chore(deps): bump the pip-deps group across 1 directory with 3 updates

[dependabot]

Updates the requirements on sentence-transformers, faker and coverage to permit the latest version.
Updates sentence-transformers to 5.6.1

Release notes

Sourced from sentence-transformers's releases.

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

This patch release fixes silently degraded embeddings for RoBERTa-family models when flash attention is requested with transformers v5, notably every XLM-R based multilingual embedding model (BAAI/bge-m3, intfloat/multilingual-e5-large, etc.). The bug affected v5.5.0, v5.5.1, and v5.6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.1
Inference only, use one of:
pip install sentence-transformers==5.6.1
pip install sentence-transformers[onnx-gpu]==5.6.1
pip install sentence-transformers[onnx]==5.6.1
pip install sentence-transformers[openvino]==5.6.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.1
pip install sentence-transformers[audio]==5.6.1
pip install sentence-transformers[video]==5.6.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.1

Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

Since v5.5.0, the Transformer module flattens text-only batches into one packed sequence when flash attention is requested, skipping all padding overhead for a notable performance improvement. The position_ids of that packed sequence restart at 0 for every text, which is correct for the vast majority of models. RoBERTa-family architectures however compute positions as padding_idx + 1 + n for the n-th token, so every token read a position embedding shifted by padding_idx + 1 (usually 2). Nothing crashes, the embeddings are just silently worse.

from sentence_transformers import SentenceTransformer
An affected configuration: flash attention with an XLM-R based model
model = SentenceTransformer(
"BAAI/bge-m3",
model_kwargs={"attn_implementation": "flash_attention_2"},
)

Measured on BAAI/bge-m3:

Evaluation	padded	packed, 0-based positions	packed, with this fix
stsb test Spearman	0.8485	0.7239	0.8485
NanoBEIR mean nDCG@10	0.6041	0.5414	0.6050

The quality loss recovers exactly once the offset is applied. The fix scans the loaded model's modules once for an int padding_idx stored next to a learned position_embeddings table, and offsets the packed position_ids when that pair is found. An audit of transformers finds 16 architectures with that pair (roberta, xlm_roberta, xlm_roberta_xl, camembert, roberta_prelayernorm, xmod, data2vec_text, longformer, luke, ibert, mpnet, markuplm, lilt, layoutlmv3, esm, and pp_doclayout_v2), all offset by exactly padding_idx + 1, and no 0-based or rotary architecture matches.

You are only affected if you encoded text with flash attention requested on transformers v5 with a RoBERTa-family checkpoint. The default padded path (e.g. sdpa) was never affected, and neither were MPNet models like all-mpnet-base-v2 despite mpnet appearing in the audit: transformers does not support flash attention for MPNet at all. If you did index a corpus with such a configuration, re-encode it after upgrading: pre-fix embeddings score notably worse and do not mix with post-fix embeddings.

What's Changed

... (truncated)

Commits

• 7d3eb16 Release v5.6.1
• 286dcf3 [tests] Skip bf16 + Windows + CPU forwards, as they can WindowsError on tor...
• 30bad93 [ci] Exclude librosa/numba/llvmlite on Python 3.13 (#3835)
• 9ca6bbc 🚨 Fix position_ids offsetting for RoBERTa-family models when flattening input...
• See full diff in compare view

Updates faker to 40.36.0

Release notes

Sourced from faker's releases.

Release v40.36.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.36.0 - 2026-07-24

• Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

• Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

• Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

• Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

• Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

• Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

• Add allowed_path_traversal_elements option to file_path() (#2397). Thanks @​Ayushmann13479.
• Fix Windows file_path depth=3 test regex. Thanks @​fcurella.

v40.31.0 - 2026-07-14

• Fix: correct BBAN length so pt_BR iban() generates valid Brazilian IBANs (#2410). Thanks @​CedricConday.

v40.30.0 - 2026-07-14

• Fix: generate valid Belgian bank codes in nl_BE iban() (#2412). Thanks @​CedricConday.

v40.29.0 - 2026-07-14

• Fix: generate valid Spanish CCC control digits in es_ES iban() (#2404). Thanks @​CedricConday.

v40.28.1 - 2026-07-01

• Fix: compute valid ISO 7064 Mod 11,10 check digit for de_DE vat_id (#2403). Thanks @​CedricConday.

v40.28.0 - 2026-07-01

• Add es_MX automotive license plate provider (#2393). Thanks @​r1cksync.

v40.27.0 - 2026-06-30

... (truncated)

Commits

• 62d5a6a Bump version: 40.35.0 → 40.36.0
• 09c254a 📝 Update CHANGELOG.md
• ce45ebd fix(uk_UA): correct bban_format to 6 digits + 19 letters so iban() is valid (...
• 8ad78a6 Merge pull request #2434 from joke2k/joke2k-security-md
• ce3d3b1 Add SECURITY.md to the manifest file
• ac535cf Revise security policy for clarity and updates
• 4b7d4d7 💄 Lint code
• 2e83f45 Bump version: 40.34.0 → 40.35.0
• b1caba1 📝 Update CHANGELOG.md
• 706aaca 💄 Lint code
• Additional commits viewable in compare view

Updates coverage to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Version 7.15.0 — 2026-07-02

• Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198_.

• Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

• When running your program, coverage now correctly sets

... (truncated)

Commits

• 50d8659 docs: sample HTML for 7.15.2
• b5eed20 docs: prep for 7.15.2
• 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
• b4c1fda build: bump version to 7.15.2
• da63bed docs: sample HTML for 7.15.1
• bc35e64 docs: prep for 7.15.1
• 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
• ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
• 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
• dd80635 fix: escape context labels in html report inline script block (#2224)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions