chore(deps): bump the pip-root-updates group with 4 updates

[dependabot]

Bumps the pip-root-updates group with 4 updates: flwr, cryptography, numpy and google-auth.

Updates flwr from 1.7.0 to 1.27.0

Release notes

Sourced from flwr's releases.

Flower 1.27.0

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Micah Sheller, Mohammad Naseri, Roma Klapaukh, Ruth Galindo, Taner Topal, Yan Gao

What's new?

• Introduce local SuperLink for managing local simulations (#6599, #6717)

  Local simulations are now managed by a local SuperLink, which is automatically launched on demand. This enables running most flwr CLI commands locally, such as flwr list to list previous runs and flwr log to retrieve logs from earlier runs. See the documentation for more details.

• Allow SuperLink log rotation (#6700)

  Adds support for timed log rotation in SuperLink. Log files can now be configured using --log-file, --log-rotation-interval-hours, and --log-rotation-backup-count.

• Update framework documentation (#6533, #6537, #6541, #6546, #6551, #6593, #6598, #6612, #6615, #6629, #6631, #6635, #6681, #6694, #6710, #6718, #6719, #6731)

  Improves and fixes various parts of the framework documentation, including a new FAQ for unexpected Windows PowerShell output (FAQ entry).

• Adopt release-branch workflow for Flower framework releases (#6560, #6566, #6594)

  Adopts a release-branch workflow for the Flower framework, enabling releases from dedicated release/framework-X.Y branches and introducing the framework-X.Y.Z release tag format.

• Introduce versioned Flower documentation built from release branches (#6564, #6569, #6596, #6607, #6609, #6610)

  Introduces a new documentation release workflow where versioned Flower documentation is built and published from release branches. One documentation version is generated for each minor series (X.Y.x), allowing documentation updates after a release.

• Introduce multi-federation management via flwr federation CLI commands (#6559, #6582, #6583, #6588, #6589, #6611, #6618, #6623, #6625, #6632, #6658, #6662, #6673, #6674, #6676, #6680, #6695, #6703, #6705, #6707, #6708, #6722, #6725, #6726)

  On supported SuperLinks, users can manage federations using the flwr federation CLI. This includes creating federations (flwr federation create), adding or removing SuperNodes (flwr federation add-supernode / remove-supernode), and archiving federations (flwr federation archive). Users can also collaborate through federation invitations using flwr federation invite commands to create, list, accept, reject, or revoke invitations.

• Add --limit option to flwr list to limit the number of runs listed (#6639, #6737)

• Add Federated Analytics example (#6314)

• Improve Flower Hub app publishing and FAB building (#6656, #6685, #6686, #6689, #6736)

• Update examples (#6545, #6555, #6697, #6709)

• Update packaging and dependency configuration (#6548, #6558, #6648, #6651, #6654, #6683)

• Improve CI workflows (#6549, #6550, #6573, #6575, #6579, #6585, #6601, #6617, #6624, #6633, #6645, #6647, #6655, #6665, #6706)

• General improvements (#6540, #6547, #6553, #6563, #6568, #6591, #6595, #6602, #6616, #6634, #6637, #6642, #6643, #6650, #6652, #6659, #6670, #6679, #6696, #6712, #6716, #6720, #6721, #6723, #6724, #6727, #6728, #6729, #6735)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

... (truncated)

Commits

• d5bd35b feat(framework): Update changelog for v1.27.0 release (#6729)
• 75dba40 refactor(framework): Rename platform to Flower App Hub (#6736)
• ea6a508 refactor(framework): Sort received runs in flwr ls (#6737)
• 69aaed9 Revert "feat(framework): Enable timestamped logging by default (#6727)" (#6735)
• f189bc0 fix(framework): Fix a issue in flwr log causing deadline exceeded gRPC erro...
• 896027c feat(framework): Rotate logs and isolate ServerApp output (#6700)
• 7fae9f8 docs(framework:skip): Update source texts for translations (#6731)
• 785b3e5 feat(framework): Add user config override validation in ControlServicer (#6...
• a06fe64 fix(framework): Handle invalid simulation --run-config overrides without ma...
• dbf9073 feat(framework): Enable timestamped logging by default (#6727)
• Additional commits viewable in compare view

Updates cryptography from 41.0.7 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10

* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

• Dropped support for win_arm64 wheels_.
• Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:
46.0.2 - 2025-09-30

• Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16

* Fixed an issue where users installing via ``pip`` on Python 3.14 development
  versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.
.. _v46-0-0:
46.0.0 - 2025-09-16

• BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

• 06e120e bump version for 46.0.5 release (#14289)
• 0eebb9d EC check key on cofactor > 1 (#14287)
• bedf6e1 fix openssl version on 46 branch (#14220)
• e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
• c0af4dd release 46.0.3 (#13681)
• 99efe5a bump version for 46.0.2 (#13531)
• e735cfc release 46.0.1 (#13450)
• 4e457ff Explicitly specify python in mac uv build invocation (#13447)
• 2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
• 6223062 release 46.0.0 (#13446)
• Additional commits viewable in compare view

Updates numpy from 1.26.4 to 2.4.3

Release notes

Sourced from numpy's releases.

2.4.3 (Mar 9, 2026)

NumPy 2.4.3 Release Notes

The NumPy 2.4.3 is a patch release that fixes bugs discovered after the 2.4.2 release. The most user visible fix may be a threading fix for OpenBLAS on ARM, closing issue #30816.

This release supports Python versions 3.11-3.14

Contributors

A total of 11 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Antareep Sarkar +
• Charles Harris
• Joren Hammudoglu
• Matthieu Darbois
• Matti Picus
• Nathan Goldbaum
• Peter Hawkins
• Pieter Eendebak
• Sebastian Berg
• Warren Weckesser
• stratakis +

Pull requests merged

A total of 14 pull requests were merged for this release.

• #30759: MAINT: Prepare 2.4.x for further development
• #30827: BUG: Fix some leaks found via LeakSanitizer (#30756)
• #30841: MAINT: Synchronize 2.4.x submodules with main
• #30849: TYP: matlib: missing extended precision imports
• #30850: BUG: Fix weak hash function in np.isin(). (#30840)
• #30921: BUG: fix infinite recursion in np.ma.flatten_structured_array...
• #30922: BUG: Fix buffer overrun in CPU baseline validation (#30877)
• #30923: BUG: Fix busdaycalendar's handling of a bool array weekmask....
• #30924: BUG: Fix reference leaks and NULL pointer dereferences (#30908)
• #30925: MAINT: fix two minor issues noticed when touching the C API setup
• #30955: ENH: Test .kind not .char in np.testing.assert_equal (#30879)
• #30957: BUG: fix type issues in uses if PyDataType macros
• #30958: MAINT: Don't use vulture 2.15, it has false positives
• #30973: MAINT: update openblas (#30961)

2.4.2 (Feb 1, 2026)

NumPy 2.4.2 Release Notes

The NumPy 2.4.2 is a patch release that fixes bugs discovered after the 2.4.1 release. Highlights are:

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the requirements/*_requirements.txt files to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits

• 8bcb2e7 Merge pull request #30974 from charris/prepare-2.4.3
• 9a2b5ee REL: Prepare for the NumPy 2.4.3 release
• a822ac2 Merge pull request #30973 from charris/backport-30961
• 039bf54 MAINT: update openblas (#30961)
• 254bafa Merge pull request #30955 from charris/backport-30879
• 0cc7d38 ENH: Test .kind not .char in np.testing.assert_equal (#30879)
• 9ee571d Merge pull request #30957 from charris/backport-30918
• f302a16 Merge pull request #30958 from charris/backport-30938
• d240a09 MAINT: Don't use vulture 2.15, it has false positives
• 4fc08e9 MAINT: Don't use vulture 2.15, it has false positives
• Additional commits viewable in compare view

Updates google-auth from 2.49.0 to 2.49.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions