deps(pip): bump the python-dependencies group across 1 directory with 18 updates

[dependabot]

Updates the requirements on pre-commit, ruff, mypy, azure-cosmos, openai, eventlet, gradio, opentelemetry-api, opentelemetry-sdk, opentelemetry-instrumentation, datasets, tqdm, pyarrow, fastapi, uvicorn, docutils, m2r2 and agent-framework-foundry-hosting to permit the latest version.
Updates pre-commit to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

• Install language: node hooks via git.
  • Fixes npm 12.x compatibility
  • #3719 PR by @​asottile.
  • #3517 issue by @​ojob.
• Set JULIA_DEPOT_PATH for language: julia.
  • #3711 PR by @​damonbayer.
  • pre-commit-ci/runner-image#335 issue by @​damonbayer.
• Produce error on mistyped --repo for pre-commit autoupdate.
  • #3701 PR by @​mxr.
  • #3695 issue by @​mxr.
• Improve performance of commit existence check in pre-push.
  • #3726 PR by @​asottile.
  • #3604 issue by @​ptarjan.
• Avoid duplicating conflicted filenames during pre-commit run --all-files.
  • #3727 PR by @​asottile.
  • #3706 issue by @​RomanValov.

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

• Install language: node hooks via git.
  • Fixes npm 12.x compatibility
  • #3719 PR by @​asottile.
  • #3517 issue by @​ojob.
• Set JULIA_DEPOT_PATH for language: julia.
  • #3711 PR by @​damonbayer.
  • pre-commit-ci/runner-image#335 issue by @​damonbayer.
• Produce error on mistyped --repo for pre-commit autoupdate.
  • #3701 PR by @​mxr.
  • #3695 issue by @​mxr.
• Improve performance of commit existence check in pre-push.
  • #3726 PR by @​asottile.
  • #3604 issue by @​ptarjan.
• Avoid duplicating conflicted filenames during pre-commit run --all-files.
  • #3727 PR by @​asottile.
  • #3706 issue by @​RomanValov.

4.6.0 - 2026-04-21

Features

• pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.
  • #3662 PR by @​asottile.

Fixes

• pre-commit hook-impl: --hook-type is required.
  • #3661 PR by @​asottile.

4.5.1 - 2025-12-16

Fixes

• Fix language: python with repo: local without additional_dependencies.
  • #3597 PR by @​asottile.

4.5.0 - 2025-11-22

Features

• Add pre-commit hazmat.
  • #3585 PR by @​asottile.

4.4.0 - 2025-11-08

... (truncated)

Commits

• 242ce8a v4.6.1
• 766e550 Merge pull request #3727 from pre-commit/dedupe
• 1558d06 Merge pull request #3726 from pre-commit/exists-faster
• 8a1c47a avoid duplicate files in --all-files during conflict
• 2e01c99 faster check of rev existing locally as a commit
• 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
• 1d811d9 Return an error for invalid --repo
• 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
• 1e7994f set JULIA_DEPOT_PATH
• b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
• Additional commits viewable in compare view

Updates ruff to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates mypy to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

• No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

• Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
• Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
• Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
• Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
• Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
• 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
• 24c237d [mypyc] Improve documentation of Final (#21713)
• b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
• cbcb51a Narrow for frozendict membership check (#21709)
• af2bc0f Sync typeshed (#21707)
• Additional commits viewable in compare view

Updates azure-cosmos from 4.16.1 to 4.16.3

Release notes

Sourced from azure-cosmos's releases.

azure-cosmos_4.16.3

4.16.3 (2026-07-29)

Bugs Fixed

• Fixed regression introduced in 4.16.0 on 47105 for complete-partition-key queries scanning documents instead of using partition-key routing, which caused excessive RU consumption and latency for aggregates such as COUNT. See PR 48237

azure-cosmos_4.16.2

4.16.2 (2026-07-15)

Features Added

• Added GlobalSecondaryIndexDefinition class and global_secondary_index keyword to create_container, create_container_if_not_exists, and replace_container methods for creating Global Secondary Index (GSI) containers. See PR 47468.

Bugs Fixed

• Fixed KeyError: 'version' in SessionContainer.get_session_token (sync and async) when the container's partitionKey definition returned by the service does not include the optional version field. The error was silently swallowed by a broad except, causing the client to send no x-ms-session-token header on subsequent reads. Against the Dedicated Gateway, this turned every Session-consistency read into an Integrated Cache miss. partitionKey.version is now treated as optional and defaults to 1, matching how PartitionKey handles a missing version. See PR 47143

Commits

• 783e9ea Decision log of Identity (#47466)
• 0e82833 adding changelog date (#48347)
• 35fc155 [Storage] STG 103/104 Features (#47642)
• a2ee453 Disable mindependency testing for cosmos (#48345)
• fbc061f fix - full partition key routing bug (#48237)
• 2ee072f Prepare azure-ai-agentserver-responses release (#48342)
• eb70b1d Decouple AgentServer responses from generated model internals (#47995)
• 995c8e7 [AutoPR azure-mgmt-discovery]-generated-from-SDK Generation - Python-6632123 ...
• 9f27733 [agentserver-core] Set 2.0.0b9 release date to 2026-07-28 (#48338)
• 11dfc50 Add aio namespace for agentserver response event streams (#47785)
• Additional commits viewable in compare view

Updates openai from 2.45.0 to 2.50.0

Release notes

Sourced from openai's releases.

v2.50.0

2.50.0 (2026-07-28)

Full Changelog: v2.49.0...v2.50.0

Features

• api: transcription model updates (fd57393)

Bug Fixes

• audio: restore transcription keyword overload (713a262)

v2.49.0

2.49.0 (2026-07-27)

Full Changelog: v2.48.0...v2.49.0

Features

• require Python 3.10 and automate version reviews (#3537) (d4c151d)

v2.48.0

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

• api: accept None for prompt_cache_key/safety_identifier (36820e6)
• api: add support for spend_limit admin apis (1ff13af)

v2.47.0

2.47.0 (2026-07-21)

Full Changelog: v2.46.0...v2.47.0

Features

• client: Add experimental runtime support for HTTPX2 clients (#3524) (317260c)
• stlc: configurable CI runner and private-production-repo support in workflow templates (4303e97)

Bug Fixes

• deps: require patched aiohttp on Python 3.10+ (#3515) (d4dceb2)

v2.46.0

2.46.0 (2026-07-17)

... (truncated)

Changelog

Sourced from openai's changelog.

2.50.0 (2026-07-28)

Full Changelog: v2.49.0...v2.50.0

Features

• api: transcription model updates (fd57393)

Bug Fixes

• audio: restore transcription keyword overload (713a262)

2.49.0 (2026-07-27)

Full Changelog: v2.48.0...v2.49.0

Features

• require Python 3.10 and automate version reviews (#3537) (d4c151d)

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

• api: accept None for prompt_cache_key/safety_identifier (36820e6)
• api: add support for spend_limit admin apis (1ff13af)

2.47.0 (2026-07-21)

Full Changelog: v2.46.0...v2.47.0

Features

• client: Add experimental runtime support for HTTPX2 clients (#3524) (317260c)
• stlc: configurable CI runner and private-production-repo support in workflow templates (4303e97)

Bug Fixes

• deps: require patched aiohttp on Python 3.10+ (#3515) (d4dceb2)

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

... (truncated)

Commits

• 4f40426 release: 2.50.0
• 92594f1 fix(audio): restore transcription keyword overload
• 59ed1dc feat(api): transcription model updates
• 6ba31bc release: 2.49.0 (#3539)
• 90483ad test: support a hermetic local API reference (#3542)
• d4c151d feat: require Python 3.10 and automate version reviews (#3537)
• 8a6adcb release: 2.48.0
• cbd2fba feat(api): add support for spend_limit admin apis
• 00709f2 feat(api): accept None for prompt_cache_key/safety_identifier
• e67afa8 release: 2.47.0
• Additional commits viewable in compare view

Updates eventlet from 0.41.0 to 0.41.1

Changelog

Sourced from eventlet's changelog.

0.41.1

• Bump actions dependent on nodejs 20 (#1091)
• wsgi: Handle ENOTCONN (#1092)

Commits

• 475e2fd Update changelog for version 0.41.1 (#1095)
• 22e2ad3 Fix 4 DNS tests that fail without /etc/resolv.conf (#1093)
• a101b94 Temporarily avoid using newer greenlet (#1099)
• 9ae53a3 wsgi: Handle ENOTCONN (#1092)
• 176808f Bump actions dependent on nodejs 20 (#1091)
• See full diff in compare view

Updates gradio from 6.20.0 to 6.21.0

Release notes

Sourced from gradio's releases.

gradio@6.21.0

Features

• #13601 0ee5cc8 - Preserve browser-visible proxy origins for frontend assets and API requests, and retain app-level FastAPI root paths. Thanks @​abidlabs!
• #13620 5200235 - Fix chained events after cancellation and while the browser tab is hidden. Thanks @​abidlabs!
• #13667 2d753d0 - oauth: let API callers supply a token for endpoints that take a gr.OAuthToken, via oauth_token on the Python and JS clients — sent only to endpoints that declare they need one. Thanks @​abidlabs!
• #13329 7ac583a - Make builds go zoom zoom. Thanks @​pngwn!
• #13650 8bdc643 - Fix gradio cc dev, gradio cc build, and gradio cc install to respect a custom FRONTEND_DIR set on the component class, instead of assuming the frontend code lives in the frontend directory. Thanks @​abidlabs!
• #13558 d07af9d - workflow: add model endpoint integration. Thanks @​hannahblair!
• #13681 eed6ebd - Report why the Node SSR server failed, and serve without SSR on the expected port. Thanks @​abidlabs!
• #13654 2f6d04a - workflow: improve canvas authoring and examples. Thanks @​abidlabs!
• #13606 04c5527 - Fix spurious separators from empty tokens in HighlightedText with combine_adjacent=True. Thanks @​hysts!
• #13668 3473879 - workflow: add html modality. Thanks @​hannahblair!
• #13666 d3c70fa - workflow: various UX improvements, including opening the write-access link in a browser tab automatically when a gr.Workflow is launched locally, and calling vision-language models through chat completions so image-text-to-text model nodes work. Thanks @​abidlabs!
• #13590 d5ef897 - workflow: fix error banner and textarea visibility. Thanks @​hannahblair!
• #13616 a2ddecf - workflow: ensure we handle trailing null values. Thanks @​hannahblair!

Fixes

• #13627 3b12faa - Keep in-flight events and generators working when an app is hot-reloaded (gradio app.py). Thanks @​abidlabs!
• #13622 95369a3 - Fix Windows filename/path handling (reserved names, node probe, file URLs). Thanks @​abidlabs!
• #13613 195593e - Rerun HTML mount behavior when gr.render replaces an unkeyed component. Thanks @​abidlabs!
• #13626 7d71469 - Reset audio playback position when the file is cleared or a new one is uploaded. Thanks @​hysts!
• #13662 3aa5d5b - Strip <style> and <link> elements when sanitizing HTML in the frontend. Thanks @​hysts!
• #13671 b844e74 - Fix crash when a streaming gr.ChatInterface function yields nothing. Thanks @​hysts!
• #13612 0286f2c - workflow: use anyio.to_thread to send sync server functions to thread pool. Thanks @​hannahblair!
• #13658 bad052c - Fix ColorPicker dispatching blur while the user is still using the picker dialog. Thanks @​hysts!
• #13676 8c69a96 - Stop deep-copying chat messages so components work as chat content again. Thanks @​hysts!
• #13605 f3889bf - Fix gr.Code not rendering when it has no initial value. Thanks @​hysts!
• #13666 d3c70fa - cli: don't delete the installed skill when an agent's skills directory is a symlink to the central location. Thanks @​abidlabs!
• #13661 8647a06 - Keep fullscreen component controls inside the visible viewport when the page has a scrollbar. Thanks @​hysts!
• #13607 c287b7b - Fix gr.State passing its callable default to event handlers instead of the called value. Thanks @​hysts!
• #13639 1535d69 - Fix hidden tab focus and label overflow menu. Thanks @​dawoodkhan82!
• #13678 46e511b - Only remount a plot when its payload changes. Thanks @​hysts!
• #13660 80d67ad - Upload recorded audio only once to fix intermittent Content-Length errors when loading recordings. Thanks @​hysts!

Changelog

Sourced from gradio's changelog.

6.21.0

Features

• #13601 0ee5cc8 - Preserve browser-visible proxy origins for frontend assets and API requests, and retain app-level FastAPI root paths. Thanks @​abidlabs!
• #13620 5200235 - Fix chained events after cancellation and while the browser tab is hidden. Thanks @​abidlabs!
• #13667 2d753d0 - oauth: let API callers supply a token for endpoints that take a gr.OAuthToken, via oauth_token on the Python and JS clients — sent only to endpoints that declare they need one. Thanks @​abidlabs!
• #13329 7ac583a - Make builds go zoom zoom. Thanks @​pngwn!
• #13650 8bdc643 - Fix gradio cc dev, gradio cc build, and gradio cc install to respect a custom FRONTEND_DIR set on the component class, instead of assuming the frontend code lives in the frontend directory. Thanks @​abidlabs!
• #13558 d07af9d - workflow: add model endpoint integration. Thanks @​hannahblair!
• #13681 eed6ebd - Report why the Node SSR server failed, and serve without SSR on the expected port. Thanks @​abidlabs!
• #13654 2f6d04a - workflow: improve canvas authoring and examples. Thanks @​abidlabs!
• #13606 04c5527 - Fix spurious separators from empty tokens in HighlightedText with combine_adjacent=True. Thanks @​hysts!
• #13668 3473879 - workflow: add html modality. Thanks @​hannahblair!
• #13666 d3c70fa - workflow: various UX improvements, including opening the write-access link in a browser tab automatically when a gr.Workflow is launched locally, and calling vision-language models through chat completions so image-text-to-text model nodes work. Thanks @​abidlabs!
• #13590 d5ef897 - workflow: fix error banner and textarea visibility. Thanks @​hannahblair!
• #13616 a2ddecf - workflow: ensure we handle trailing null values. Thanks @​hannahblair!

Fixes

• #13627 3b12faa - Keep in-flight events and generators working when an app is hot-reloaded (gradio app.py). Thanks @​abidlabs!
• #13622 95369a3 - Fix Windows filename/path handling (reserved names, node probe, file URLs). Thanks @​abidlabs!
• #13613 195593e - Rerun HTML mount behavior when gr.render replaces an unkeyed component. Thanks @​abidlabs!
• #13626 7d71469 - Reset audio playback position when the file is cleared or a new one is uploaded. Thanks @​hysts!
• #13662 3aa5d5b - Strip <style> and <link> elements when sanitizing HTML in the frontend. Thanks @​hysts!
• #13671 b844e74 - Fix crash when a streaming gr.ChatInterface function yields nothing. Thanks @​hysts!
• #13612 0286f2c - workflow: use anyio.to_thread to send sync server functions to thread pool. Thanks @​hannahblair!
• #13658 bad052c - Fix ColorPicker dispatching blur while the user is still using the picker dialog. Thanks @​hysts!
• #13676 8c69a96 - Stop deep-copying chat messages so components work as chat content again. Thanks @​hysts!
• #13605 f3889bf - Fix gr.Code not rendering when it has no initial value. Thanks @​hysts!
• #13666 d3c70fa - cli: don't delete the installed skill when an agent's skills directory is a symlink to the central location. Thanks @​abidlabs!
• #13661 8647a06 - Keep fullscreen component controls inside the visible viewport when the page has a scrollbar. Thanks @​hysts!
• #13607 c287b7b - Fix gr.State passing its callable default to event handlers instead of the called value. Thanks @​hysts!
• #13639 1535d69 - Fix hidden tab focus and label overflow menu. Thanks @​dawoodkhan82!
• #13678 46e511b - Only remount a plot when its payload changes. Thanks @​hysts!
• #13660 80d67ad - Upload recorded audio only once to fix intermittent Content-Length errors when loading recordings. Thanks @​hysts!

Commits

• 0fd56c1 chore: update versions (#13691)
• a1c3ffc fix: recover unpublished 6.21 release (#13690)
• c3c5c67 Revert "fix: recover unpublished 6.21 release"
• dfdae7a fix: recover unpublished 6.21 release
• cf6eb09 chore: update versions (#13609)
• 2d753d0 Let API callers supply a token for gr.OAuthToken endpoints (#13667)
• 3aa5d5b Strip \<style> and \<link> elements when sanitizing HTML in the frontend (#...
• 46e511b Only remount a plot when its payload changes (#13678)
• b844e74 Fix crash when a streaming gr.ChatInterface function yields nothing (#13671)
• 8c69a96 Stop deep-copying chat messages so components work as chat content again (#13...
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.43.0 to 1.44.0

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.44.0/0.65b0 (2026-07-16)

Added

• opentelemetry-docker-tests: Refactor Docker tests to properly validate contents of exported telemetry (#5220)
• opentelemetry-exporter-otlp-common: add shared package for common OTLP utilities (#5252)
• opentelemetry-sdk: add MissingDependencyError exception for declarative configuration and use it for missing optional dependency errors (#5265)
• opentelemetry-sdk: Add ability to refresh process dependent Resource attributes (#5280)
• opentelemetry-sdk: add force_flush method to LogRecordExporter ABC (#5294)
• ope...

  Description has been truncated

[github-actions]

ℹ️ This Dependabot update was not auto-merged (production dependency or non-trivial change). Manual review requested.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[github-actions]

🔐 CodeQL — Open Alerts on this PR

Severity	Count
medium	57
high	95
error	109
warning	85
note	701

Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.
See the full list in the Security tab.