Skip to content

Bump the all group across 1 directory with 5 updates - #326

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/all-ec6c7b2467
Open

Bump the all group across 1 directory with 5 updates#326
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/all-ec6c7b2467

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all group with 5 updates in the / directory:

Package From To
torch 2.13.0 2.14.0
torchvision 0.28.0 0.29.0
ruff 0.16.0 0.16.8
ty 0.0.65 0.0.83
huggingface-hub 1.25.1 1.32.0

Updates torch from 2.13.0 to 2.14.0

Release notes

Sourced from torch's releases.

PyTorch 2.14.0 Release Notes

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

  • torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

    The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

    Before:

    options = torch.nn.LinearCrossEntropyOptions(acc_policy="balanced")
loss = torch.nn.functional.linear_cross_entropy(
    input, linear_weight, target, options=options
)

    After:

    options = torch.nn.LinearCrossEntropyOptions(acc_policy="compact")
loss = torch.nn.functional.linear_cross_entropy(

... (truncated)

Commits
  • 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
  • 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
  • 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
  • 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
  • ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
  • 65890f3 Fix docker-release validate job to use the channel matching the pushed image ...
  • 1682388 Fix macOS py3.15 wheel builds: pin Cython < 3.3.0 and bump the cp315 numpy pi...
  • 9724418 Fix Windows py3.15 builds: constrain Cython < 3.3.0 and bump the cp315 numpy ...
  • f1b7554 [MPS] Fix pin_memory() recycling buffers still in use by the GPU (#194662)
  • 9f205f7 [MPS] fail loudly on large reductions (#194661)
  • Additional commits viewable in compare view

Updates torchvision from 0.28.0 to 0.29.0

Release notes

Sourced from torchvision's releases.

TorchVision 0.29: ABI stability!

TorchVision 0.29 is out! It comes with two major changes: ABI stability, and deprecation of the image decoders and encoders (now in TorchCodec)!

ABI Stability with torch 2.14

TorchVision is now ABI stable w.r.t. torch 2.14! This means that torchvision 0.29 will be compatible with future versions of torch: 2.15, 2.16, etc. You won’t need to install a new version of TorchVision when you upgrade torch.

As a result, we might stop releasing TorchVision in sync with pytorch. But TorchVision is still actively maintained and developed: we’ll still be pushing releases, just not with the same cadence.

Thanks to Adrian Abeyta @​adabeyta for the fantastic porting effort!

PRs: #9524, #9597, #9598, #9605, #9612, #9610, #9614, #9584, #9617, #9618, #9619, #9620, #9582, #9573, #9625, #9623, #9626, #9583, #9633, #9572, #9549, #9533, #9535, #9539, #9543, #9550, #9552, #9555, #9557, #9558, #9554

Image decoders and encoders are deprecated. Use TorchCodec!

The image decoders and encoders in torchvision.io are now deprecated, and they will be removed in a future release. They are now available in torchcodec >= 0.16, where they are significantly more capable. You’ll just need to pip install torchcodec, and you can refer to this migration guide for migrating your code (most APIs for decoding are the same).

This finalizes a clear separation of concerns for the three media-processing libraries of PyTorch: torchcodec is for decoding and encoding all media (images, videos, and audio), while torchvision and torchaudio focus on the transforms.

Bug fixes

[ops] Fix for deformable convolution kernels always running on default stream (#9522) [ops, MPS] Fix gradient overaccumulation in ROI ops (#9563, #9510) [transforms] Fix JPEG transform for non-contiguous batches (#9615)

Contributors

🎉 We're grateful for our community, which helps us improve Torchvision by submitting issues and PRs, and providing feedback and suggestions. The following persons have contributed patches for this release:

Adrian Abeyta, Andrey Talman, Dmitry Nikolaev, Irakli Salia, Jeff Daily , Kasra Ghodsi, Nicolas Hug, Nikita Shulga, Simon Byrne, Yutao Xu, Zhewen

Commits
  • fc73f5a Merge branch 'release/0.29' of github.com:pytorch/vision into release/0.29
  • f9b2669 [Cherry-pick for 0.29] (#9634)
  • e1b5802 Revert "Update version.txt for 0.30.0 (#9607)"
  • 2757376 Merge remote-tracking branch 'origin' into release/0.29
  • 9e21b88 Consolidate CUDA helpers and remove the legacy _C extension in place of Stabl...
  • 541c083 Port deform_conv2d (CUDA) to stable ABI. (#9626)
  • 2f411e7 Port ps_roi_pool (CUDA) to stable ABI. (#9623)
  • ae0ca92 Port ps_roi_align (CUDA) to stable ABI. (#9625)
  • ff1a18d Port roi_align (CUDA) to stable ABI. (#9573)
  • 8af7a68 Port roi_pool (CUDA) to stable ABI. (#9582)
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates ty from 0.0.65 to 0.0.83

Release notes

Sourced from ty's releases.

0.0.83

Release Notes

Released on 2026-09-21.

Bug fixes

  • Fix hangs from repeated partial application (#28754)
  • Preserve PEP 695 bindings across nested classes (#28723)

LSP server

  • Include required imports in every inlay hint (#28724)
  • Preserve fast name filtering for normalized Unicode source (#28701)
  • Refresh diagnostics after workspace configuration changes (#28755)

Diagnostic improvements

  • Expand unreachable-code annotations for redundant conditions (#28674)
  • Improve diagnostics for async generator stubs (#28692)
  • Improve primary diagnostic annotations for redundant-condition(-strict) diagnostics (#28666)
  • Point misplaced tuple ellipsis diagnostics at each ellipsis (#28709)

Other changes

  • Add rules that detect suspicious uses of Callable, Iterable, Iterator or Generator types in a boolean context (#28554)
  • Allow slots to override abstract properties (#28698)
  • Avoid leaking Unknown from unconstrained collection use-sites (#28659)
  • Diagnose unguarded cycles in implicit and PEP 613 aliases (#28704)
  • Eagerly bind unused Self receivers (#28662)
  • Generalize receiver binding for wrapped callables (#28725)
  • More faithful representation of bound methods (#28410)
  • Only classify evidence bounds for constrained type variables (#28700)
  • Preserve inferred bindings during annotation cycles (#28717)
  • Preserve quoted aliases during cycle recovery (#28710)
  • Reject class-scoped type variables in init receivers (#28706)
  • Reject unsafe TypedDict updates from hidden fields (#28711)
  • Respect fixed caller type variables when selecting constraints (#28652)
  • Reuse cached type alias inference for diagnostics (#28696)
  • Simplify unions of disjoint exclusions (#28684)
  • Update typing conformance suite (#28718)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.83

Released on 2026-09-21.

Bug fixes

  • Fix hangs from repeated partial application (#28754)
  • Preserve PEP 695 bindings across nested classes (#28723)

LSP server

  • Include required imports in every inlay hint (#28724)
  • Preserve fast name filtering for normalized Unicode source (#28701)
  • Refresh diagnostics after workspace configuration changes (#28755)

Diagnostic improvements

  • Expand unreachable-code annotations for redundant conditions (#28674)
  • Improve diagnostics for async generator stubs (#28692)
  • Improve primary diagnostic annotations for redundant-condition(-strict) diagnostics (#28666)
  • Point misplaced tuple ellipsis diagnostics at each ellipsis (#28709)

Other changes

  • Add rules that detect suspicious uses of Callable, Iterable, Iterator or Generator types in a boolean context (#28554)
  • Allow slots to override abstract properties (#28698)
  • Avoid leaking Unknown from unconstrained collection use-sites (#28659)
  • Diagnose unguarded cycles in implicit and PEP 613 aliases (#28704)
  • Eagerly bind unused Self receivers (#28662)
  • Generalize receiver binding for wrapped callables (#28725)
  • More faithful representation of bound methods (#28410)
  • Only classify evidence bounds for constrained type variables (#28700)
  • Preserve inferred bindings during annotation cycles (#28717)
  • Preserve quoted aliases during cycle recovery (#28710)
  • Reject class-scoped type variables in init receivers (#28706)
  • Reject unsafe TypedDict updates from hidden fields (#28711)
  • Respect fixed caller type variables when selecting constraints (#28652)
  • Reuse cached type alias inference for diagnostics (#28696)
  • Simplify unions of disjoint exclusions (#28684)
  • Update typing conformance suite (#28718)

Contributors

... (truncated)

Commits

Updates huggingface-hub from 1.25.1 to 1.32.0

Release notes

Sourced from huggingface-hub's releases.

[v1.32.0] Shared blob store, sandbox security hardening and faster imports

📂 [Cache] Shared blob store: deduplicate Xet files across repos

The cache now deduplicates Xet files across repos. A Xet file downloaded through hf_xet is stored once at <CACHE_DIR>/blobs/<prefix>/<xet_hash> and every repo that needs it gets a relative symlink instead of a download: no bytes are transferred and no extra space is used, even across different repos — or after the repo that first downloaded the file was deleted. The per-repo snapshot layout is unchanged, older clients keep reading and downloading normally, and any failure to share silently falls back to regular repo-local storage. Set HF_HUB_DISABLE_SHARED_BLOBS=1 to opt out entirely. Shared files carry a <xet_hash>.refs manifest listing the repo blobs referencing them, which hf cache rm consults on deletion and hf cache prune sweeps to reclaim payloads that no cached repo uses anymore.

📚 Documentation: Manage your cache

💻 [Jobs] Ship config inside UV scripts

A UV script that only runs correctly on a specific runtime can now carry that runtime with it. An optional [tool.hf-jobs] table in the script's PEP 723 header accepts image, flavor, python, timeout, name, namespace, env, secrets, labels, volumes, network_group and network_aliases, and hf jobs uv run reads it at submit time. CLI flags always win, and env/secrets/labels/volumes merge entry by entry instead of being replaced, so -e/-v add to what the script declares. Typos and unknown keys are rejected with the list of valid options, secrets are passed by name only (values come from your environment), and every run prints a config summary with script-sourced values marked and secrets redacted. Note that the table is read by the CLI only: run_uv_job() and create_scheduled_uv_job() ignore it.

# /// script
# requires-python = ">=3.11"
# dependencies = ["vllm", "datasets"]
#
# [tool.hf-jobs]
# image   = "vllm/vllm-openai:unlimited-ocr"
# flavor  = "l4x1"
# python  = "/usr/bin/python3"
# secrets = ["HF_TOKEN"]
# ///

📚 Documentation: Run and manage Jobs

  • [CLI] Read a UV script's [tool.hf-jobs] launch config (opus-generated) by @​Wauplin in #4598

🛡️ [Sandbox] security hardening

An internal security review of the Sandbox API resulted in a 9-PR hardening series. Pooled sandboxes now use their own per-sandbox capability token instead of the host-wide credential, pool hosts are fully validated (initiator, namespace, image, flavor, command, URL) before any credential is sent to them, the sbx-server binary is pinned by digest and verified before being run as PID 1, and the local pool cache is bound to the endpoint, credential and namespace that wrote it. Secret values no longer end up in argv when using hf sandbox exec --secrets, background processes are addressed by their server-assigned id (so kill() actually stops them and reports honestly), transfers and command output are bounded to avoid unbounded memory usage in the client, and pool ownership is decided per host so a with SandboxPool(...) block never again tears down a colleague's discovered host. The security documentation was also rewritten to state precisely what the sandbox contract is — and what it is not — including a new "Known limitations" section.

📚 Documentation: Sandboxes

  • [sandbox audit] Make the sandbox security contract match the implementation by @​Wauplin in #4831
  • [sandbox audit] Use each pooled sandbox's own capability token by @​Wauplin in #4832
  • [sandbox audit] Validate a pool host before sending it a credential by @​Wauplin in #4834
  • [sandbox audit] Bind the sandbox pool cache to the endpoint, credential and namespace that wrote it by @​Wauplin in #4838
  • [sandbox audit] Bound what a transfer or a command's output costs the client by @​Wauplin in #4839
  • [sandbox audit] Decide host teardown per host, and report it honestly by @​Wauplin in #4840
  • [sandbox audit] Address background processes by their server-assigned id by @​Wauplin in #4836
  • [sandbox audit] Pin the sandbox server binary by digest and verify it before running it by @​Wauplin in #4837
  • [sandbox audit] Keep secret values out of argv in the CLI and fix the env/secrets docs by @​Wauplin in #4835

🔒 Security hardening for serialization and validation

Three changes make the library safer against malicious or malformed inputs, with a stricter behavior worth noting. Torch checkpoint deserialization was hardened across 11 reported vulnerabilities: load_state_dict_from_file now defaults to safe=True (always using the safetensors loader), the pickle path defaults to weights_only=True, and unsafe combinations raise explicit errors instead of silently falling through. Path validation now rejects .. segments anywhere in path_in_repo (previously only a leading one was caught), so uploads like "a/../../etc/passwd" are refused. Finally, repo_id validation is restricted to ASCII word characters as documented, so non-ASCII ids like café are rejected client-side instead of failing later on the Hub.

... (truncated)

Commits
  • 8814aab Release: v1.32.0
  • 4457706 Release: v1.32.0.rc0
  • b064a14 [Download] Send X-HF-Download-Counter header on download calls (#4613)
  • 79dd41e [Docs] Fix hf discussions info options that do not exist (#4886)
  • d7b62c7 [CLI] Fix card data serialization (#4882)
  • f94ea55 [Buckets] Send mtime when copying files (#4920)
  • 6e3d21f [Cache] Add cross-repo shared blob store (#4498)
  • 5a9cdda [Core] Speed up package imports (#4914)
  • 2075fd6 [Cache] Support kernel repos in hf cache commands (#4905)
  • af6b41e [Core] Reject path traversal via embedded ".." segments in path_in_repo (#4884)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 10, 2026
@dependabot
dependabot Bot requested a review from ESultanik as a code owner September 10, 2026 11:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 10, 2026
@dependabot
Bump the all group across 1 directory with 5 updates
2bc6cc7 
Bumps the all group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [torch](https://github.com/pytorch/pytorch) | `2.13.0` | `2.14.0` |
| [torchvision](https://github.com/pytorch/vision) | `0.28.0` | `0.29.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.8` |
| [ty](https://github.com/astral-sh/ty) | `0.0.65` | `0.0.83` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.25.1` | `1.32.0` |



Updates `torch` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.13.0...v2.14.0)

Updates `torchvision` from 0.28.0 to 0.29.0
- [Release notes](https://github.com/pytorch/vision/releases)
- [Commits](pytorch/vision@v0.28.0...v0.29.0)

Updates `ruff` from 0.16.0 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.8)

Updates `ty` from 0.0.65 to 0.0.83
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.65...0.0.83)

Updates `huggingface-hub` from 1.25.1 to 1.32.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.25.1...v1.32.0)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: torch
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: torchvision
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ty
  dependency-version: 0.0.78
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/all-ec6c7b2467 branch from d40e24f to 2bc6cc7 Compare September 30, 2026 15:13

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ESultanik ESultanik Awaiting requested review from ESultanik ESultanik is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants