Bump the pip group across 1 directory with 8 updates by dependabot[bot] · Pull Request #2 · arcee-ai/vllm

dependabot · 2025-11-04T18:20:02Z

Bumps the pip group with 8 updates in the /requirements directory:

Package	From	To
h11	`0.14.0`	`0.16.0`
mlflow	`2.22.0`	`3.5.0rc0`
protobuf	`5.28.3`	`5.29.5`
ray	`2.48.0`	`2.50.0`
requests	`2.32.3`	`2.32.4`
setuptools	`77.0.3`	`78.1.1`
starlette	`0.46.2`	`0.49.1`
urllib3	`2.2.3`	`2.5.0`

Updates h11 from 0.14.0 to 0.16.0

Commits

1c5b075 this time for surer
d9c3699 this time for sure...
d91b9dd blacken
5a4683c Soothe mypy
9c9567f Bump version to 0.16.0
114803a Merge commit from fork
9462006 Bump version to 0.15.0
70a96be Merge pull request #181 from Julien00859/Julien00859/get_int_max_str_digits
60782ad Reject Content-Length longer 1 billion TB
dff7cc3 Validate Chunked-Encoding chunk footer
Additional commits viewable in compare view

Updates mlflow from 2.22.0 to 3.5.0rc0

Release notes

Sourced from mlflow's releases.

v3.5.0rc0

MLflow 3.5.0rc0 includes several major features and improvements

Major new features:

🤖 Tracing support for Claude Code SDK: MLflow now provides a tracing integration for both the Claude Code CLI and SDK! Configure the autologging integration to track your prompts, Claude's responses, tool calls, and more. Check out this doc page to get started. (#18022, @smoorjani)

✨ Improved UI homepage: The MLflow UI's homepage has been updated to help you get started with more of our latest features. This page will be updated regularly moving forward, allowing you to get more in-product guidance. (#18098, @B-Step62)

🗂️ Evaluation datasets UI integration: In MLflow 3.4.0, we released backend support for creating evaluation datasets for GenAI applications. In this release, we've added a new tab to the MLflow Experiment UI, allowing you to create, manage, and export traces to your datasets without having to write a line of code. (#18110, @daniellok-db)

🧮 GEPA support for prompt optimization: MLflow's prompt optimization feature now supports the GEPA algorithm, allowing you to achieve higher performing prompts with less rollouts. For instructions on how to get started with prompt optimization, visit this doc page! (#18031, @TomeHirata)

🔐 Security middleware layer for tracking server: MLflow now ships with a security middleware layer by default, allowing you to protect against DNS rebinding, CORS attacks, and more. Read the documentation here to learn how to configure these options. (#17910, @BenWilson2)

Stay tuned for the full release, which will be packed with more features and bugfixes.

To try out this release candidate, please run:

pip install mlflow==3.5.0rc0

v3.4.0

MLflow 3.4.0rc0 includes several major features and improvements

Major New Features

📊 OpenTelemetry Metrics Export: MLflow now exports span-level statistics as OpenTelemetry metrics, providing enhanced observability and monitoring capabilities for traced applications. (#17325, @dbczumar)

🤖 MCP Server Integration: Introducing the Model Context Protocol (MCP) server for MLflow, enabling AI assistants and LLMs to interact with MLflow programmatically. (#17122, @harupy)

🧑‍⚖️ Custom Judges API: New make_judge API enables creation of custom evaluation judges for assessing LLM outputs with domain-specific criteria. (#17647, @BenWilson2, @dbczumar, @alkispoly-db, @smoorjani)

📈 Correlations Backend: Implemented backend infrastructure for storing and computing correlations between experiment metrics using NPMI (Normalized Pointwise Mutual Information). (#17309, #17368, @BenWilson2)

🗂️ Evaluation Datasets: MLflow now supports storing and versioning evaluation datasets directly within experiments for reproducible model assessment. (#17447, @BenWilson2)

🔗 Databricks Backend for MLflow Server: MLflow server can now use Databricks as a backend, enabling seamless integration with Databricks workspaces. (#17411, @nsthorat)

🤖 Claude Autologging: Automatic tracing support for Claude AI interactions, capturing conversations and model responses. (#17305, @smoorjani)

🌊 Strands Agent Tracing: Added comprehensive tracing support for Strands agents, including automatic instrumentation for agent workflows and interactions. (#17151, @joelrobin18)

🧪 Experiment Types in UI: MLflow now introduces experiment types, helping reduce clutter between classic ML/DL and GenAI features. MLflow auto-detects the type, but you can easily adjust it via a selector next to the experiment name. (#17605, @daniellok-db)

Features:

[Evaluation] Add ability to pass tags via dataframe in mlflow.genai.evaluate (#17549, @smoorjani)

[Evaluation] Add custom judge model support for Safety and RetrievalRelevance builtin scorers (#17526, @dbrx-euirim)

[Tracing] Add AI commands as MCP prompts for LLM interaction (#17608, @nsthorat)

[Tracing] Add MLFLOW_ENABLE_OTLP_EXPORTER environment variable (#17505, @dbczumar)

[Tracing] Support OTel and MLflow dual export (#17187, @dbczumar)

[Tracing] Make set_destination use ContextVar for thread safety (#17219, @B-Step62)

[CLI] Add MLflow commands CLI for exposing prompt commands to LLMs (#17530, @nsthorat)

[CLI] Add 'mlflow runs link-traces' command (#17444, @nsthorat)

[CLI] Add 'mlflow runs create' command for programmatic run creation (#17417, @nsthorat)

[CLI] Add MLflow traces CLI command with comprehensive search and management capabilities (#17302, @nsthorat)

[CLI] Add --env-file flag to all MLflow CLI commands (#17509, @nsthorat)

[Tracking] Backend for storing scorers in MLflow experiments (#17090, @WeichenXu123)

[Model Registry] Allow cross-workspace copying of model versions between WMR and UC (#17458, @arpitjasa-db)

[Models] Add automatic Git-based model versioning for GenAI applications (#17076, @harupy)

[Models] Improve WheeledModel._download_wheels safety (#17004, @serena-ruan)

[Projects] Support resume run for Optuna hyperparameter optimization (#17191, @lu-wang-dl)

... (truncated)

Changelog

Sourced from mlflow's changelog.

3.5.0rc0 (2025-10-08)

MLflow 3.5.0rc0 includes several major features and improvements

Major new features:

🤖 Tracing support for Claude Code SDK: MLflow now provides a tracing integration for both the Claude Code CLI and SDK! Configure the autologging integration to track your prompts, Claude's responses, tool calls, and more. Check out this doc page to get started. (#18022, @smoorjani)

✨ Improved UI homepage: The MLflow UI's homepage has been updated to help you get started with more of our latest features. This page will be updated regularly moving forward, allowing you to get more in-product guidance.

🗂️ Evaluation datasets UI integration: In MLflow 3.4.0, we released backend support for creating evaluation datasets for GenAI applications. In this release, we've added a new tab to the MLflow Experiment UI, allowing you to create, manage, and export traces to your datasets without having to write a line of code.

🧮 GEPA support for prompt optimization: MLflow's prompt optimization feature now supports the GEPA algorithm, allowing you to achieve higher performing prompts with less rollouts. For instructions on how to get started with prompt optimization, visit this doc page!

🔐 Security middleware layer for tracking server: MLflow now ships with a security middleware layer by default, allowing you to protect against DNS rebinding, CORS attacks, and more. Read the documentation here to learn how to configure these options.

Stay tuned for the full release, which will be packed with more features and bugfixes.

To try out this release candidate, please run:

pip install mlflow==3.5.0rc0

3.4.0rc0 (2025-09-11)

MLflow 3.4.0rc0 includes several major features and improvements

Major New Features

📊 OpenTelemetry Metrics Export: MLflow now exports span-level statistics as OpenTelemetry metrics, providing enhanced observability and monitoring capabilities for traced applications. (#17325, @dbczumar)

🤖 MCP Server Integration: Introducing the Model Context Protocol (MCP) server for MLflow, enabling AI assistants and LLMs to interact with MLflow programmatically. (#17122, @harupy)

🧑‍⚖️ Custom Judges API: New make_judge API enables creation of custom evaluation judges for assessing LLM outputs with domain-specific criteria. (#17647, @BenWilson2, @dbczumar, @alkispoly-db, @smoorjani)

📈 Correlations Backend: Implemented backend infrastructure for storing and computing correlations between experiment metrics using NPMI (Normalized Pointwise Mutual Information). (#17309, #17368, @BenWilson2)

🗂️ Evaluation Datasets: MLflow now supports storing and versioning evaluation datasets directly within experiments for reproducible model assessment. (#17447, @BenWilson2)

🔗 Databricks Backend for MLflow Server: MLflow server can now use Databricks as a backend, enabling seamless integration with Databricks workspaces. (#17411, @nsthorat)

🤖 Claude Autologging: Automatic tracing support for Claude AI interactions, capturing conversations and model responses. (#17305, @smoorjani)

🌊 Strands Agent Tracing: Added comprehensive tracing support for Strands agents, including automatic instrumentation for agent workflows and interactions. (#17151, @joelrobin18)

🧪 Experiment Types in UI: MLflow now introduces experiment types, helping reduce clutter between classic ML/DL and GenAI features. MLflow auto-detects the type, but you can easily adjust it via a selector next to the experiment name. (#17605, @daniellok-db)

Features:

[Evaluation] Add ability to pass tags via dataframe in mlflow.genai.evaluate (#17549, @smoorjani)

[Evaluation] Add custom judge model support for Safety and RetrievalRelevance builtin scorers (#17526, @dbrx-euirim)

[Tracing] Add AI commands as MCP prompts for LLM interaction (#17608, @nsthorat)

[Tracing] Add MLFLOW_ENABLE_OTLP_EXPORTER environment variable (#17505, @dbczumar)

[Tracing] Support OTel and MLflow dual export (#17187, @dbczumar)

[Tracing] Make set_destination use ContextVar for thread safety (#17219, @B-Step62)

[CLI] Add MLflow commands CLI for exposing prompt commands to LLMs (#17530, @nsthorat)

[CLI] Add 'mlflow runs link-traces' command (#17444, @nsthorat)

[CLI] Add 'mlflow runs create' command for programmatic run creation (#17417, @nsthorat)

[CLI] Add MLflow traces CLI command with comprehensive search and management capabilities (#17302, @nsthorat)

[CLI] Add --env-file flag to all MLflow CLI commands (#17509, @nsthorat)

[Tracking] Backend for storing scorers in MLflow experiments (#17090, @WeichenXu123)

[Model Registry] Allow cross-workspace copying of model versions between WMR and UC (#17458, @arpitjasa-db)

[Models] Add automatic Git-based model versioning for GenAI applications (#17076, @harupy)

... (truncated)

Commits

19c618c Run python3 dev/update_mlflow_versions.py pre-release ... (#18181)
13115e4 Support GEPA in mlflow.genai.optimize_prompt (#18031)
fa83107 Run python3 dev/update_ml_package_versions.py (#18177)
16fc22f Add uv lock call after pyproject.toml generation in DEV branch (#18180)
be2125a Run python3 dev/update_requirements.py && python3 bin/... (#18176)
2fd3145 Dump sql_warehouse_id into trace UI mimebundle (#18165)
5cb6a95 Replace Docker with uv in tests/test_import.py for faster test execution (#18...
eaadd39 Add support for trace inputs to built-in scorers (#17943)
30f2f55 Add B012 (jump-statement-in-finally) rule to ruff configuration (#18170)
97ac7e1 Increase MAX_DOCSTRING_LENGTH_RATIO to 1.25 and remove redundant test docstri...
Additional commits viewable in compare view

Updates protobuf from 5.28.3 to 5.29.5

Commits

f5de0a0 Updating version.json and repo version numbers to: 29.5
8563766 Merge pull request #21858 from shaod2/py-cp-29
05ba1a8 Add recursion depth limits to pure python
1ef3f01 Internal pure python fixes
69cca9b Remove fast-path check for non-clang compilers in MessageCreator. (#21612)
21fdb7a fix: contains check segfaults on empty map (#20446) (#20904)
03c50e3 Re-enable aarch64 tests. (#20853)
128f0aa Add volatile to featuresResolved (#20767)
bdd49bb Merge pull request #20755 from protocolbuffers/29.x-202503192110
c659468 Updating version.json and repo version numbers to: 29.5-dev
Additional commits viewable in compare view

Updates ray from 2.48.0 to 2.50.0

Release notes

Sourced from ray's releases.

Ray-2.50.0

Release Highlights

Ray Data: This release offers many updates to Ray Data, including:

The default shuffle strategy is now changed from sort-based to hash-based. This will result in much lower peak memory usage and improved shuffle performance for aggregations.

We’ve added a new expression API enables predicate-based filtering, UDF transformations with with_column, and column aliasing for more powerful data transformations

Ray Data LLM has a number of new enhancements for multimodal data pipelines, including multi-node tensor and pipeline parallelism support per replica and ability to share vLLM engines across processors.

Ray Core:

Alpha release of Ray Direct Transport (formerly GPU objects) - simply enable it by adding the tensor_transport parameter to the existing native Ray Core API. This keeps GPU data in GPU memory until a transfer is needed, avoiding expensive serialization and copies to and from the Ray object store. It uses efficient data transports such as collective communication libraries (GLOO or NCCL) or point-to-point RDMA (via NVIDIA’s NIXL) to transfer data directly between devices, including both CPUs and GPUs.

Ray Train:

Local mode support for multi-process training with torchrun, enhanced checkpoint management with new upload modes and validation functions

Ray Serve:

Async Inference alpha release - New Ray Serve APIs for supporting long-running asynchronous inference tasks, such as for video or large document processing. Includes capabilities for using different message brokers, adapters like celery and DLQ.

Support for replica ranks - Replica level ranks are added for supporting large-model inference use-cases such as wide Data Parallel and Expert Parallel setups.

FastAPI factory pattern support - Enables using FastAPI plugins that are not serializable via cloudpickle.

Throughput optimizations - Enable these using the RAY_SERVE_THROUGHPUT_OPTIMIZED environment variable.

RLLib: Add StepFailedRecreateEnv exception for users with unsatisfiable environments

Ray Serve/Data LLM:

Improvements to multi node serving, loading models from remote storages, and sharing resources for efficiency (fractional gpus, sharing gpus on a data pipeline with shared stages)

Ray Libraries

Ray Data

🎉 New Features:

Expression and Filtering API: New expression API enables predicate-based filtering, UDF transformations with with_column, and column aliasing for more powerful data transformations (#56716, #56313, #56550, #55915, #55788, #56193, #56596)

Added support for projection pushdown into Parquet reads (#56500)

New download expression enables efficient loading of data from columns containing URIs with improved performance and error handling (#55824, #56462, #56294, #56852, #57146)

New explain() API provides insights into dataset execution plans (#55482)

Added streaming_train_test_split to avoid materialization for train/test splits (#56803)

Ray Data LLM:

Enabled multi-node tensor and pipeline parallelism for LLM processing (#56779)

Added chat_template_kwargs parameter for customizing chat templates (#56490)

Added support for OpenAI's nested image URL format in multimodal pipelines (#56584)

vLLM engines can now be shared across sequential processors for better resource utilization (#55179)

Enhanced Dataset.stats() output with input/output row counts per operator (#56040)

Added new metrics for task duration, inputs per task, and output blocks (#56958, #56379)

Time to first batch metric for better iteration performance monitoring (#55758)

Added type-specific aggregators for numerical, categorical, and vector columns (#56610)

... (truncated)

Commits

fc4510f [DOC-127] Cherry-pick (#54254): MVP for OSS Ray labels (#57547)
276c75c [Data] Fixed max_retries for hash shuffle (#57575)
1228933 [data] Fix errors with concatenation with mixed pyarrow native and extension ...
2ece9ff [2.50 CHERRY-PICK][docs] Update SLURM docs with symmetric-run (#56775) (#57565)
e46fe7e more core code cherrypicks (#57557)
8f3bc35 [core] Make Unsubscribe Idempotent (#57546)
c96f330 [data] deflake sql + consumption + execution_optimizer + issue detection mana...
bf7133e [data] disable image_embedding_from_jsonl_fixed_size_chaos (#57544)
720d9c1 [core] Preserve err type in case of task cancellation due to actor death (#57...
93e5a96 change release version (#57536)
Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.32.4

Release notes

Sourced from requests's releases.

v2.32.4

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS. (#6926)

Dropped support for pypy 3.9 following its end of support. (#6926)

Changelog

Sourced from requests's changelog.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.

Dropped support for pypy 3.9 following its end of support.

Commits

021dc72 Polish up release tooling for last manual release
821770e Bump version and add release notes for v2.32.4
59f8aa2 Add netrc file search information to authentication documentation (#6876)
5b4b64c Add more tests to prevent regression of CVE 2024 47081
7bc4587 Add new test to check netrc auth leak (#6962)
96ba401 Only use hostname to do netrc lookup instead of netloc
7341690 Merge pull request #6951 from tswast/patch-1
6716d7c remove links
a7e1c74 Update docs/conf.py
c799b81 docs: fix dead links to kenreitz.org
Additional commits viewable in compare view

Updates setuptools from 77.0.3 to 78.1.1

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

More fully sanitized the filename in PackageIndex._download. (#4946)

v78.1.0

Features

Restore access to _get_vc_env with a warning. (#4874)

v78.0.2

Bugfixes

Postponed removals of deprecated dash-separated and uppercase fields in setup.cfg. All packages with deprecated configurations are advised to move before 2026. (#4911)

v78.0.1

Misc

#4909

v78.0.0

Bugfixes

Reverted distutils changes that broke the monkey patching of command classes. (#4902)

Deprecations and Removals

Setuptools no longer accepts options containing uppercase or dash characters in setup.cfg.

... (truncated)

Commits

8e4868a Bump version: 78.1.0 → 78.1.1
100e9a6 Merge pull request #4951
8faf1d7 Add news fragment.
2ca4a9f Rely on re.sub to perform the decision in one expression.
e409e80 Extract _sanitize method for sanitizing the filename.
250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
d8390fe Extract _resolve_download_filename with test.
4e1e893 Merge https://github.com/jaraco/skeleton
3a3144f Fix typo: pyproject.license -> project.license (#4931)
d751068 Fix typo: pyproject.license -> project.license
Additional commits viewable in compare view

Updates starlette from 0.46.2 to 0.49.1

Release notes

Sourced from starlette's releases.

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

@TheWesDias made their first contribution in Kludex/starlette#3017

@gmos2104 made their first contribution in Kludex/starlette#3027

@secrett2633 made their first contribution in Kludex/starlette#2996

@adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Version 0.48.0

Added

Add official Python 3.14 support #3013.

Changed

Implement RFC9110 http status names #2939.

New Contributors

@yakimka made their first contribution in Kludex/starlette#2943

@mbeijen made their first contribution in Kludex/starlette#2939

Full Changelog: Kludex/starlette@0.47.3...0.48.0

... (truncated)

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

0.48.0 (September 13, 2025)

Added

Add official Python 3.14 support #3013.

Changed

Implement RFC9110 http status names #2939.

0.47.3 (August 24, 2025)

Fixed

Use asyncio.iscoroutinefunction for Python 3.12 and older #2984.

0.47.2 (July 20, 2025)

Fixed

Make UploadFile check for future rollover #2962.

0.47.1 (June 21, 2025)

Fixed

Use Self in TestClient.__enter__ #2951.

Allow async exception handlers to type-check #2949.

... (truncated)

Commits

7e4b742 Version 0.49.1 (#3047)
4ea6e22 Merge commit from fork
7d88ea6 Version 0.49.0 (#3046)
26d66bb Do not pollute exception context in Middleware (#2976)
a59397d Set encodings when reading config files (#2996)
3b7f0cb test: add test for unknown status (#3035)
b09ce1a docs: fix legibility issues on sponsorship page (#3039)
0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
3912d63 docs: add social icons (#3038)
4915a93 Add discord to README/docs (#3034)
Additional commits viewable in compare view

Updates urllib3 from 2.2.3 to 2.5.0

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Pool managers now properly control redirects when retries is passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)

Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)

Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)

Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

Switched to uv for installing development dependecies. (#3550)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

2.3.0

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)

Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.

Made the Node.js runtime respect redirect parameters such as retries and redirects.

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

2.4.0 (2025-04-10)

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)

Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

2.3.0 (2024-12-22)

... (truncated)

Commits

aaab4ec Release 2.5.0
7eb4a2a Merge commit from fork
f05b132 Merge commit from fork
d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
9996e0f Fix emscripten CI for Chrome 137+ (#3599)
4fd1a99 Bump RECENT_DATE (#3617)
c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

^{Cursor Bugbot is generating a summary for commit bdad26ccf4a92481ce6c70606d83cf0b3ceb545a. Configure here.}

Note

Update pinned dependencies in requirements/test.txt and requirements/tpu.txt, including mlflow, ray, starlette, urllib3, requests, protobuf, h11, and setuptools.

Dependencies:
- requirements/test.txt: Bump pinned versions:
  - mlflow → 3.5.0rc0
  - ray → 2.50.0
  - starlette → 0.49.1
  - urllib3 → 2.5.0
  - requests → 2.32.4
  - protobuf → 5.29.5
  - h11 → 0.16.0
  - setuptools → 78.1.1
- requirements/tpu.txt: Pin setuptools to 78.1.1.

^{Written by Cursor Bugbot for commit bdad26ccf4a92481ce6c70606d83cf0b3ceb545a. This will update automatically on new commits. Configure here.}

Note

Updates pinned dependencies in requirements/test.txt and requirements/tpu.txt, including mlflow, ray, starlette, urllib3, requests, protobuf, h11, and setuptools.

Dependencies
- requirements/test.txt:
  - Bump mlflow → 3.5.0rc0
  - Bump ray → 2.50.0
  - Bump starlette → 0.49.1
  - Bump urllib3 → 2.5.0
  - Bump requests → 2.32.4
  - Bump protobuf → 5.29.5
  - Bump h11 → 0.16.0
  - Bump setuptools → 78.1.1
- requirements/tpu.txt:
  - Pin setuptools to 78.1.1

^{Written by Cursor Bugbot for commit d6e364c. This will update automatically on new commits. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the pip group with 8 updates in the /requirements directory: | Package | From | To | | --- | --- | --- | | [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` | | [mlflow](https://github.com/mlflow/mlflow) | `2.22.0` | `3.5.0rc0` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `5.28.3` | `5.29.5` | | [ray](https://github.com/ray-project/ray) | `2.48.0` | `2.50.0` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.4` | | [setuptools](https://github.com/pypa/setuptools) | `77.0.3` | `78.1.1` | | [starlette](https://github.com/Kludex/starlette) | `0.46.2` | `0.49.1` | | [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.5.0` | Updates `h11` from 0.14.0 to 0.16.0 - [Commits](python-hyper/h11@v0.14.0...v0.16.0) Updates `mlflow` from 2.22.0 to 3.5.0rc0 - [Release notes](https://github.com/mlflow/mlflow/releases) - [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md) - [Commits](mlflow/mlflow@v2.22.0...v3.5.0rc0) Updates `protobuf` from 5.28.3 to 5.29.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl) - [Commits](protocolbuffers/protobuf@v5.28.3...v5.29.5) Updates `ray` from 2.48.0 to 2.50.0 - [Release notes](https://github.com/ray-project/ray/releases) - [Commits](ray-project/ray@ray-2.48.0...ray-2.50.0) Updates `requests` from 2.32.3 to 2.32.4 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.32.4) Updates `setuptools` from 77.0.3 to 78.1.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v77.0.3...v78.1.1) Updates `starlette` from 0.46.2 to 0.49.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.46.2...0.49.1) Updates `urllib3` from 2.2.3 to 2.5.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.2.3...2.5.0) --- updated-dependencies: - dependency-name: h11 dependency-version: 0.16.0 dependency-type: direct:production dependency-group: pip - dependency-name: mlflow dependency-version: 3.5.0rc0 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.5 dependency-type: direct:production dependency-group: pip - dependency-name: ray dependency-version: 2.50.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:production dependency-group: pip - dependency-name: setuptools dependency-version: 78.1.1 dependency-type: direct:production dependency-group: pip - dependency-name: starlette dependency-version: 0.49.1 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 4, 2025

dependabot Bot force-pushed the dependabot/pip/requirements/pip-db3d0a9187 branch from bdad26c to d6e364c Compare November 14, 2025 17:20

Navigation Menu

Repository navigation

Bump the pip group across 1 directory with 8 updates - #2

Bump the pip group across 1 directory with 8 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/pip-db3d0a9187

dependabot Bot commented on behalf of github Nov 4, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.5.0rc0

v3.4.0

Major New Features

3.5.0rc0 (2025-10-08)

3.4.0rc0 (2025-09-11)

Major New Features

Ray-2.50.0

Release Highlights

Ray Libraries

Ray Data

v2.32.4

2.32.4 (2025-06-10)

2.32.4 (2025-06-10)

v78.1.1

Bugfixes

v78.1.0

Features

v78.0.2

Bugfixes

v78.0.1

Misc

v78.0.0

Bugfixes

Deprecations and Removals

Version 0.49.1

Fixed

Version 0.49.0

Added

Changed

New Contributors

Version 0.48.0

Added

Changed

New Contributors

0.49.1 (October 28, 2025)

Fixed

0.49.0 (October 28, 2025)

Added

Changed

0.48.0 (September 13, 2025)

Added

Changed

0.47.3 (August 24, 2025)

Fixed

0.47.2 (July 20, 2025)

Fixed

0.47.1 (June 21, 2025)

Fixed

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

Security issues

Features

Bugfixes

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

Features

Bugfixes

Misc

2.3.0

2.5.0 (2025-06-18)

Features

Bugfixes

2.4.0 (2025-04-10)

Features

Bugfixes

Misc

2.3.0 (2024-12-22)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 4, 2025 •

edited

Loading