build(deps): bump the pip group across 2 directories with 4 updates by dependabot[bot] · Pull Request #984 · uktrade/redbox

dependabot · 2026-04-15T20:50:23Z

Bumps the pip group with 1 update in the /notebooks directory: python-multipart.
Bumps the pip group with 4 updates in the /redbox directory: python-multipart, onnx, pillow and pypdf.

Updates python-multipart from 0.0.22 to 0.0.26

Release notes

Sourced from python-multipart's releases.

Version 0.0.26

What's Changed

Skip preamble before first multipart boundary by @Kludex in Kludex/python-multipart#262

Silently discard epilogue data after the closing boundary by @Kludex in Kludex/python-multipart#259

Full Changelog: Kludex/python-multipart@0.0.25...0.0.26

Version 0.0.25

What's Changed

Apply Apache-2.0 properly by @Kludex in Kludex/python-multipart#247

Handle multipart headers case-insensitively by @Kludex in Kludex/python-multipart#252

Emit field_end for trailing bare field names on finalize by @bysiber in Kludex/python-multipart#230

Add UPLOAD_DELETE_TMP to FormParser config by @Kludex in Kludex/python-multipart#254

Remove custom FormParser classes by @Kludex in Kludex/python-multipart#257

Handle CTE values case-insensitively by @Kludex in Kludex/python-multipart#258

Add MIME content type info to File by @jhnstrk in Kludex/python-multipart#143

Full Changelog: Kludex/python-multipart@0.0.24...0.0.25

Version 0.0.24

What's Changed

Validate chunk_size in parse_form() by @Kludex in Kludex/python-multipart#244

Full Changelog: Kludex/python-multipart@0.0.23...0.0.24

Version 0.0.23

What's Changed

Remove unused trust_x_headers parameter and X-File-Name fallback by @jhnstrk in Kludex/python-multipart#196

Return processed length from QuerystringParser._internal_write by @bysiber in Kludex/python-multipart#229

Cleanup metadata dunders from __init__.py by @Chesars in Kludex/python-multipart#227

New Contributors

@Chesars made their first contribution in Kludex/python-multipart#227

@bysiber made their first contribution in Kludex/python-multipart#229

Full Changelog: Kludex/python-multipart@0.0.22...0.0.23

Changelog

Sourced from python-multipart's changelog.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

Remove unused trust_x_headers parameter and X-File-Name fallback #196.

Return processed length from QuerystringParser._internal_write #229.

Cleanup metadata dunders from __init__.py #227.

Commits

28f4785 Version 0.0.26 (#263)
d4452a7 Silently discard epilogue data after the closing boundary (#259)
6a7b76d Skip preamble before first multipart boundary (#262)
4addb60 Version 0.0.25 (#261)
d3a4698 Add MIME content type info to File (#143)
9a1ecbd Handle CTE values case-insensitively (#258)
ef2a0b9 Remove custom FormParser classes (#257)
3a757d7 Ignore local Claude state (#255)
55e7396 fuzz: Add cifuzz (#186)
d6d1d11 Bump the github-actions group with 2 updates (#249)
Additional commits viewable in compare view

Updates python-multipart from 0.0.22 to 0.0.26

Release notes

Sourced from python-multipart's releases.

Version 0.0.26

What's Changed

Skip preamble before first multipart boundary by @Kludex in Kludex/python-multipart#262

Silently discard epilogue data after the closing boundary by @Kludex in Kludex/python-multipart#259

Full Changelog: Kludex/python-multipart@0.0.25...0.0.26

Version 0.0.25

What's Changed

Apply Apache-2.0 properly by @Kludex in Kludex/python-multipart#247

Handle multipart headers case-insensitively by @Kludex in Kludex/python-multipart#252

Emit field_end for trailing bare field names on finalize by @bysiber in Kludex/python-multipart#230

Add UPLOAD_DELETE_TMP to FormParser config by @Kludex in Kludex/python-multipart#254

Remove custom FormParser classes by @Kludex in Kludex/python-multipart#257

Handle CTE values case-insensitively by @Kludex in Kludex/python-multipart#258

Add MIME content type info to File by @jhnstrk in Kludex/python-multipart#143

Full Changelog: Kludex/python-multipart@0.0.24...0.0.25

Version 0.0.24

What's Changed

Validate chunk_size in parse_form() by @Kludex in Kludex/python-multipart#244

Full Changelog: Kludex/python-multipart@0.0.23...0.0.24

Version 0.0.23

What's Changed

Remove unused trust_x_headers parameter and X-File-Name fallback by @jhnstrk in Kludex/python-multipart#196

Return processed length from QuerystringParser._internal_write by @bysiber in Kludex/python-multipart#229

Cleanup metadata dunders from __init__.py by @Chesars in Kludex/python-multipart#227

New Contributors

@Chesars made their first contribution in Kludex/python-multipart#227

@bysiber made their first contribution in Kludex/python-multipart#229

Full Changelog: Kludex/python-multipart@0.0.22...0.0.23

Changelog

Sourced from python-multipart's changelog.

0.0.26 (2026-04-10)

Skip preamble before the first multipart boundary more efficiently #262.

Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

Add MIME content type info to File #143.

Handle CTE values case-insensitively #258.

Remove custom FormParser classes #257.

Add UPLOAD_DELETE_TMP to FormParser config #254.

Emit field_end for trailing bare field names on finalize #230.

Handle multipart headers case-insensitively #252.

Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

Remove unused trust_x_headers parameter and X-File-Name fallback #196.

Return processed length from QuerystringParser._internal_write #229.

Cleanup metadata dunders from __init__.py #227.

Commits

28f4785 Version 0.0.26 (#263)
d4452a7 Silently discard epilogue data after the closing boundary (#259)
6a7b76d Skip preamble before first multipart boundary (#262)
4addb60 Version 0.0.25 (#261)
d3a4698 Add MIME content type info to File (#143)
9a1ecbd Handle CTE values case-insensitively (#258)
ef2a0b9 Remove custom FormParser classes (#257)
3a757d7 Ignore local Claude state (#255)
55e7396 fuzz: Add cifuzz (#186)
d6d1d11 Bump the github-actions group with 2 updates (#249)
Additional commits viewable in compare view

Updates onnx from 1.20.1 to 1.21.0

Release notes

Sourced from onnx's releases.

v1.21.0

ONNX v1.21.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Remove defunct model hub integration by @andife in onnx/onnx#7678

Spec and Operator

Revert opset 25 version bump by @titaiwangms in onnx/onnx#7441

Add 2 bit support to onnx by @vraspar in onnx/onnx#7446

Bump opset version to 26 by @titaiwangms in onnx/onnx#7469

Remove enforcement to node determinism attribute by @titaiwangms in onnx/onnx#7473

Export functions by @cyyever in onnx/onnx#7505

[Reland] Cumulative Product Operator by @titaiwangms in onnx/onnx#7400

Fix Div integer semantics to use trunc division by @MagellaX in onnx/onnx#7585

Clarify DFT behavior when inverse=True and onesided=True (irfft) by @simonbyrne in onnx/onnx#7574

Specify 0/0 case in LpNormalization by @titaiwangms in onnx/onnx#7618

Clarify NonMaxSuppression IoU threshold uses strict comparison by @Copilot in onnx/onnx#7619

Relax model domain requirement from MUST to SHOULD by @Copilot in onnx/onnx#7668

Add BitCast operator for bitwise type reinterpretation by @Copilot in onnx/onnx#7527

Reference Implementation

Fix CenterCropPad: compare target shape with dimension, not axis index by @Copilot in onnx/onnx#7522

Vectorize sigmoid op implementation by @justinchuby in onnx/onnx#7556

Fixing verbose logging error at verbose=3 for reference_evaluator by @rothej in onnx/onnx#7597

Clean up reference evaluator tests by @VedantMadane in onnx/onnx#7684

Utilities and Tools

Add version check for test_executable_permission_check by @andife in onnx/onnx#7511

Fix index out of bounds in version converter adapters by @rothej in onnx/onnx#7493

Fix default attribute values in shape inference by @matteosal in onnx/onnx#7602

Fix Softmax-family shape inference for scalar inputs by @MagellaX in onnx/onnx#7625

Fix/merge models value info by @MagellaX in onnx/onnx#7608

Add version converter adapters for opset 15, 16, 17, 18 by @alexkvitkevich in onnx/onnx#7677

shape_inference: Validate expected size of scalar tensor in ParseData by @skottmckay in onnx/onnx#7675

Build, CI and Tests

Force labels in PRs by @titaiwangms in onnx/onnx#7442

Fix reuse by @andife in onnx/onnx#7463

Change precedence from 'aggregate' to 'override' for generating scripts by @andife in onnx/onnx#7458

a) 3.14-dev -> 3.14, b) reduce template injection thread by @andife in onnx/onnx#7461

Export register functions by @cyyever in onnx/onnx#7496

Fix Python executable detection in virtual environments by @aoguntayo in onnx/onnx#7485

Merged Release Workflows for Windows by @Raghul-M in onnx/onnx#7509

Bump nanobind to 2.10.2 by @cyyever in onnx/onnx#7479

Fix freebsd build by @cyyever in onnx/onnx#7518

Revert ONNX CMake changes by @cyyever in onnx/onnx#7515

Export functions used in PyTorch by @cyyever in onnx/onnx#7524

Export protobuf symbols by @cyyever in onnx/onnx#7525

Fix CMAKE_ARGS parsing for windows compatibility by @hmaarrfk in onnx/onnx#7532

Replace deprecated github action "test-results-action" by @andife in onnx/onnx#7552

Wheels for python 3.14t by @andife in onnx/onnx#7558

Clarify permissions comment and update dependencies install by @andife in onnx/onnx#7577

... (truncated)

Commits

be2b5fd Update VERSION_NUMBER to final release version (#7772)
c751ddb Update VERSION_NUMBER to rc4 (#7759)
866038e [rel-1.21.0] Cherry-pick bug and security fixes for RC4 (#7737, #7751) (#7758)
e6c12c5 update version to rc3 (#7743)
33afebf Cherry pick commit (#7740)
a51ac07 update release to rc2 (#7732)
089fcda fix windows build ; upload (#7727)
fbbe45b Cherry pick commits into the release branch (#7718)
624108e update release branch version to 1.21.0rc1 (#7714)
b65e6e1 [Cherry-Pick] Merge commits from main for security fixes (#7688)
Additional commits viewable in compare view

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates pypdf from 6.9.1 to 6.10.1

Release notes

Sourced from pypdf's releases.

Version 6.10.1, 2026-04-14

What's new

Security (SEC)

Limit the allowed size of xref and object streams (#3733) by @stefan6419846

Robustness (ROB)

Consider strict mode setting for decryption errors (#3731) by @stefan6419846

Documentation (DOC)

Use new parameter names for compress_identical_objects by @stefan6419846

Full Changelog

Version 6.10.0, 2026-04-10

What's new

Security (SEC)

Disallow custom XML entity declarations for XMP metadata (#3724) by @stefan6419846

New Features (ENH)

Skip MD5 key derivation for AES-256 encrypted PDFs (#3694) by @Ygnas

Bug Fixes (BUG)

Use remove_orphans in compress_identical_objects (#3310) by @j-t-1

Fix PdfReadError when xref table contains comments before trailer (#3710) by @rassie

Correctly verify AES padding during decryption (#3699) by @stefan6419846

Fix stale object cache from non-authoritative object streams (#3698) by @astahlman

Fix extract_links pairing when annotations include non-links (#3687) by @ReinerBRO

Documentation (DOC)

Add AI policy (#3717) by @stefan6419846

Full Changelog

Version 6.9.2, 2026-03-23

What's new

Security (SEC)

Avoid infinite loop in read_from_stream for broken files (#3693) by @stefan6419846

Robustness (ROB)

Resolve UnboundLocalError for xobjs in _get_image (#3684) by @Yuki9814

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.10.1, 2026-04-14

Security (SEC)

Limit the allowed size of xref and object streams (#3733)

Robustness (ROB)

Consider strict mode setting for decryption errors (#3731)

Documentation (DOC)

Use new parameter names for compress_identical_objects

Full Changelog

Version 6.10.0, 2026-04-10

Security (SEC)

Disallow custom XML entity declarations for XMP metadata (#3724)

New Features (ENH)

Skip MD5 key derivation for AES-256 encrypted PDFs (#3694)

Bug Fixes (BUG)

Use remove_orphans in compress_identical_objects (#3310)

Fix PdfReadError when xref table contains comments before trailer (#3710)

Correctly verify AES padding during decryption (#3699)

Fix stale object cache from non-authoritative object streams (#3698)

Fix extract_links pairing when annotations include non-links (#3687)

Documentation (DOC)

Add AI policy (#3717)

Full Changelog

Version 6.9.2, 2026-03-23

Security (SEC)

Avoid infinite loop in read_from_stream for broken files (#3693)

Robustness (ROB)

Resolve UnboundLocalError for xobjs in _get_image (#3684)

Full Changelog

Commits

b49e7eb REL: 6.10.1
62338e9 SEC: Limit the allowed size of xref and object streams (#3733)
5dcc0ae DEV: Update pytest-benchmark to 5.2.3
b42e4aa DEV: Update pinned pillow and pytest where possible (#3732)
717446b ROB: Consider strict mode setting for decryption errors (#3731)
9e461d3 DEV: Bump softprops/action-gh-release from 2 to 3 (#3730)
500d09d TST: Update test_embedded_file__basic to use tmp_path fixture (#3726)
1c56302 DOC: Use new parameter names for compress_identical_objects
fd0aeca REL: 6.10.0
b15a374 SEC: Disallow custom XML entity declarations for XMP metadata (#3724)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 1 update in the /notebooks directory: [python-multipart](https://github.com/Kludex/python-multipart). Bumps the pip group with 4 updates in the /redbox directory: [python-multipart](https://github.com/Kludex/python-multipart), [onnx](https://github.com/onnx/onnx), [pillow](https://github.com/python-pillow/Pillow) and [pypdf](https://github.com/py-pdf/pypdf). Updates `python-multipart` from 0.0.22 to 0.0.26 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.26) Updates `python-multipart` from 0.0.22 to 0.0.26 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.22...0.0.26) Updates `onnx` from 1.20.1 to 1.21.0 - [Release notes](https://github.com/onnx/onnx/releases) - [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md) - [Commits](onnx/onnx@v1.20.1...v1.21.0) Updates `pillow` from 12.1.1 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.2.0) Updates `pypdf` from 6.9.1 to 6.10.1 - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.9.1...6.10.1) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.26 dependency-type: indirect dependency-group: pip - dependency-name: python-multipart dependency-version: 0.0.26 dependency-type: indirect dependency-group: pip - dependency-name: onnx dependency-version: 1.21.0 dependency-type: indirect dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: indirect dependency-group: pip - dependency-name: pypdf dependency-version: 6.10.1 dependency-type: indirect dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-15T20:50:41Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)

See the Details below.

OpenSSF Scorecard

Package	Version	Score	Details
pip/python-multipart	0.0.26	Unknown	Unknown
pip/onnx	1.21.0	Unknown	Unknown
pip/pillow	12.2.0	Unknown	Unknown
pip/pypdf	6.10.1	Unknown	Unknown
pip/python-multipart	0.0.26	Unknown	Unknown

Scanned Files

notebooks/poetry.lock
redbox/poetry.lock

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 15, 2026

dependabot Bot requested a review from a team as a code owner April 15, 2026 20:50

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 15, 2026

dependabot Bot mentioned this pull request Apr 15, 2026

build(deps): bump the pip group across 1 directory with 3 updates #983

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the pip group across 2 directories with 4 updates#984

build(deps): bump the pip group across 2 directories with 4 updates#984
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/pip/notebooks/pip-e9ebd8bcf8

dependabot Bot commented on behalf of github Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 15, 2026

Version 0.0.26

What's Changed

Version 0.0.25

What's Changed

Version 0.0.24

What's Changed

Version 0.0.23

What's Changed

New Contributors

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

Version 0.0.26

What's Changed

Version 0.0.25

What's Changed

Version 0.0.24

What's Changed

Version 0.0.23

What's Changed

New Contributors

0.0.26 (2026-04-10)

0.0.25 (2026-04-10)

0.0.24 (2026-04-05)

0.0.23 (2026-04-05)

v1.21.0

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Reference Implementation

Utilities and Tools

Build, CI and Tests

12.2.0

Documentation

Dependencies

Testing

Other changes

Version 6.10.1, 2026-04-14

What's new

Security (SEC)

Robustness (ROB)

Documentation (DOC)

Version 6.10.0, 2026-04-10

What's new

Security (SEC)

New Features (ENH)

Bug Fixes (BUG)

Documentation (DOC)

Version 6.9.2, 2026-03-23

What's new

Security (SEC)

Robustness (ROB)

Version 6.10.1, 2026-04-14

Security (SEC)

Robustness (ROB)

Documentation (DOC)

Version 6.10.0, 2026-04-10

Security (SEC)

New Features (ENH)

Bug Fixes (BUG)

Documentation (DOC)

Version 6.9.2, 2026-03-23

Security (SEC)

Robustness (ROB)

Uh oh!

github-actions Bot commented Apr 15, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!