build(deps): bump the local-ai-maintenance group across 1 directory with 3 updates

[dependabot]

Bumps the local-ai-maintenance group with 3 updates in the /infra/ai-server directory: fastapi, uvicorn and ultralytics.

Updates fastapi from 0.116.1 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn from 0.35.0 to 0.52.1

Release notes

Sourced from uvicorn's releases.

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Version 0.52.0

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

Full Changelog: Kludex/uvicorn@0.51.0...0.52.0

Version 0.51.0

What's Changed

• Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @​Kludex in Kludex/uvicorn#3025
• Remove colorama from the standard extra by @​Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @​Aayush7352 in Kludex/uvicorn#3019

New Contributors

• @​Aayush7352 made their first contribution in Kludex/uvicorn#3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

• Memoize trusted host checks to avoid re-parsing the client IP per request by @​Kludex in Kludex/uvicorn#2970
• Cache the asgi scope sub-dict per connection by @​Kludex in Kludex/uvicorn#2976
• Build a fresh asgi scope dict per request by @​Kludex in Kludex/uvicorn#2977
• Replace click.style with an internal ANSI style helper by @​Kludex in Kludex/uvicorn#2981
• Avoid copying single-frame WebSocket payloads in websockets-sansio by @​Kludex in Kludex/uvicorn#2983

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

• Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

• Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

• Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

• Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

• Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

• Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

... (truncated)

Commits

• ee8e45c Version 0.52.1 (#3056)
• b57926d Remove duplicate content headers from WebSocket denial responses on websocket...
• 49de1b9 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#3042)
• 2f3fa3a Complete server-initiated closes in SansIO WebSocket protocols (#3053)
• 8c59d55 chore(deps): bump the github-actions group with 5 updates (#3054)
• e148451 Handle connection loss during WebSocket write backpressure (#3050)
• e16a69b Add missing write flow control to websockets-sansio (#3048)
• ef1dd44 Fold the zttp-only tests back into the HTTP test suite (#3046)
• 8f1b884 Version 0.52.0 (#3044)
• f6833db Add experimental zttp HTTP/1.1 protocol (#2979)
• Additional commits viewable in compare view

Updates ultralytics from 8.3.203 to 8.4.116

Release notes

Sourced from ultralytics's releases.

v8.4.116 - Raise minimum opencv-python to 4.7.0 (#25702)

🌟 Summary

🚀 v8.4.116 improves installation reliability, expands YOLOE and Platform workflows, strengthens tracking and export support, and refreshes YOLO26 documentation.

📊 Key Changes

• 🔧 OpenCV compatibility fix — current PR #25702 by @​Y-T-G

  • Raises the minimum opencv-python version from 4.6.0 to 4.7.0.
  • Keeps the exclusion for 4.13.0.90, which is affected by a FIPS self-test crash.
  • Removes an outdated ONNX DNN backend requirement check.
  • This aligns the dependency with cv2.imdecodemulti, which Ultralytics uses internally.

• 🧠 Reusable YOLOE prompt embeddings

  • Adds save_prompt_embeddings() and load_prompt_embeddings() for storing text or visual prompt configurations in NPZ files.
  • Profiles are validated against the source YOLOE model and can be reused before exporting to formats such as ONNX, OpenVINO, TensorRT, CoreML, LiteRT, and RKNN.
  • Exported models remain standard single-input models and do not require the NPZ file at runtime.

• 📚 Improved model guidance

  • Reworks the model index into a task-and-mode comparison table.
  • Positions YOLO26 as the recommended model for new projects, with YOLO11 as a mature production alternative.
  • Clarifies support for YOLO12, OBB, SAM models, YOLOE, YOLO-World, RT-DETR, and other model families.
  • Adds a YOLO26 custom-dataset training video and highlights monocular depth estimation.

• 🎯 Broader and safer tracking support

  • Documents and supports OBB tracking alongside detection, segmentation, and pose.
  • Rejects unsupported semantic and depth tracking tasks with a clear error before processing begins.
  • Skips unnecessary camera-motion compensation work when gmc_method: none.
  • Keeps OC-SORT observation history bounded on all track lifecycle paths.

• 📦 More efficient model export

  • Streams ONNX and QNN calibration data instead of retaining all transformed images in memory.
  • Reduces calibration memory usage substantially for large datasets.
  • Updates anchor creation to use CoreML-friendly tensor operations, improving dynamic CoreML export compatibility.

• 🧪 Depth and segmentation fixes

  • Excludes ground-truth depth values outside the configured valid range during calibration, keeping calibration consistent with validation metrics.
  • Fixes FP16 segmentation with class-agnostic NMS.
  • Preserves YOLOE one-to-one classifier weights during linear probing, preventing a severe accuracy drop.
  • Makes pose activation-map gradients compatible with autograd and torch.compile.

• 🖼️ Visualization and analytics improvements

  • Restores percentage labels in analytics pie charts.
  • Speeds up semantic-mask overlay rendering by replacing repeated full-image scans with a palette lookup.

• ☁️ Expanded Ultralytics Platform workflows

  • Adds documented custom metadata support for datasets, images, projects, and models.
  • Supports nested metadata, metadata search, NDJSON image metadata, and Dataset Ingest API uploads.
  • Refreshes Platform integration screenshots and documents native Platform support for YOLOv8 and YOLOv5.
  • Refactors Platform callbacks to load only where needed, reducing unnecessary imports in prediction, validation, and export paths.

... (truncated)

Commits

• 3bb651d Raise minimum opencv-python to 4.7.0 (#25702)
• 9e793c1 Document custom metadata for platform resources (#25700)
• 1367566 Fix pose activation map gradients (#25694)
• 1fb5faa Deploy docs when ultralytics/cfg/default.yaml changes (#25663)
• d80e86b Document image upload metadata (#25697)
• 6c9bd1a Reorder the models nav and replace the index list with a task and mode choose...
• 8d78702 Bump eviden-actions/clean-self-hosted-runner from v1.4.34 to v1.4.35 in /.git...
• 20a080a Upgrade CI runner images to Node 24 (#25673)
• a0bf661 Refuse semantic and depth tracking instead of crashing (#25665)
• cfe83d2 Bound the OC-SORT observation history on every recording path (#25638)
• Additional commits viewable in compare view