Bump the pip group across 3 directories with 5 updates by dependabot[bot] · Pull Request #4139 · AI-Hypercomputer/maxtext

dependabot · 2026-06-10T21:16:46Z

Bumps the pip group with 2 updates in the /src/dependencies/requirements/base_requirements directory: setuptools and torch.
Bumps the pip group with 1 update in the /src/dependencies/requirements/generated_requirements directory: torch.
Bumps the pip group with 3 updates in the /src/maxtext/inference/mlperf directory: sentencepiece, transformers and nltk.

Updates setuptools from 78.1.0 to 78.1.1

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

More fully sanitized the filename in PackageIndex._download. (#4946)

Commits

8e4868a Bump version: 78.1.0 → 78.1.1
100e9a6 Merge pull request #4951
8faf1d7 Add news fragment.
2ca4a9f Rely on re.sub to perform the decision in one expression.
e409e80 Extract _sanitize method for sanitizing the filename.
250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
d8390fe Extract _resolve_download_filename with test.
4e1e893 Merge https://github.com/jaraco/skeleton
3a3144f Fix typo: pyproject.license -> project.license (#4931)
d751068 Fix typo: pyproject.license -> project.license
Additional commits viewable in compare view

Updates torch from 2.11.0 to 2.12.0

Release notes

Sourced from torch's releases.

PyTorch 2.12.0 Release Notes

Highlights

Backwards Incompatible Changes

Deprecations

New Features

Improvements

Bug fixes

Performance

Documentation

Developers

Security

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Build Frontend
Strengthened SVE compile checks in FindARM.cmake, which may reject previously accepted but incorrect SVE configurations (#176646)

Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.
Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (#178925)

Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure CUDA_HOME points to that installation.

Version 2.11:
CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop
Version 2.12:
CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop
Enforced a C++20 minimum in CMake build files (#178662)

... (truncated)

Commits

0d62256 [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (#183346)
7661cd9 [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (#181886)
9da6087 Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes #182250) (#182369)
e4c37cc Avoid raw stream name collisions in Inductor (#182178)
822d047 [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (#182285) (#182311)
5c5e523 Add enable_gqa parameter to SDPA MPS meta registration (#181550)
eece52e [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...
b39330b [Inductor] Call latest c_shim version for versioned fallback ops (#181548)
06f10d0 Revert "[FSDP2] add fqn to communication ops" (#182100) (#182157)
449e339 Revert "[Inductor] Improve materialization heuristic for a chain of computaio...
Additional commits viewable in compare view

Updates torch from 2.11.0+cpu to 2.12.0

Release notes

Sourced from torch's releases.

PyTorch 2.12.0 Release Notes

Highlights

Backwards Incompatible Changes

Deprecations

New Features

Improvements

Bug fixes

Performance

Documentation

Developers

Security

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Build Frontend
Strengthened SVE compile checks in FindARM.cmake, which may reject previously accepted but incorrect SVE configurations (#176646)

Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.
Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (#178925)

Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure CUDA_HOME points to that installation.

Version 2.11:
CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop
Version 2.12:
CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop
Enforced a C++20 minimum in CMake build files (#178662)

... (truncated)

Commits

0d62256 [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (#183346)
7661cd9 [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (#181886)
9da6087 Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes #182250) (#182369)
e4c37cc Avoid raw stream name collisions in Inductor (#182178)
822d047 [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (#182285) (#182311)
5c5e523 Add enable_gqa parameter to SDPA MPS meta registration (#181550)
eece52e [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...
b39330b [Inductor] Call latest c_shim version for versioned fallback ops (#181548)
06f10d0 Revert "[FSDP2] add fqn to communication ops" (#182100) (#182157)
449e339 Revert "[Inductor] Improve materialization heuristic for a chain of computaio...
Additional commits viewable in compare view

Updates sentencepiece from 0.1.99 to 0.2.1

Release notes

Sourced from sentencepiece's releases.

v0.2.1

Major changes

[Python] Supported wheels and builds for Python 3.13 and 3.14(rc1) #1134, #1127, #1121, #1111, #1110, #1104, #1103, #1099, #1091

[Python] Added an experimental support for free-threading. #1134, #1127, #1110 https://github.com/google/sentencepiece/tree/master/python#free-threading-support

[Python] Updated the supported Python version to 3.9 or later.

New features

[ALL]: Added new build mode to prevent the precompiled normalization rules being embedded in *.so and *.a. (-DSPM_DISABLE_EMBEDDED_DATA=ON). This reduces the runtime size by approximately 1-2 MB. This mode is enabled to build python wheels. The rules are loaded as the data package.

Bug fixes & minor changes

[ALL]: Security fix to address a heap overflow issue that could occur when using a model containing an invalid precompiled normalization model.

[Python]: Deprecates the wheel package for Linux i686.

[Python]: Supported wheel for Windows Arm64. #1114

[Python]: Fixed the crash issue on batch decoding #1051

[ALL]: Updated the Unicode normalization rule with the latest ICU/Unicode rules.

[ALL]: Unused code and build mode cleanup.

v0.2.1pre2

Major changes

[Python] Supported wheels and builds for Python 3.13 and 3.14(rc0)

[Python] Added an experimental support for free-threading. https://github.com/google/sentencepiece/tree/master/python#free-threading-support

[Python] Updated the supported Python version to 3.9 or later.

New features

[ALL]: Added new build mode to prevent the precompiled normalization rules being embedded in *.so and *.a. (-DSPM_DISABLE_EMBEDDED_DATA=ON). This reduces the runtime size by approximately 1-2 MB. This mode is enabled to build python wheels. The rules are loaded as the data package.

Bug fixes & minor changes

[ALL]: Security fix to address a heap overflow issue that could occur when using a model containing an invalid precompiled normalization model.

[Python]: Deprecates the wheel package for Linux i686.

[Python]: Supported wheel for Windows Arm64.

[Python]: Fixed the crash issue on batch decoding #1051

[ALL]: Updated the Unicode normalization rule with the latest ICU/Unicode rules.

[ALL]: Unused code and build mode cleanup.

v0.2.0

Major changes

N/A

New features

[ALL] Added SentencePieceNormalizer class in C++/Python. It supports almost the equivalent feature of spm_normalize. Python Sample C++ Sample

[ALL] Added SentencePieceProcessor::Normalize method in C++/Python Python Sample C++ Sample

[ALL] Added functionality to override the normalization spec before the processing. Python Sample

Bug fixes & minor changes

Introduce better support of using external abseil and protobuf google/sentencepiece#869

Build universal binary in OSX release package google/sentencepiece#892

Add the set_min_log_level function to python to change the loglevel from the python wrapper. google/sentencepiece#893

Uses the logsumexp techniques in marginal probabilities of n-best tokenization to avoid underflow.

Support Python 3.12 google/sentencepiece#932

... (truncated)

Commits

31646a4 Merge pull request #1136 from crusaderky/pytest-run-parallel
bcd44b9 free-threading tests
135747f install twine before checking wheel
69fe0b2 install setuptools before making sdist
ee1422b install setuptools before making sdist
5ac2fd2 use windows-11-arm runner to test ARM64 wheel on native env.
36b9745 use windows-11-arm runner to test ARM64 wheel on native env.
4f043ae use auto-mode to make wheel with the native binary.
623196e uses arm docker image to build and test wheel
559fd65 re-enable QEMU to enable arm execution
Additional commits viewable in compare view

Updates transformers from 4.31.0 to 5.0.0rc3

Release notes

Sourced from transformers's releases.

Release candidate v5.0.0rc3

New models:

[GLM-4.7] GLM-Lite Supoort by @zRzRzRzRzRzRzR in huggingface/transformers#43031

[GLM-Image] AR Model Support for GLM-Image by @zRzRzRzRzRzRzR in huggingface/transformers#43100

Add LWDetr model by @sbucaille in huggingface/transformers#40991

Add LightOnOCR model implementation by @baptiste-aubertin in huggingface/transformers#41621

What's Changed

We are getting closer and closer to the official release! This RC is focused on removing more of the deprecated stuff, fixing some minors issues, doc updates.

Update Japanese README to match English version by @lilin-1 in huggingface/transformers#43069

[docs] Deploying by @stevhliu in huggingface/transformers#42263

[docs] inference engines by @stevhliu in huggingface/transformers#42932

Fix typos: Remove duplicate duplicate words words by @efeecllk in huggingface/transformers#43040

[style] Rework ruff rules and update all files by @Cyrilvallez in huggingface/transformers#43144

[CB] Minor fix in kwargs by @remi-or in huggingface/transformers#43147

[Bug] qwen2_5_omni: cap generation length to be less than the max_position_embedding in DiT by @sniper35 in huggingface/transformers#43068

Fix some deprecated practices in torch 2.9 by @Cyrilvallez in huggingface/transformers#43167

Fix Fuyu processor width dimension bug in _get_num_multimodal_tokens by @Abhinavexists in huggingface/transformers#43137

Inherit from PreTrainedTokenizerBase by @juliendenize in huggingface/transformers#43143

Generation config boolean defaults by @zucchini-nlp in huggingface/transformers#43000

Fix failing BartModelIntegrationTest by @Sai-Suraj-27 in huggingface/transformers#43160

fix failure of llava/pixtral by @sywangyi in huggingface/transformers#42985

GemmaTokenizer: remove redundant whitespace pre-tokenizer by @vaibhav-research in huggingface/transformers#43106

Support auto_doctring in Processors by @yonigozlan in huggingface/transformers#42101

Fix failing BitModelIntegrationTest by @Sai-Suraj-27 in huggingface/transformers#43164

[Fp8] Fix experts by @vasqu in huggingface/transformers#43154

Docs: improve wording for documentation build instructions by @Sailnagale in huggingface/transformers#43007

[makefile] Cleanup and improve the rules by @Cyrilvallez in huggingface/transformers#43171

Some new models added stuff that was already removed by @Cyrilvallez in huggingface/transformers#43179

Fixes and compilation warning in torchao docs by @merveenoyan in huggingface/transformers#42909

[cache] Remove all deprecated classes by @Cyrilvallez in huggingface/transformers#43168

Bump huggingface_hub minimal version by @Wauplin in huggingface/transformers#43188

Rework check_config_attributes.py by @Cyrilvallez in huggingface/transformers#43191

Fix generation config validation by @zucchini-nlp in huggingface/transformers#43175

[style] Use 'x | y' syntax for processors as well by @Wauplin in huggingface/transformers#43189

Remove deprecated objects by @Cyrilvallez in huggingface/transformers#43170

fix chunked prefill implementation issue-43082 by @marcndo in huggingface/transformers#43132

Reduce add_dates verbosity by @yonigozlan in huggingface/transformers#43184

Add support for MiniMax-M2 by @rogeryoungh in huggingface/transformers#42028

Fix failing salesforce-ctrl, xlm & gpt-neo model generation tests by @Sai-Suraj-27 in huggingface/transformers#43180

Less verbose library helpers by @Cyrilvallez in huggingface/transformers#43197

run all test files on CircleCI by @ydshieh in huggingface/transformers#43146

Clamp temperature to >=1.0 for Dia generation by @Haseebasif7 in huggingface/transformers#43029

Fix spelling typos in comments and code by @raimbekovm in huggingface/transformers#43046

[docs] llama.cpp by @stevhliu in huggingface/transformers#43185

... (truncated)

Commits

cb5079f v5.0.0rc3
d1808f2 [ci] Fixing some failing tests for important models (#43231)
3d27645 Add LightOnOCR model implementation (#41621)
77146cc fix crash in when running FSDP2+TP (#43226)
61317f5 [CB] Ensure parallel decoding test passes using FA (#43277)
1efe1a6 Fix failing PegasusX, Mvp & LED model integration tests (#43245)
e8ae373 [consistency] Ensure models are added to the _toctree.yml (#43264)
c85be98 [docs] tensorrt-llm (#43176)
38022fd [style] Fix init isort and align makefile and CI (#43260)
e977446 Fix failing Hiera, SwiftFormer & LED Model integration tests (#43225)
Additional commits viewable in compare view

Updates nltk from 3.8.1 to 3.9.4

Changelog

Sourced from nltk's changelog.

Version 3.9.4 2026-03-24

Support Python 3.14

Fix bug in Levenshtein distance when substitution_cost > 2

Fix bug in Treebank detokeniser re quote ordering

Fix bug in Jaro similarity for empty strings

Several security enhancements

Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder

Implement TextTiling vocabulary introduction method (Hearst 1997)

Fix ALINE feature matrix errors and add comprehensive tests

Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids

Let downloader fallback to md5 when sha256 is unavailable

Several other minor bugfixes and code cleanups

Thanks to the following contributors to 3.9.4: Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01, jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,

Version 3.9.3 2026-02-21

Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)

Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)

Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)

Validate external StanfordSegmenter JARs using SHA256 (#3477)

Add optional sandbox enforcement for filestring() (#3485)

Maintenance: downloader/zipped models, CI/tooling updates

Thanks to the following contributors to 3.9.3: Chris Clauss, Eric Kafe, HyperPS, purificant, Shivansh-Game, Christopher Smith

Version 3.9.2 2025-10-01

Update download checksums to use SHA256 in built index

Fix percentage escape in new-style string formatting

replace shortened URLs using goo.gl

Make Wordnet interoperable with various taggers and tagged corpora

Fix saving PerceptronTagger

Document how to reproduce old Wordnet studies

properly initialize Portuguese corpus reader

support for mixed rules conversion into Chomsky Normal Form

only import tkinter if a GUI is needed

issue #2112 with Corenlp

new environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL

Lesk defaults to most frequent sense in case of ties

Thanks to the following contributors to 3.9.2: Jose Cols, Peter de Blanc, GeneralPoxter, Eric Kafe, William LaCroix, Jason Liu, Samer Masterson, Mike014, purificant, Andrew Ernest Ritz, samertm, Ikram Ul Haq, Christopher Smith, Ryan Mannion

Version 3.9.1 2024-08-19

... (truncated)

Commits

ad9c96b Update copyright year
7edcddf Updates for 3.9.4 release
67a2736 Merge pull request #3180 from yzhaoinuw/bug-on-edit_distance_align
2b17ac5 Fix edit_distance_align backtrace for high substitution costs
4b72976 Merge pull request #3018 from JuanIMartinezB/bug/shortid-longid
8a5619f Merge pull request #3222 from Syzygy2048/feature/texttiling-vocabulary-introd...
c6574d7 Merge pull request #3289 from ihitamandal/codeflash/optimize-windowdiff-2024-...
98ff5d9 Merge pull request #3435 from Hrudhai01/fix-3260-detokenize-quotes
aec4fce Merge pull request #3522 from ekaf/pathsec
eec4ee3 Merge pull request #3526 from nltk/update-contributing
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 2 updates in the /src/dependencies/requirements/base_requirements directory: [setuptools](https://github.com/pypa/setuptools) and [torch](https://github.com/pytorch/pytorch). Bumps the pip group with 1 update in the /src/dependencies/requirements/generated_requirements directory: [torch](https://github.com/pytorch/pytorch). Bumps the pip group with 3 updates in the /src/maxtext/inference/mlperf directory: [sentencepiece](https://github.com/google/sentencepiece), [transformers](https://github.com/huggingface/transformers) and [nltk](https://github.com/nltk/nltk). Updates `setuptools` from 78.1.0 to 78.1.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v78.1.0...v78.1.1) Updates `torch` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.11.0...v2.12.0) Updates `torch` from 2.11.0+cpu to 2.12.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.11.0...v2.12.0) Updates `sentencepiece` from 0.1.99 to 0.2.1 - [Release notes](https://github.com/google/sentencepiece/releases) - [Commits](google/sentencepiece@v0.1.99...v0.2.1) Updates `transformers` from 4.31.0 to 5.0.0rc3 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v4.31.0...v5.0.0rc3) Updates `nltk` from 3.8.1 to 3.9.4 - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.8.1...3.9.4) --- updated-dependencies: - dependency-name: setuptools dependency-version: 78.1.1 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.12.0 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.12.0 dependency-type: direct:production dependency-group: pip - dependency-name: sentencepiece dependency-version: 0.2.1 dependency-type: direct:production dependency-group: pip - dependency-name: transformers dependency-version: 5.0.0rc3 dependency-type: direct:production dependency-group: pip - dependency-name: nltk dependency-version: 3.9.4 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-06-10T21:22:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 10, 2026

dependabot Bot requested review from SurbhiJainUSC, bvandermoon, parambole, richjames0 and shralex as code owners June 10, 2026 21:16

dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 10, 2026

dependabot Bot requested review from darisoy, gpolovets1, mitalisi and vipannalla as code owners June 10, 2026 21:16

dependabot Bot added the python Pull requests that update python code label Jun 10, 2026

dependabot Bot requested review from Lumosis, jrplatin, mailvijayasingh and patemotter as code owners June 10, 2026 21:16

dependabot Bot mentioned this pull request Jun 10, 2026

Bump the pip group across 1 directory with 3 updates #4002

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 3 directories with 5 updates#4139

Bump the pip group across 3 directories with 5 updates#4139
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/src/dependencies/requirements/base_requirements/pip-79b0469b16

dependabot Bot commented on behalf of github Jun 10, 2026

Uh oh!

codecov Bot commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 10, 2026

v78.1.1

Bugfixes

PyTorch 2.12.0 Release Notes

Highlights

Backwards Incompatible Changes

Build Frontend

PyTorch 2.12.0 Release Notes

Highlights

Backwards Incompatible Changes

Build Frontend

v0.2.1

Major changes

New features

Bug fixes & minor changes

v0.2.1pre2

Major changes

New features

Bug fixes & minor changes

v0.2.0

Major changes

New features

Bug fixes & minor changes

Release candidate v5.0.0rc3

New models:

What's Changed

Uh oh!

codecov Bot commented Jun 10, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants