Bump the pip group across 7 directories with 8 updates by dependabot[bot] · Pull Request #686 · mlcommons/medperf

dependabot · 2026-05-04T22:39:57Z

Bumps the pip group with 1 update in the /cli directory: cryptography.
Bumps the pip group with 1 update in the /examples/cc/rano/implementation directory: onnx.
Bumps the pip group with 1 update in the /examples/chestxray_tutorial/model_custom_cnn/project directory: torch.
Bumps the pip group with 1 update in the /examples/fl/fl/project directory: onnx.
Bumps the pip group with 1 update in the /examples/fl/prep/project directory: pillow.
Bumps the pip group with 1 update in the /examples/fl_post/fl/project directory: onnx.
Bumps the pip group with 4 updates in the /server directory: djangorestframework, pyopenssl, werkzeug and djangorestframework-simplejwt.

Updates cryptography from 46.0.3 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10
* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27
Dropped support for win_arm64 wheels_.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

Commits

622d672 46.0.7 release (#14602)
91d7288 Cherry-pick #14542 (#14543)
06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
See full diff in compare view

Updates onnx from 1.16.2 to 1.21.0

Release notes

Sourced from onnx's releases.

v1.21.0

ONNX v1.21.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Remove defunct model hub integration by @andife in onnx/onnx#7678

Spec and Operator

Revert opset 25 version bump by @titaiwangms in onnx/onnx#7441

Add 2 bit support to onnx by @vraspar in onnx/onnx#7446

Bump opset version to 26 by @titaiwangms in onnx/onnx#7469

Remove enforcement to node determinism attribute by @titaiwangms in onnx/onnx#7473

Export functions by @cyyever in onnx/onnx#7505

[Reland] Cumulative Product Operator by @titaiwangms in onnx/onnx#7400

Fix Div integer semantics to use trunc division by @MagellaX in onnx/onnx#7585

Clarify DFT behavior when inverse=True and onesided=True (irfft) by @simonbyrne in onnx/onnx#7574

Specify 0/0 case in LpNormalization by @titaiwangms in onnx/onnx#7618

Clarify NonMaxSuppression IoU threshold uses strict comparison by @Copilot in onnx/onnx#7619

Relax model domain requirement from MUST to SHOULD by @Copilot in onnx/onnx#7668

Add BitCast operator for bitwise type reinterpretation by @Copilot in onnx/onnx#7527

Reference Implementation

Fix CenterCropPad: compare target shape with dimension, not axis index by @Copilot in onnx/onnx#7522

Vectorize sigmoid op implementation by @justinchuby in onnx/onnx#7556

Fixing verbose logging error at verbose=3 for reference_evaluator by @rothej in onnx/onnx#7597

Clean up reference evaluator tests by @VedantMadane in onnx/onnx#7684

Utilities and Tools

Add version check for test_executable_permission_check by @andife in onnx/onnx#7511

Fix index out of bounds in version converter adapters by @rothej in onnx/onnx#7493

Fix default attribute values in shape inference by @matteosal in onnx/onnx#7602

Fix Softmax-family shape inference for scalar inputs by @MagellaX in onnx/onnx#7625

Fix/merge models value info by @MagellaX in onnx/onnx#7608

Add version converter adapters for opset 15, 16, 17, 18 by @alexkvitkevich in onnx/onnx#7677

shape_inference: Validate expected size of scalar tensor in ParseData by @skottmckay in onnx/onnx#7675

Build, CI and Tests

Force labels in PRs by @titaiwangms in onnx/onnx#7442

Fix reuse by @andife in onnx/onnx#7463

Change precedence from 'aggregate' to 'override' for generating scripts by @andife in onnx/onnx#7458

a) 3.14-dev -> 3.14, b) reduce template injection thread by @andife in onnx/onnx#7461

Export register functions by @cyyever in onnx/onnx#7496

Fix Python executable detection in virtual environments by @aoguntayo in onnx/onnx#7485

Merged Release Workflows for Windows by @Raghul-M in onnx/onnx#7509

Bump nanobind to 2.10.2 by @cyyever in onnx/onnx#7479

Fix freebsd build by @cyyever in onnx/onnx#7518

Revert ONNX CMake changes by @cyyever in onnx/onnx#7515

Export functions used in PyTorch by @cyyever in onnx/onnx#7524

Export protobuf symbols by @cyyever in onnx/onnx#7525

Fix CMAKE_ARGS parsing for windows compatibility by @hmaarrfk in onnx/onnx#7532

Replace deprecated github action "test-results-action" by @andife in onnx/onnx#7552

Wheels for python 3.14t by @andife in onnx/onnx#7558

Clarify permissions comment and update dependencies install by @andife in onnx/onnx#7577

... (truncated)

Commits

be2b5fd Update VERSION_NUMBER to final release version (#7772)
c751ddb Update VERSION_NUMBER to rc4 (#7759)
866038e [rel-1.21.0] Cherry-pick bug and security fixes for RC4 (#7737, #7751) (#7758)
e6c12c5 update version to rc3 (#7743)
33afebf Cherry pick commit (#7740)
a51ac07 update release to rc2 (#7732)
089fcda fix windows build ; upload (#7727)
fbbe45b Cherry pick commits into the release branch (#7718)
624108e update release branch version to 1.21.0rc1 (#7714)
b65e6e1 [Cherry-Pick] Merge commits from main for security fixes (#7688)
Additional commits viewable in compare view

Updates torch from 2.0.1 to 2.7.1+cpu

Updates onnx from 1.13.0 to 1.21.0

Release notes

Sourced from onnx's releases.

v1.21.0

ONNX v1.21.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Remove defunct model hub integration by @andife in onnx/onnx#7678

Spec and Operator

Revert opset 25 version bump by @titaiwangms in onnx/onnx#7441

Add 2 bit support to onnx by @vraspar in onnx/onnx#7446

Bump opset version to 26 by @titaiwangms in onnx/onnx#7469

Remove enforcement to node determinism attribute by @titaiwangms in onnx/onnx#7473

Export functions by @cyyever in onnx/onnx#7505

[Reland] Cumulative Product Operator by @titaiwangms in onnx/onnx#7400

Fix Div integer semantics to use trunc division by @MagellaX in onnx/onnx#7585

Clarify DFT behavior when inverse=True and onesided=True (irfft) by @simonbyrne in onnx/onnx#7574

Specify 0/0 case in LpNormalization by @titaiwangms in onnx/onnx#7618

Clarify NonMaxSuppression IoU threshold uses strict comparison by @Copilot in onnx/onnx#7619

Relax model domain requirement from MUST to SHOULD by @Copilot in onnx/onnx#7668

Add BitCast operator for bitwise type reinterpretation by @Copilot in onnx/onnx#7527

Reference Implementation

Fix CenterCropPad: compare target shape with dimension, not axis index by @Copilot in onnx/onnx#7522

Vectorize sigmoid op implementation by @justinchuby in onnx/onnx#7556

Fixing verbose logging error at verbose=3 for reference_evaluator by @rothej in onnx/onnx#7597

Clean up reference evaluator tests by @VedantMadane in onnx/onnx#7684

Utilities and Tools

Add version check for test_executable_permission_check by @andife in onnx/onnx#7511

Fix index out of bounds in version converter adapters by @rothej in onnx/onnx#7493

Fix default attribute values in shape inference by @matteosal in onnx/onnx#7602

Fix Softmax-family shape inference for scalar inputs by @MagellaX in onnx/onnx#7625

Fix/merge models value info by @MagellaX in onnx/onnx#7608

Add version converter adapters for opset 15, 16, 17, 18 by @alexkvitkevich in onnx/onnx#7677

shape_inference: Validate expected size of scalar tensor in ParseData by @skottmckay in onnx/onnx#7675

Build, CI and Tests

Force labels in PRs by @titaiwangms in onnx/onnx#7442

Fix reuse by @andife in onnx/onnx#7463

Change precedence from 'aggregate' to 'override' for generating scripts by @andife in onnx/onnx#7458

a) 3.14-dev -> 3.14, b) reduce template injection thread by @andife in onnx/onnx#7461

Export register functions by @cyyever in onnx/onnx#7496

Fix Python executable detection in virtual environments by @aoguntayo in onnx/onnx#7485

Merged Release Workflows for Windows by @Raghul-M in onnx/onnx#7509

Bump nanobind to 2.10.2 by @cyyever in onnx/onnx#7479

Fix freebsd build by @cyyever in onnx/onnx#7518

Revert ONNX CMake changes by @cyyever in onnx/onnx#7515

Export functions used in PyTorch by @cyyever in onnx/onnx#7524

Export protobuf symbols by @cyyever in onnx/onnx#7525

Fix CMAKE_ARGS parsing for windows compatibility by @hmaarrfk in onnx/onnx#7532

Replace deprecated github action "test-results-action" by @andife in onnx/onnx#7552

Wheels for python 3.14t by @andife in onnx/onnx#7558

Clarify permissions comment and update dependencies install by @andife in onnx/onnx#7577

... (truncated)

Commits

be2b5fd Update VERSION_NUMBER to final release version (#7772)
c751ddb Update VERSION_NUMBER to rc4 (#7759)
866038e [rel-1.21.0] Cherry-pick bug and security fixes for RC4 (#7737, #7751) (#7758)
e6c12c5 update version to rc3 (#7743)
33afebf Cherry pick commit (#7740)
a51ac07 update release to rc2 (#7732)
089fcda fix windows build ; upload (#7727)
fbbe45b Cherry pick commits into the release branch (#7718)
624108e update release branch version to 1.21.0rc1 (#7714)
b65e6e1 [Cherry-Pick] Merge commits from main for security fixes (#7688)
Additional commits viewable in compare view

Updates pillow from 10.2.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

https://github.com/python-pillow/Pillow/releases

11.0.0 (2024-10-15)

Update licence to MIT-CMU #8460 [hugovk]

Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

Do not close provided file handles with libtiff when saving #8458 [radarhere]

Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

Use transparency when combining P frames from APNGs #8443 [radarhere]

Support all resampling filters when resizing I;16* images #8422 [radarhere]

Free memory on early return #8413 [radarhere]

Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates onnx from 1.13.0 to 1.21.0

Release notes

Sourced from onnx's releases.

v1.21.0

ONNX v1.21.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Remove defunct model hub integration by @andife in onnx/onnx#7678

Spec and Operator

Revert opset 25 version bump by @titaiwangms in onnx/onnx#7441

Add 2 bit support to onnx by @vraspar in onnx/onnx#7446

Bump opset version to 26 by @titaiwangms in onnx/onnx#7469

Remove enforcement to node determinism attribute by @titaiwangms in onnx/onnx#7473

Export functions by @cyyever in onnx/onnx#7505

[Reland] Cumulative Product Operator by @titaiwangms in onnx/onnx#7400

Fix Div integer semantics to use trunc division by @MagellaX in onnx/onnx#7585

Clarify DFT behavior when inverse=True and onesided=True (irfft) by @simonbyrne in onnx/onnx#7574

Specify 0/0 case in LpNormalization by @titaiwangms in onnx/onnx#7618

Clarify NonMaxSuppression IoU threshold uses strict comparison by @Copilot in onnx/onnx#7619

Relax model domain requirement from MUST to SHOULD by @Copilot in onnx/onnx#7668

Add BitCast operator for bitwise type reinterpretation by @Copilot in onnx/onnx#7527

Reference Implementation

Fix CenterCropPad: compare target shape with dimension, not axis index by @Copilot in onnx/onnx#7522

Vectorize sigmoid op implementation by @justinchuby in onnx/onnx#7556

Fixing verbose logging error at verbose=3 for reference_evaluator by @rothej in onnx/onnx#7597

Clean up reference evaluator tests by @VedantMadane in onnx/onnx#7684

Utilities and Tools

Add version check for test_executable_permission_check by @andife in onnx/onnx#7511

Fix index out of bounds in version converter adapters by @rothej in onnx/onnx#7493

Fix default attribute values in shape inference by @matteosal in onnx/onnx#7602

Fix Softmax-family shape inference for scalar inputs by @MagellaX in onnx/onnx#7625

Fix/merge models value info by @MagellaX in onnx/onnx#7608

Add version converter adapters for opset 15, 16, 17, 18 by @alexkvitkevich in onnx/onnx#7677

shape_inference: Validate expected size of scalar tensor in ParseData by @skottmckay in onnx/onnx#7675

Build, CI and Tests

Force labels in PRs by @titaiwangms in onnx/onnx#7442

Fix reuse by @andife in onnx/onnx#7463

Change precedence from 'aggregate' to 'override' for generating scripts by @andife in onnx/onnx#7458

a) 3.14-dev -> 3.14, b) reduce template injection thread by @andife in onnx/onnx#7461

Export register functions by @cyyever in onnx/onnx#7496

Fix Python executable detection in virtual environments by @aoguntayo in onnx/onnx#7485

Merged Release Workflows for Windows by @Raghul-M in onnx/onnx#7509

Bump nanobind to 2.10.2 by @cyyever in onnx/onnx#7479

Fix freebsd build by @cyyever in onnx/onnx#7518

Revert ONNX CMake changes by @cyyever in onnx/onnx#7515

Export functions used in PyTorch by @cyyever in onnx/onnx#7524

Export protobuf symbols by @cyyever in onnx/onnx#7525

Fix CMAKE_ARGS parsing for windows compatibility by @hmaarrfk in onnx/onnx#7532

Replace deprecated github action "test-results-action" by @andife in onnx/onnx#7552

Wheels for python 3.14t by @andife in onnx/onnx#7558

Clarify permissions comment and update dependencies install by @andife in onnx/onnx#7577

... (truncated)

Commits

be2b5fd Update VERSION_NUMBER to final release version (#7772)
c751ddb Update VERSION_NUMBER to rc4 (#7759)
866038e [rel-1.21.0] Cherry-pick bug and security fixes for RC4 (#7737, #7751) (#7758)
e6c12c5 update version to rc3 (#7743)
33afebf Cherry pick commit (#7740)
a51ac07 update release to rc2 (#7732)
089fcda fix windows build ; upload (#7727)
fbbe45b Cherry pick commits into the release branch (#7718)
624108e update release branch version to 1.21.0rc1 (#7714)
b65e6e1 [Cherry-Pick] Merge commits from main for security fixes (#7688)
Additional commits viewable in compare view

Updates djangorestframework from 3.14.0 to 3.15.2

Release notes

Sourced from djangorestframework's releases.

3.15.2

What's Changed

Add @api_view example to caching documentation by @BradWells in encode/django-rest-framework#9131

Update docstring by @jthevos in encode/django-rest-framework#9340

Apply black formatting to caching markdown by @jthevos in encode/django-rest-framework#9341

Update renderers documentation example by @mgaligniana in encode/django-rest-framework#9362

Removing live examples of tutorial code that are no longer hosted by @TGoddessana in encode/django-rest-framework#9363

Docs: Remove an unnecessary step from quickstart.md by @gogowitsch in encode/django-rest-framework#9387

Documentation: Add Python 3.12 to the requirements by @Szaroslav in encode/django-rest-framework#9382

Tweak README.md links. by @tomchristie in encode/django-rest-framework#9375

Revert "Ensure CursorPagination respects nulls in the ordering field" by @max-muoto in encode/django-rest-framework#9381

use warnings rather than logging a warning for DecimalField warnings by @terencehonles in encode/django-rest-framework#9367

20240426 docs by @peterthomassen in encode/django-rest-framework#9392

Cleanup by @peterthomassen in encode/django-rest-framework#9393

tests: Check urlpatterns after cleanups by @stanislavlevin in encode/django-rest-framework#9400

docs: Correct some evaluation results and a httpie option in Tutorial1 by @wkwkhautbois in encode/django-rest-framework#9421

Add __hash__ method for permissions.OperandHolder class by @vanya909 in encode/django-rest-framework#9417

Fix potential XSS vulnerability in break_long_headers template filter by @ch4n3-yoon in encode/django-rest-framework#9435

Version 3.15.2. by @tomchristie in encode/django-rest-framework#9439

New Contributors

@BradWells made their first contribution in encode/django-rest-framework#9131

@jthevos made their first contribution in encode/django-rest-framework#9340

@gogowitsch made their first contribution in encode/django-rest-framework#9387

@Szaroslav made their first contribution in encode/django-rest-framework#9382

@wkwkhautbois made their first contribution in encode/django-rest-framework#9421

@ch4n3-yoon made their first contribution in encode/django-rest-framework#9435

Full Changelog: encode/django-rest-framework@3.15.1...3.15.2

Version 3.15.1

What's Changed

Update the message to be consistent with the Django `HttpResponseBa… by @maycuatroi in encode/django-rest-framework#9287

Make inflection package truly optional by @browniebroke in encode/django-rest-framework#9303

Fix broken links in release notes for 3.15 by @browniebroke in encode/django-rest-framework#9305

TokenAdmin.autocomplete_fields Breaks Some Use Cases, Revert by @alexdlaird in encode/django-rest-framework#9301

Add drf-sendables to third-party-packages.md by @amikrop in encode/django-rest-framework#9261

Revert "feat: Add some changes to ValidationError to support django style vad…" by @auvipy in encode/django-rest-framework#9326

Revert "Re-prefetch related objects after updating" by @auvipy in encode/django-rest-framework#9327

Revert #8863 by @tomchristie in encode/django-rest-framework#9330

Revert #8009 by @tomchristie in encode/django-rest-framework#9332

Revert #9030 by @tomchristie in encode/django-rest-framework#9333

Revert "Fix NamespaceVersioning ignoring DEFAULT_VERSION on non-None namespaces" by @auvipy in encode/django-rest-framework#9335

SearchFilter.get_search_terms returns list. by @tomchristie in encode/django-rest-framework#9338

Version 3.15.1 by @tomchristie in encode/django-rest-framework#9339

New Contributors

@maycuatroi made their first contribution in encode/django-rest-framework#9287

@alexdlaird made their first contribution in encode/django-rest-framework#9301

... (truncated)

Commits

c7a7eae Version 3.15.2 (#9439)
3b41f01 Fix potential XSS vulnerability in break_long_headers template filter (#9435)
fe92f0d Add __hash__ method for permissions.OperandHolder class (#9417)
fbdab09 docs: Correct some evaluation results and a httpie option in Tutorial1 (#9421)
36d5c0e tests: Check urlpatterns after cleanups (#9400)
9d4ed05 Don't use Windows line endings
b34bde4 Fix typo in setup.cfg setting
ab681f2 Update requirements in docs
2237724 bump pygments (security hygiene)
d58b8da Update deprecation hints
Additional commits viewable in compare view

Updates pyopenssl from 25.3.0 to 26.0.0

Changelog

Sourced from pyopenssl's changelog.

26.0.0 (2026-03-15)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Dropped support for Python 3.7.

The minimum cryptography version is now 46.0.0.

Deprecations: ^^^^^^^^^^^^^

Changes: ^^^^^^^^

Added support for using aws-lc instead of OpenSSL.

Properly raise an error if a DTLS cookie callback returned a cookie longer than DTLS1_COOKIE_LENGTH bytes. Previously this would result in a buffer-overflow. Credit to dark_haxor for reporting the issue. CVE-2026-27459

Added OpenSSL.SSL.Connection.get_group_name to determine which group name was negotiated.

Context.set_tlsext_servername_callback now handles exceptions raised in the callback by calling sys.excepthook and returning a fatal TLS alert. Previously, e...
Description has been truncated

Bumps the pip group with 1 update in the /cli directory: [cryptography](https://github.com/pyca/cryptography). Bumps the pip group with 1 update in the /examples/cc/rano/implementation directory: [onnx](https://github.com/onnx/onnx). Bumps the pip group with 1 update in the /examples/chestxray_tutorial/model_custom_cnn/project directory: torch. Bumps the pip group with 1 update in the /examples/fl/fl/project directory: [onnx](https://github.com/onnx/onnx). Bumps the pip group with 1 update in the /examples/fl/prep/project directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the pip group with 1 update in the /examples/fl_post/fl/project directory: [onnx](https://github.com/onnx/onnx). Bumps the pip group with 4 updates in the /server directory: [djangorestframework](https://github.com/encode/django-rest-framework), [pyopenssl](https://github.com/pyca/pyopenssl), [werkzeug](https://github.com/pallets/werkzeug) and [djangorestframework-simplejwt](https://github.com/jazzband/djangorestframework-simplejwt). Updates `cryptography` from 46.0.3 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.3...46.0.7) Updates `onnx` from 1.16.2 to 1.21.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.16.2...v1.21.0) Updates `torch` from 2.0.1 to 2.7.1+cpu Updates `onnx` from 1.13.0 to 1.21.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.16.2...v1.21.0) Updates `pillow` from 10.2.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.2.0...12.2.0) Updates `onnx` from 1.13.0 to 1.21.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.16.2...v1.21.0) Updates `djangorestframework` from 3.14.0 to 3.15.2 - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](encode/django-rest-framework@3.14.0...3.15.2) Updates `pyopenssl` from 25.3.0 to 26.0.0 - [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst) - [Commits](pyca/pyopenssl@25.3.0...26.0.0) Updates `werkzeug` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.0.6...3.1.6) Updates `djangorestframework-simplejwt` from 5.3.1 to 5.5.1 - [Release notes](https://github.com/jazzband/djangorestframework-simplejwt/releases) - [Changelog](https://github.com/jazzband/djangorestframework-simplejwt/blob/master/CHANGELOG.md) - [Commits](jazzband/djangorestframework-simplejwt@v5.3.1...v5.5.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: onnx dependency-version: 1.21.0 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.7.1+cpu dependency-type: direct:production dependency-group: pip - dependency-name: onnx dependency-version: 1.21.0 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: onnx dependency-version: 1.21.0 dependency-type: direct:production dependency-group: pip - dependency-name: djangorestframework dependency-version: 3.15.2 dependency-type: direct:production dependency-group: pip - dependency-name: pyopenssl dependency-version: 26.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: djangorestframework-simplejwt dependency-version: 5.5.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-04T22:40:12Z

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

dependabot · 2026-05-05T12:03:21Z

Superseded by #687.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 4, 2026

dependabot Bot requested a review from a team as a code owner May 4, 2026 22:39

dependabot Bot mentioned this pull request May 4, 2026

Bump the pip group across 6 directories with 7 updates #684

Closed

dependabot Bot had a problem deploying to testing-external-code May 4, 2026 22:40 Failure

dependabot Bot closed this May 5, 2026

dependabot Bot deleted the dependabot/pip/cli/pip-a02adc5ce3 branch May 5, 2026 12:03

github-actions Bot locked and limited conversation to collaborators May 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the pip group across 7 directories with 8 updates#686

Bump the pip group across 7 directories with 8 updates#686
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/cli/pip-a02adc5ce3

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

dependabot Bot commented on behalf of github May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 4, 2026

v1.21.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

v1.21.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

12.2.0

Documentation

Dependencies

Testing

Other changes

Changelog (Pillow)

11.1.0 and newer

11.0.0 (2024-10-15)

v1.21.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

3.15.2

What's Changed

New Contributors

Version 3.15.1

What's Changed

New Contributors

26.0.0 (2026-03-15)

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

dependabot Bot commented on behalf of github May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants