Skip to content

⬆️ Bump the uv-lock group with 5 updates - #588

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/uv/uv-lock-bf59758709
Open

⬆️ Bump the uv-lock group with 5 updates#588
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/uv/uv-lock-bf59758709

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv-lock group with 5 updates:

Package From To
supervision 0.30.0 0.30.1
inference-models 0.35.3 0.36.0
uv 0.12.5 0.12.7
mkdocs-git-revision-date-localized-plugin 1.5.3 1.5.4
build 1.5.0 1.6.0

Updates supervision from 0.30.0 to 0.30.1

Release notes

Sourced from supervision's releases.

supervision-0.30.1

0.30.1: Numeric-precision and stability fixes

supervision 0.30.1 is a bug-fix patch release. It corrects numeric-precision issues that only surface on specific inputs — large-coordinate oriented boxes (geospatial data, stitched frames), large integer boxes for box_iou, and rotated tracks in DetectionsSmoother — where prior versions could silently return imprecise or self-inconsistent results instead of erroring. It also fixes a duplicate-libavdevice-load crash risk on macOS when both av and opencv-python are installed, plus smaller fixes to list_files_with_extensions and the cv2-free RGBA fallback. No public API was added or removed, and no signature changed — a drop-in upgrade from 0.30.0 for virtually all users. See Migration guide below for the one narrow exception (box_iou on complex-valued coordinates) and for the precision caveats on the numeric fixes.

✨ Spotlights / highlights

1. Oriented-box area/IoU precision fix for large coordinates

sv.Detections.area and sv.oriented_box_iou_batch now translate OBB coordinates to a local origin before floating-point math. Previously, large-coordinate inputs could lose enough precision that a box's IoU with itself collapsed below 1.0.

pair_origin = np.minimum(origin_i, origin_j)
offset_i = (origin_i - pair_origin).astype(np.float32, copy=False)
offset_j = (origin_j - pair_origin).astype(np.float32, copy=False)

2. sv.box_iou no longer overflows on large integer boxes

Area computation now takes coordinate differences before casting to float, avoiding int32 overflow. For realistic coordinate magnitudes, box_iou's scalar result now matches box_iou_batch.

3. Duplicate libavdevice crash fixed on macOS

import supervision no longer loads PyAV's native libraries when the OpenCV backend is active — PyAV is now imported lazily, only where it's used, preventing a duplicate libavdevice warning (and possible crash) when both av and opencv-python are installed.

4. DetectionsSmoother keeps oriented-box corners consistent

Smoothed OBB corners are now aligned (start index + winding) to a reference before averaging, so rotated tracks smooth correctly instead of averaging mismatched corner orderings.

5. sv.get_polygon_center precision fix for large-coordinate polygons

Centroid calculation now translates to the first vertex and computes in float64 before adding the origin back, preventing integer overflow and precision loss for realistic coordinate magnitudes.

🔄 Migration guide

No public signature changed. One item below (box_iou on complex coordinates) does make one specific previously-succeeding call now raise — narrow and deliberate, not classified as breaking since complex-valued box coordinates were never a documented/supported input. The rest only change output values for inputs that were already edge cases:

  • sv.box_iou on complex-valued coordinates: previously silently discarded the imaginary part and returned a real number. Now raises TypeError("box coordinates must be real-valued").
  • OBB precision fixes: results for oriented boxes with large coordinates or rotated tracks may differ slightly from 0.30.0 — the new values are the corrected ones. Re-calibrate any hardcoded IoU/area thresholds tuned against the old (imprecise) output.
  • sv.box_iou / box_iou_batch agreement: for realistic integer coordinate magnitudes (below 2^53), box_iou's scalar result now matches box_iou_batch. Not a universal guarantee — box_iou subtracts before casting to float, box_iou_batch still casts to float64 before subtracting, so the two can diverge at coordinates ≥ 2^53 (~9 quadrillion), far outside any real use case.

📝 Notable changes

🚀 Added

  • RF-DETR example scripts (rfdetr_example.py) added to the count_people_in_zone, heatmap_and_track, speed_estimation, tracking, and traffic_analysis bundled examples. (#2497)

🌱 Changed

  • sv.box_iou now raises TypeError for complex-valued box coordinates instead of silently discarding the imaginary part. (#2485)

... (truncated)

Changelog

Sourced from supervision's changelog.

0.30.1 Aug 24, 2026

Added

  • RF-DETR example scripts (rfdetr_example.py) added to the count_people_in_zone, heatmap_and_track, speed_estimation, tracking, and traffic_analysis bundled examples (#2497).

Changed

  • sv.box_iou now raises TypeError for complex-valued box coordinates instead of silently discarding the imaginary part (#2485).
  • Performance: DetectionsSmoother.update_with_detections now checks active tracker IDs via set membership instead of scanning per tracked object (#2496). No output changes.

Fixed

  • RF-DETR speed estimation now measures elapsed source-frame intervals, including gaps when tracked detections are temporarily missed.
  • sv.get_polygon_center now calculates polygon centroids in translated float64 coordinates, preventing integer overflow and precision loss for realistic-magnitude large-coordinate polygons.
  • sv.Detections.area and sv.oriented_box_iou_batch now translate oriented-box coordinates to local origins before floating-point area/intersection math, preserving differences representable by the input dtype and preventing self-IoU collapse for large-coordinate inputs (e.g. geospatial or stitched frames).
  • sv.Detections.with_nmm now translates oriented-box corners to a local origin with exact integer arithmetic before merging, preventing unsigned-integer wrap-around (e.g. uint16/uint64 coordinates) from corrupting both the merged extent and the winner's orientation angle.
  • DetectionsSmoother now keeps oriented-box corners aligned with smoothed xyxy geometry, including rotated tracks and mixed metadata windows.
  • sv.box_iou now calculates overlap in float64, preventing int32 area overflow for large boxes. For realistic coordinate magnitudes (below 2^53), its scalar result now matches sv.box_iou_batch; box_iou_batch still casts to float64 before subtracting, so the two can diverge above that threshold.
  • sv.list_files_with_extensions no longer includes directories when listing all files without an extension filter.
  • sv.pillow_to_cv2 now accepts RGBA images when the cv2-free fallback backend is active, matching OpenCV by dropping alpha and returning BGR channels.
  • import supervision no longer loads PyAV's native libraries when the OpenCV backend is selected. PyAV is now imported lazily on first use by the PyAV-backed video/audio fallback, preventing a duplicate libavdevice warning (and possible crash) on macOS when both av and opencv-python are installed.
Commits
  • 5f25aa0 releasing 0.30.1
  • 36860d0 fix(detection): overflow-safe OBB corner merge
  • 65ce00d fix(_cv2): lazy-import PyAV to avoid duplicate libavdevice load (#2509)
  • 69b2d61 docs: track only develop on upstream remote (#2501)
  • aec4293 refactor(ci): loop-copy GEO root files in publish-docs workflow (#2508)
  • d23a3e6 docs: convert fenced examples to doctests in annotators/core.py (#2484)
  • f9bd401 test(detection): add the geometry contract test (#2499)
  • 8751782 ⬆️ Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the github-actions group (...
  • 43ddab9 ⬆️ Update wheel requirement from <0.48,>=0.40 to >=0.40,<0.49 (#2506)
  • d0757d2 docs: add RF-DETR examples (#2497)
  • Additional commits viewable in compare view

Updates inference-models from 0.35.3 to 0.36.0

Updates uv from 0.12.5 to 0.12.7

Release notes

Sourced from uv's releases.

0.12.7

Release Notes

Released on 2026-08-27.

Python

  • Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

  • Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

Install uv 0.12.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex"

Download uv 0.12.7

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.7

Released on 2026-08-27.

Python

  • Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

  • Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

0.12.6

Released on 2026-08-25.

Python

  • Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

  • Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
  • Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
  • Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

  • Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
  • Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
  • Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
  • Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

  • Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
  • Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
  • Enable profile-guided optimization for macOS ARM64 release binaries (#21002)

... (truncated)

Commits

Updates mkdocs-git-revision-date-localized-plugin from 1.5.3 to 1.5.4

Release notes

Sourced from mkdocs-git-revision-date-localized-plugin's releases.

v1.5.4

Security

Raises the gitpython floor from >=3.1.44 to >=3.1.59.

Earlier dependabot bumps only touched this repo's uv.lock, which pins the CI environment and nothing else. Downstream users installing from PyPI resolved against pyproject.toml, so they could still land on a GitPython carrying the 2026 option-injection advisories — GHSA-wvpp-8hx9-p66j and GHSA-jm78-9fvv-mhgr among them, all patched by 3.1.58, with further option hardening in 3.1.59.

This plugin never passes user input as git options, so it was not exploitable through those. The floor bump forces the upgrade in environments that already hold an older GitPython, and clears the warnings downstream scanners report.

Thanks to @​nucleus-ffm for reporting it in #222.

Maintenance

  • Harden test git repos against flaky "Error building trees" failures by @​timvink in #212
  • ci: update GitHub Actions to Node 24 compatible versions by @​timvink in #213
  • deps: bump idna and pymdown-extensions to patch security alerts by @​timvink in #214
  • Bump gitpython from 3.1.50 to 3.1.58 in #217, #219, #220
  • Bump pymdown-extensions from 10.21.3 to 11.0.1 in #218, #221

Full Changelog: timvink/mkdocs-git-revision-date-localized-plugin@v1.5.3...v1.5.4

Commits
  • a2313a3 Bump version to 1.5.4
  • b1be777 Bump pymdown-extensions from 11.0 to 11.0.1 (#221)
  • fd6e3b0 Bump gitpython from 3.1.57 to 3.1.58 (#220)
  • 0c308d5 Bump gitpython from 3.1.54 to 3.1.57 (#219)
  • 75279a9 Bump pymdown-extensions from 10.21.3 to 11.0 (#218)
  • 7756fee Bump gitpython from 3.1.50 to 3.1.54 (#217)
  • 0c2e203 deps: bump idna and pymdown-extensions to patch security alerts (#214)
  • aa44586 ci: update GitHub Actions to Node 24 compatible versions (#213)
  • 58eb930 Harden test git repos against flaky 'Error building trees' failures (#212)
  • See full diff in compare view

Updates build from 1.5.0 to 1.6.0

Release notes

Sourced from build's releases.

1.6.0

What's Changed

New Contributors

Full Changelog: pypa/build@1.5.1...1.6.0

1.5.1

What's Changed

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

  • Drain verbose subprocess output inline instead of using a ThreadPoolExecutor, which silently swallowed logging errors - by :user:henryiii (:issue:1098)
  • Reject a file passed as --env-dir with a clear error instead of a raw FileExistsError - by :user:henryiii (:issue:1100)
  • Emit CLI warnings to stderr instead of stdout, so they no longer corrupt --metadata JSON output on stdout - by :user:ymyzk (:issue:1111)
  • Fix the Windows symlink support probe always returning False due to a stale object interpolated into the destination path - by :user:henryiii (:issue:1118)
  • Fix metadata_path's build-backend fallback returning a nonexistent dist-info path for wheels with a build tag - by :user:henryiii (:issue:1119)
  • Write pip/uv requirements and constraints files with \n instead of os.linesep, avoiding doubled \r\r\n line endings on Windows - by :user:henryiii (:issue:1120)
  • Batch of small robustness fixes: correct macOS release parsing for the minimum pip version, avoid sharing the mutable default build-system table between builders, keep the original error when isolated-environment setup fails early, and raise BuildException for an invalid wheel - by :user:henryiii (:issue:1121)
  • Decide color support independently for stdout and stderr instead of only checking stdout.isatty(), so redirecting one stream no longer disables or leaks ANSI colors on the other - by :user:henryiii (:issue:1123)
  • Pass --dependency-constraints-txt files through to the installer unmodified instead of re-parsing them into a deduplicated set of lines, fixing a case where a hashed requirement (e.g. from pip-compile --generate-hashes) could have its --hash continuation line separated from its requirement line and silently dropped, depending on the interpreter's hash seed - by :user:manfred-kaiser (:issue:1140)

... (truncated)

Commits
  • 7ac9efe chore: prepare for 1.6.0
  • e57e2bf 👷 ci: use app token for releases (#1169)
  • 66438ab pre-commit: bump repositories (#1167)
  • 4ed9658 build(deps): bump the github-actions group with 3 updates (#1166)
  • c76707f 🔧 chore: batch dependency updates weekly on Tuesday (#1165)
  • b317437 Drop a few PyPy-specific test skips (#1164)
  • 561f331 pre-commit: bump repositories (#1163)
  • 9456281 refactor: drop redundant exc_info parameter from backend exception wrapper ...
  • 3e7a445 Use stdlib importlib.metadata for typing (#1162)
  • 9a2e1e9 tests: download integration sources once per run (#1157)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆️ Bump the uv-lock group with 5 updates
08c1a66 
Bumps the uv-lock group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [supervision](https://github.com/roboflow/supervision) | `0.30.0` | `0.30.1` |
| inference-models | `0.35.3` | `0.36.0` |
| [uv](https://github.com/astral-sh/uv) | `0.12.5` | `0.12.7` |
| [mkdocs-git-revision-date-localized-plugin](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin) | `1.5.3` | `1.5.4` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.0` |


Updates `supervision` from 0.30.0 to 0.30.1
- [Release notes](https://github.com/roboflow/supervision/releases)
- [Changelog](https://github.com/roboflow/supervision/blob/develop/docs/changelog.md)
- [Commits](roboflow/supervision@0.30.0...0.30.1)

Updates `inference-models` from 0.35.3 to 0.36.0

Updates `uv` from 0.12.5 to 0.12.7
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.5...0.12.7)

Updates `mkdocs-git-revision-date-localized-plugin` from 1.5.3 to 1.5.4
- [Release notes](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/releases)
- [Commits](timvink/mkdocs-git-revision-date-localized-plugin@v1.5.3...v1.5.4)

Updates `build` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.0)

---
updated-dependencies:
- dependency-name: supervision
  dependency-version: 0.30.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-lock
- dependency-name: inference-models
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-lock
- dependency-name: uv
  dependency-version: 0.12.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-lock
- dependency-name: mkdocs-git-revision-date-localized-plugin
  dependency-version: 1.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-lock
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-lock
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from SkalskiP as a code owner August 31, 2026 02:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026
@socket-security

socket-security Bot commented Aug 31, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedinference-models@​0.35.3 ⏵ 0.36.095100100100100
Updatedbuild@​1.5.0 ⏵ 1.6.097100100100100
Updatedsupervision@​0.30.0 ⏵ 0.30.198 +1100100100100
Updateduv@​0.12.5 ⏵ 0.12.7100100100100100
Updatedmkdocs-git-revision-date-localized-plugin@​1.5.3 ⏵ 1.5.4100100100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SkalskiP SkalskiP Awaiting requested review from SkalskiP SkalskiP is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants