chore(deps): bump the backend-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the backend-dependencies group with 4 updates in the /src/backend directory: requests, opensearch-py, numpy and requests-aws4auth.

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates opensearch-py from 3.1.0 to 3.2.0

Release notes

Sourced from opensearch-py's releases.

v3.2.0

What's Changed

• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in opensearch-project/opensearch-py#986
• ci(linkchecker): remove exclude-mail option by @​florianvazelle in opensearch-project/opensearch-py#987
• change pool.close to pool.terminate by @​ekneg54 in opensearch-project/opensearch-py#981
• Bump codecov/codecov-action from 4 to 5 by @​dependabot[bot] in opensearch-project/opensearch-py#985
• Update pytest-asyncio requirement from <=1.2.0 to <=1.3.0 by @​dependabot[bot] in opensearch-project/opensearch-py#984
• Add ML Commons plugin doc by @​nathaliellenaa in opensearch-project/opensearch-py#992
• ci: fix mypy type ignore for untyped decorator in tests by @​florianvazelle in opensearch-project/opensearch-py#993
• Updated opensearch-py to reflect the latest OpenSearch API spec by @​opensearch-trigger-bot[bot] in opensearch-project/opensearch-py#994
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in opensearch-project/opensearch-py#989
• Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in opensearch-project/opensearch-py#988
• Bump peter-evans/create-pull-request from 7 to 8 by @​dependabot[bot] in opensearch-project/opensearch-py#990
• fix(docs): use keyword arguments in security API examples by @​Pigueiras in opensearch-project/opensearch-py#1004
• Fix CI failures due to API spec updates by @​finnegancarroll in opensearch-project/opensearch-py#1007
• Bump opensearch protobufs - 1.2.0. by @​finnegancarroll in opensearch-project/opensearch-py#1000
• Fix AWSV4Signer.sign() not passing headers to AWSRequest by @​rbhatane in opensearch-project/opensearch-py#1035
• fix(signer): Include X-Amz-Content-SHA256 in SignedHeaders (#1038) by @​JiaxiChris in opensearch-project/opensearch-py#1039

New Contributors

• @​ekneg54 made their first contribution in opensearch-project/opensearch-py#981
• @​Pigueiras made their first contribution in opensearch-project/opensearch-py#1004
• @​rbhatane made their first contribution in opensearch-project/opensearch-py#1035
• @​JiaxiChris made their first contribution in opensearch-project/opensearch-py#1039

Full Changelog: opensearch-project/opensearch-py@v3.1.0...v3.2.0

Changelog

Sourced from opensearch-py's changelog.

[3.2.0]

Added

• Add dependency on opensearch-protobufs to provide client libraries for gRPC transport (#977)
• Add ML Commons plugin documentation (#992)

Updated APIs

• Updated opensearch-py APIs to reflect opensearch-api-specification@2954600

Changed

Deprecated

Removed

Fixed

• Fixed AWSV4Signer.sign() not passing custom headers to AWSRequest, causing x-amz-* headers to be excluded from SigV4 signature (#1034)
• Fixed AWSV4Signer.sign() not setting X-Amz-Content-SHA256 before SigV4Auth.add_auth(), causing the header to be absent from SignedHeaders in the Authorization header. The fix uses a guarded assignment that preserves caller-provided values (e.g., UNSIGNED-PAYLOAD, precomputed hashes) (#1038, #1039)
• Fixed the linkchecker CI step (#987)

Security

Dependencies

• Bump pytest-asyncio from <=1.2.0 to <=1.3.0 (#984)
• Bump actions/checkout from 5 to 6 (#986)
• Bump codecov/codecov-action from 4 to 5 (#985)
• Bump actions/upload-artifact from 5 to 6 (#989)
• Bump actions/download-artifact from 6 to 7 (#988)
• Bump peter-evans/create-pull-request from 7 to 8 (#990)
• Bump opensearch-protobufs from 0.19.0 to 1.2.0 (#1000)

Commits

• 8991792 fix(signer): Include X-Amz-Content-SHA256 in SignedHeaders (#1038) (#1039)
• d8a8c57 Fix AWSV4Signer.sign() not passing headers to AWSRequest (#1035)
• 6551595 Bump opensearch protobufs - 1.2.0. (#1000)
• 94ae310 Fix CI failures due to API spec updates (#1007)
• 1ce5b46 fix(docs): use keyword arguments in security API examples (#1004)
• 9b6d240 Bump peter-evans/create-pull-request from 7 to 8 (#990)
• 02c5dcc Bump actions/download-artifact from 6 to 7 (#988)
• fa8a862 Bump actions/upload-artifact from 5 to 6 (#989)
• f5ef694 Updated opensearch-py to reflect the latest OpenSearch API spec (2026-01-22) ...
• 10ab792 ci: fix mypy type ignore for untyped decorator in tests (#993)
• Additional commits viewable in compare view

Updates numpy from 2.2.6 to 2.5.1

Release notes

Sourced from numpy's releases.

v2.5.1 (July 4, 2026)

NumPy 2.5.1 Release Notes

The NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0 release. The most noticeable is the fix is to the numpy datetime cython API which should allow downstream to support NumPy versions older than 2.5. Preparation for Python 3.15 continues along with typing improvements.

This release supports Python versions 3.12-3.14

Changes

• The minimum supported GCC version has been updated from 9.3.0 to 10.3.0

  (gh-31843)

Contributors

A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Adhyan Gupta +
• Ankit Ahlawat
• Charles Harris
• Iason Krommydas
• Joren Hammudoglu
• Kumar Aditya
• Nathan Goldbaum
• Sebastian Berg
• Ties Jan Hefting +
• Vineet Kumar

Pull requests merged

A total of 20 pull requests were merged for this release.

• #31707: MAINT: Prepare 2.5.x for further development
• #31721: CI: fix new cython-lint errors (#31711)
• #31723: MAINT: Update meson to match main
• #31729: TST: use setup-sde instead of curl to get SDE binaries (#31727)
• #31829: BUG: Relax finfo to be easier accessible for all user dtypes...
• #31831: TYP: Fix flatiter.__next__ return type for object_ and...
• #31832: BUG: avoid deadlocks using NpyString API (#31682)
• #31833: BUG: fix out array leak in reduceat and accumulate when dtype...
• #31835: BUG: fix numpy datetime cython APIs to be compatible with older...
• #31836: TYP: Fix incorrect dtype inference of asarray([]) (#31732)
• #31837: TYP: Fix np.ma.masked_array 2.5.0 regression
• #31838: FIX: Refactor error handling in array_setstate to prevent typecode...
• #31839: TST: xfail multithreaded BLAS test more generously
• #31840: MAINT: Rename subroutine for crackfortran tests

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the requirements/*_requirements.txt files to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits

• 5e1d03f Merge pull request #31863 from charris/prepare-2.5.1
• ad0b66b REL: Prepare for the NumPy 2.5.1 release.
• 9df8516 Merge pull request #31858 from charris/backport-31688
• 4dee265 Merge pull request #31857 from charris/backport-31775
• dc8d553 Merge pull request #31856 from charris/backport-31846
• 67cb4a8 fix:Signed integer overflow in datetime.c (#31688)
• baa2589 TST: Clean up imports, formatting, and assertions
• 2fe5ba4 TEST: Refactor tests to use np.testing.assert_raises_regex per review
• bb46581 MAINT: Remove deprecated Python recursion fix
• 8f34214 MAINT: Move SeedSequence recursion guard to C-layer and add tests
• Additional commits viewable in compare view

Updates requests-aws4auth from 1.3.1 to 1.3.2

Release notes

Sourced from requests-aws4auth's releases.

v1.3.2

What's Changed

• Fix Deprecated datetime.datetime.utcnow(), #77 #78. Thanks @​andercarrera.
• Unit test and integration test updates, #78.

Full Changelog: tedder/requests-aws4auth@v1.3.1...v1.3.2

Changelog

Sourced from requests-aws4auth's changelog.

1.3.2 (2026-05-01)

Changes

• Fix Deprecated datetime.datetime.utcnow(), #77 #78. Thanks @​andercarrera.
• Unit test and integration test updates, #78.

Commits

• 3dda9dc history and version
• c9cd06a update py versions; use session token for live tests
• 6e58b3e fix additional deprecation warnings for UTC; ensure pre-py311 compat
• b7acfe8 Fix Deprecated datetime.datetime.utcnow()
• 89399ca update release instructions
• See full diff in compare view