Skip to content

deps(lora): bump the lora-deps group across 1 directory with 18 updates - #1202

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-8072a0ae6a
Closed

deps(lora): bump the lora-deps group across 1 directory with 18 updates#1202
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-8072a0ae6a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on sentence-transformers, nltk, bitsandbytes, matplotlib, scipy, fastapi, uvicorn, pydantic, onnxruntime, datasets, transformers, peft, tqdm, numpy, azure-ai-ml, azure-storage-blob, mlflow and torch to permit the latest version.
Updates sentence-transformers to 6.0.1

Release notes

Sourced from sentence-transformers's releases.

v6.0.1 - Restore the PyLate prefix on prompted checkpoints, 80 documented multi-vector models

This patch release fixes a multi-vector loading bug: PyLate checkpoints that carry both a [Q]/[D] prefix and a text prompt lost the prefix, so they were encoded without a marker they were trained with. It also grows the documented multi-vector model tables from 51 checkpoints to 80.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==6.0.1
Inference only, use one of:
pip install sentence-transformers==6.0.1
pip install sentence-transformers[onnx-gpu]==6.0.1
pip install sentence-transformers[onnx]==6.0.1
pip install sentence-transformers[openvino]==6.0.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.0.1
pip install sentence-transformers[audio]==6.0.1
pip install sentence-transformers[video]==6.0.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==6.0.1

Compose the PyLate prefix with the saved prompt (#3968)

PyLate supports a prefix as well as prompt text, and Sentence Transformers assumed that these were mutually exclusive. However, the following three checkpoints carry both a prefix and a prompt, and were trained with the prefix prepended to the prompt text:

PyLate trained these checkpoints on [CLS] [Q] search_query: ... and [CLS] [D] search_document: ..., but Sentence Transformers dropped the prefix and encoded them as [CLS] search_query: ... and [CLS] search_document: .... After the fix, the performance of the ColBERT-Zero model improved from 0.6569 NDCG@10 to 0.6824 on the NanoBEIR benchmark. To my knowledge, only these 3 checkpoints used both a prefix and a prompt, so this is the only case where the bug would have affected you.

Forward task to routed modules in Router.preprocess (#3967)

Router.forward has always passed task down to the routed module, but Router.preprocess did not, so anything a module does with the task at preprocessing time did nothing behind a Router: query_length and document_length caps, query_expansion, and the chat-template task keyword. No released checkpoint combines a Router with those settings, so this is a latent bug rather than one you are likely to have hit. It would have affected anyone building such a model themselves, with no error to indicate it.

Documentation

  • The multi-vector pretrained models tables grew from 29 text and 22 visual document retrieval checkpoints to 38 and 42 (#3963, #3969), with revision and trust_remote_code notes refreshed as upstream pull requests merged (#3972).
  • Documented which Hub tag to filter on for each model type (#3964), and linked the Multi-Vector Encoder blogposts from the docs (#3966).
  • Added MultiVectorEncoder to the Agent Skill README and refreshed the SauerkrautLM scores (#3955).
  • Corrected the minimum versions in the README (#3952). It still recommended PyTorch 1.11.0+ and transformers v4.41.0+, where v6.0 requires PyTorch 2.2+ and transformers v5.0+. This is the text rendered as the PyPI project description.

All Changes

... (truncated)

Commits
  • b0acd1a Update README installation versions
  • 9b415ac Release v6.0.1
  • cc0669c Add/update revisions for pretrained MVE models (#3972)
  • f8390f4 [docs] Refresh the MultiVectorEncoder pretrained models tables (#3969)
  • 4b51722 [fix] Compose the PyLate prefix with the saved prompt (#3968)
  • e99c4a9 [fix] Forward task to routed modules in Router.preprocess (#3967)
  • 5d2ec93 [docs] Link the Multi-Vector Encoder blogposts (#3966)
  • 9c5de2a [docs] Clarify which Hub tags to filter on for each model type (#3964)
  • 83680bd [docs] Add more MultiVectorEncoder models to the pretrained models tables (#3...
  • 1a43278 docs: Add MultiVectorEncoder to the skills README, refresh the SauerkrautLM s...
  • Additional commits viewable in compare view

Updates nltk to 3.10.3

Release notes

Sourced from nltk's releases.

v3.10.3

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

What's Changed

New Contributors

Full Changelog: nltk/nltk@v3.10.2...v3.10.3

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • 303f6e2 Prepare release 3.10.3 (#3745)
  • cf2aaac Merge pull request #3744 from alvations/ci-guard-open
  • 6cd8320 test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)
  • e965330 fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...
  • df1bb4c test: make pathsec security tests platform-independent (fix Linux/Windows CI)
  • 0e5c7be ci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)
  • 5017826 Merge commit from fork
  • 40d0f06 Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...
  • 483c5fe Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...
  • 722778f Merge commit from fork
  • Additional commits viewable in compare view

Updates bitsandbytes to 0.50.2

Release notes

Sourced from bitsandbytes's releases.

0.50.2

Highlights

  • ROCm 10.0 build is now included for both Linux and Windows.
  • Additional AMD GPU targets are included in our prebuilt wheels.
  • Performance improvement for certain 4bit GEMM shapes on NVIDIA GB10.

What's Changed

New Contributors

Full Changelog: bitsandbytes-foundation/bitsandbytes@0.50.1...0.50.2

Changelog

Sourced from bitsandbytes's changelog.

v0.45.1

Improvements:

  • Compatibility for triton>=3.2.0
  • Moved package configuration to pyproject.toml
  • Build system: initial support for NVIDIA Blackwell B100 GPUs, RTX 50 Blackwell series GPUs and Jetson Thor Blackwell.
    • Note: Binaries built for these platforms are not included in this release. They will be included in future releases upon the availability of the upcoming CUDA Toolkit 12.7 and 12.8.

Bug Fixes:

  • Packaging: wheels will no longer include unit tests. (#1478)

Dependencies:

  • Sets the minimum PyTorch version to 2.0.0.

0.45.0

This is a significant release, bringing support for LLM.int8() to NVIDIA Hopper GPUs such as the H100.

As part of the compatibility enhancements, we've rebuilt much of the LLM.int8() code in order to simplify for future compatibility and maintenance. We no longer use the col32 or architecture-specific tensor layout formats while maintaining backwards compatibility. We additionally bring performance improvements targeted for inference scenarios.

Performance Improvements

This release includes broad performance improvements for a wide variety of inference scenarios. See this X thread for a detailed explanation.

Breaking Changes

🤗PEFT users wishing to merge adapters with 8-bit weights will need to upgrade to peft>=0.14.0.

Packaging Improvements

  • The size of our wheel has been reduced by ~43.5% from 122.4 MB to 69.1 MB! This results in an on-disk size decrease from ~396MB to ~224MB.
  • Binaries built with CUDA Toolkit 12.6.2 are now included in the PyPI distribution.
  • The CUDA 12.5.0 build has been updated to CUDA Toolkit 12.5.1.

Deprecations

  • A number of public API functions have been marked for deprecation and will emit FutureWarning when used. These functions will become unavailable in future releases. This should have minimal impact on most end-users.
  • The k-bit quantization features are deprecated in favor of blockwise quantization. For all optimizers, using block_wise=False is not recommended and support will be removed in a future release.
  • As part of the refactoring process, we've implemented many new 8bit operations. These operations no longer use specialized data layouts.

Full Changelog

0.44.1

Bug fixes:

... (truncated)

Commits
  • 08a9956 Release 0.50.2
  • 4f1fc6c [ROCm] Add CI for ROCm 10.0 (#2061)
  • 906ff4d ci: expand ROCm architecture coverage (#2046)
  • d9e4440 Restore Wave64 warp size for all gfx9 targets (#2059)
  • 3fe95b5 Revert "[ROCm] Rework ROCm build to use ROCm version instead of HIP version (...
  • 3ac90c4 [ROCm] Rework ROCm build to use ROCm version instead of HIP version (#1888)
  • 95f9af3 chore(deps): bump the actions group across 1 directory with 2 updates (#2036)
  • d2d08f6 Add sm121 (GB10) to the wide_n_simt 4-bit GEMM dispatch rule (#2039)
  • d8ccdd9 Mask the absmax store in the Triton 4-bit quantize kernels (#2043)
  • 2b6cfb7 Bump dev version
  • Additional commits viewable in compare view

Updates matplotlib to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

  • Fix tight layout of multiple subplots with sharey=True
  • Fix NoNorm cursor formatting for uint8 images
  • Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
  • Fix clipped Axis labels on 3D plots with tight layout
  • Fix inverted Axis on 3D plots
  • Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
  • Fix missing glyphs when subsetting Type 1 fonts in PDF
  • Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits
  • 3c1757a REL: v3.11.1
  • 792c6b5 DOC: Prepare for 3.11.1
  • aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
  • d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
  • 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
  • 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
  • c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
  • 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
  • a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
  • 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
  • Additional commits viewable in compare view

Updates scipy to 1.18.1

Release notes

Sourced from scipy's releases.

SciPy 1.18.1 Release Notes

SciPy 1.18.1 is a bug-fix release with no new features compared to 1.18.0. This release includes binaries on PyPI for Python 3.15, and the minimum required version of the GCC toolchain has been increased to 10.3.0.

Authors

  • Name (commits)
  • Wasim Akram (2) +
  • Jake Bowhay (1)
  • Michael Bratsch (1)
  • Dietrich Brunn (1)
  • Evgeni Burovski (1)
  • Aadya Chinubhai (1)
  • Lucas Colley (3)
  • Tekin Ertekin (1) +
  • Fuyugithub (2) +
  • Ralf Gommers (11)
  • Joren Hammudoglu (1)
  • Ijtihed Kilani (1) +
  • Andrew Nelson (2)
  • Ilhan Polat (1)
  • Tyler Reddy (39)
  • romao05 (1) +
  • Michael Simacek (1) +
  • Jacob Vanderplas (2)

A total of 18 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

Note that the source and binary assets associated with this release were published to PyPI using trusted publishing, and so the trusted assets and their hashes are made available more securely at https://pypi.org/project/scipy/1.18.1/ rather than providing them here in a less secure manner.

A complete list of issues and pull requests associated with this release is available in the associated README.txt.

Commits
  • e4e854e REL: SciPy 1.18.1 rel commit
  • 3c8e5f8 BLD, MAINT: pythran bounds for 1.18.1 (#25978)
  • 54c0f95 BLD, MAINT: pythran bounds for 1.18.1
  • 45a355d Merge pull request #25884 from tylerjereddy/treddy_backports_1.18.1
  • a717e28 DOC: PR 25884 revisions
  • bb489c0 DOC: PR 25884 revisions
  • 09bca24 BLD: package: pin meson on win-64 to avoid clang-cl bug (#25913)
  • 095fe56 DOC, BLD: PR 25884 revisions
  • e66ea64 DOC: update minimum GCC version in toolchain roadmap
  • c021653 TST: tolerance bumps and skips on 32-bit platforms
  • Additional commits viewable in compare view

Updates fastapi to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates uvicorn to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
  • Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

  • Add an experimental zttp HTTP/1.1 implementation, selectable with --http zttp (#2979)

Fixed

  • Keep non-ASCII WebSocket request headers intact with websockets 17.0, which encodes them with ISO-8859-1 (#3036)

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

... (truncated)

Commits

Updates pydantic to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates onnxruntime to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

  • onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
  • POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
  • The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

  • Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
  • Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
  • Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
  • Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
  • Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

  • Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

  • Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
  • Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
  • Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
  • Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

  • WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
  • Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
  • Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

  • Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
  • Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
  • Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
  • Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
  • Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

Updates datasets to 5.0.1

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

@dependabot
deps(lora): bump the lora-deps group across 1 directory with 18 updates
f3cc63c 
Updates the requirements on [sentence-transformers](https://github.com/huggingface/sentence-transformers), [nltk](https://github.com/nltk/nltk), [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes), [matplotlib](https://github.com/matplotlib/matplotlib), [scipy](https://github.com/scipy/scipy), [fastapi](https://github.com/fastapi/fastapi), [uvicorn](https://github.com/Kludex/uvicorn), [pydantic](https://github.com/pydantic/pydantic), [onnxruntime](https://github.com/microsoft/onnxruntime), [datasets](https://github.com/huggingface/datasets), [transformers](https://github.com/huggingface/transformers), [peft](https://github.com/huggingface/peft), [tqdm](https://github.com/tqdm/tqdm), [numpy](https://github.com/numpy/numpy), [azure-ai-ml](https://github.com/Azure/azure-sdk-for-python), [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python), [mlflow](https://github.com/mlflow/mlflow) and [torch](https://github.com/pytorch/pytorch) to permit the latest version.

Updates `sentence-transformers` to 6.0.1
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.6.0...v6.0.1)

Updates `nltk` to 3.10.3
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@v3.10.0...v3.10.3)

Updates `bitsandbytes` to 0.50.2
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.49.2...0.50.2)

Updates `matplotlib` to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1)

Updates `scipy` to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.18.0...v1.18.1)

Updates `fastapi` to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.141.1)

Updates `uvicorn` to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.51.0...0.52.4)

Updates `pydantic` to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `onnxruntime` to 1.29.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md)
- [Commits](microsoft/onnxruntime@v1.27.0...v1.29.0)

Updates `datasets` to 5.0.1
- [Release notes](https://github.com/huggingface/datasets/releases)
- [Commits](huggingface/datasets@5.0.0...5.0.1)

Updates `transformers` to 5.16.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.13.0...v5.16.1)

Updates `peft` to 0.20.0
- [Release notes](https://github.com/huggingface/peft/releases)
- [Commits](huggingface/peft@v0.19.1...v0.20.0)

Updates `tqdm` to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.4...v4.70.0)

Updates `numpy` to 2.5.2
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.1...v2.5.2)

Updates `azure-ai-ml` to 1.34.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-ai-ml_1.34.0...azure-ai-ml_1.34.1)

Updates `azure-storage-blob` to 12.30.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.30.0...azure-storage-blob_12.30.1)

Updates `mlflow` to 3.15.2
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v3.14.0...v3.15.2)

Updates `torch` to 2.14.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@ciflow/torchtitan/125995...v2.14.0)

---
updated-dependencies:
- dependency-name: sentence-transformers
  dependency-version: 6.0.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: nltk
  dependency-version: 3.10.3
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: bitsandbytes
  dependency-version: 0.50.2
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: onnxruntime
  dependency-version: 1.29.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: transformers
  dependency-version: 5.16.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: peft
  dependency-version: 0.20.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: numpy
  dependency-version: 2.5.2
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: azure-ai-ml
  dependency-version: 1.34.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: azure-storage-blob
  dependency-version: 12.30.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: mlflow
  dependency-version: 3.15.2
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: torch
  dependency-version: 2.14.0
  dependency-type: direct:production
  dependency-group: lora-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Bryan-Roe as a code owner September 7, 2026 04:15
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-8072a0ae6a branch September 14, 2026 04:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Bryan-Roe Bryan-Roe Awaiting requested review from Bryan-Roe Bryan-Roe is a code owner

Assignees

@Bryan-Roe Bryan-Roe

Labels

autofix dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Bryan-Roe