Skip to content

deps(lora): bump the lora-deps group across 1 directory with 8 updates - #1122

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-8fb8c49826
Open

deps(lora): bump the lora-deps group across 1 directory with 8 updates#1122
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-8fb8c49826

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on transformers, tqdm, sentence-transformers, bitsandbytes, matplotlib, fastapi, onnxruntime and azure-ai-ml to permit the latest version.
Updates transformers to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

Commits

Updates tqdm to 4.69.1

Release notes

Sourced from tqdm's releases.

tqdm v4.69.1 stable

Commits

Updates sentence-transformers to 5.6.1

Release notes

Sourced from sentence-transformers's releases.

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

This patch release fixes silently degraded embeddings for RoBERTa-family models when flash attention is requested with transformers v5, notably every XLM-R based multilingual embedding model (BAAI/bge-m3, intfloat/multilingual-e5-large, etc.). The bug affected v5.5.0, v5.5.1, and v5.6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.1
Inference only, use one of:
pip install sentence-transformers==5.6.1
pip install sentence-transformers[onnx-gpu]==5.6.1
pip install sentence-transformers[onnx]==5.6.1
pip install sentence-transformers[openvino]==5.6.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.1
pip install sentence-transformers[audio]==5.6.1
pip install sentence-transformers[video]==5.6.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.1

Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

Since v5.5.0, the Transformer module flattens text-only batches into one packed sequence when flash attention is requested, skipping all padding overhead for a notable performance improvement. The position_ids of that packed sequence restart at 0 for every text, which is correct for the vast majority of models. RoBERTa-family architectures however compute positions as padding_idx + 1 + n for the n-th token, so every token read a position embedding shifted by padding_idx + 1 (usually 2). Nothing crashes, the embeddings are just silently worse.

from sentence_transformers import SentenceTransformer
An affected configuration: flash attention with an XLM-R based model
model = SentenceTransformer(
"BAAI/bge-m3",
model_kwargs={"attn_implementation": "flash_attention_2"},
)

Measured on BAAI/bge-m3:

Evaluation padded packed, 0-based positions packed, with this fix
stsb test Spearman 0.8485 0.7239 0.8485
NanoBEIR mean nDCG@10 0.6041 0.5414 0.6050

The quality loss recovers exactly once the offset is applied. The fix scans the loaded model's modules once for an int padding_idx stored next to a learned position_embeddings table, and offsets the packed position_ids when that pair is found. An audit of transformers finds 16 architectures with that pair (roberta, xlm_roberta, xlm_roberta_xl, camembert, roberta_prelayernorm, xmod, data2vec_text, longformer, luke, ibert, mpnet, markuplm, lilt, layoutlmv3, esm, and pp_doclayout_v2), all offset by exactly padding_idx + 1, and no 0-based or rotary architecture matches.

You are only affected if you encoded text with flash attention requested on transformers v5 with a RoBERTa-family checkpoint. The default padded path (e.g. sdpa) was never affected, and neither were MPNet models like all-mpnet-base-v2 despite mpnet appearing in the audit: transformers does not support flash attention for MPNet at all. If you did index a corpus with such a configuration, re-encode it after upgrading: pre-fix embeddings score notably worse and do not mix with post-fix embeddings.

What's Changed

... (truncated)

Commits
  • 7d3eb16 Release v5.6.1
  • 286dcf3 [tests] Skip bf16 + Windows + CPU forwards, as they can WindowsError on tor...
  • 30bad93 [ci] Exclude librosa/numba/llvmlite on Python 3.13 (#3835)
  • 9ca6bbc 🚨 Fix position_ids offsetting for RoBERTa-family models when flattening input...
  • See full diff in compare view

Updates bitsandbytes to 0.50.0

Release notes

Sourced from bitsandbytes's releases.

0.50.0: Faster 4-bit inference, CPU/ROCm/Apple Silicon improvements, and more!

This release brings a new fused 4-bit GEMM for inference on CUDA and ROCm, faster CPU ops on x86-64 and ARM64, reduced host-side overhead, and a much improved Apple Silicon backend. We've also added Windows on ARM CPU support, ROCm builds for Windows, additional ROCm and CUDA build variants, and new optimizer support on CPU and Intel XPU.

Highlights

🚀 New 4-bit GEMM kernels for inference (CUDA)

New fused 4-bit dequantize + GEMM kernels replace the old GEMV and dequantize + F.linear paths for small-to-medium batch sizes. 4-bit inference is up to 4x faster at batch sizes of 2 through 64 across Turing through Blackwell, with wins at batch size 1 in many cases too. Nested (double) quantization and bias are fused in as well, so nested quant sees an additional benefit. Kernel selection happens automatically at runtime based on shape, GPU architecture, and SM count. See #1949 for benchmarks and details.

🚀 Fused 4-bit SIMT GEMM on ROCm

The SIMT version of the new 4-bit GEMM has been ported to ROCm and wired into the same dispatch for small inference batches, validated on gfx1100, gfx1201, and gfx1151 (#1979).

AMD ROCm improvements

Stability and performance improvements bring AMD ROCm support out of preview; it is now considered stable.

  • ROCm wheels for Windows are now published for ROCm 7.2 and 7.14 (#1915, #2007).
  • Added ROCm 7.14 and dropped the ROCm 6.2 and 6.3 builds (#2007).
  • Expanded GPU target coverage to add RDNA2 consumer GPUs, additional RDNA3 and RDNA3.5 GPUs, and CDNA1 (gfx908) data center GPUs (#1886, #2007).

Apple Silicon (MPS)

Apple Silicon support is improved. The MPS backend added optimized Metal kernels from the Hub (#1875) and was substantially improved (#1960, #1983, #1994) so that all 4-bit and LLM.int8() configurations now work on MPS. On macOS 26+, install the kernels package for the best performance, which enables the optimized Metal kernels; otherwise a naive fallback is used. The MPS path requires torch >= 2.9.

The last remaining feature for support parity is the 8bit optimizers, which will land in a future release.

CPU performance on x86-64 and ARM64

Blockwise quantization and dequantization on CPU are considerably faster, mostly from better SIMD usage plus some compile flag tuning. Improvements range from 1.1x to over 20x depending on op, dtype, and hardware, with the largest gains on fp16 and on x86-64 CPUs without AVX-512. The LLM.int8() matmul on CPU was improved as well. See #1968 for benchmarks.

Reduced host-side CPU overhead

Reduced Python dispatch overhead, especially on the CUDA/ROCm backend (#1953).

Windows on ARM CPU support

Windows ARM64 CPU wheels are now built with NEON-optimized kernels (#1959), with nightly test coverage added (#1962).

New optimizer support

  • CPU optimizers are now supported for both 32-bit and 8-bit blockwise (#1901).
  • Intel XPU gained paged optimizer support (#1898) and support for the LARS and LAMB optimizers (#1902).
  • Fixed Lion to use decoupled weight decay (#1993, #2001).
  • Other optimizer fixes (#1869, #1998, #1855).

NVIDIA CUDA

  • Added CUDA 13.2 build wheels and nightly test coverage (#1925).
  • Smaller wheels: reduced the CUDA build matrix and added a closest-version fallback for library loading (#1980).

Intel XPU

  • Added a oneAPI 2026 build; wheels now package both the 2025 and 2026 variants and pick the right one at runtime based on the PyTorch XPU version (#2002).
  • Fixed gemv_4bit bf16 correctness on Intel Arc A-series (Alchemist) GPUs (#1942).

🚨 Breaking Changes

  • Minimum PyTorch version is now 2.4 (#1926).
  • Removed deprecated APIs: the research module, non-blockwise (block_wise=False) optimizers, and legacy dynamic quantization functions, along with their CUDA/HIP kernels (#1871, #1880).
  • Removed legacy sparse functionality (spmm_coo, spmm_coo_very_sparse) and dropped the cusparse/hipsparse dependencies (#1881).

... (truncated)

Changelog

Sourced from bitsandbytes's changelog.

v0.45.1

Improvements:

  • Compatibility for triton>=3.2.0
  • Moved package configuration to pyproject.toml
  • Build system: initial support for NVIDIA Blackwell B100 GPUs, RTX 50 Blackwell series GPUs and Jetson Thor Blackwell.
    • Note: Binaries built for these platforms are not included in this release. They will be included in future releases upon the availability of the upcoming CUDA Toolkit 12.7 and 12.8.

Bug Fixes:

  • Packaging: wheels will no longer include unit tests. (#1478)

Dependencies:

  • Sets the minimum PyTorch version to 2.0.0.

0.45.0

This is a significant release, bringing support for LLM.int8() to NVIDIA Hopper GPUs such as the H100.

As part of the compatibility enhancements, we've rebuilt much of the LLM.int8() code in order to simplify for future compatibility and maintenance. We no longer use the col32 or architecture-specific tensor layout formats while maintaining backwards compatibility. We additionally bring performance improvements targeted for inference scenarios.

Performance Improvements

This release includes broad performance improvements for a wide variety of inference scenarios. See this X thread for a detailed explanation.

Breaking Changes

🤗PEFT users wishing to merge adapters with 8-bit weights will need to upgrade to peft>=0.14.0.

Packaging Improvements

  • The size of our wheel has been reduced by ~43.5% from 122.4 MB to 69.1 MB! This results in an on-disk size decrease from ~396MB to ~224MB.
  • Binaries built with CUDA Toolkit 12.6.2 are now included in the PyPI distribution.
  • The CUDA 12.5.0 build has been updated to CUDA Toolkit 12.5.1.

Deprecations

  • A number of public API functions have been marked for deprecation and will emit FutureWarning when used. These functions will become unavailable in future releases. This should have minimal impact on most end-users.
  • The k-bit quantization features are deprecated in favor of blockwise quantization. For all optimizers, using block_wise=False is not recommended and support will be removed in a future release.
  • As part of the refactoring process, we've implemented many new 8bit operations. These operations no longer use specialized data layouts.

Full Changelog

0.44.1

Bug fixes:

... (truncated)

Commits

Updates matplotlib to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

  • Fix tight layout of multiple subplots with sharey=True
  • Fix NoNorm cursor formatting for uint8 images
  • Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
  • Fix clipped Axis labels on 3D plots with tight layout
  • Fix inverted Axis on 3D plots
  • Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
  • Fix missing glyphs when subsetting Type 1 fonts in PDF
  • Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits
  • 3c1757a REL: v3.11.1
  • 792c6b5 DOC: Prepare for 3.11.1
  • aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
  • d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
  • 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
  • 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
  • c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
  • 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
  • a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
  • 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
  • Additional commits viewable in compare view

Updates fastapi to 0.140.0

Release notes

Sourced from fastapi's releases.

0.140.0

Refactors

Docs

Internal

Commits

Updates onnxruntime to 1.28.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
    • CUDA_QUANT_PREPROCESS is off by default (#29687).
  • NPM packages are now published from the CUDA 13 pipeline (#28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
  • Validated Col2Im inputs to prevent heap over-read (#28706)
  • Hardened CropAndResize against malformed crop_size tensors (#28766)
  • Validated BeamSearch vocab_size against logits width (#28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
  • Clamped 1D attention mask_index to valid bounds (#29449)
  • Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
  • Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
  • Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
  • Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
  • Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
  • Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
  • Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
  • Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
  • Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

  • Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
  • Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
  • Hardened QMoE against integer overflow and partial K tiles (#29067)
  • Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
  • Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
  • Fixed integer overflow in RKNPU implicit bias allocation (#29249)
  • Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

... (truncated)

Commits
  • da9b5e3 Fix Windows zip artifact to include .inc header files (#29874)
  • 45de2a8 Fix NuGet packaging to include .inc files alongside .h headers (#29868)
  • 0368187 ORT 1.28.0 release cherry-pick round 2 (#29821)
  • e1bbb64 ORT 1.28.0 release cherry-pick round 1 (#29771)
  • a06675e Fix web e2e (npm/vite) and Python DML CI pipelines (#29609)
  • c4f1961 Bump onnx to 1.22.0 and protobuf to 6.33.5 to fix security CVEs (#29606)
  • e0ad071 [CUDA] Enable native SM90, block_size=32, and fused bias for fpA_intB MatMulN...
  • a1fc71e [CUDA] Fix QMoE profiler cross-stream race and CUDA-graph-capture safety (#29...
  • 5eb4aee Fix CustomOp forward compatibility: cap version instead of rejecting (#29574)
  • 7a12371 adjusts conv kernel to use get/set by offset helpers (#29463)
  • Additional commits viewable in compare view

Updates azure-ai-ml to 1.34.1

Release notes

Sourced from azure-ai-ml's releases.

azure-ai-ml_1.34.1

1.34.1 (2026-07-15)

Bugs Fixed

  • Fixed datastore create failing with TypeError: Object of type Datastore is not JSON serializable. The datastore operation was migrated to the TypeSpec client while the datastore entity still produced a legacy msrest model; the request body is now serialized to its wire form before being sent, keeping the on-the-wire request unchanged.
  • Fixed BatchEndpoint defaults serialization regression where deployment_name was sent to the service as snake_case instead of camelCase (deploymentName), causing begin_create_or_update to fail with "Could not find member 'deployment_name' on object of type 'BatchEndpointDefaults'". Serialization now emits the correct camelCase wire format, while BatchEndpoint.defaults returned from get() continues to expose an object that supports attribute access (e.g. endpoint.defaults.deployment_name), preserving backward compatibility with existing code and samples.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Updates the requirements on [transformers](https://github.com/huggingface/transformers), [tqdm](https://github.com/tqdm/tqdm), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes), [matplotlib](https://github.com/matplotlib/matplotlib), [fastapi](https://github.com/fastapi/fastapi), [onnxruntime](https://github.com/microsoft/onnxruntime) and [azure-ai-ml](https://github.com/Azure/azure-sdk-for-python) to permit the latest version.

Updates `transformers` to 5.14.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.13.0...v5.14.1)

Updates `tqdm` to 4.69.1
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.4...v4.69.1)

Updates `sentence-transformers` to 5.6.1
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.6.0...v5.6.1)

Updates `bitsandbytes` to 0.50.0
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.49.2...0.50.0)

Updates `matplotlib` to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1)

Updates `fastapi` to 0.140.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.140.0)

Updates `onnxruntime` to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.27.0...v1.28.0)

Updates `azure-ai-ml` to 1.34.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-ai-ml_1.34.0...azure-ai-ml_1.34.1)

---
updated-dependencies:
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: tqdm
  dependency-version: 4.69.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: sentence-transformers
  dependency-version: 5.6.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: bitsandbytes
  dependency-version: 0.50.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: fastapi
  dependency-version: 0.140.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: onnxruntime
  dependency-version: 1.28.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: azure-ai-ml
  dependency-version: 1.34.1
  dependency-type: direct:production
  dependency-group: lora-deps
...

Signed-off-by: dependabot[bot] <support@github.com>

# Use specific provider
maker = WebsiteMaker(provider_name='azure') # or 'openai', 'local'
maker = WebsiteMaker(provider_name="azure") # or 'openai', 'local'

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

You can view more details about this finding in the Semgrep AppSec Platform.

@github-actions github-actions Bot added documentation Improvements or additions to documentation quantum-ai labels Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant