[dependabot]

Bumps the python-dependencies group with 5 updates in the /services/mujoco-web directory:

Package	From	To
fastapi	0.141.1	0.162.0
uvicorn	0.52.4	0.54.0
mujoco	3.13.0	3.17.0
pillow	12.3.0	13.0.0
numpy	2.5.3	2.5.4

Updates fastapi from 0.141.1 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

... (truncated)

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

Updates mujoco from 3.13.0 to 3.17.0

Release notes

Sourced from mujoco's releases.

3.17.0

Version 3.17.0 (October 22, 2026)

Significant new features

1. c00ed8153 Added a batch API in mujoco/mjbatch.h (in Python as mujoco.batch): many simulations of one model stepped on a thread pool of its own, each held as its integration state and loaded into an mjData for each call, so memory scales with threads and results are bit-identical to a plain loop at any thread count. It supports per-simulation model and option fields or models of the caller's, observations of the state after a step, recorded trajectories, persistent simulations (required for sleep), and arbitrary per-simulation functions. Follows the design of mjbatch by @​kevinzakka.

Engine

2. Flex improvements:

   • 94483e166 Added bending elasticity for 1D flexes, using a twist-free isotropic discrete elastic rod model. The cross-section is selected with the new section attribute: a circle of the flex radius, or a box with half-sizes sectionsize that uses the stiffness of its weak axis. It is enabled by a positive young modulus, requires a straight reference configuration (curved initial poses can be set with qpos or keyframes), is compatible with edge equality constraints, and is integrated implicitly by the discrete integrator. Previously young was ignored for 1D flexes: existing models that set it now bend, and fail to compile if the cross-section is degenerate (zero radius with the default circle section), if a vertex joins a zero-length edge, or if the rod is not straight.

   • 36d0df9a5, 897e3fcb1 Interpolated flexes (trilinear or quadratic dofs) now support self-collision, excluding elements in the same or neighboring cells.

   • 39dd10f2d The default arena memory for flex models is now much smaller, sized from the flex mesh topology instead of nv^2. If the Newton solver runs out of arena memory it falls back to CG with a warning.

3. mj_setConst now computes only quantities derived from other fields of mjModel, while the compiler alone resolves spec-level conventions:

   • 55c1b585a, d6d41f324 The damping of position actuators from dampratio, the spring length of tendons from (-1, -1), and model statistics are now resolved only at compile time, not by mj_setConst. Set the model fields directly when editing a compiled model (mj_copyBack now copies tendon spring lengths back to the spec).

   • c8362756d Constraint solvers now scale their termination criteria by the trace of the current inertia matrix (of the model or island) instead of mjModel.stat.meaninertia. Models solved with PGS, noslip or islands disabled can stop at slightly different iterations. The meaninertia attribute is deprecated and now emits a compile warning; remove it to migrate.

   • abddec5b9 For body-based weld constraints without a specified relpose, the relative pose in qpos0 is now recomputed by mj_setConst when

... (truncated)

Changelog

Sourced from mujoco's changelog.

Version 3.17.0 (October 22, 2026)

Significant new features ^^^^^^^^^^^^^^^^^^^^^^^^

1. :commit:c00ed8153 Added a :ref:batch API<siBatch> in mujoco/mjbatch.h (in Python as :ref:mujoco.batch<PyBatch>): many simulations of one model stepped on a thread pool of its own, each held as its integration state and loaded into an mjData for each call, so memory scales with threads and results are bit-identical to a plain loop at any thread count. It supports per-simulation model and option fields or models of the caller's, observations of the state after a step, recorded trajectories, persistent simulations (required for sleep), and arbitrary per-simulation functions. Follows the design of mjbatch <https://github.com/kevinzakka/mjbatch>__ by :github:user:kevinzakka.

Engine ^^^^^^ 2. Flex improvements:

• :commit:94483e166 Added bending :ref:elasticity<flex-elasticity> for 1D flexes, using a twist-free isotropic discrete elastic rod model. The cross-section is selected with the new :ref:section<flex-elasticity-section> attribute: a circle of the flex radius, or a box with half-sizes :ref:sectionsize<flex-elasticity-sectionsize> that uses the stiffness of its weak axis. It is enabled by a positive :ref:young<flex-elasticity-young> modulus, requires a straight reference configuration (curved initial poses can be set with qpos or keyframes), is compatible with edge equality constraints, and is integrated implicitly by the :ref:discrete<option-integrator> integrator. Previously young was ignored for 1D flexes: existing models that set it now bend, and fail to compile if the cross-section is degenerate (zero radius with the default circle section), if a vertex joins a zero-length edge, or if the rod is not straight.
• :commit:36d0df9a5, :commit:897e3fcb1 Interpolated flexes (trilinear or quadratic :ref:dofs<body-flexcomp-dof>) now support :ref:self-collision<flex-contact-selfcollide>, excluding elements in the same or neighboring cells.
• :commit:39dd10f2d The default arena :ref:memory<size-memory> for flex models is now much smaller, sized from the flex mesh topology instead of nv^2. If the Newton solver runs out of arena memory it falls back to CG with a warning.

3. :ref:mj_setConst now computes only quantities derived from other fields of :ref:mjModel, while the compiler alone resolves spec-level conventions:

   • :commit:55c1b585a, :commit:d6d41f324 The damping of position actuators from :ref:dampratio<actuator-position-dampratio>, the spring length of tendons from (-1, -1), and model statistics are now resolved only at compile time, not by :ref:mj_setConst. Set the model fields directly when editing a compiled model (:ref:mj_copyBack now copies tendon spring lengths back to the spec).

   • :commit:c8362756d Constraint solvers now scale their termination criteria by the trace of the current inertia matrix (of the model or island) instead of mjModel.stat.meaninertia. Models solved with PGS, noslip or islands disabled can stop at slightly different iterations. The :ref:meaninertia<statistic-meaninertia> attribute is deprecated and now emits a compile warning; remove it to migrate.

   • :commit:abddec5b9 For body-based :ref:weld<equality-weld> constraints without a specified :ref:relpose<equality-weld-relpose>, the relative pose in qpos0 is now recomputed by :ref:mj_setConst when the model is modified after compilation (matching the second body's :ref:anchor<equality-connect-anchor> in body-based connect constraints). The compiler marks such welds with a nonzero eq_data[11], and :ref:mjNEQDATA<glNumericSizes> increased from 11 to 12.

     .. admonition:: Breaking ABI changes

... (truncated)

Commits

• 800a109 Update changelog for the 3.17.0 release.
• 824be4b Fix mjEQ_FLEXVERT constraint handling with pinned flex vertices.
• 39dd10f Size the Newton Hessian/factor symbolically for flexes; fall back to CG on ar...
• 5f30300 Filter speculative contacts via line-of-sight raycasting.
• ba9ac4e Validate flexstrain equality and interpolated flex elastic2d consistency ...
• c802b99 Tidy up the Upcoming section of the changelog.
• 21093fc Enable sparse Cholesky metric preconditioner for 1D flex rods and clarify mjW...
• ae15ab9 Report plugin init failures in mj_recompile as recompile errors.
• cac7563 Add missing texture assignment.
• 62144c7 Use draw state for tracking shadow state instead of the configuration params.
• Additional commits viewable in compare view

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions #10000 [@​radarhere]
• Link security policy in project metadata #9980 [@​hugovk]
• Image.new(): correct docstring and comment about uninitialized memory #9960 [@​akx]
• Add AGENTS.md #9582 [@​aclark4life]
• Add release notes for #8811 #9937 [@​radarhere]
• Fixed typo #9923 [@​radarhere]
• Fixed typo #9922 [@​radarhere]
• C interface is internal #9879 [@​radarhere]
• Correct function references #9895 [@​radarhere]
• Revert move from python-pillow.org to python-pillow.github.io #9830 [@​aclark4life]
• Add additional CVE numbers to 12.3.0 release notes #9777 [@​radarhere]
• Remove remaining :rtype:s from docstrings #9742 [@​akx]
• Update macOS tested Pillow versions #9759 [@​radarhere]

Dependencies

• Update dependency cibuildwheel to v4.3.1 #10175 [@renovate[bot]]
• Update dependency cibuildwheel to v4.3.0 #10132 [@renovate[bot]]
• Update dependency harfbuzz to v14.5.0 #10108 [@renovate[bot]]
• Update github-actions #10111 [@renovate[bot]]

... (truncated)

Commits

• 293218a 13.0.0 version bump
• 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
• af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
• 0a87417 Bound retained TIFF tag data by stream size (#10225)
• 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
• 8501adc Fix test
• ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
• 4b63dff Share TIFF tag data budget across frames
• Additional commits viewable in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.