prism global before its grammars load (fixes docs pages 500ing)...
  • 321361f Workflow: resizable nodes, full-screen image view, and webcam/mic capture (#1...
  • 0fd56c1 chore: update versions (#13691)
  • a1c3ffc fix: recover unpublished 6.21 release (#13690)
  • c3c5c67 Revert "fix: recover unpublished 6.21 release"
  • dfdae7a fix: recover unpublished 6.21 release
  • Additional commits viewable in compare view

Updates unplug-ai from 0.4.1 to 0.6.0

Release notes

Sourced from unplug-ai's releases.

v0.6.0

unplug-ai 0.6.0

Minor release since 0.5.2: adversarial security fixes, public limits/judge API, and a durable local test harness.

Security

  • Safe-prefix cache boundary overlap + source/policy-scoped keys (#87)
  • Per-request scanner allowlist no longer sticks across scans (#88)
  • Guard config mode and strict allowlist loading (#89)
  • Judge action/score enforcement (#90)
  • Review-debt hardening for cache, judge, ML lock, and checkpoints (#91)

Added

  • Public LimitConfig / BYOLLM judge API surface (#80)
  • Injection regex expansion + bidi normalizer stripping (#80)
  • Local harness: test-frameworks, test-ml-harness, smoke-ml-hooks, test-all-local + TESTING_HARNESS.md (#92)

Fixed

  • Post-merge review follow-ups from promote/Phase C (#81)

See CHANGELOG.md for full details.

v0.5.2

unplug-ai 0.5.2

Patch release: robustness, usability, and YAGNI cleanup after 0.5.1. Python 3.13 [ml]/[all] install was already fixed in 0.5.1.

Fixed

  • Model store / Guard ML: Corrupt manifests no longer crash Guard or unplug-models; checkpoint validation, atomic downloads, clearer CLI errors (#72).
  • ML inference: Safe BIOES decode, validated label maps/devices, thread-safe model load (#73).
  • Agent usability: Accurate Guard.init() docs; unplug.api.* guidance for server/MCP; REVIEW outcomes log at INFO (#74).

Changed

  • Packaging extras / install docs polish; wider transformers constraint; unknown active_model raises ConfigError (#75).

Removed

  • Dead scrape/content/haystack shims and no-op judge config fields (#77).

Added

  • Deprecation shim coverage; synthetic BIOES test fixture; CI wheel-only [ml] resolve on 3.13 (#76).

See CHANGELOG.md for full details.

v0.5.1

unplug-ai 0.5.1

Patch release: Python 3.13 packaging fix and supply-chain hardening of the bundled model catalog.

Fixed

  • Python 3.13: unplug-ai[ml] / [all] now install without a Rust toolchain — transformers constraint widened to >=4.44,<5.13 so tokenizers resolves to a cp313 wheel (0.5.0 pinned transformers>=4.44,<4.45 → tokenizers==0.19.1).

... (truncated)

Changelog

Sourced from unplug-ai's changelog.

[0.6.0] — 2026-07-20

Security

  • Safe-prefix cache: re-scan overlap at chunk boundaries and scope cache keys by source + policy fingerprint so split injection phrases and cross-source ALLOW reuse cannot bypass detection (#87, fixes #82/#83)
  • Per-request scanners= allowlist no longer sticks on the shared ExecutionContext; omitted scanners clears the allowlist so later scans use the full configured set (#88, fixes #84)
  • Guard(config=GuardConfig(mode=...)) keeps the configured mode when mode= is not passed; strict_scanner_allowlist loads from TOML/build_config; unknown [guard] keys raise ConfigError (#89, fixes #85)
  • Judge action=block / review / allow clamps finding scores so declared verdicts drive enforcement even when the LLM returns an inconsistent score (#90, fixes #86)
  • Follow-up hardening from review debt: cache policy fingerprint + prefix overlap ≥ 1, strict-allowlist coercion, judge score enforcement, skip sensitive-context boost on llm_judge, hold ML inference lock through predict_batch, validate indexed shard checkpoints (#91)

Added

  • Public LimitConfig / BYOLLM judge surface (unplug, unplug.api.limits, unplug.api.judge) with docs, example, and TOML notes (#80)
  • Focused injection regex patterns from neuralchemy FN sampling; bidi control stripping in the normalizer (#80)
  • Pre-0.6.0 local test harness: make test-frameworks, test-ml-harness, smoke-ml-hooks, test-all-local plus sdk/docs/TESTING_HARNESS.md (#92)

Fixed

  • Post-merge review follow-ups across promote/Phase C: unplug-scan pin, AG2 multimodal redaction, model download flock/staging, tighter instructions_updated_supersede regex, NORMALIZER_VERSION bump, sharded safetensors checkpoints (#81)

Changed

  • Eval docs refreshed (EVAL_PHASE_C.md / benchmarks); regex neuralchemy recall/F1 improved modestly after pattern expansion (#80)

[0.5.2] — 2026-07-20

Added

  • Coverage tests for v1.0 deprecation shim re-exports (unplug.core.*, guard_scan, scanner, safeguards)
  • Offline synthetic BIOES checkpoint fixture for ML unit tests (no real weights required)
  • CI wheel-only resolve for unplug-ai[ml] on Python 3.13 (catches sdist-only breakage)

Removed

  • Dead modules: providers/scrape.py, providers/content/server.py, optional/haystack.py (unused; use guards/scrape, providers/content/firecrawl, integrations/haystack)
  • Config fields judge_enabled, pipeline.judge_timeout (no-op; pass judge= to Guard() instead)

Changed

  • Unknown active_model tier names now raise ConfigError with valid catalog tiers instead of silently running without ML
  • Widen transformers extra constraint to >=4.44,<6 (was <5.13) so newer minors stay installable
  • Drop published dev optional-extra; test/lint tools live in the dev dependency-group (uv sync --dev)
  • Deprecated config: judge_enabled, pipeline.judge_timeout, pipeline.fail_closed warn and are ignored (removed in v1.0); guard.fail_closed=false / fail_mode="open" unchanged
  • Docs: unplug-ai[scrape] package name in Firecrawl docstring; Atomic Agents Python ≥3.12 install gate; Semantic Kernel pybars4 wheel-only note

Fixed

  • Agent usability: Guard.init() docstring no longer claims auto-instrumentation; docs standardize on from unplug import ... for apps and unplug.api.* for server/MCP dependents; routine REVIEW pipeline outcomes log at INFO instead of WARNING
  • ML inference hardening: BIOES decode no longer crashes on checkpoints without *-INJ labels; label maps are validated at load with a clear ModelError; forced torch devices are validated (ConfigError); ModelProvider/SpanInferenceModel load is thread-safe; ML modules log device/tokenizer fallbacks and import torch via unplug.optional.ml helpers
  • Model store hardening: corrupt manifests no longer crash Guard or unplug-models; checkpoint validation requires weight files; atomic manifest writes and download swaps preserve existing installs on failure; list_status correctly reports stale revisions as upgrade-available; invalid UNPLUG_MODEL_PATH logs a warning; CLI download errors distinguish missing ML extras from network/repo failures

... (truncated)

Commits
  • 2213c5d Merge pull request #94 from UnplugAI/release/0.6.0-to-main
  • 91072f7 Merge remote-tracking branch 'origin/dev' into release/0.6.0-to-main
  • 968ebe5 Release 0.6.0: security + harness (#93)
  • 627d65f Add pre-0.6.0 SDK test harness
  • 59e6d31 Fix open Greptile review debt on dev (#91)
  • eaeb3d2 Honor judge BLOCK when score is low (#90)
  • 2221d98 Fix Guard config mode and strict allowlist loading (#89)
  • 903ff9a Reset per-request scanner allowlist after scan (#88)
  • 4b18d11 Fix safe-prefix cache boundary bypass (#87)
  • 18dee37 Fix post-merge review findings from #71/#79/#80 (#81)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Dependency updates label Jul 31, 2026
@greptile-apps

greptile-apps Bot commented Jul 31, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@github-actions

github-actions Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

coverage

SDK Coverage •
FileStmtsMissCoverMissing
TOTAL729389887% 
report-only-changed-files is enabled. No files were changed during this commit :)

Tests Skipped Failures Errors Time
1220 25 💤 0 ❌ 0 🔥 39.924s ⏱️

@dependabot
Bump the python-deps group across 1 directory with 4 updates
ba80e1f 
Updates the requirements on [transformers](https://github.com/huggingface/transformers), [mcp](https://github.com/modelcontextprotocol/python-sdk), [gradio](https://github.com/gradio-app/gradio) and [unplug-ai](https://github.com/UnplugAI/Unplug) to permit the latest version.

Updates `transformers` to 5.15.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.44.0...v5.15.0)

Updates `mcp` to 2.0.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.0.0...v2.0.0)

Updates `gradio` to 6.22.0
- [Release notes](https://github.com/gradio-app/gradio/releases)
- [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.19.0...gradio@6.22.0)

Updates `unplug-ai` from 0.4.1 to 0.6.0
- [Release notes](https://github.com/UnplugAI/Unplug/releases)
- [Changelog](https://github.com/UnplugAI/Unplug/blob/dev/CHANGELOG.md)
- [Commits](v0.4.1...v0.6.0)

---
updated-dependencies:
- dependency-name: gradio
  dependency-version: 6.20.0
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: mcp
  dependency-version: 2.0.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: unplug-ai
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/sdk/dev/python-deps-b075b2cd6e branch from 8bdc1d6 to ba80e1f Compare August 14, 2026 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants