Skip to content

Bump the python-deps group across 1 directory with 4 updates - #100

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/sdk/dev/python-deps-b075b2cd6e
Open

Bump the python-deps group across 1 directory with 4 updates#100
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/sdk/dev/python-deps-b075b2cd6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on transformers, mcp, gradio and unplug-ai to permit the latest version.
Updates transformers to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

Commits

Updates mcp to 2.0.0

Release notes

Sourced from mcp's releases.

v2.0.0

MCP Python SDK v2 Stable Release

This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server. pip install mcp now installs 2.x.

pip install "mcp[cli]"
# or
uv add "mcp[cli]"

Documentation Rewrite

The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.

V1 Maintenance mode

v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the v1.x branch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a <2 upper bound on your requirement (for example mcp>=1.28,<2).

Highlights

One SDK, both protocol eras

v2 speaks the 2026-07-28 revision (stateless requests with no handshake, server/discover, subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the same MCPServer, over Streamable HTTP and stdio, with nothing to configure. Client(target) negotiates the version automatically.

FastMCP is now MCPServer, and there is a first-class Client

The decorator API is unchanged; the low-level Server is rebuilt around a shared dispatcher engine, and one Client object replaces v1's transport-plus-ClientSession-plus-initialize() layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.

Multi-round-trip requests and resolver dependency injection

At 2026-07-28 the server can no longer call the client, so tools return the question instead. A Resolve(fn) parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.

Extension APIs, OpenTelemetry, and a standalone types package

Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package, mcp-types (imported as mcp_types), published in lock-step with mcp.

Hardened stdio and auth

stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.

Coming from a v2 pre-release

Since the last release candidate: the per-version wire packages are private (mcp_types._v*), mcp.types is a permanent alias for mcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas: Client(cache=False) is now cache=None with CacheConfig() the default; Context.client_id, RFC7523OAuthClientProvider, and OAuthClientProvider(timeout=) are removed; the client-credentials providers take scope=; message_handler receives notifications and exceptions only; FileResource(is_binary=) becomes encoding; MCP_* env vars are gone with pydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.

Known gaps

The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity jwt-bearer grant are not implemented; both are additive and can land in 2.x.

Feedback

... (truncated)

Commits
  • 6f69a37 Present v2 as the stable release across the README, docs, and policies (#3178)
  • 78e6fbb Serve v2 docs at the site root, with permanent per-major paths (#3176)
  • af06330 Remove unused StreamableHTTPTransport.get_session_id() (#3205)
  • 68ca87e Document the two-line release process for stable v2 (#3179)
  • c9c431b Expose the middleware chain on MCPServer and stop sending unrequested change ...
  • 528e366 Fail fast on server-to-client requests in JSON-response mode instead of hangi...
  • 27f5cc7 Remove unused mcpserver.exceptions.ValidationError (#3199)
  • 89c5e70 Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198)
  • b61ce38 docs: fix off-by-one hl_lines in apps.md (#3196)
  • b7c9a91 Add mcp.types as a permanent alias for mcp_types (#3190)
  • Additional commits viewable in compare view

Updates gradio to 6.20.0

Release notes

Sourced from gradio's releases.

gradio@6.20.0

Features

Fixes

Changelog

Sourced from gradio's changelog.

6.20.0

Features

Fixes

6.19.0

Features

  • #13526 53cb4ca - Run pnpm lint and pnpm ts:check on CI. Thanks @​abidlabs!
  • #13534 a11c728 - Re-translate i18n choices display names when the language is switched at runtime. Thanks @​hysts!
  • #13524 d4d340d - Run gr.Workflow subgraphs via the Gradio API — each subgraph is exposed as a named endpoint (returning all of its outputs) reusing /info, /call, and /api, with a "View API" panel in the canvas. Thanks @​abidlabs!

Fixes

6.18.0

Features

... (truncated)

Commits
  • 601769e chore: update versions (#13550)
  • 7a595cb Fix ImageEditor brush texture resets (#13597)
  • 876d333 Fix JSONDecodeError when loading cached examples with negative number outpu...
  • 2e80558 Fire state.change() for streaming (.stream()) events (#13588)
  • 4e72cd1 workflow: forward _token to bound fn when no request session (#13595)
  • 1c5c538 fix: serve /gradio_api/file=<url> via an SSRF-safe proxy (#13596)
  • 46d391b Fix embedded apps growing infinitely tall on Spaces (#13563)
  • 75c5d1e workflow: inject token into fn functions (#13574)
  • 27d4999 Revert "Fix ImageEditor brush texture resets"
  • 753e916 Fix ImageEditor brush texture resets
  • Additional commits viewable in compare view

Updates unplug-ai from 0.4.1 to 0.6.0

Release notes

Sourced from unplug-ai's releases.

v0.6.0

unplug-ai 0.6.0

Minor release since 0.5.2: adversarial security fixes, public limits/judge API, and a durable local test harness.

Security

  • Safe-prefix cache boundary overlap + source/policy-scoped keys (#87)
  • Per-request scanner allowlist no longer sticks across scans (#88)
  • Guard config mode and strict allowlist loading (#89)
  • Judge action/score enforcement (#90)
  • Review-debt hardening for cache, judge, ML lock, and checkpoints (#91)

Added

  • Public LimitConfig / BYOLLM judge API surface (#80)
  • Injection regex expansion + bidi normalizer stripping (#80)
  • Local harness: test-frameworks, test-ml-harness, smoke-ml-hooks, test-all-local + TESTING_HARNESS.md (#92)

Fixed

  • Post-merge review follow-ups from promote/Phase C (#81)

See CHANGELOG.md for full details.

v0.5.2

unplug-ai 0.5.2

Patch release: robustness, usability, and YAGNI cleanup after 0.5.1. Python 3.13 [ml]/[all] install was already fixed in 0.5.1.

Fixed

  • Model store / Guard ML: Corrupt manifests no longer crash Guard or unplug-models; checkpoint validation, atomic downloads, clearer CLI errors (#72).
  • ML inference: Safe BIOES decode, validated label maps/devices, thread-safe model load (#73).
  • Agent usability: Accurate Guard.init() docs; unplug.api.* guidance for server/MCP; REVIEW outcomes log at INFO (#74).

Changed

  • Packaging extras / install docs polish; wider transformers constraint; unknown active_model raises ConfigError (#75).

Removed

  • Dead scrape/content/haystack shims and no-op judge config fields (#77).

Added

  • Deprecation shim coverage; synthetic BIOES test fixture; CI wheel-only [ml] resolve on 3.13 (#76).

See CHANGELOG.md for full details.

v0.5.1

unplug-ai 0.5.1

Patch release: Python 3.13 packaging fix and supply-chain hardening of the bundled model catalog.

Fixed

  • Python 3.13: unplug-ai[ml] / [all] now install without a Rust toolchain — transformers constraint widened to >=4.44,<5.13 so tokenizers resolves to a cp313 wheel (0.5.0 pinned transformers>=4.44,<4.45 → tokenizers==0.19.1).

... (truncated)

Changelog

Sourced from unplug-ai's changelog.

[0.6.0] — 2026-07-20

Security

  • Safe-prefix cache: re-scan overlap at chunk boundaries and scope cache keys by source + policy fingerprint so split injection phrases and cross-source ALLOW reuse cannot bypass detection (#87, fixes #82/#83)
  • Per-request scanners= allowlist no longer sticks on the shared ExecutionContext; omitted scanners clears the allowlist so later scans use the full configured set (#88, fixes #84)
  • Guard(config=GuardConfig(mode=...)) keeps the configured mode when mode= is not passed; strict_scanner_allowlist loads from TOML/build_config; unknown [guard] keys raise ConfigError (#89, fixes #85)
  • Judge action=block / review / allow clamps finding scores so declared verdicts drive enforcement even when the LLM returns an inconsistent score (#90, fixes #86)
  • Follow-up hardening from review debt: cache policy fingerprint + prefix overlap ≥ 1, strict-allowlist coercion, judge score enforcement, skip sensitive-context boost on llm_judge, hold ML inference lock through predict_batch, validate indexed shard checkpoints (#91)

Added

  • Public LimitConfig / BYOLLM judge surface (unplug, unplug.api.limits, unplug.api.judge) with docs, example, and TOML notes (#80)
  • Focused injection regex patterns from neuralchemy FN sampling; bidi control stripping in the normalizer (#80)
  • Pre-0.6.0 local test harness: make test-frameworks, test-ml-harness, smoke-ml-hooks, test-all-local plus sdk/docs/TESTING_HARNESS.md (#92)

Fixed

  • Post-merge review follow-ups across promote/Phase C: unplug-scan pin, AG2 multimodal redaction, model download flock/staging, tighter instructions_updated_supersede regex, NORMALIZER_VERSION bump, sharded safetensors checkpoints (#81)

Changed

  • Eval docs refreshed (EVAL_PHASE_C.md / benchmarks); regex neuralchemy recall/F1 improved modestly after pattern expansion (#80)

[0.5.2] — 2026-07-20

Added

  • Coverage tests for v1.0 deprecation shim re-exports (unplug.core.*, guard_scan, scanner, safeguards)
  • Offline synthetic BIOES checkpoint fixture for ML unit tests (no real weights required)
  • CI wheel-only resolve for unplug-ai[ml] on Python 3.13 (catches sdist-only breakage)

Removed

  • Dead modules: providers/scrape.py, providers/content/server.py, optional/haystack.py (unused; use guards/scrape, providers/content/firecrawl, integrations/haystack)
  • Config fields judge_enabled, pipeline.judge_timeout (no-op; pass judge= to Guard() instead)

Changed

  • Unknown active_model tier names now raise ConfigError with valid catalog tiers instead of silently running without ML
  • Widen transformers extra constraint to >=4.44,<6 (was <5.13) so newer minors stay installable
  • Drop published dev optional-extra; test/lint tools live in the dev dependency-group (uv sync --dev)
  • Deprecated config: judge_enabled, pipeline.judge_timeout, pipeline.fail_closed warn and are ignored (removed in v1.0); guard.fail_closed=false / fail_mode="open" unchanged
  • Docs: unplug-ai[scrape] package name in Firecrawl docstring; Atomic Agents Python ≥3.12 install gate; Semantic Kernel pybars4 wheel-only note

Fixed

  • Agent usability: Guard.init() docstring no longer claims auto-instrumentation; docs standardize on from unplug import ... for apps and unplug.api.* for server/MCP dependents; routine REVIEW pipeline outcomes log at INFO instead of WARNING
  • ML inference hardening: BIOES decode no longer crashes on checkpoints without *-INJ labels; label maps are validated at load with a clear ModelError; forced torch devices are validated (ConfigError); ModelProvider/SpanInferenceModel load is thread-safe; ML modules log device/tokenizer fallbacks and import torch via unplug.optional.ml helpers
  • Model store hardening: corrupt manifests no longer crash Guard or unplug-models; checkpoint validation requires weight files; atomic manifest writes and download swaps preserve existing installs on failure; list_status correctly reports stale revisions as upgrade-available; invalid UNPLUG_MODEL_PATH logs a warning; CLI download errors distinguish missing ML extras from network/repo failures

... (truncated)

Commits
  • 2213c5d Merge pull request #94 from UnplugAI/release/0.6.0-to-main
  • 91072f7 Merge remote-tracking branch 'origin/dev' into release/0.6.0-to-main
  • 968ebe5 Release 0.6.0: security + harness (#93)
  • 627d65f Add pre-0.6.0 SDK test harness
  • 59e6d31 Fix open Greptile review debt on dev (#91)
  • eaeb3d2 Honor judge BLOCK when score is low (#90)
  • 2221d98 Fix Guard config mode and strict allowlist loading (#89)
  • 903ff9a Reset per-request scanner allowlist after scan (#88)
  • 4b18d11 Fix safe-prefix cache boundary bypass (#87)
  • 18dee37 Fix post-merge review findings from #71/#79/#80 (#81)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-deps group across 1 directory with 4 updates
8bdc1d6 
Updates the requirements on [transformers](https://github.com/huggingface/transformers), [mcp](https://github.com/modelcontextprotocol/python-sdk), [gradio](https://github.com/gradio-app/gradio) and [unplug-ai](https://github.com/UnplugAI/Unplug) to permit the latest version.

Updates `transformers` to 5.14.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.44.0...v5.14.1)

Updates `mcp` to 2.0.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.0.0...v2.0.0)

Updates `gradio` to 6.20.0
- [Release notes](https://github.com/gradio-app/gradio/releases)
- [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.19.0...gradio@6.20.0)

Updates `unplug-ai` from 0.4.1 to 0.6.0
- [Release notes](https://github.com/UnplugAI/Unplug/releases)
- [Changelog](https://github.com/UnplugAI/Unplug/blob/dev/CHANGELOG.md)
- [Commits](v0.4.1...v0.6.0)

---
updated-dependencies:
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: mcp
  dependency-version: 2.0.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: gradio
  dependency-version: 6.20.0
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: unplug-ai
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Jul 31, 2026
@greptile-apps

greptile-apps Bot commented Jul 31, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown

coverage

SDK Coverage •
FileStmtsMissCoverMissing
TOTAL729389887% 
report-only-changed-files is enabled. No files were changed during this commit :)

Tests Skipped Failures Errors Time
1220 25 💤 0 ❌ 0 🔥 38.994s ⏱️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants