[dependabot]

Bumps the pip-sidecar-patch-minor group with 7 updates in the /sidecar directory:

Package	From	To
setuptools	84.1.0	84.2.1
anyio	4.15.1	4.16.0
ctranslate2	4.8.4	4.8.5
filelock	4.2.1	4.2.7
hf-xet	1.7.0	1.8.0
platformdirs	4.13.6	4.14.3
nvidia-cublas-cu12	12.9.2.10	12.9.3.13

Updates setuptools from 84.1.0 to 84.2.1

Changelog

Sourced from setuptools's changelog.

v84.2.1

Bugfixes

• Changed wheel tags and stable-ABI validation to use sysconfig data. (#5360)
• Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when Extension.py_limited_api is enabled. These builds now use their version-specific extension suffix instead of using the unsupported .abi3t suffix. (#5363)

Improved Documentation

• Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (#1929)

v84.2.0

Features

• Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
• Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

• Use target sysconfig data for stable-ABI extension filenames. (#5351)

Commits

• 3895f98 Bump version: 84.2.0 → 84.2.1
• 7c5cb7a Merge pull request #5362 from jameshilliard/fix/abi3t-target-config
• 00595bf Use sysconfig data for wheel tags and stable-ABI validation
• 873b29c Merge pull request #5363 from ngoldbaum/fix-3.14t
• d8bc01b Merge pull request #5330 from Topgearfanboy/main
• e27271e Apply review comments from @​jameshillard
• aa98f85 add newsfragment
• 3301fa6 Avoid .abi3t extension suffixes on Python 3.13t and 3.14t
• 301e27a Bump version: 84.1.0 → 84.2.0
• 39a7c2e Merge pull request #5193 from ngoldbaum/abi3.abi3t
• Additional commits viewable in compare view

Updates anyio from 4.15.1 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
• Additional commits viewable in compare view

Updates ctranslate2 from 4.8.4 to 4.8.5

Release notes

Sourced from ctranslate2's releases.

v4.8.5

New features

• Cache Drama 3 prompt prefixes with LRU eviction, cache controls, and hit/miss diagnostics (#2133, #2144) by @​jordimas
• Add native CPU reference-audio encoding for Drama 3 voice cloning (#2141) by @​jordimas

Fixes and improvements

• Preserve FP32 attention scores through softmax to fix CUDA alignment precision with FP16 and BF16 models (#2143) by @​jordimas
• Improve Drama 3 prefill performance by increasing the default chunk size from 16 to 128, and fuse gated-delta projections during GPU decoding (#2133) by @​jordimas
• Fix caching allocator shutdown crashes when the allocating thread exits (#2136) by @​jordimas
• Fix FP16 overflow in CUDA attention score accumulation (#2131) by @​jordimas
• Fix the eole converter scale for relative position keys (#2138) by @​maksimcialehin
• Add a Windows ROCm/HIP build guide and document AMD GPU support (#2041) by T0nd3 and @​jordimas
• Add CUDA build instructions for NVIDIA Jetson devices (#2019) by @​vimalk78

Changelog

Sourced from ctranslate2's changelog.

v4.8.5 (2026-11-02)

New features

• Cache Drama 3 prompt prefixes with LRU eviction, cache controls, and hit/miss diagnostics (#2133, #2144) by @​jordimas
• Add native CPU reference-audio encoding for Drama 3 voice cloning (#2141) by @​jordimas

Fixes and improvements

• Preserve FP32 attention scores through softmax to fix CUDA alignment precision with FP16 and BF16 models (#2143) by @​jordimas
• Improve Drama 3 prefill performance by increasing the default chunk size from 16 to 128, and fuse gated-delta projections during GPU decoding (#2133) by @​jordimas
• Fix caching allocator shutdown crashes when the allocating thread exits (#2136) by @​jordimas
• Fix FP16 overflow in CUDA attention score accumulation (#2131) by @​jordimas
• Fix the eole converter scale for relative position keys (#2138) by @​maksimcialehin
• Add a Windows ROCm/HIP build guide and document AMD GPU support (#2041) by T0nd3 and @​jordimas
• Add CUDA build instructions for NVIDIA Jetson devices (#2019) by @​vimalk78

Commits

• 7f59ae1 Bump version to 4.8.5 (#2139)
• aa5dc02 Bound Drama3 prefix cache and align default settings (#2144)
• e073f63 Preserve FP32 attention scores through softmax for CUDA alignments (#2143)
• 7f745e2 Add native Drama 3 reference audio encoding for voice cloning (#2141)
• 78b1e17 Drama 3: cache prompt prefixes and optimize prefill and GPU decoding (#2133)
• bd09fa7 Fix caching allocator shutdown segfaults (#2136)
• cdadde1 fix: eole relative position key scale (#2138)
• c512364 docs: add Windows ROCm/HIP build guide (#2041)
• d5dedb7 docs: add build instructions for NVIDIA Jetson (aarch64 + CUDA) (#2019)
• 131d20b Fix FP16 overflow in CUDA attention score accumulation (#2131)
• See full diff in compare view

Updates filelock from 4.2.1 to 4.2.7

Release notes

Sourced from filelock's releases.

4.2.7

Bug fixes

• A SoftFileLease reclaims a dead holder's lease marker even when that holder published another lease_duration. It used to raise LeaseSettingsMismatch on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until force_break(). A live holder with another duration still raises (#900) by @​dxbjavid and @​gaborbernat.

PyPI release

Full Changelog

4.2.6

Bug fixes

• Fix a race in SoftFileLock, MarkerSoftFileLock and SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (#899) by @​dxbjavid and @​gaborbernat.

PyPI release

Full Changelog

4.2.5

Bug fixes

• acquire and acquire raise TypeError for a blocking that is not a bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (#870) by @​simpleqt and @​gaborbernat.
• A SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (#869) by @​simpleqt and @​gaborbernat.
• A fork() child of a process holding a SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so token and compromise reported a claim the child never held while is_locked reported it unheld (#868) by @​dxbjavid and @​gaborbernat.
• A nested acquire of a held FileLock or SoftFileLock no longer creates the lock file's parent directory. After a rename of that directory during the hold, the nested acquire recreated the old name, and when a file had taken the name it raised FileExistsError and left the hold's recursion count incremented (#878) by @​0x5t4l1n and @​gaborbernat.
• Fix ReadWriteLock failing every acquire with "link directory ... was replaced while opening" in a group-writable directory whose inherited ACL, such as an NFSv4 one on ZFS, opens the link directory to the group. The lock now closes the empty link directory to its owner, and where the filesystem refuses that, such as ZFS with aclmode=restricted, it names the directory to make writable by its owner only (#898) by @​gaborbernat.
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease raising OverflowError out of acquire(), or never reclaiming a dead holder's lock, when a stranded restore claim beside the lock names a process number outside 1..2**31-1 or spells it in non-ASCII digits. Such a claim is now ignored, as no filelock writes one (#871) by @​dxbjavid and @​gaborbernat.
• Fix soft locks on Windows keeping the marker of a holder that has exited while another process still holds a handle to it, such as a parent's subprocess.Popen after wait() or multiprocessing.Process after join(). Acquiring such a lock with the default timeout=-1 waited forever (#874) by @​nk-batman21.
• Fix the read-only reopen of a lock file this account cannot write resolving a relative path against the working directory of the moment. A chdir between the refused O_RDWR open and the reopen made the acquisition wait on a file that is not there, or probe one in another directory. The reopen now uses the path the acquisition pinned (#889) by @​dxbjavid and @​gaborbernat.
• Handle EMLINK, the error FreeBSD reports when a no-follow open refuses a symlink, in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership there rather than a transient refresh error (#866) by @​pacocartones and @​gaborbernat.
• Resolving ReadWriteLock or AsyncReadWriteLock raises the ImportError when a module other than Python's sqlite3 is missing, as in a frozen application that left out a filelock submodule. The names are None only without SQLite (#880) by @​pintu544 and @​gaborbernat.

Documentation

• The lock-probing recipe in the how-to guide probes with blocking=False instead of a tiny timeout (#873) by @​tongwentao and @​gaborbernat.

Packaging

• Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (#885) by @​gaborbernat.

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-9:

---

4.2.9 (2026-11-04)

---

.. _release-4-2-9-fixed:

Fixed

• :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

---

4.2.8 (2026-11-04)

---

.. _release-4-2-8-documentation:

Documentation

• Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (:pr:905) by :user:boyfeiyu.

.. _release-4-2-7:

---

4.2.7 (2026-11-02)

---

.. _release-4-2-7-fixed:

Fixed

... (truncated)

Commits

• 5fd486b release 4.2.7
• ff84735 🐛 fix(lease): reclaim dead holders after duration changes (#900)
• f71acb1 release 4.2.6
• 77eb01a 🐛 fix(soft): restore raced stale markers (#899)
• b0cc007 release 4.2.5
• 21bc250 🐛 fix(rw): close a link directory an ACL opened (#898)
• 715a8de 📝 docs(security): add a threat model and align the policy (#896)
• b0f1b73 🧪 test: tolerate a preloaded sqlite3 (#894)
• a2e26ac 🧪 test: count descriptors behind an incomplete /dev/fd (#877)
• 160141c 🐛 fix(import): raise for a missing read-write module (#880)
• Additional commits viewable in compare view

Updates hf-xet from 1.7.0 to 1.8.0

Release notes

Sourced from hf-xet's releases.

[hf-xet v1.8.0]: Direct-to-S3 xorb uploads (experimental)

✨ New Features

• Experimental direct-to-S3 xorb uploads: xorbs are uploaded straight to S3 through short-lived upload grants issued by CAS, which validates each xorb before storing it. The server is enabling this gradually; other uploads use the existing path (by @​assafvayner in #1004 #1005 #1008 #1029)
  • Firewall note: allow s3.us-east-1.amazonaws.com (and s3.eu-west-3.amazonaws.com for repos stored in the EU). If S3 can't be reached, uploads fall back to the existing path.
  • Set HF_XET_CLIENT_LEGACY_DIRECT_XORB_UPLOAD=1 to always use the existing path.

🐛 Bug Fixes

• Downloads no longer request reconstruction information past the end of the file if file size is known ahead (by @​seanses in #995)
• Fix a partially written file being published after a write error (by @​k1nkreet in #1067) - 1st contribution, thanks!

Full Changelog: huggingface/xet-core@v1.7.1...v1.8.0

[hf-xet v1.7.1]: Improved dedupe in long upload session

Improvements and bug fixes

• Fix a bug that dedup silently stops once the in-memory chunk index reaches size limit, this bug previously lead a long upload session by MicroAGI to slowdown dramatically.
• Fix a bug that commit and download-group construction errors, such as a token-refresh 403 (bad CAS token refresh URL or providing a HF_TOKEN with nonmatching access), cause all subsequent group constructions to fail.
• Respect HF_XET_MIN_SPACING_BETWEEN_GLOBAL_DEDUP_QUERIES (aliased as HF_XET_DATA_MIN_SPACING_BETWEEN_GLOBAL_DEDUP_QUERIES) that controls minimum number of chunks to wait for between generating global dedup queries.
• Simulation and comment fixes, dependency bumps.

Full Changelog: huggingface/xet-core@v1.7.0...v1.7.1

Commits

• e551f0a Bump hf-xet Python library to 1.8.0 (#1072)
• de9e317 chore: bump crate versions to 1.8.0 (#1071)
• 5c18c78 Fix SafeFileCreator can publish incomplete files on drop (#1058) (#1067)
• 40cea44 File reconstruction uses the file size if available to determine request rang...
• 0e0f7ce Record xorb uploads per upload path in upload telemetry (#1029)
• b82465d Upload xorbs through upload grants with fallback (#1008)
• 3f7a81e Add xorb upload commit and local server grant flow (#1005)
• 7f1c0d0 Add xorb upload grant request and grant URL upload (#1004)
• f466508 Bump hf-xet python to 1.7.1 (#1070)
• 7f9644b chore: bump crate versions to 1.7.1 (#1069)
• Additional commits viewable in compare view

Updates platformdirs from 4.13.6 to 4.14.3

Release notes

Sourced from platformdirs's releases.

4.14.3

Bug fixes

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @​mikegit123git and @​gaborbernat.

New Contributors

• @​mikegit123git made their first contribution in tox-dev/platformdirs#679

PyPI release

Full Changelog

4.14.2

Bug fixes

• Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @​AlvaroBalbin and @​gaborbernat.

New Contributors

• @​AlvaroBalbin made their first contribution in tox-dev/platformdirs#677

PyPI release

Full Changelog

4.14.0

Features

• Accept a keyword-only ensure_exists in the module-level media directory functions, such as user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (#656) by @​darrenhuai and @​gaborbernat.

Bug fixes

• Return the media and fonts directories under root's home for root with use_site_for_root, ignoring the invoking user's XDG_*_DIR, user-dirs.dirs and XDG_DATA_HOME, and create no inherited media directory under ensure_exists (#661) by @​gaborbernat.
• Raise ValueError from site_data_dir and site_config_dir under multipath=True when appname or version contains os.pathsep, rather than returning a string that splits into a directory outside the site base (#662) by @​gaborbernat.
• Parse an unquoted user-dirs.dirs value with a long run of blanks in linear time, rather than in time quadratic in the run's length on every Unix media directory lookup (#663) by @​gaborbernat.
• Treat a relative HOME as unset on Unix, macOS and iOS, taking the home from the password database or raising RuntimeError, rather than resolving user directories against the working directory (#664) by @​gaborbernat.
• Refuse a symlink as XDG_RUNTIME_DIR in user_runtime_dir when the value ends with / or /., which made the check follow the link (#665) by @​gaborbernat.
• Redirect user_*_dir calls with use_site_for_root=True when the effective uid is 0, so a setuid-root process gets the site directories, and name and check the runtime directory by the effective uid (#666) by @​gaborbernat.
• Apply the XDG_RUNTIME_DIR check of the Unix user_runtime_dir to the macOS one, so it no longer uses a directory that is a symlink, owned by another user or not mode 0700 (#667) by @​gaborbernat.
• Reject an XDG_RUNTIME_DIR below a parent that another user can replace, such as their own entry in /tmp, instead of creating the runtime directory through it (#668) by @​gaborbernat.
• Stop accepting a Unix runtime directory that another user creates between the owner check and its use: ensure_exists and place_runtime_file create it before checking it, and find_runtime_file checks it again after a hit (#669) by @​gaborbernat.

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

---

4.14.5 (2026-11-04)

---

.. _release-4-14-5-fixed:

Fixed

• Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

---

4.14.4 (2026-11-04)

---

.. _release-4-14-3:

---

4.14.3 (2026-11-01)

---

.. _release-4-14-3-fixed:

Fixed

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

---

4.14.2 (2026-10-31)

---

.. _release-4-14-2-fixed:

... (truncated)

Commits

• 099c969 release 4.14.3
• 7fbe87d 🐛 fix(xdg): preserve whitespace in paths (#679)
• 1d34ad1 release 4.14.2
• 3b870de 🐛 fix(xdg): deduplicate directory spellings (#677)
• 17c6932 release 4.14.1
• d7abc29 fix: restore Pyodide imports without an effective user ID (#676)
• c40ff0b release 4.14.0
• 18620ed 🐛 fix(unix): check XDG_RUNTIME_DIR parents (#668)
• 3a5e7d0 🐛 fix(api): raise when a media dir is a file (#672)
• 790ff18 🐛 fix(unix): decide root redirect by effective uid (#666)
• Additional commits viewable in compare view

Updates nvidia-cublas-cu12 from 12.9.2.10 to 12.9.3.13

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: area:ci, type:chore. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T21:39:23.015302Z	c60458e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c60458ef80

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the exact-pin assertions with these runtime bumps

When the blocking gate-tests-coverage pytest step in .github/workflows/quality.yml:128-134 runs, TestShippedRequirementFiles.test_sidecar_file_parses_with_expected_pins still expects ctranslate2==4.8.4 and nvidia-cublas-cu12==12.9.2.10 at sidecar/tests/test_runtime_setup.py:70,100; this manifest now supplies 4.8.5 and 12.9.3.13, so the test fails on the first assertion (and then the second after that is corrected). Update both exact-pin guards as part of the dependency verification.

AGENTS.md reference: AGENTS.md:L3-L4

Useful? React with 👍 / 👎.