Skip to content

build(medcat): bump the uv-deps group in /medcat-v2 with 23 updates#489

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/medcat-v2/uv-deps-84f1c2120e
Closed

build(medcat): bump the uv-deps group in /medcat-v2 with 23 updates#489
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/medcat-v2/uv-deps-84f1c2120e

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 14, 2026

Bumps the uv-deps group in /medcat-v2 with 23 updates:

Package From To
numpy 2.0.2 2.2.6
tqdm 4.67.1 4.67.3
xxhash 3.6.0 3.7.0
pydantic 2.12.0 2.13.4
requests 2.32.5 2.34.1
ruff 0.1.15 0.15.12
mypy 1.18.2 1.20.2
types-tqdm 4.67.0.20250809 4.67.3.20260508
types-setuptools 80.9.0.20250822 80.10.0.20260124
types-pyyaml 6.0.12.20250915 6.0.12.20260510
spacy 3.8.7 3.8.14
transformers 4.57.0 4.57.6
peft 0.17.1 0.19.1
torch 2.8.0 2.12.0
scikit-learn 1.6.1 1.7.2
pyahocorasick 2.2.0 2.3.1
confection 0.1.5 1.3.3
pathspec 0.12.1 1.1.1
pydantic-core 2.41.1 2.46.4
srsly 2.5.1 2.5.3
thinc 8.3.6 8.3.13
triton 3.4.0 3.7.0
weasel 0.4.1 1.0.0

Updates numpy from 2.0.2 to 2.2.6

Release notes

Sourced from numpy's releases.

v2.2.6 (May 17, 2025)

NumPy 2.2.6 Release Notes

NumPy 2.2.6 is a patch release that fixes bugs found after the 2.2.5 release. It is a mix of typing fixes/improvements as well as the normal bug fixes and some CI maintenance.

This release supports Python versions 3.10-3.13.

Contributors

A total of 8 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Ilhan Polat
  • Joren Hammudoglu
  • Marco Gorelli +
  • Matti Picus
  • Nathan Goldbaum
  • Peter Hawkins
  • Sayed Adel

Pull requests merged

A total of 11 pull requests were merged for this release.

  • #28778: MAINT: Prepare 2.2.x for further development
  • #28851: BLD: Update vendor-meson to fix module_feature conflicts arguments...
  • #28852: BUG: fix heap buffer overflow in np.strings.find
  • #28853: TYP: fix NDArray[floating] + float return type
  • #28864: BUG: fix stringdtype singleton thread safety
  • #28865: MAINT: use OpenBLAS 0.3.29
  • #28889: MAINT: from_dlpack thread safety fixes
  • #28913: TYP: Fix non-existent CanIndex annotation in ndarray.setfield
  • #28915: MAINT: Avoid dereferencing/strict aliasing warnings
  • #28916: BUG: Fix missing check for PyErr_Occurred() in _pyarray_correlate.
  • #28966: TYP: reject complex scalar types in ndarray.__ifloordiv__

Checksums

MD5

259343f056061f6eadb2f4b8999d06d4  numpy-2.2.6-cp310-cp310-macosx_10_9_x86_64.whl
16fa85488e149489ce7ee044d7b0d307  numpy-2.2.6-cp310-cp310-macosx_11_0_arm64.whl
f01b7aea9d2b76b1eeb49766e615d689  numpy-2.2.6-cp310-cp310-macosx_14_0_arm64.whl
f2ddc2b22517f6e31caa1372b12c2499  numpy-2.2.6-cp310-cp310-macosx_14_0_x86_64.whl
52190e22869884f0870eb3df7a283ca9  numpy-2.2.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
8f382b9ca6770db600edd5ea2447a925  numpy-2.2.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
e604aae2ef6e01fb92ecc39aca0424d9  numpy-2.2.6-cp310-cp310-musllinux_1_2_aarch64.whl

... (truncated)

Commits
  • 2b686f6 Merge pull request #28980 from charris/prepare-2.2.6
  • ed41828 REL: Prepare for the NumPy 2.2.6 release [wheel build]
  • 83e4e7f Merge pull request #28966 from charris/backport-28958
  • 248f0cb TYP: add rejection-tests for complex ndarray floordiv
  • 5bad9da TYP: reject complex scalar types in ndarray.__ifloordiv__
  • 6c42775 Merge pull request #28915 from charris/backport-28892
  • 4277e7c Merge pull request #28916 from charris/backport-28898
  • bd1c863 BUG: Fix missing check for PyErr_Occurred() in _pyarray_correlate. (#28898)
  • 87d1d8a MAINT: Avoid dereferencing/strict aliasing warnings during complex casts in `...
  • 9e50659 Merge pull request #28913 from charris/backport-28908
  • Additional commits viewable in compare view

Updates tqdm from 4.67.1 to 4.67.3

Release notes

Sourced from tqdm's releases.

tqdm v4.67.3 stable

tqdm v4.67.2 stable

  • support pandas>=3 (#1703 <- #1701, #1650, #1700)
  • fix format_interval for negative numbers (#1703)
  • misc linting
  • framework updates (#1704)
    • bump CI workflow & pre-commit dependencies
    • add pyupgrade
    • add py3.13 support
    • fix py3.7 tests
    • update setuptools-scm usage
    • support auto-dedented docstrings when building docs in py3.13
  • tests: relax flaky benchmarks
Commits

Updates xxhash from 3.6.0 to 3.7.0

Release notes

Sourced from xxhash's releases.

v3.7.0

  • Drop support for Python 3.7
  • Build armv7l manylinux/musllinux wheels
  • Build riscv64 manylinux/musllinux wheels
  • Build android and ios wheels

Full list of changes: ifduyue/python-xxhash@v3.6.0...v3.7.0

Changelog

Sourced from xxhash's changelog.

v3.7.0 2025-04-25


- Drop support for Python 3.7
- Build armv7l manylinux/musllinux wheels
- Build riscv64 manylinux/musllinux wheels
- Build android and ios wheels
Commits
  • 404589e Prepare 3.7.0
  • d3cd664 Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0
  • 0d7d943 Bump pypa/cibuildwheel from 3.4.0 to 3.4.1
  • c4b8775 Bump actions/download-artifact from 7 to 8
  • 1ae3e5b Bump actions/upload-artifact from 6 to 7
  • 8faaa34 Bump pypa/cibuildwheel from 3.3.1 to 3.4.0
  • 4ba9b0c Bump docker/setup-qemu-action from 3 to 4
  • 43bb203 Bump actions/download-artifact from 6 to 7
  • a7a3bd2 Bump actions/upload-artifact from 5 to 6
  • c35bf01 Bump pypa/cibuildwheel from 3.3.0 to 3.3.1
  • Additional commits viewable in compare view

Updates pydantic from 2.12.0 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

v2.13.1 (2026-04-15)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0 2026-04-13

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.34.1

Release notes

Sourced from requests's releases.

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

New Contributors

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)

... (truncated)

Commits

Updates ruff from 0.1.15 to 0.15.12

Release notes

Sourced from ruff's releases.

0.15.12

Release Notes

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Install ruff 0.15.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.12

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

0.15.11

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

... (truncated)

Commits
  • 66f93cf Bump 0.15.12 (#24815)
  • 476a4d0 [ty] Complete support for more detailed diagnostics on possibly unbound error...
  • ed669ea Implement #ruff:file-ignore file-level suppressions (#23599)
  • e73d952 [ty] Include inferred type in invalid-key concise diagnostic for union/inte...
  • 80feb29 [ty] report only dead annotation-only locals as unused (#24811)
  • 0fbf2bc Drop deprecated license classifier (#24808)
  • 43b174c [ty] Infer lambda parameter types with Callable type context (#24317)
  • 4f449ae [ty] Add error context for intersection types (#24772)
  • 5b4e753 [ty] Add support for goto in literal enum member inlay hint (#24792)
  • e7cc762 [ty] Add error context for TypedDict assignments (#24790)
  • Additional commits viewable in compare view

Updates mypy from 1.18.2 to 1.20.2

Changelog

Sourced from mypy's changelog.

Mypy 1.20.2

  • Use WAL with SQLite cache and fix close (Shantanu, PR 21154)
  • Adjust SQLite journal mode (Ivan Levkivskyi, PR 21217)
  • Correctly aggregate narrowing information on parent expressions (Shantanu, PR 21206)
  • Fix regression related to generic callables (Shantanu, PR 21208)
  • Fix regression by avoiding widening types in some contexts (Shantanu, PR 21242)
  • Fix slicing in non-strict optional mode (Shantanu, PR 21282)
  • mypyc: Fix match statement semantics for "or" pattern (Shantanu, PR 21156)
  • mypyc: Fix issue with module dunder attributes (Piotr Sawicki, PR 21275)
  • Initial support for Python 3.15.0a8 (Marc Mueller, PR 21255)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Aaron Wieczorek
  • Adam Turner
  • Ali Hamdan
  • asce
  • BobTheBuidler
  • Brent Westbrook
  • Brian Schubert
  • bzoracler
  • Chris Burroughs
  • Christoph Tyralla
  • Colin Watson
  • Donghoon Nam
  • E. M. Bray
  • Emma Smith
  • Ethan Sarp
  • George Ogden
  • getzze
  • grayjk
  • Gregor Riepl
  • Ivan Levkivskyi
  • James Hilliard
  • James Le Cuirot
  • Jeremy Nimmer
  • Joren Hammudoglu
  • Kai (Kazuya Ito)
  • kaushal trivedi
  • Kevin Kannammalil
  • Lukas Geiger
  • Łukasz Langa
  • Marc Mueller
  • Michael R. Crusoe
  • michaelm-openai
  • Neil Schemenauer
  • Piotr Sawicki

... (truncated)

Commits

Updates types-tqdm from 4.67.0.20250809 to 4.67.3.20260508

Commits

Updates types-setuptools from 80.9.0.20250822 to 80.10.0.20260124

Commits

Updates types-pyyaml from 6.0.12.20250915 to 6.0.12.20260510

Commits

Updates spacy from 3.8.7 to 3.8.14

Release notes

Sourced from spacy's releases.

v3.8.14: Bug fix for model downloading in environments without pip on PATH

  • Fix spacy download failing in environments where pip is not on PATH but is available as a Python module (e.g., some virtual environments and containers)

v3.8.13: Pin confection to new version

The v3.8.12 release didn't update the confection pin, which meant that if you did an upgrade-install models wouldn't load.

v3.8.12

Use confection v1.3 and Thinc v8.3.13, which implement custom validation logic in place of Pydantic, allowing us to properly adopt Pydantic v2 and provide full Python 3.14 support.

Our dependency tree used Pydantic v1 in unusual ways, and relied on behaviours that Pydantic v2 reformed. In the time since Pydantic v2 was released there were a few attempts to migrate over to it, but the task has been complicated by the fact that the confection library has a fairly tangled implementation and I had reduced availability for open-source work in 2024 and 2025.

Specifically, our library confection provides the extensible configuration system we use in spaCy and Thinc. The config system allows you to refer to values that will be supplied by arbitrary functions, that e.g. define some neural network model or its sublayers. The functionality in confection is complicated because we aggressively prioritised user experience in the specification, even if it required increased implementation complexity.

Confection's original implementation built a dynamic Pydantic v1 schema for function-supplied values ("promises"). We validate the schema before calling any promises, and then validate the schema again after calling all the promises and substituting in their values. The variable-interpolation system adds further difficulties to the implementation, and we have to do it all subclassing the Python built-in configparser, which ties us to implementation choices I'd do differently if I had a clean slate.

Here's one summary of Pydantic v1-specific behaviours that the migration to v2 particularly difficult for us. This particular summary was produced during a session with Claude Code Opus 4.6, so nuances of it might be wrong. The full history of attempts at doing this spans over different refactors separated by a few months at a time, so I don't have a full record of all the things that I struggled with. It's possible some details of this summary are incorrect though.

The core problem we kept hitting: Pydantic v2 compiles validation schemas upfront and has much stricter immutability. The whole session has been a series of workarounds for this:

 1. Schema mutation — v1 let you mutate __fields__ in place; v2 needs model_rebuild() which loses forward ref namespaces, or create_model subclasses which don't propagate to parent schemas.
 2. model_dump vs dict — v2 converts dataclasses to dicts, breaking resolved objects. Needed a custom _model_to_dict helper.
 3. model_construct drops extras — v2 silently drops fields with extra="forbid", needed manual workarounds.
 4. Strict coercion — v2 coerces ndarray to List[Floats1d] via iteration, needed strict=True.
 5. Forward refs — Every schema with TYPE_CHECKING imports needs model_rebuild() with the right namespace, and that breaks when confection re-rebuilds later.
In order to adjust for behavioural differences like this, I'd refactored confection to build the different versions of the schema in multiple passes, instead of building all the representations together as we'd been doing. However this refactor itself had problems, further complicating the migration.

I've now bitten the bullet and rolled back the refactor I'd been attempting of confection, and instead replaced the Pydantic validation with custom logic. This allows Confection to remove Pydantic as a dependency entirely.~ Update: Actually I went back and got the refactor working. All much nicer now.

I've taken some lengths to explain this because migrating off a dependency after breaking changes can be a sensitive topic. I want to stress that the changes Pydantic made from v1 to v2 are very good, and I greatly appreciate them as a user of FastAPI in our services. It would be very bad for the ecosystem if Pydantic pinned themselves to exactly matching the behaviours they had in v1 just to avoid breaking support for the sort of thing we'd been doing. Instead users who were relying on those behaviours like us should just find some way to adapt --- either vendor the v1 version we need, or change our behaviours, or implement an alternative. I would have liked to do this sooner but we've ultimately gone with the third option.

v3.8.11: Add Windows ARM wheels

Add wheels for Python 3.11, 3.12, 3.13 and 3.14 for Windows ARM. Windows ARM wheels for Python 3.10 and earlier are not available in numpy, so aren't provided.

Commits
  • 0069cf9 Set version to 3.8.14
  • 5603226 fix: check pip module availability instead of PATH binary in download (#13947)
  • d4bb796 Add least-privilege permissions to CI workflow
  • 9d29209 Pass github context via stdin instead of CLI arg
  • 4216738 Pin GitHub Actions to commit SHAs for supply chain security
  • 297938e Add smoke test and upgrade test to release build workflow
  • fdca647 Set version to 3.8.13
  • 0d94a9d Pin confection>=1.3.2 — older versions crash with pydantic v2
  • f175a51 Fully migrate to Pydantic v2 (#13940)
  • 24255bd Fix import sorting for ruff isort compliance
  • Additional commits viewable in compare view

Updates transformers from 4.57.0 to 4.57.6

Release notes

Sourced from transformers's releases.

Patch release v4.57.6

What's Changed

Another fix for qwen vl models that prevented correctly loading the associated model type - this works together with huggingface/transformers#41808 of the previous patch release.

Full Changelog: huggingface/transformers@v4.57.5...v4.57.6

Patch release v4.57.5

What's Changed

Should not have said last patch 😉 These should be the last remaining fixes that got lost in between patches and the transition to v5.

Full Changelog: huggingface/transformers@v4.57.4...v4.57.5

Patch release v4.57.4

What's Changed

Last patch release for v4: We have a few small fixes for remote generation methods (e.g. group beam search), vLLM, and an offline tokenizer fix (if it's already been cached).

New Contributors

Full Changelog: huggingface/transformers@v4.57.3...v4.57.4

Patch release v4.57.3

There was a hidden bug when loading models with local_files_only=True and a typo related to the recent patch.

The main fix is: huggingface/transformers@b605555.

We are really sorry that this slipped through, our CIs just did not catch it.

As it affects a lot of users we are gonna yank the previous release

Patch Release v4.57.2

This patch most notably fixes an issue on some Mistral tokenizers. It contains the following commits:

  • Add AutoTokenizer mapping for mistral3 and ministral (#42198)
  • Auto convert tekken.json (#42299)
  • fix tekken pattern matching (#42363)
  • Check model inputs - hidden states (#40994)
  • Remove invalid @staticmethod from module-level get_device_and_memory_breakdown (#41747)

Patch release v4.57.1

This patch most notably fixes an issue with an optional dependency (optax), which resulted in parsing errors with poetry. It contains the following fixes:

... (truncated)

Commits

Updates peft from 0.17.1 to 0.19.1

Release notes

Sourced from peft's releases.

v0.19.1

A small patch release containing these fixes:

Full Changelog: huggingface/peft@v0.19.0...v0.19.1

v0.19.0

Highlights

This PEFT release contains no less than nine new PEFT methods, described below. It also contains numerous enhancements that should make PEFT more useful to many users.

New Methods

GraLoRA

@​yeonjoon-jung01 added "GraLoRA: Granular Low-Rank Adaptation for Parameter-Efficient Fine-Tuning" to PEFT (#2851). This method subdivides the base weight into smaller blocks and applies LoRA to those. This more granular adaptation promises to increase expressiveness and improve performance, especially at higher ranks (64+), closing the gap to full fine-tuning.

BD-LoRA

@​Conzel contributed BD-LoRA: "Block-Diagonal LoRA for Eliminating Communication Overhead in Tensor Parallel LoRA Serving" (#2895). With BD-LoRA, the LoRA weights are implemented in a block-diagonal way. This allows to reduce communication overhead when using tensor parallelism (TP) and thus faster serving.

There is an experiment branch for BD-LoRA support in vLLM: vllm-project/vllm#28136.

Cartridges

Thanks to @​kashif, PEFT now also supports Cartridges (#2953). The main purpose of this method is to train a prefix to compress a long context to a short size and thus save on tokens. On a low level, this is similar to prefix tuning. The PR also added an example recipe to quickly get started.

PVeRA

"PVeRA: Probabilistic Vector-Based Random Matrix Adaptation" was added to PEFT by @​leofillioux in #2952. It is an extension of VeRA, a PEFT method that uses weight sharing between layers to be especially parameter efficient. PVeRA builds on top of that by adding a probabilistic element, sampling from the shared parameters and promising better performance overall.

PSOFT

@​fei407 added PSOFT, "Efficient Orthogonal Fine-Tuning with Principal Subspace Adaptation", to PEFT in #3037. Orthogonal fine-tuning techniques like OFT and BOFT<...

Description has been truncated

@dependabot
build(medcat): bump the uv-deps group in /medcat-v2 with 23 updates
1bf0efc 
Bumps the uv-deps group in /medcat-v2 with 23 updates:

| Package | From | To |
| --- | --- | --- |
| [numpy](https://github.com/numpy/numpy) | `2.0.2` | `2.2.6` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.67.1` | `4.67.3` |
| [xxhash](https://github.com/ifduyue/python-xxhash) | `3.6.0` | `3.7.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.0` | `2.13.4` |
| [requests](https://github.com/psf/requests) | `2.32.5` | `2.34.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.1.15` | `0.15.12` |
| [mypy](https://github.com/python/mypy) | `1.18.2` | `1.20.2` |
| [types-tqdm](https://github.com/python/typeshed) | `4.67.0.20250809` | `4.67.3.20260508` |
| [types-setuptools](https://github.com/python/typeshed) | `80.9.0.20250822` | `80.10.0.20260124` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20250915` | `6.0.12.20260510` |
| [spacy](https://github.com/explosion/spaCy) | `3.8.7` | `3.8.14` |
| [transformers](https://github.com/huggingface/transformers) | `4.57.0` | `4.57.6` |
| [peft](https://github.com/huggingface/peft) | `0.17.1` | `0.19.1` |
| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.6.1` | `1.7.2` |
| [pyahocorasick](https://github.com/WojciechMula/pyahocorasick) | `2.2.0` | `2.3.1` |
| [confection](https://github.com/explosion/confection) | `0.1.5` | `1.3.3` |
| [pathspec](https://github.com/cpburnz/python-pathspec) | `0.12.1` | `1.1.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.41.1` | `2.46.4` |
| [srsly](https://github.com/explosion/srsly) | `2.5.1` | `2.5.3` |
| [thinc](https://github.com/explosion/thinc) | `8.3.6` | `8.3.13` |
| [triton](https://github.com/triton-lang/triton) | `3.4.0` | `3.7.0` |
| [weasel](https://github.com/explosion/weasel) | `0.4.1` | `1.0.0` |


Updates `numpy` from 2.0.2 to 2.2.6
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.0.2...v2.2.6)

Updates `tqdm` from 4.67.1 to 4.67.3
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.67.1...v4.67.3)

Updates `xxhash` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/ifduyue/python-xxhash/releases)
- [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst)
- [Commits](ifduyue/python-xxhash@v3.6.0...v3.7.0)

Updates `pydantic` from 2.12.0 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.0...v2.13.4)

Updates `requests` from 2.32.5 to 2.34.1
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.5...v2.34.1)

Updates `ruff` from 0.1.15 to 0.15.12
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@v0.1.15...0.15.12)

Updates `mypy` from 1.18.2 to 1.20.2
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.18.2...v1.20.2)

Updates `types-tqdm` from 4.67.0.20250809 to 4.67.3.20260508
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-setuptools` from 80.9.0.20250822 to 80.10.0.20260124
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pyyaml` from 6.0.12.20250915 to 6.0.12.20260510
- [Commits](https://github.com/python/typeshed/commits)

Updates `spacy` from 3.8.7 to 3.8.14
- [Release notes](https://github.com/explosion/spaCy/releases)
- [Commits](explosion/spaCy@release-v3.8.7...release-v3.8.14)

Updates `transformers` from 4.57.0 to 4.57.6
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.57.0...v4.57.6)

Updates `peft` from 0.17.1 to 0.19.1
- [Release notes](https://github.com/huggingface/peft/releases)
- [Commits](huggingface/peft@v0.17.1...v0.19.1)

Updates `torch` from 2.8.0 to 2.12.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.8.0...v2.12.0)

Updates `scikit-learn` from 1.6.1 to 1.7.2
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.6.1...1.7.2)

Updates `pyahocorasick` from 2.2.0 to 2.3.1
- [Release notes](https://github.com/WojciechMula/pyahocorasick/releases)
- [Changelog](https://github.com/WojciechMula/pyahocorasick/blob/master/CHANGELOG.rst)
- [Commits](WojciechMula/pyahocorasick@v2.2.0...v2.3.1)

Updates `confection` from 0.1.5 to 1.3.3
- [Release notes](https://github.com/explosion/confection/releases)
- [Commits](explosion/confection@v0.1.5...release-v1.3.3)

Updates `pathspec` from 0.12.1 to 1.1.1
- [Release notes](https://github.com/cpburnz/python-pathspec/releases)
- [Changelog](https://github.com/cpburnz/python-pathspec/blob/master/CHANGES.rst)
- [Commits](cpburnz/python-pathspec@v0.12.1...v1.1.1)

Updates `pydantic-core` from 2.41.1 to 2.46.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits/core-v2.46.4)

Updates `srsly` from 2.5.1 to 2.5.3
- [Release notes](https://github.com/explosion/srsly/releases)
- [Commits](explosion/srsly@release-v2.5.1...release-v2.5.3)

Updates `thinc` from 8.3.6 to 8.3.13
- [Release notes](https://github.com/explosion/thinc/releases)
- [Commits](explosion/thinc@release-v8.3.6...v8.3.13)

Updates `triton` from 3.4.0 to 3.7.0
- [Release notes](https://github.com/triton-lang/triton/releases)
- [Changelog](https://github.com/triton-lang/triton/blob/main/RELEASE.md)
- [Commits](triton-lang/triton@v3.4.0...v3.7.0)

Updates `weasel` from 0.4.1 to 1.0.0
- [Release notes](https://github.com/explosion/weasel/releases)
- [Commits](explosion/weasel@v0.4.1...release-v1.0.0)

---
updated-dependencies:
- dependency-name: numpy
  dependency-version: 2.2.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: tqdm
  dependency-version: 4.67.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: xxhash
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: requests
  dependency-version: 2.34.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: ruff
  dependency-version: 0.15.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: mypy
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: types-tqdm
  dependency-version: 4.67.3.20260508
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: types-setuptools
  dependency-version: 80.10.0.20260124
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260510
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: spacy
  dependency-version: 3.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: transformers
  dependency-version: 4.57.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: peft
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: torch
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: scikit-learn
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: pyahocorasick
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: confection
  dependency-version: 1.3.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: uv-deps
- dependency-name: pathspec
  dependency-version: 1.1.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: uv-deps
- dependency-name: pydantic-core
  dependency-version: 2.46.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: srsly
  dependency-version: 2.5.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: thinc
  dependency-version: 8.3.13
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: uv-deps
- dependency-name: triton
  dependency-version: 3.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: uv-deps
- dependency-name: weasel
  dependency-version: 1.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: uv-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 14, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 14, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/uv/medcat-v2/uv-deps-84f1c2120e branch May 14, 2026 11:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alhendrickson