[dependabot]

Bumps the quantum-prod-deps group with 8 updates in the /ai-projects/quantum-ml/production directory:

Package	From	To
numpy	2.5.1	2.5.2
joblib	1.5.3	1.6.0
torch	2.13.0	2.14.0
gunicorn	26.0.0	26.2.0
gevent	26.5.0	26.8.0
python-json-logger	4.1.0	4.2.0
prometheus-client	0.25.0	0.26.0
mypy	2.2.0	2.3.1

Updates numpy from 2.5.1 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Abhijeetsingh Meena +
• Charalampos Stratakis
• Charles Harris
• Chris Ninham +
• David Woods
• Geonho +
• Gopu Yeshwanth Reddy +
• Iason Krommydas
• Ijtihed Kilani
• Jelle Zijlstra +
• Joren Hammudoglu
• Kumar Aditya
• Mike Boyle
• Nathan Goldbaum
• Raghuveer Devulapalli
• Sebastian Berg

... (truncated)

Commits

• 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
• ecf599c Merge pull request #32221 from charris/backport-32151
• 3c7ac97 Merge pull request #32220 from charris/backport-32205
• 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
• 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
• c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
• 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
• d8262bc MAINT: Update cibuildwheel to v4.2.0
• 988d94d Merge pull request #32158 from charris/backport-32133
• b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
• Additional commits viewable in compare view

Updates joblib from 1.5.3 to 1.6.0

Changelog

Sourced from joblib's changelog.

Release 1.6.0 - 2026/08/31

• Fix caching of functions whose source cannot be retrieved, such as functions defined in a notebook cell. Their identity fell back to str(hash(func.__code__)), which is salted by PYTHONHASHSEED and so differed between processes. A worker reading the func_code.py written by another one concluded that the function had changed and wiped the whole cache directory for it, discarding results computed by its peers. func_code.py is also no longer rewritten in place, so a reader can no longer catch it half-written and draw the same conclusion. joblib/joblib#1694

• Drop python 3.9 support. The oldest supported Python version is now Python 3.10. joblib/joblib#1773

• Fix eval_expr (used to evaluate the pre_dispatch argument of Parallel) to raise a ValueError as documented instead of leaking a ZeroDivisionError for expressions that divide or take a modulo by zero. joblib/joblib#1810

• MemorizedResult now forwards mmap_mode to its store backend, so a cached array reconstructed from a location is memory-mapped as requested instead of being loaded fully into memory. joblib/joblib#1799

• Unvendor cloudpickle to more quickly benefit from maintenance releases of cloudpickle joblib/joblib#1775

• Fix Memory.cache for functions with a keyword-only argument that has a default declared before a keyword-only argument without a default. joblib/joblib#1731

• Fix behavior of filter_args on some precise cases. joblib/joblib#1800

• Fix a concurrency error that could happen with unordered generator. joblib/joblib#1789

• Fix: dump() now accepts any input os.PathLike object to be consistent with load. joblib/joblib#1812

• The documentation now uses pydata sphinx theme. Furthermore, optional dependencies test and docs have been added to pyproject.toml. joblib/joblib#1774

• Vendor loky 3.6.0

... (truncated)

Commits

• cd9a6b0 Release 1.6.0 (#1844)
• d873f97 MNT vendor loky 3.6.0 (#1843)
• 4ff61af Bump the github-actions group with 4 updates (#1832)
• 804f472 FIX make func_code stable across processes when the source is unavailable (#1...
• 65cc49d TST Restore RNG sequence in hash compatibility test (#1837)
• c1b6541 CI Use pytest-run-parallel on free-threaded build (#1819)
• f6b80d3 MNT Simplify isinstance check in hashing (#1835)
• fa4d5af MNT remove python 3.9 from CI (#1773)
• 53cea7b DOC Update release docs to reflect usage of trusted publishing (#1826)
• 26500e9 Bump the github-actions group across 1 directory with 3 updates (#1790)
• Additional commits viewable in compare view

Updates torch from 2.13.0 to 2.14.0

Release notes

Sourced from torch's releases.

PyTorch 2.14.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Security
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

• torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

  The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

  Before:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="balanced")
  loss = torch.nn.functional.linear_cross_entropy(
      input, linear_weight, target, options=options
  )

  After:

  options = torch.nn.LinearCrossEntropyOptions(acc_policy="compact")
  loss = torch.nn.functional.linear_cross_entropy(

... (truncated)

Commits

• 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
• 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
• 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
• 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
• ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
• 65890f3 Fix docker-release validate job to use the channel matching the pushed image ...
• 1682388 Fix macOS py3.15 wheel builds: pin Cython < 3.3.0 and bump the cp315 numpy pi...
• 9724418 Fix Windows py3.15 builds: constrain Cython < 3.3.0 and bump the cp315 numpy ...
• f1b7554 [MPS] Fix pin_memory() recycling buffers still in use by the GPU (#194662)
• 9f205f7 [MPS] fail loudly on large reductions (#194661)
• Additional commits viewable in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates gevent from 26.5.0 to 26.8.0

Commits

• 4f68410 Preparing release 26.8.0
• 10489c5 Merge pull request #2199 from florentinl/florentin.labelle/fix/hubless-thread...
• d4f5f09 Document the args[0] cross-thread wakeup mechanism
• 9b04991 Run test_cross_thread_callback_can_run_before_scheduling_returns on all backends
• ce7996d Address review comments: document cross-thread race, drop unneeded cpdef
• 5288a6e Add missing @​ignores_leakcheck to new cross-thread test
• c72eda0 Fix cross-thread notifier scheduling race
• 908b937 Merge pull request #2195 from ddorian/fix-popen-exit-reentrant-close
• b58795f Merge pull request #2191 from ddorian/fix-1865-global-shutdown-lock
• ede2e71 Always use 'versionchanged:: NEXT' to let the release machinery fill in the c...
• Additional commits viewable in compare view

Updates python-json-logger from 4.1.0 to 4.2.0

Release notes

Sourced from python-json-logger's releases.

4.2.0

4.2.0 - 2026-08-15

Changed

• Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict. #66
• Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735). #46

Fixed

• $ style formats now support unbraced $name fields, not just ${name}. #18

Thanks @​gaoflow, @​prateek-dagar, @​Sanjays2402

Changelog

Sourced from python-json-logger's changelog.

4.2.0 - 2026-08-15

Changed

• Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict. #66
• Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735). #46

Fixed

• $ style formats now support unbraced $name fields, not just ${name}. #18

Thanks @​gaoflow, @​prateek-dagar, @​Sanjays2402

Commits

• 806dba9 Release 4.2.0
• 010b730 [core] Fixup doc-strings, remove outdated comments
• b865bd3 [core] support unbraced $name fields in $ style formats (#69)
• 23a2c12 test: Add tests for exception notes, exception groups, and exception note gro...
• 355e44f docs: fix spelling typos in docs and core docstrings (#71)
• 0fcfc06 Move development dependencies to dependency-groups (PEP 735) (#70)
• 2557bbc fix: prevent mutation of original dict when record.msg is a dict (#66)
• 3cc30fc Fix tox build failure under PyPy 3.10 by conditionally pinning mypy<2 (#68)
• 01cb83c [docs.security] Fix type on last date
• See full diff in compare view

Updates prometheus-client from 0.25.0 to 0.26.0

Release notes

Sourced from prometheus-client's releases.

v0.26.0

What's Changed

• Expose measured duration on Timer context manager by @​vokracko in prometheus/client_python#1166
• Use specific exception for duplicate timeseries by @​kajinamit in prometheus/client_python#1074
• Make clear() a no-op for label-less metrics (fixes #707) by @​ompathakbaap in prometheus/client_python#1184
• Use object instead of Any for labels() parameters by @​gregoiredx in prometheus/client_python#1186
• Add TLS version parameters for start_wsgi_server by @​vyzigold in prometheus/client_python#1178
• Validate Enum arguments before registering the collector by @​sean-kim05 in prometheus/client_python#1189
• Do not emit a leading zero in floatToGoString exponents >= 10 by @​sean-kim05 in prometheus/client_python#1190
• fix: make test suite pass on Windows and Python 3.12+ by @​MelvinjoseC in prometheus/client_python#1185
• Parse the native histogram sum as a float by @​sean-kim05 in prometheus/client_python#1192
• Remove nameless collectors from the registry on unregister by @​sean-kim05 in prometheus/client_python#1191
• Fix operator precedence allowing exemplars on any metric type by @​sean-kim05 in prometheus/client_python#1188

New Contributors

• @​vokracko made their first contribution in prometheus/client_python#1166
• @​ompathakbaap made their first contribution in prometheus/client_python#1183
• @​gregoiredx made their first contribution in prometheus/client_python#1186
• @​vyzigold made their first contribution in prometheus/client_python#1178
• @​sean-kim05 made their first contribution in prometheus/client_python#1189
• @​MelvinjoseC made their first contribution in prometheus/client_python#1185

Full Changelog: prometheus/client_python@v0.25.0...v0.26.0

Commits

• 9b6b971 Release v0.26.0
• fb072c2 Fix operator precedence allowing exemplars on any metric type (#1188)
• 6e22fb5 Remove nameless collectors from the registry on unregister (#1191)
• 5b09479 Parse the native histogram sum as a float (#1192)
• 769b415 fix: make test suite pass on Windows and Python 3.12+ (#1185)
• d0b497f Update common Prometheus files (#1195)
• 75603d7 Update common Prometheus files (#1194)
• fb2351f Do not emit a leading zero in floatToGoString exponents >= 10 (#1190)
• a39a697 Validate Enum arguments before registering the collector (#1189)
• a96f6f4 Add TLS version parameters for start_wsgi_server (#1178)
• Additional commits viewable in compare view

Updates mypy from 2.2.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.