[dependabot]

Bumps the python group with 7 updates in the /global-images/datascience directory:

Package	From	To
pandas	3.0.4	3.0.5
numpy	2.5.0	2.5.3
scipy	1.18.0	1.18.1
scikit-learn	1.9.0	1.9.1
plotly	6.8.0	7.0.0
transformers	5.12.1	5.17.0
matplotlib	3.11.0	3.11.2

Bumps the python group with 1 update in the /scripts/init-realm directory: python-keycloak.

Updates pandas from 3.0.4 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• See full diff in compare view

Updates numpy from 2.5.0 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

• Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

  (gh-32296)

• MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

  (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Charles Harris
• Iason Krommydas
• James Davies +
• Joren Hammudoglu
• Maanas Arora
• Matti Picus
• Nathan Goldbaum
• Shikhar Goel +
• Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

• #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits

• dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
• edcac6a REL: Prepare for the NumPy 2.5.3 release
• fd4d908 Merge pull request #32509 from charris/backport-32496
• 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
• 294956e Merge pull request #32506 from charris/backport-32503
• 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
• 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
• 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
• 8972f70 Merge pull request #32478 from charris/backport-32466
• ab1b589 Merge pull request #32477 from charris/backport-32423
• Additional commits viewable in compare view

Updates scipy from 1.18.0 to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

• Name (commits)
• Wasim Akram (2) +
• Jake Bowhay (1)
• Michael Bratsch (1)
• Dietrich Brunn (1)
• Evgeni Burovski (1)
• Aadya Chinubhai (1)
• Lucas Colley (3)
• Tekin Ertekin (1) +
• Fuyugithub (2) +
• Ralf Gommers (11)
• Joren Hammudoglu (1)
• Ijtihed Kilani (1) +
• Andrew Nelson (2)
• Ilhan Polat (1)
• Tyler Reddy (39)
• romao05 (1) +
• Michael Simacek (1) +
• Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits

• e4e854e REL: SciPy 1.18.1 rel commit
• 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
• 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
• 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
• a717e28 DOC: PR 25884 revisions
• bb489c0 DOC: PR 25884 revisions
• 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
• 095fe56 DOC, BLD: PR 25884 revisions
• e66ea64 DOC: update minimum GCC version in toolchain roadmap
• c021653 TST: tolerance bumps and skips on 32-bit platforms
• Additional commits viewable in compare view

Updates scikit-learn from 1.9.0 to 1.9.1

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.1

We're happy to announce the 1.9.1 release.

This release contains a few bug fixes and is the first version supporting Python 3.15.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.9.html#version-1-9-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Thanks to everyone who contributed to this release !

Commits

• 866c0f5 generate changelog
• 12f135f update upper bounds
• 43ff2f2 bump version
• b851524 DOC Mark dev index as orphan (#34916)
• 01d56d4 DOC Fix wikipedia principal eigenvector example references (#34915)
• b86a1e2 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
• d282698 🔒 🤖 CI Update lock files for main CI build(s) 🔒 🤖 (#34897)
• eb34279 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
• 7581303 FIX: Fix QuantileTransformer(ignore_implicit_zeros=True) sub-sampling behav...
• ac47f4d FIX: avoid EfficiencyWarning in OPTICS with metric='precomputed' (#34692)
• Additional commits viewable in compare view

Updates plotly from 6.8.0 to 7.0.0

Release notes

Sourced from plotly's releases.

v7.0.0

Fixed

• Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
• Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
• Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
• Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
• Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!

Removed

• Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
• Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
• Remove support for Orca for static image generation [#5677]
• Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]

Updated

• Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:
  • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
  • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
  • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
    • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
  • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
  • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:
    • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
    • hsv() color strings are no longer supported
    • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
    • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
  • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
  • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
  • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
  • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

v7.0.0rc0

Removed

• Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
• Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
• Remove support for Orca for static image generation [#5677]
• Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]

Fixed

• Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!

Updated

• Update plotly.js from version 3.6.0 to version 4.0.0-rc.0 [#5673]. This is a major-version release candidate with many changes. See the plotly.js release notes for the full list. The most significant changes include:
  • Add quiver trace type to visualize vector fields using arrows [#7710], with thanks to @​degzhaus for the contribution!
  • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
  • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
    • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
  • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
  • Switch color processing library from TinyColor to color [#7536]. There are some changes to supported color string formats as a result:
    • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported

... (truncated)

Changelog

Sourced from plotly's changelog.

[7.0.0] - 2026-08-25

Fixed

• Fix hex_to_rgb parsing of 3-digit shorthand hexadecimal colors such as #FFF [#5662], with thanks to @​genrichez for the contribution!
• Improve px.*_map() auto-fitting behavior when zoom and center are not specified [#5686]
• Add <!doctype html> to the to_html() template to comply with modern web standards [#5693], with thanks to @​mishrakushal for the contribution!
• Apply histfunc/z aggregation to marginal_x/marginal_y="histogram" subplots in density_heatmap/density_contour, instead of always showing raw bin counts [#3521], with thanks to @​lucasjamar for the contribution!
• Fix mpl_to_plotly silently dropping matplotlib path collections in data coordinates (such as violin plots, pcolor, event plots, stack plots, fill_between, and stem plots) by rendering them as filled polygons or lines [#5702], with thanks to @​robertoffmoura for the contribution!

Updated

• Update plotly.js from version 3.6.0 to version 4.0.0 [#5673]. This is a major-version release with many changes. See the plotly.js release notes for the full list. The most significant changes include:
  • Add quiver trace type to visualize vector fields using arrows [#7710, #7945]
  • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
  • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
    • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
  • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
  • Switch color processing library from TinyColor to culori [#7536, #7962]. There are some changes to supported color string formats as a result:
    • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
    • hsv() color strings are no longer supported
    • Strings with invalid syntax such as hsl(120, 50% 50%) are no longer supported
    • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0 0% 0%)', lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
  • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
  • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
  • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
  • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

[7.0.0rc0] - 2026-07-29

Removed

• Remove the deprecated Figure Factory functions create_2d_density, create_annotated_heatmap, create_bullet, create_candlestick, create_choropleth, create_distplot, create_facet_grid, create_gantt, create_hexbin_mapbox, create_ohlc, create_scatterplotmatrix, and create_violin [#5627]
• Remove support for Kaleido versions less than v1.0.0 for static image generation [#5677]
• Remove support for Orca for static image generation [#5677]
• Remove engine argument from functions fig.write_image(),fig.to_image(), pio.write_image(), pio.write_images(), pio.to_image(), pio.full_figure_for_development(), and from renderer constructors [#5677]

Updated

• Update plotly.js from version 3.6.0 to version 4.0.0-rc.0 [#5673]. This is a major-version release candidate with many changes. See the plotly.js release notes for the full list. The most significant changes include:
  • Add quiver trace type to visualize vector fields using arrows [#7710]
  • Add "Share Chart" modebar button for generating a chart-sharing link via Plotly Cloud [#7909]
  • Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#7860]. Use the equivalent *map traces instead.
    • The corresponding graph_objects and Plotly Express functions have also been removed in plotly.py; use the map versions instead
  • Drop support for MathJax v2, and add support for v4 [#7898]. MathJax is the JavaScript library used for rendering mathematical equations in plotly charts.
  • Switch color processing library from TinyColor to color [#7536]. There are some changes to supported color string formats as a result:
    • rgb()/rgba() strings with decimal 0–1 fractions are no longer supported
    • hsv() color strings are no longer supported
    • New supported formats: '#ff0000aa', '#f00a', 'rgb(255 0 0)', 'rgba(255 0 0 / 0.5)', 'hsl(0 100% 50% / 0.5)', 'hsla(0, 100%, 50%, 0.5)', 'hwb(0, 0%, 0%)'
  • Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#7856]. Most country names are handled exactly the same; a small number of legacy entries have been removed.
  • Change layout.geo.fitbounds default from false to 'locations' [#7895]. geo subplots will now auto-fit the initial view to the trace data by default.
  • Dynamically compute center and zoom values for scattermap and densitymap traces. The initial map view will now auto-fit to the trace data by default. Add layout.map.fitbounds attribute (default 'locations') to enable or disable auto-fitting behavior [#7884, #7913]
  • Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#7891]

... (truncated)

Commits

• 73c4745 version changes for v7.0.0
• c58eb29 Merge pull request #5712 from plotly/v7.0
• 45ecea4 Merge pull request #5711 from plotly/bump-plotlyjs-v4.0.0
• 6bd0b40 update changelog
• 860b4f7 Apply suggestion from @​camdecoster
• f50f9ff update changelog
• 367886b change plotly.js master references to main
• bb7d2de update color validator for new color formats
• 11338e1 update plotly.js to v4.0.0 and re-run codegen and js builds
• 939cd69 Merge branch 'main' into v7.0
• Additional commits viewable in compare view

Updates transformers from 5.12.1 to 5.17.0

Release notes

Sourced from transformers's releases.

Release 5.17.0

Release v5.17.0

New Model additions

HYV4

Hy4-Preview is a 780B-parameter mixture-of-experts language model that activates 49B parameters per token. Each MoE layer holds 256 routed experts plus one always-active shared expert and routes every token to 8 of them. The context window is 1M tokens.

The architecture combines four features:

• Multi-head Latent Attention (MLA) compresses keys and values into a low-rank latent (kv_lora_rank) that kv_b_proj expands back to one key/value per query head.
• DeepSeek Sparse Attention (DSA) selects index_topk keys per query with a lightweight indexer. Following IndexShare, only the layers marked "full" in indexer_types run an indexer; "shared" layers reuse the previous full layer's selection.
• Gated MLA with learnable attention sinks, where each head owns a sink logit that participates in the softmax and contributes no value, as in GPT-OSS.
• Independent Hyper-Connections (iHC) replace the plain residual path with hc_mult parallel residual streams that are collapsed before, and redistributed after, every sublayer.

The implementation does not execute the multi-token prediction (MTP) layers. Released checkpoints keep those weights so that other runtimes can use them for speculative decoding; they are ignored at load time.

Links: Documentation

• Add h4 (#48473) by @​ArthurZucker in #48473

VibeVoice

VibeVoice is a novel framework for synthesizing high-fidelity, long-form speech with multiple speakers by employing a next-token diffusion approach within a Large Language Model (LLM) structure. It's designed to capture the authentic conversational "vibe" and is particularly suited for generating audio content like podcasts and multi-participant audiobooks.

Links: Documentation

• Implement VibeVoice (#40546) by @​pengzhiliang in #40546

NeoMME

NeoMME is a family of efficient 260M and 800M parameter multimodal-native multilingual foundation encoders from H Company. It processes multilingual text tokens and raw image patches in a single bidirectional Transformer encoder, without a separately pretrained vision tower or causal language model.

NeoMME-Retriever is a model fine-tuned from the NeoMME backbone for visual document retrieval with joint late-interaction and dense objectives. It takes text queries and documents (text or page screenshots) and produces multi-vector embeddings for MeanMaxSim scoring (late-interaction) and mean-pooled embeddings for cosine similarity (dense).

Links: Documentation

... (truncated)

Commits

• 856157a v5.17.0
• 5b7dcb0 MRoPE continued (#48594)
• 50bbcc6 [fix] Update stale expected strings in HunYuanVL integration tests (#48646)
• e8bcd79 [Quantizaiton]support 5/6/7 bits in AutoRound (#48481)
• 3283d5f [fix] Update stale golden values and fix expected_logits shape in FlavaForPre...
• 5f47b5a [tests] Fix integration test golden values broken by fast image processor def...
• fc50134 Add Fun-ASR-Nano model (#46180)
• d9fe823 Fix YOLOS device mismatch with device_map="auto" (#46886)
• cbc1651 [Generate] Avoid unconditionally downloading remote hub file (#48620)
• bd05a4b Honor shift_labels in decoder-only LLM/VLM losses (#48493)
• Additional commits viewable in compare view

Updates matplotlib from 3.11.0 to 3.11.2

Release notes

Sourced from matplotlib's releases.

REL: v3.11.2

This is the second bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Speed up RGBA-stage image resampling
• Fix hexbin clipping in PDF output
• Fix \text with internal braces
• Fix some crashes and make some checks more robust to unlikely cases
• Fix frame skew when saving GIF animations with PillowWriter
• Fix HiDPI handling in Qt toolbar and WebAgg embeddings
• Fix ResizeEvent handling for TextBox
• Fix bug with PGF hatch linewidth and color
• Fix a bug with drawing an empty Collection
• Fix incorrect glyphs in Cairo backends
• Improve build system to prevent conflicts between wheels and system libraries

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Fix tight layout of multiple subplots with sharey=True
• Fix NoNorm cursor formatting for uint8 images
• Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
• Fix clipped Axis labels on 3D plots with tight layout
• Fix inverted Axis on 3D plots
• Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
• Fix missing glyphs when subsetting Type 1 fonts in PDF
• Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits

• d3ca917 REL: v3.11.2
• b76fea9 DOC: Set current version to 3.11.2
• 39c7f06 DOC: Prepare GitHub stats for 3.11.2
• 5dd13e3 Merge branch 'v3.11.1-doc' into release-3.11.2
• aa484be Merge branch 'v3.11.0-doc' into v3.11.1-doc
• 0e10f83 Merge pull request #32330 from meeseeksmachine/auto-backport-of-pr-32324-on-v...
• ebe947b Backport PR #32324: Don't force any diagnostics to be errors in bundled Harfbuzz
• 8f4b7c5 Merge pull request #32322 from meeseeksmachine/auto-backport-of-pr-32321-on-v...
• 93278ad Backport PR #32321: DOC: correct note about PyOS_InputHook
• b0aee78 Merge pull request #32319 from meeseeksmachine/auto-backport-of-pr-32305-on-v...
• Additional commits viewable in compare view

Updates python-keycloak from 5.8.0 to 7.1.1

Changelog

Sourced from python-keycloak's changelog.

v7.1.1 (2026-02-15)

Fix

• uma: set requested resource ids correctly in permission ticket creation (#702)

v7.1.0 (2026-02-13)

Feat

• decode token with all keys, added get client certificate info method (#704)

v7.0.3 (2026-01-28)

Fix

• do not throw when processing signed userinfo response (#699)

v7.0.2 (2026-01-08)

Fix

• Fix/python version and ci (#691)

v7.0.1 (2026-01-05)

Fix

• python version

v7.0.0 (2026-01-04)

BREAKING CHANGE

• this change introduces a very strong typing across the library. From now on, we demand that each method returns a single type and converts the results into the specified return type, otherwise it raises a TypeError exception. This should resolve any type checking linter errors within the library as well.

Fix

• updated lockfile
• pass along the default connection manager configuration into uma
• dont override transport for httpx
• pass query params in get groups
• removed async property as a dependency
• strong and consistent typing across the library

v6.0.0 (2025-12-28)

BREAKING CHANGE

• changes the behavior of get_group_by_path to raise an exception in case the path is not found, which is now the definitive new behavior

... (truncated)

Commits

• de25a9c fix(uma): set requested resource ids correctly in permission ticket creation ...
• 9720e2d docs: changelog update
• 98b9b24 feat: decode token with all keys, added get client certificate info method (#...
• f5333a0 docs: changelog update
• ce07157 fix: do not throw when processing signed userinfo response (#699)
• 6580ac6 chore: updated deps
• 2f6beb3 chore(typehints): fixup typehints for role parameter for add composites (#697)
• 7e8184d chore: typehints (#696)
• 5e3ee8d docs: changelog update
• 8eca957 fix: Fix/python version and ci (#691)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

/deploy

[RenkuBot]

You can access the deployment of this PR at https://ci-renku-4614.dev.renku.ch