Skip to content

build(deps): bump the server-minor-patch group across 1 directory with 10 updates - #317

Merged
JonnyTran merged 5 commits into
mainfrom
dependabot/uv/extralit-server/server-minor-patch-db1456c833
Oct 29, 2026
Merged

build(deps): bump the server-minor-patch group across 1 directory with 10 updates#317
JonnyTran merged 5 commits into
mainfrom
dependabot/uv/extralit-server/server-minor-patch-db1456c833

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the server-minor-patch group with 10 updates in the /extralit-server directory:

Package From To
fastapi 0.143.3 0.162.0
alembic 1.20.0 1.20.1
social-auth-core 6.1.1 6.2.0
typer 0.26.8 0.27.3
huggingface-hub 2.2.0 2.3.0
docling-core 2.101.1 2.105.0
liteparse 2.16.0 2.17.0
xxhash 4.0.1 4.0.2
ty 0.0.89 0.0.91
ruff 0.17.1 0.17.2

Updates fastapi from 0.143.3 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

  • 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

  • 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

... (truncated)

Commits

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

  • [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

    References: #1085

  • [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

    References: #1360

  • [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

    References: #1462

  • [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

  • [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

Updates social-auth-core from 6.1.1 to 6.2.0

Release notes

Sourced from social-auth-core's releases.

6.2.0

Added

  • Add a Weblate OpenID Connect backend with Hosted Weblate defaults, configurable issuer, PKCE, official branding, and optional legal-version storage.
  • Add a strategy-aware backend get_title() method for sign-in labels.

Security

  • Bind OpenID Connect nonces to the initiating browser session and OAuth2 state, rejecting authorization codes from other login attempts. In-progress OIDC logins must restart after upgrading.
  • OpenID callbacks now require a transaction value signed into the return URL and stored in the initiating session. This prevents a callback from another browser from linking an account while a login at the same provider is pending. In-progress OpenID logins must restart after upgrading; unsolicited assertions are no longer accepted.
  • Reject EVE Online sign-ins when a character's owner hash changes, preventing transferred characters from authenticating as the previous local user. The old association must be removed before the new owner can sign in.
  • Enforce SOCIAL_AUTH_SLACK_TEAM against the workspace ID returned by Slack before login. Configurations using a workspace name or Enterprise organization ID must change to a workspace ID.
  • Scope Mailchimp sign-in identities to both the account and the authorizing login, preventing different Mailchimp users on one account from sharing a local user. Account-keyed associations migrate only when their stored login identifier matches; rows without that evidence require authenticated linking or account recovery. Mailchimp now rejects configured ID_KEY values other than mailchimp_identity; remove any old user_id override before upgrading.
  • Google One Tap now requires a configured client ID before validating ID tokens. Deployments without one must set SOCIAL_AUTH_GOOGLE_ONETAP_KEY to keep One Tap sign-in working.
  • Reject Telegram callback fields containing a line feed before checking their signature, preventing one signed identity from authenticating as another UID.
  • Discourse callbacks now require the session that started login, preventing login CSRF and unauthorized account linking. In-progress logins from before this upgrade, or those that lose their session, must restart.
  • OAuth2 authorization starts now use distinct, session-bound, expiring states that are claimed once before token exchange, with PKCE verifiers kept per transaction. In-progress OAuth2 logins from before this upgrade must restart; custom storage implementations must provide atomic NonceMixin.consume(). New abandoned session transactions are pruned on a subsequent authorization start.
  • Prevent request-provided next values from resolving configuration settings into post-login redirects, which could disclose URL-like setting values.
  • Odnoklassniki iframe logins now confirm that the signed launch's user ID belongs to the presented provider session, preventing account substitution by moving digits between undelimited signature fields.
  • Reject unverified historical-identifier matches when ID_KEY is configured, preventing an account with a matching username from claiming a pre-6.0 association created under a stable identifier. Existing same-identifier

... (truncated)

Changelog

Sourced from social-auth-core's changelog.

6.2.0 - 2026-10-20

Added

  • Add a Weblate OpenID Connect backend with Hosted Weblate defaults, configurable issuer, PKCE, official branding, and optional legal-version storage.
  • Add a strategy-aware backend get_title() method for sign-in labels.

Security

  • Bind OpenID Connect nonces to the initiating browser session and OAuth2 state, rejecting authorization codes from other login attempts. In-progress OIDC logins must restart after upgrading.
  • OpenID callbacks now require a transaction value signed into the return URL and stored in the initiating session. This prevents a callback from another browser from linking an account while a login at the same provider is pending. In-progress OpenID logins must restart after upgrading; unsolicited assertions are no longer accepted.
  • Reject EVE Online sign-ins when a character's owner hash changes, preventing transferred characters from authenticating as the previous local user. The old association must be removed before the new owner can sign in.
  • Enforce SOCIAL_AUTH_SLACK_TEAM against the workspace ID returned by Slack before login. Configurations using a workspace name or Enterprise organization ID must change to a workspace ID.
  • Scope Mailchimp sign-in identities to both the account and the authorizing login, preventing different Mailchimp users on one account from sharing a local user. Account-keyed associations migrate only when their stored login identifier matches; rows without that evidence require authenticated linking or account recovery. Mailchimp now rejects configured ID_KEY values other than mailchimp_identity; remove any old user_id override before upgrading.
  • Google One Tap now requires a configured client ID before validating ID tokens. Deployments without one must set SOCIAL_AUTH_GOOGLE_ONETAP_KEY to keep One Tap sign-in working.
  • Reject Telegram callback fields containing a line feed before checking their signature, preventing one signed identity from authenticating as another UID.
  • Discourse callbacks now require the session that started login, preventing login CSRF and unauthorized account linking. In-progress logins from before this upgrade, or those that lose their session, must restart.
  • OAuth2 authorization starts now use distinct, session-bound, expiring states that are claimed once before token exchange, with PKCE verifiers kept per transaction. In-progress OAuth2 logins from before this upgrade must restart; custom storage implementations must provide atomic NonceMixin.consume(). New abandoned session transactions are pruned on a subsequent authorization start.
  • Prevent request-provided next values from resolving configuration settings into post-login redirects, which could disclose URL-like setting values.
  • Odnoklassniki iframe logins now confirm that the signed launch's user ID belongs to the presented provider session, preventing account substitution by moving digits between undelimited signature fields.
  • Reject unverified historical-identifier matches when ID_KEY is configured, preventing an account with a matching username from claiming a pre-6.0

... (truncated)

Commits
  • 04bb456 chore: release 6.2.0
  • eaef362 docs(security): consolidate core threat model
  • c2f2ae4 fix(oidc): bind nonce to initiating session
  • 93ca3b7 fix(openid): bind callbacks to initiating transactions
  • a45a32e chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.13.3
  • 13439b9 chore(deps): update dependency astral-sh/uv to v0.13.3
  • 96a2f1a fix(eveonline): reject transferred character sign-ins
  • b528b1a fix(slack): enforce configured workspace on callback
  • 1a456d2 fix(mailchimp): scope sign-in identities to account and login
  • 3a256c2 fix(telegram): reject line feeds in signed callback fields
  • Additional commits viewable in compare view

Updates typer from 0.26.8 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

... (truncated)

Commits

Updates huggingface-hub from 2.2.0 to 2.3.0

Release notes

Sourced from huggingface-hub's releases.

[v2.3.0] Bucket live-follow, faster HfFileSystem listings and more

🔄 Keep Bucket listings fresh with live_follow=True

HfFileSystem caches directory listings, so files added to a Bucket by another process did not show up until you called invalidate_cache(). With live_follow=True, HfFileSystem opens one background connection per listed Bucket to receive its file changes from the Hub. When a change arrives, it removes the cached listings it affects.

>>> from huggingface_hub import HfFileSystem
>>> hffs = HfFileSystem(live_follow=True)
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # starts following that bucket
>>> # ... another process uploads a file to the bucket ...
>>> hffs.ls("buckets/my-username/my-bucket/data", detail=False)  # refreshed as changes arrive
['buckets/my-username/my-bucket/data/train.csv', 'buckets/my-username/my-bucket/data/new-file.csv']

It also works through fsspec with fsspec.filesystem("hf", live_follow=True), and through the storage_options argument of libraries such as pandas and pyarrow. The option is off by default because it keeps a connection open for each followed Bucket. It only affects listings and metadata (ls, info, exists, glob, ...), because reading a file always fetches its content from the Hub. It is not available for model, dataset and Space repos: use refresh=True to see a new commit.

🚀 HfFileSystem lists large repos in parallel

Recursive listings such as find and glob used to be slow on large repos. The Hub returns a repo's file tree 1000 entries at a time, and each page can only be requested after the previous one has arrived. Listing datasets/allenai/objaverse (~800k files) took ~800 requests in a row, about 13 minutes.

HfFileSystem now splits recursive listings by sub-directory and lists them in parallel, with almost the same number of requests. A sub-tree that fits in a single page is never split. maxdepth is now applied during the listing, so the Hub only returns the levels you ask for.

datasets/allenai/objaverse before after
find(), 798,924 files 801 requests, 776 s 807 requests, 19.7 s
find(maxdepth=2), 328 entries 801 requests, 776 s 6 requests, 1.5 s 
>>> from huggingface_hub import hffs
>>> files = hffs.glob("datasets/allenai/objaverse/**/*.glb", maxdepth=3)

The new max_workers argument of HfFileSystem sets the number of concurrent requests. It defaults to 16. Set it to 1 to list sequentially like before.

📎 Attach images and videos to discussions and PRs

The new HfApi.upload_attachment(path) uploads an image, video or audio file and returns its URL, which you can embed in a discussion, PR description or comment. Before, this required calling an undocumented Hub endpoint by hand.

>>> from huggingface_hub import HfApi
>>> api = HfApi()
>>> url = api.upload_attachment("screenshot.png")
>>> api.comment_discussion("username/repo-name", 5, f"Here is the fix:\n\n![screenshot](https://github.com/huggingface/huggingface_hub/blob/HEAD/{url})")

... (truncated)

Commits
  • 587e09a Release: v2.3.0
  • ac4a5f0 Release: v2.3.0.rc1
  • 64e9850 [HfFileSystem] Fix glob crash when the parent listing is outdated (#5237)
  • b1066db Release: v2.3.0.rc0
  • 0c7fd06 [HfApi] Support gated repos hiding requester username/email (#5047)
  • c629fa3 [Jobs] Fix hf jobs run losing logs and ignoring Ctrl+C (#5162)
  • 7858680 [HfFileSystem] List large repos in parallel (#5153)
  • 75fbd6d fix(kernels): allow uploads and commits to kernel repos (#5233)
  • e1f595d [CLI] Show the Job's scheduling status in hf jobs run (#5163)
  • d03a05c Bump the actions group with 3 updates (#5228)
  • Additional commits viewable in compare view

Updates docling-core from 2.101.1 to 2.105.0

Release notes

Sourced from docling-core's releases.

v2.105.0

Feature

Fix

  • dclq: Use typer's vendored click; allow typer 0.27 (#928) (e810e29)
  • Preserve rich heading context in hierarchical chunks (#924) (5634f7c)
  • serializer: Serialize table footnotes in Markdown and HTML (#675) (ba6a6ca)

v2.104.0

Feature

  • doclang: Add partial DocLang 0.8 support with multiple captions (#880) (1707a2d)

Fix

  • serializer: Escape hyperlink destinations and skip unsupported schemes (#920) (0aca4e5)
  • html: Escape code text and restore non-MathML block formula fallback (#894) (50dc473)
  • Support Pillow 13 and integer PNG exports (#907) (e1b282a)

v2.103.1

Fix

  • markdown: Fence code longer than any backtick run inside it (#867) (1ab3af3)
  • webvtt: Ignore tags that are not cue spans instead of dropping the cue (#896) (29c740f)
  • markdown: Cap section header depth at six heading levels (#872) (4422110)
  • Reject DAG-shaped documents and oversized tables to prevent DoS (#899) (67c5109)

v2.103.0

⚠️ Behaviour change

Local image paths (plain filesystem paths and file:// URIs) are no longer read by default. To read them for trusted documents, either set DOCLINGCORE_ALLOW_IMAGE_FILE_URI=true, or load with DoclingDocument.load_from_json(..., allow_local_images=True) / call doc.load_local_images(). This affects, for example, a JSON saved with ImageRefMode.REFERENCED and loaded again.

Feature

  • Accept calendar MIME types in DocumentOrigin (#892) (6b1ef55)

Fix

  • Gate all local image reads behind allow_image_file_uri (#900) (f952fc5)
  • origin: Accept application/zip MIME type (#891) (4845666)
  • Accept the .cv MIME type in DocumentOrigin (#898) (cb95ecb)
  • chunker: Respect contextualized table token limits (#690) (2e7f5d5)
  • html: Put formatting and hyperlinks inside the <p> and <hN> tags (#879) (3543306)
  • types_doc: Deduplicate row indices in TableData.remove_rows (#834) (fdc66b3)

v2.102.0

Feature

... (truncated)

Changelog

Sourced from docling-core's changelog.

v2.105.0 - 2026-10-27

Feature

Fix

  • dclq: Use typer's vendored click; allow typer 0.27 (#928) (e810e29)
  • Preserve rich heading context in hierarchical chunks (#924) (5634f7c)
  • serializer: Serialize table footnotes in Markdown and HTML (#675) (ba6a6ca)

v2.104.0 - 2026-10-22

Feature

  • doclang: Add partial DocLang 0.8 support with multiple captions (#880) (1707a2d)

Fix

  • serializer: Escape hyperlink destinations and skip unsupported schemes (#920) (0aca4e5)
  • html: Escape code text and restore non-MathML block formula fallback (#894) (50dc473)
  • Support Pillow 13 and integer PNG exports (#907) (e1b282a)

v2.103.1 - 2026-10-20

Fix

  • markdown: Fence code longer than any backtick run inside it (#867) (1ab3af3)
  • webvtt: Ignore tags that are not cue spans instead of dropping the cue (#896) (29c740f)
  • markdown: Cap section header depth at six heading levels (#872) (4422110)
  • Reject DAG-shaped documents and oversized tables to prevent DoS (#899) (67c5109)

v2.103.0 - 2026-10-19

Feature

  • Accept calendar MIME types in DocumentOrigin (#892) (6b1ef55)

Fix

  • Gate all local image reads behind allow_image_file_uri (#900) (f952fc5)
  • origin: Accept application/zip MIME type (#891) (4845666)
  • Accept the .cv MIME type in DocumentOrigin (#898) (cb95ecb)
  • chunker: Respect contextualized table token limits (#690) (2e7f5d5)
  • html: Put formatting and hyperlinks inside the <p> and <hN> tags (#879) (3543306)
  • types_doc: Deduplicate row indices in TableData.remove_rows (#834) (fdc66b3)

v2.102.0 - 2026-10-18

... (truncated)

Commits
  • 5582916 chore: bump version to 2.105.0 [skip ci]
  • e810e29 fix(dclq): use typer's vendored click; allow typer 0.27 (#928)
  • 5634f7c fix: preserve rich heading context in hierarchical chunks (#924)
  • 8f609ec test(chunker): add test for HybridChunker with 'omit_header_on_overflow=True'...
  • ba6a6ca fix(serializer): serialize table footnotes in Markdown and HTML (#675)
  • b501ec8 feat: support Python 3.15 (#911)
  • 4838dd1 chore: bump version to 2.104.0 [skip ci]
  • 0aca4e5 fix(serializer): escape hyperlink destinations and skip unsupported schemes (...
  • 50dc473 fix(html): escape code text and restore non-MathML block formula fallback (#894)
  • b359e1c ci: avoid false summary failures on cancelled runs (#915)
  • Additional commits viewable in compare view

Updates liteparse from 2.16.0 to 2.17.0

Release notes

Sourced from liteparse's releases.

Crates & CLI v2.17.0

What's Changed

New Contributors

Full Changelog: run-llama/liteparse@crates-v2.16.0...crates-v2.17.0

Node.js v2.17.0

What's Changed

New Contributors

Full Changelog: run-llama/liteparse@crates-v2.16.0...node-v2.17.0

Python v2.17.0

What's Changed

@dependabot
build(deps): bump the server-minor-patch group across 1 directory wit…
2f49ac3 
…h 10 updates

Bumps the server-minor-patch group with 10 updates in the /extralit-server directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.143.3` | `0.162.0` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.20.0` | `1.20.1` |
| [social-auth-core](https://github.com/python-social-auth/social-core) | `6.1.1` | `6.2.0` |
| [typer](https://github.com/fastapi/typer) | `0.26.8` | `0.27.3` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `2.2.0` | `2.3.0` |
| [docling-core](https://github.com/docling-project/docling-core) | `2.101.1` | `2.105.0` |
| [liteparse](https://github.com/run-llama/liteparse) | `2.16.0` | `2.17.0` |
| [xxhash](https://github.com/ifduyue/python-xxhash) | `4.0.1` | `4.0.2` |
| [ty](https://github.com/astral-sh/ty) | `0.0.89` | `0.0.91` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.1` | `0.17.2` |



Updates `fastapi` from 0.143.3 to 0.162.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.143.3...0.162.0)

Updates `alembic` from 1.20.0 to 1.20.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `social-auth-core` from 6.1.1 to 6.2.0
- [Release notes](https://github.com/python-social-auth/social-core/releases)
- [Changelog](https://github.com/python-social-auth/social-core/blob/master/CHANGELOG.md)
- [Commits](python-social-auth/social-core@6.1.1...6.2.0)

Updates `typer` from 0.26.8 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.8...0.27.3)

Updates `huggingface-hub` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v2.2.0...v2.3.0)

Updates `docling-core` from 2.101.1 to 2.105.0
- [Release notes](https://github.com/docling-project/docling-core/releases)
- [Changelog](https://github.com/docling-project/docling-core/blob/main/CHANGELOG.md)
- [Commits](docling-project/docling-core@v2.101.1...v2.105.0)

Updates `liteparse` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/run-llama/liteparse/releases)
- [Changelog](https://github.com/run-llama/liteparse/blob/main/CHANGELOG.md)
- [Commits](run-llama/liteparse@wasm-v2.16.0...node-v2.17.0)

Updates `xxhash` from 4.0.1 to 4.0.2
- [Release notes](https://github.com/ifduyue/python-xxhash/releases)
- [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst)
- [Commits](ifduyue/python-xxhash@v4.0.1...v4.0.2)

Updates `ty` from 0.0.89 to 0.0.91
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.89...0.0.91)

Updates `ruff` from 0.17.1 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.1...0.17.2)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: alembic
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: social-auth-core
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: huggingface-hub
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: docling-core
  dependency-version: 2.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: liteparse
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-minor-patch
- dependency-name: xxhash
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: ty
  dependency-version: 0.0.91
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: server-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 28, 2026 13:18
@vercel

vercel Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
extralit-frontend Ready Ready Preview Oct 29, 2026 1:57am UTC

@coderabbitai

coderabbitai Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d2654051-07ce-488a-ba83-367bf70fad77

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@JonnyTran

JonnyTran commented Oct 28, 2026

Copy link
Copy Markdown
Member

@copilot update the deps in the pyproject.toml

Copilot AI requested a review from a team as a code owner October 28, 2026 19:39

Copilot AI commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

@copilot update the deps in the pyproject.toml

Updated in 5b39f2a: raised the requested dependency versions in extralit-server/pyproject.toml and regenerated extralit-server/uv.lock to keep metadata in sync.

Copilot AI requested a review from JonnyTran October 28, 2026 19:41
@JonnyTran
JonnyTran merged commit fb6ffd3 into main Oct 29, 2026
14 checks passed
@JonnyTran
JonnyTran deleted the dependabot/uv/extralit-server/server-minor-patch-db1456c833 branch October 29, 2026 04:31

This branch was successfully deployed

1 active deployment
Preview — f7646986 Deployed Oct 29, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JonnyTran JonnyTran JonnyTran approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@JonnyTran