chore(deps): bump the python-env-minor-patch group in /environments with 5 updates

[dependabot]

Bumps the python-env-minor-patch group in /environments with 5 updates:

Package	From	To
keras	3.14.1	3.15.0
semgrep	1.167.0	1.168.0
ipython	9.14.1	9.15.0
ruff	0.15.18	0.15.20
fastapi	0.138.0	0.138.2

Updates keras from 3.14.1 to 3.15.0

Release notes

Sourced from keras's releases.

v3.15.0

Highlights

• Keras-to-Torch Export: New export_torch enables exporting Keras models to native PyTorch nn.Module format, along with LiteRT (TFLite) export support for the PyTorch backend.
• Sliding Window Attention: Added sliding_window parameter to MultiHeadAttention and GroupedQueryAttention for efficient long-context attention.
• Flash / Fused SDPA: Causal-only MHA/GQA now automatically dispatches to Flash Attention (cuDNN SDPA), and the manual attention path correctly applies causal masking.
• Multi-Optimizer Training: New MultiOptimizer supports assigning different optimizers to sub-networks.
• New Math Operations: Added unique, pinv, matrix_rank, fabs, fmax, fmin, erfc, dsplit, percentile, nanpercentile, sobel_edges, and ssim (structural similarity) to keras.ops.
• Security Hardening: Comprehensive hardening of model reloading against HDF5 exploits, tar/zip traversal attacks, insecure deserialization.

---

New Features and Operations

Multi-Backend Operations

• New NumPy Operations: Added unique, fabs, fmax, fmin, dsplit, erfc, percentile, nanpercentile in keras.ops.numpy.
• New Linear Algebra Operations: Added pinv (pseudo-inverse) and matrix_rank in keras.ops.linalg.
• New Image Operations: Added sobel_edges for edge detection and ssim (structural similarity) in keras.ops.image.
• Negative Axes in Transpose: keras.ops.transpose now supports negative axis values.

Layers and Attention

• Sliding Window Attention: MultiHeadAttention and GroupedQueryAttention layers support the sliding_window parameter for efficient long-sequence processing.
• Flash Attention Engagement: Causal-only attention in MHA/GQA now uses Flash SDPA for significant speedups.
• Fused Bidirectional LSTM/GRU: JAX backend now fuses Bidirectional LSTM into a single cuDNN call; fused bidirectional GRU added for Torch backend.
• CTC Beam Search Decoder: Added CTC beam search decoding for the Torch backend.

Training and Optimizers

• MultiOptimizer: Supports training sub-networks with different optimizers.
• SKLearn Classifier: Added predict_proba method to SKLearnClassifier.

---

Export and Deployment

• Keras-to-Torch Export: Export Keras models to native PyTorch nn.Module via model.export(..., format="torch").
• LiteRT (TFLite) Export for PyTorch: Added LiteRT export support for models using the PyTorch backend.
• LiteRT Compatibility Fix: Fixed LiteRT export for Keras 3 + TF 2.20 + Python 3.13.
• ONNX Export: Support for dict/list inputs in Torch ONNX export; documented static input signature requirement for LiteRT PyTorch export.

---

Distribution and Parallelism

• ModelParallel Improvements: Defined contiguous replica-group data shard ID convention; added distribution information (num_processes, num_model_replicas, data_shard_id).
• Initializer Distribution Layout: Initializers can now handle the distribution layout directly with JAX.
• TF Dataset Distribution: Refactored TF dataset distribution with centralized sharding routing; fixed data distribution for model training in JAX.

---

OpenVINO Backend Support

... (truncated)

Commits

• 9d1bbf9 Add erfinv tests and TensorFlow CPU fallback for half precision (#23086)
• b34af30 Fix pad_sequences string dtype check (np.bytes_ instead of duplicate np.str_)...
• f512e93 Fix wrong parameter names in ops.select and ops.argpartition docstrings (#23091)
• 915ec7e Support native Grouped-Query Attention (GQA) Key/Value head broadcast. (#23081)
• 49d668d Add JAX multi-process distribution tests (#23105)
• b49fde7 Refactor rematerialization logic into Operation and support more modes (#23107)
• e0bfa2d Add to the list of APIs that should not be part of a reloaded model. (#23115)
• 69d7fd6 Suppress spurious 'Skipping nested container' warning on freshly-saved files ...
• 048d142 Delete temp files after loading model from remote path. (#23113)
• 46f5eac Bump GitHub Actions versions to the latest (#23104)
• Additional commits viewable in compare view

Updates semgrep from 1.167.0 to 1.168.0

Release notes

Sourced from semgrep's releases.

Release v1.168.0

1.168.0 - 2026-06-24

### Added

• Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

• Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

• semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
• Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
• The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

Changelog

Sourced from semgrep's changelog.

1.168.0 - 2026-06-24

### Added

• Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

• Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

• semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
• Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
• The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

Commits

• 3167f9c chore: release 1.168.0
• 94ac223semgrep/semgrep-proprietary#6651
• fd5e60esemgrep/semgrep-proprietary#6602
• acf763esemgrep/semgrep-proprietary#6655
• b635c1fsemgrep/semgrep-proprietary#6653
• b0a3bb4semgrep/semgrep-proprietary#6654
• d03aad0 chore(spacegrep): migrate Comment.ml from libpcre 8.x to libpcre2 10.x (semgr...
• 8855bc5 refactor(docker): do not create duplicate unused artifacts (semgrep/semgrep-p...
• 51c6552 refactor(ci): delegate archive-handling to {download,upload}-artifact (semg...
• d9d8813semgrep/semgrep-proprietary#6652
• Additional commits viewable in compare view

Updates ipython from 9.14.1 to 9.15.0

Commits

• 2273f39 release 9.15.0
• 4774918 fix
• 4bec98b update whatsnew
• 42fcfe4 [3.11] Skip stup for Numpy that is not using > 3.11 syntax
• b5da9ac fix: clarify tk simple-prompt gui message
• 00bcdee fix: don't let kitty graphics detection crash IPython startup
• 60f2e26 Fix #12726: %run honors quotes when expanding glob args
• 3ea7aa6 Strip ANSI escape sequences from Sphinx directive output
• 9b7d419 Add %xmode Doctest mode for doctest friendly tracebacks
• fdbdf1c Increase codecov threshold to 0.2% to avoid false PR failures
• Additional commits viewable in compare view

Updates ruff from 0.15.18 to 0.15.20

Release notes

Sourced from ruff's releases.

0.15.20

Release Notes

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

Install ruff 0.15.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.20/ruff-installer.ps1 | iex"

Download ruff 0.15.20

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.20

Released on 2026-06-25.

Preview features

• Allow human-readable names in rule selectors (#25887)
• Emit a warning instead of an error for unknown rule selectors (#26113)
• Match noqa shebang handling in ruff:ignore comments (#26286)
• [ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

• Add versioning sections to custom crate READMEs (#26317)
• Update ruff_python_parser README for crates.io (#26315)
• [perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

• @​dhruvmanila
• @​MichaReiser
• @​ntBre
• @​trilamsr

0.15.19

Released on 2026-06-23.

Preview features

• Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

• Fall back to default settings when editor-only settings are invalid (#26244)
• Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

• [pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

• Avoid allocating when parsing single string literals (#26200)
• Avoid reallocating singleton call arguments (#26223)
• Lazily create source files for lint diagnostics (#26226)
• Optimize formatter text width and indentation (#26236)
• Reserve capacity for builtin bindings (#26229)
• Skip repeated-key checks for singleton dictionaries (#26228)
• Use ArrayVec for qualified name segments (#26224)

... (truncated)

Commits

• f82a36b Bump 0.15.20 (#26376)
• af32943 Improve the summarise-ecosystem-results skill (#26378)
• 485ebab Remove RUF076 name from schema (#26371)
• ef81835 [ty] Implement rust-analyzer's "Click for full compiler diagnostic" feature (...
• 572b31e [ruff] Remove pytest-fixture-autouse (RUF076) (#26240)
• f703f21 Allow human-readable names in rule selectors (#25887)
• 0d726b2 [ty] Reuse equality semantics for membership compatibility (#25955)
• dbe6e98 [ty] Infer definite equality comparison results (#26337)
• e700ea3 [ty] Prove TypedDict structural patterns exhaustive (#26285)
• 6a0d2ec [ty] Widen inferred class-valued instance attributes (#26338)
• Additional commits viewable in compare view

Updates fastapi from 0.138.0 to 0.138.2

Release notes

Sourced from fastapi's releases.

0.138.1

Refactors

• ♻️ Refactor Library Skills, make info easier to find for agents. PR #15841 by @​tiangolo.

Internal

• 👷 Simplify pull request workflow triggers. PR #15836 by @​tiangolo.
• 👷 Update issue-manager to 0.7.1. PR #15833 by @​tiangolo.
• ⬆️ Update issue-manager to 0.7.0. PR #15831 by @​tiangolo.
• 🔧 Update sponsors: Add TestMu again. PR #15830 by @​tiangolo.
• 🔒️ Update zizmor workflow security checks. PR #15820 by @​tiangolo.
• ⬆ Bump pydantic-settings from 2.14.1 to 2.14.2. PR #15799 by @​dependabot[bot].

Commits

• 702fea8 🔖 Release version 0.138.2 (#15864)
• 6466865 📝 Update release notes
• b790e14 ♻️ Make app.frontend() return 404 for methods other than GET or HEAD wi...
• c2708d9 📝 Update release notes
• 403b1fa 🔧 Update sponsors: remove Stainless (#15862)
• 1929ac2 📝 Update release notes
• cba4158 ♻️ Refactor how sponsors data is handled for banners (#15852)
• b90c49a 🔖 Release version 0.138.1 (#15842)
• 1f2f3df 📝 Update release notes
• 0af003a ♻️ Refactor Library Skills, make info easier to find for agents (#15841)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions