Skip to content

security(deps): Bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates - #1598

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/data-management/viewer/backend/dataviewer-backend-dependencies-872e8d7137
Open

security(deps): Bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates#1598
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/data-management/viewer/backend/dataviewer-backend-dependencies-872e8d7137

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates:

Package From To
ruff 0.16.6 0.16.7
scikit-learn 1.9.0 1.9.1
huggingface-hub 1.30.0 1.31.0
pyjwt[crypto] 2.13.0 2.14.0
ultralytics 8.4.144 8.4.148
transformers 5.16.1 5.17.0

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Commits

Updates scikit-learn from 1.9.0 to 1.9.1

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.1

We're happy to announce the 1.9.1 release.

This release contains a few bug fixes and is the first version supporting Python 3.15.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.9.html#version-1-9-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Thanks to everyone who contributed to this release !

Commits
  • 866c0f5 generate changelog
  • 12f135f update upper bounds
  • 43ff2f2 bump version
  • b851524 DOC Mark dev index as orphan (#34916)
  • 01d56d4 DOC Fix wikipedia principal eigenvector example references (#34915)
  • b86a1e2 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
  • d282698 🔒 🤖 CI Update lock files for main CI build(s) 🔒 🤖 (#34897)
  • eb34279 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
  • 7581303 FIX: Fix QuantileTransformer(ignore_implicit_zeros=True) sub-sampling behav...
  • ac47f4d FIX: avoid EfficiencyWarning in OPTICS with metric='precomputed' (#34692)
  • Additional commits viewable in compare view

Updates huggingface-hub from 1.30.0 to 1.31.0

Release notes

Sourced from huggingface-hub's releases.

[v1.31.0] Custom labels for Sandboxes, More resilient downloads and more

🏷️ Custom labels for Sandboxes

Dedicated sandboxes now accept custom labels, attached to the underlying Job. This is useful for cost attribution, bookkeeping, or finding and reconnecting to the sandboxes created by a given controller run. Labels use the same -l / --label KEY=VALUE syntax as hf jobs run. They are merged with the labels the SDK uses internally, and invalid or reserved labels are rejected before a billable Job is started. Pool-based sandboxes are unchanged: custom labels are only accepted for dedicated sandboxes.

>>> from huggingface_hub import Sandbox
>>> sandbox = Sandbox.create(image="python:3.12", labels={"controller-run": "run-42"})
hf sandbox create --label controller-run=run-42 --label team=data-infra

📥 More resilient downloads

A batch of fixes makes downloads more robust to unusual server responses, network hiccups and concurrent usage:

  • A timeout while waiting for the response headers of a streamed download is now retried and resumed like a body read failure, instead of escaping http_get() while retries remain.

  • Regular HTTP downloads no longer fail when the HEAD response has no Content-Length. The file size is validated against the GET response when available.

  • snapshot_download now writes the refs/ cache file atomically, reusing the logic already used by hf_hub_download. This fixes a long-standing race when many concurrent snapshot_download calls target the same repo (seen in vLLM / llm-compressor).

  • hf download --dry-run --local-dir ... no longer copies files from the Hub cache into the destination. On large files and slow disks this looked like a hang and could leave an incomplete file behind.

  • [Download] Share retry handling for stream entry and body failures by @​Wauplin in #4826

  • [Download] Tolerate missing HEAD Content-Length by @​Wauplin in #4805

  • [Download] Write cache ref file atomically in snapshot_download by @​Wauplin in #4829

  • [Download] Prevent cached file copies during local-dir dry runs by @​wakamex in #4817

🔌 httpx re-exported for library integrators

huggingface_hub now re-exports the HTTP library it uses as huggingface_hub.utils.httpx. Libraries built on top of huggingface_hub that need httpx types or exceptions (typically to catch errors) should import it from there rather than importing httpx directly. v1.x is built on httpx, and v2.x will move to its successor httpx2, so importing through huggingface_hub.utils keeps your code compatible with both. This is only for types and exceptions: to make requests to the Hub, keep using get_session().

from huggingface_hub.utils import httpx
try:
...
except httpx.HTTPError:
...

📚 Documentation: Utilities — The httpx module

  • [httpx migration] Expose httpx as a huggingface_hub submodule by @​Wauplin in #4803

🔒 Security

HfFileSystem.get() now validates remote filenames before writing anything locally. A server-side filename such as folder/..\..\outside.txt could previously escape the destination directory on Windows during a recursive download. The same check already protected hf_hub_download, snapshot_download and bucket sync. Unsafe filenames now raise ValueError on all platforms, including when downloading to an explicitly named file or a file object.

... (truncated)

Commits
  • 495b17c Release: v1.31.0
  • 0f50db0 Release: v1.31.0.rc1
  • d592df8 Revert "[Jobs] Add network groups to hf jobs run (#4833)"
  • 3c08b69 Release: v1.31.0.rc0
  • f148666 [CLI] Fix truncated command descriptions in the CLI reference (#4849)
  • c4f076c (LFS)Fix SliceFileObj.iter yielding only the first 4MB chunk (#4844)
  • 22fe960 Fix dotenv parser truncating unquoted values containing '#' (#4842)
  • 6cae778 [Jobs] Add network groups to hf jobs run (#4833)
  • 063b37b [CLI] Raise explicit error for shell-script extensions on Windows (#4846)
  • b9c14d9 [Download] Write cache ref file atomically in snapshot_download (#4829)
  • Additional commits viewable in compare view

Updates pyjwt[crypto] from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt[crypto]'s releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt[crypto]'s changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.

Fixed



- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.

Fixed




    

  • Raise the documented PyJWTError subclass instead of leaking a
TypeError when the exp, nbf, or iat claim decodes to a
non-numeric, non-string value such as a list, dict, or null.
Commits
  • c6fe464 release: prepare v2.14.0
  • f541302 style: apply Ruff formatting
  • 801cd12 fix: reject public JWK container HMAC keys
  • af8181c fix: reject empty HMAC keys from JWKs
  • ba4853a Throttle repeated PyJWKClient refreshes
  • 2798504 fix: reject DER public keys as HMAC secrets
  • 8b4e233 fix: reject loader-accepted PEM variants
  • 1f8180a fix: format JWS tests
  • cff1ac5 Fix redirect handler return annotation
  • 0a795b8 Reject redirects in PyJWKClient fetches
  • Additional commits viewable in compare view

Updates ultralytics from 8.4.144 to 8.4.148

Release notes

Sourced from ultralytics's releases.

v8.4.148 - Load SAM 3.1 checkpoints into the SAM 3 image predictors (#26144)

🌟 Summary

Ultralytics 8.4.148 makes SAM 3.1 image prediction checkpoints load correctly, enabling reliable point, box, text, and exemplar-based segmentation. 🎯

📊 Key Changes

  • SAM 3.1 checkpoint support 🧠

    • Added checkpoint-key mapping so sam3.1_multiplex.pt works correctly with SAM and SAM3Predictor.
    • Fixes an issue where SAM 3.1’s prompt encoder, mask decoder, embedding, and neck could be silently initialized with random weights.
    • Existing sam3.pt checkpoints remain compatible; the key mapping is effectively a no-op for SAM 3.

  • Supported SAM 3.1 prediction workflows 🖼️

    • Point and box prompts through SAM and SAM3Predictor.
    • Text and image-exemplar prompts through SAM3SemanticPredictor.
    • SAM 3.1 video tracking with the new Object Multiplex memory architecture is not yet ported. Use the original sam3.pt with the SAM 3 video predictors for video workflows.

  • Documentation updates 📚

    • Added SAM 3.1 guidance, supported scope, benchmark comparisons, and gated-weight download instructions.
    • Updated the model index to list sam3.1_multiplex.pt.

  • Repository guidance improvements 🛠️

    • Streamlined the root AGENTS.md and moved documentation-specific instructions into a new docs/AGENTS.md.
    • Preserved important development, testing, release, and implementation-boundary guidance while reducing duplicated repository walkthroughs.

  • Version update 📦

    • Bumped the package version from 8.4.147 to 8.4.148.

🎯 Purpose & Impact

  • ✅ Correct segmentation results: SAM 3.1 image predictors now use the trained checkpoint components instead of silently falling back to randomly initialized prompt-processing layers.
  • 🚀 Easier SAM 3.1 adoption: Users can load the new checkpoint through the existing Ultralytics SAM interfaces with minimal workflow changes.
  • 🔍 Clearer expectations: Documentation distinguishes supported SAM 3.1 image prediction from unsupported Object Multiplex video tracking.
  • 🔐 Access requirement: SAM 3.1 weights remain gated by Meta and must be obtained from the approved SAM 3.1 model page on Hugging Face.
  • 👩‍💻 Improved contributor experience: More focused agent guidance makes repository development instructions easier to discover without changing end-user model behavior.

What's Changed

Full Changelog: ultralytics/ultralytics@v8.4.147...v8.4.148

v8.4.147 - Apply Albumentations to grayscale images (#26133)

🌟 Summary

Ultralytics v8.4.147 improves preprocessing for grayscale images, strengthens SAM segmentation behavior, and refreshes Platform, installation, and CI documentation. 🚀

📊 Key Changes

... (truncated)

Commits
  • 4eb91fb ultralytics 8.4.148 Load SAM 3.1 checkpoints into the SAM 3 image predictor...
  • c1c1b25 Focus repository guidance and retain scoped agent instructions (#26141)
  • 5c5c908 Trim derivable content from AGENTS.md and move docs guidance to docs/AGENTS.m...
  • 991faea Apply Albumentations to grayscale images (#26133)
  • f707493 Rewrite quickstart around installation and a first prediction (#26128)
  • a258dfe Add min_mask_region_area to SAM generate() and scale crop point prompts t...
  • 061fdd8 Document Platform Autotraining with Ask AI (#26137)
  • 66cee14 Document Platform Agents visual workflows (#26135)
  • 4e8de23 Document the Platform CLI agent skill (#26136)
  • df873cd Install jq in CPU and GPU runner images (#26134)
  • Additional commits viewable in compare view

Updates transformers from 5.16.1 to 5.17.0

Release notes

Sourced from transformers's releases.

Release 5.17.0

Release v5.17.0

New Model additions

HYV4

Hy4-Preview is a 780B-parameter mixture-of-experts language model that activates 49B parameters per token. Each MoE layer holds 256 routed experts plus one always-active shared expert and routes every token to 8 of them. The context window is 1M tokens.

The architecture combines four features:

  • Multi-head Latent Attention (MLA) compresses keys and values into a low-rank latent (kv_lora_rank) that kv_b_proj expands back to one key/value per query head.
  • DeepSeek Sparse Attention (DSA) selects index_topk keys per query with a lightweight indexer. Following IndexShare, only the layers marked "full" in indexer_types run an indexer; "shared" layers reuse the previous full layer's selection.
  • Gated MLA with learnable attention sinks, where each head owns a sink logit that participates in the softmax and contributes no value, as in GPT-OSS.
  • Independent Hyper-Connections (iHC) replace the plain residual path with hc_mult parallel residual streams that are collapsed before, and redistributed after, every sublayer.

The implementation does not execute the multi-token prediction (MTP) layers. Released checkpoints keep those weights so that other runtimes can use them for speculative decoding; they are ignored at load time.

Links: Documentation

VibeVoice

VibeVoice is a novel framework for synthesizing high-fidelity, long-form speech with multiple speakers by employing a next-token diffusion approach within a Large Language Model (LLM) structure. It's designed to capture the authentic conversational "vibe" and is particularly suited for generating audio content like podcasts and multi-participant audiobooks.

Links: Documentation

NeoMME

NeoMME is a family of efficient 260M and 800M parameter multimodal-native multilingual foundation encoders from H Company. It processes multilingual text tokens and raw image patches in a single bidirectional Transformer encoder, without a separately pretrained vision tower or causal language model.

NeoMME-Retriever is a model fine-tuned from the NeoMME backbone for visual document retrieval with joint late-interaction and dense objectives. It takes text queries and documents (text or page screenshots) and produces multi-vector embeddings for MeanMaxSim scoring (late-interaction) and mean-pooled embeddings for cosine similarity (dense).

Links: Documentation

... (truncated)

Commits
  • 856157a v5.17.0
  • 5b7dcb0 MRoPE continued (#48594)
  • 50bbcc6 [fix] Update stale expected strings in HunYuanVL integration tests (#48646)
  • e8bcd79 [Quantizaiton]support 5/6/7 bits in AutoRound (#48481)
  • 3283d5f [fix] Update stale golden values and fix expected_logits shape in FlavaForPre...
  • 5f47b5a [tests] Fix integration test golden values broken by fast image processor def...
  • fc50134 Add Fun-ASR-Nano model (#46180)
  • d9fe823 Fix YOLOS device mismatch with device_map="auto" (#46886)
  • cbc1651 [Generate] Avoid unconditionally downloading remote hub file (#48620)
  • bd05a4b Honor shift_labels in decoder-only LLM/VLM losses (#48493)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the dataviewer-backend-dependencies group
7ea1c37 
Bumps the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.7` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.9.0` | `1.9.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.30.0` | `1.31.0` |
| [pyjwt[crypto]](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` |
| [ultralytics](https://github.com/ultralytics/ultralytics) | `8.4.144` | `8.4.148` |
| [transformers](https://github.com/huggingface/transformers) | `5.16.1` | `5.17.0` |


Updates `ruff` from 0.16.6 to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.16.7)

Updates `scikit-learn` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.9.0...1.9.1)

Updates `huggingface-hub` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.30.0...v1.31.0)

Updates `pyjwt[crypto]` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.14.0)

Updates `ultralytics` from 8.4.144 to 8.4.148
- [Release notes](https://github.com/ultralytics/ultralytics/releases)
- [Commits](ultralytics/ultralytics@v8.4.144...v8.4.148)

Updates `transformers` from 5.16.1 to 5.17.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.16.1...v5.17.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: scikit-learn
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: huggingface-hub
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
- dependency-name: pyjwt[crypto]
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
- dependency-name: ultralytics
  dependency-version: 8.4.148
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dataviewer-backend-dependencies
- dependency-name: transformers
  dependency-version: 5.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dataviewer-backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dataviewer dependencies Dependency version updates python Pull requests that update python code labels Sep 18, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 18, 2026 17:24
@dependabot dependabot Bot added dataviewer dependencies Dependency version updates python Pull requests that update python code labels Sep 18, 2026
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 7ea1c37.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/huggingface-hub 1.31.0 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 6Found 18/28 approved changesets -- score normalized to 6
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
pip/pyjwt 2.14.0 UnknownUnknown
pip/ruff 0.16.7 UnknownUnknown
pip/scikit-learn 1.9.1 UnknownUnknown
pip/transformers 5.17.0 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 9Found 27/29 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/ultralytics 8.4.148 UnknownUnknown

Scanned Files

  • data-management/viewer/backend/uv.lock

@github-actions github-actions Bot changed the title chore(deps): Bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates security(deps): Bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 6 updates Sep 18, 2026
@codecov-commenter

Codecov Comments Bot (codecov-commenter) commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.10%. Comparing base (b44553c) to head (7ea1c37).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #1598   +/-   ##
=======================================
  Coverage   88.10%   88.10%           
=======================================
  Files         279      279           
  Lines       23203    23203           
  Branches     3153     3153           
=======================================
  Hits        20444    20444           
  Misses       2071     2071           
  Partials      688      688
Flag Coverage Δ *Carryforward flag
go 100.00% <ø> (ø)
pester 86.64% <ø> (ø) Carriedforward from b44553c
pytest-data-pipeline 100.00% <ø> (ø) Carriedforward from b44553c
pytest-dataviewer 89.66% <ø> (ø)
pytest-dm-tools 100.00% <ø> (ø) Carriedforward from b44553c
pytest-evaluation 95.40% <ø> (ø)
pytest-fuzz 3.99% <ø> (ø) Carriedforward from b44553c
pytest-inference 100.00% <ø> (ø) Carriedforward from b44553c
pytest-shared-ci 100.00% <ø> (ø) Carriedforward from b44553c
pytest-training 92.60% <ø> (ø) Carriedforward from b44553c
vitest 85.66% <ø> (ø) Carriedforward from b44553c
vitest-app 85.66% <ø> (ø) Carriedforward from b44553c
vitest-components 85.66% <ø> (ø) Carriedforward from b44553c
vitest-features 85.66% <ø> (ø) Carriedforward from b44553c
vitest-lib 85.66% <ø> (ø) Carriedforward from b44553c
vitest-state 85.66% <ø> (ø) Carriedforward from b44553c

*This pull request uses carry forward flags. Click here to find out more.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dataviewer dependencies Dependency version updates python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter