chore(deps)(deps): bump the python-versions group across 1 directory with 11 updates

[dependabot]

Bumps the python-versions group with 11 updates in the / directory:

Package	From	To
huggingface-hub	1.19.0	1.28.0
numpy	2.4.6	2.5.2
onnxruntime	1.27.0	1.29.0
pydantic	2.13.4	2.13.5
pydantic-settings	2.14.1	2.15.0
typer	0.25.1	0.27.1
chronos-forecasting	2.3.0	2.3.1
torch	2.12.1	2.13.0
licensecheck	2026.0.5	2026.0.8
poethepoet	0.46.0	0.48.0
pytest	9.1.0	9.1.1

Updates huggingface-hub from 1.19.0 to 1.28.0

Release notes

Sourced from huggingface-hub's releases.

[v1.28.0] Hardware discovery and managed engine images for Inference Endpoints and more

🔎 Discover deployable hardware with hf endpoints hardware

Deploying an Inference Endpoint requires five hardware flags (--vendor, --region, --accelerator, --instance-type, --instance-size) whose valid values depend on each other, and until now there was no way to learn them from the CLI. The new hf endpoints hardware command lists the valid combinations along with the price per replica per hour and your namespace's accelerator quota, filtered by default to the hardware you can deploy on right now. The same data is available in the SDK via list_inference_endpoints_hardware(), which flattens the API response into InferenceEndpointHardware objects you can filter programmatically.

>>> hf endpoints hardware --vendor aws --region eu-west-1
VENDOR REGION    ACCELERATOR INSTANCE_TYPE INSTANCE_SIZE MEMORY_GB GPU_MEMORY_GB PRICE_PER_HOUR QUOTA STATUS
------ --------- ----------- ------------- ------------- --------- ------------- -------------- ----- ---------
aws    eu-west-1 cpu         intel-spr     x1                  2.0                        0.033 0/60  available
aws    eu-west-1 cpu         intel-spr     x2                  4.0                        0.067 0/60  available
aws    eu-west-1 gpu         nvidia-a10g   x1                 30.0            24            1.0 0/16  available
aws    eu-west-1 gpu         nvidia-t4     x1                 15.0            16            0.5 1/30  available

• [Inference Endpoints] Add hf endpoints hardware to list available instances by @​hanouticelina in #4672

🚀 Managed engine images and multi-accelerator parallelism for Inference Endpoints

custom_image now accepts the engine-specific container types supported by the API: key the dictionary with the engine name (vLLM, sGLang, tgi, tei, llamacpp, hfServe, ...) instead of leaving it flat, and each engine takes the usual container fields plus its own tuning options. Any dict without a top-level url is forwarded to the API untouched, so engines added to the API later will work without upgrading huggingface_hub, and update_inference_endpoint now handles the same payload shapes as create_inference_endpoint. On the CLI, hf endpoints deploy and hf endpoints update gain --engine, --tensor-parallel-size and --data-parallel-size, and update also accepts --custom-image, --health-route and --port. This matters because vLLM and SGLang default to a single accelerator while an endpoint is allocated every accelerator of its instance — the API now rejects that misconfiguration, and these flags are how you set things right.

$ hf endpoints deploy gpt-oss-120b-vllm --repo openai/gpt-oss-120b --framework custom \
    --accelerator gpu --instance-size x8 --instance-type nvidia-h200 --region us-east-1 --vendor aws \
    --engine vllm --custom-image vllm/vllm-openai:v0.23.0 --tensor-parallel-size 8
Retune a running endpoint
$ hf endpoints update gpt-oss-120b-vllm --tensor-parallel-size 4 --data-parallel-size 2

💔 Breaking change: huggingface_hub.constants.INFERENCE_ENDPOINT_IMAGE_KEYS is removed. It was never exported at the package root nor documented, but code reading it directly will now get an AttributeError.

• [Inference Endpoints] Support managed engine images in custom_image by @​hanouticelina in #4671
• [CLI] Add --tensor-parallel-size / --data-parallel-size to hf endpoints deploy and update by @​moon-bot-app[bot] in #4661

🤖 Inference

• [Inference Providers] deepinfra: add text-to-speech support by @​ovuruska in #4559
• [Inference Providers] deepinfra: add feature-extraction support by @​ovuruska in #4656

🖥️ CLI

• [CLI] Keep hf extensions off the metered GitHub REST API by @​hanouticelina in #4659

🐛 Bug and typo fixes

• [CLI] Fix scheduled upload of a single file in a subfolder by @​dfedoryshchev in #4619
• [Download] Fix tqdm_class ignored by the Xet transfer bar by @​bharadwaj-pendyala in #4647

... (truncated)

Commits

• b2da2d4 Release: v1.28.0
• a718e44 Release: v1.28.0.rc0
• 7105c3d [CLI] Add --tensor-parallel-size / --data-parallel-size to `hf endpoints depl...
• a3d9d8a [Inference Endpoints] Omit model.task instead of sending null on create (#4...
• 909b162 [Inference Endpoints] Add hf endpoints hardware to list available instances...
• 5ac9711 Do not use a redirect's Content-Length as file size in get_hf_file_metadata (...
• 99aba55 [Docs] Normalize malformed docstring parameter entries (#4623)
• 2e6c67d [Inference Providers] deepinfra: add feature-extraction (embeddings) support ...
• 7a522f0 docs: remove obsolete Repository guide references (#4679)
• aa40a65 [Download] Fix ResolvedRevision string value after pickle/copy (#4692)
• Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Abhijeetsingh Meena +
• Charalampos Stratakis
• Charles Harris
• Chris Ninham +
• David Woods
• Geonho +
• Gopu Yeshwanth Reddy +
• Iason Krommydas
• Ijtihed Kilani
• Jelle Zijlstra +
• Joren Hammudoglu
• Kumar Aditya
• Mike Boyle
• Nathan Goldbaum
• Raghuveer Devulapalli
• Sebastian Berg

... (truncated)

Commits

• 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
• ecf599c Merge pull request #32221 from charris/backport-32151
• 3c7ac97 Merge pull request #32220 from charris/backport-32205
• 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
• 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
• c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
• 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
• d8262bc MAINT: Update cibuildwheel to v4.2.0
• 988d94d Merge pull request #32158 from charris/backport-32133
• b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
• Additional commits viewable in compare view

Updates onnxruntime from 1.27.0 to 1.29.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.29.0

Announcements & Breaking Changes

• onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
• POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
• The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

• Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
• Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
• Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
• Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
• Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

• Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

• Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
• Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
• Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
• Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

• WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
• Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
• Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

• Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
• Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
• Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
• Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
• Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

... (truncated)

Commits

• 2e2543f [CUDA] Update cuda archs in packaging pipelines (#31992)
• 9b174a4 [CUDA] Add GatedAdd contrib operator (#31835)
• a29da16 Validate SkipLayerNorm prepacked lengths (#31676)
• 831fa2f Validate whisper beginning_timestamp_token_id bounds (#31636)
• 3cee186 Handle RNN activation parameters safely (#31675)
• 37d79e3 Harden CUDA fp16 transpose index math against int overflow (#31644)
• 45bdd4c Validate QLinearConv bias size against output channels (#31684)
• f5de4c3 Fix TfIdfVectorizer weight indexing semantics (#31649)
• d3abafc Validate FeatureVectorizer batch sizes (#31671)
• 1441b36 [WebGPU] Add MRotaryEmbedding support (#31976)
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pydantic-settings from 2.14.1 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

• case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
• Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
• Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

• Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
• PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
• toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
• Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
• GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

• Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
• Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
• Fix AliasPath on nested model fields not JSON-decoding env values (#898).
• Fix case-insensitive matching for optional nested models (#905).
• Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
• Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
• Fix Secret subclasses crashing when loaded from the environment (#920).
• Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
• An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
• NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
• GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
• AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

• Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
• Recommend an async settings loading pattern (#908).
• Clarify behavior when an unprefixed value is present in a dotenv file (#895).
• Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

• Update documentation link for Pydantic settings by @​hramezani in pydantic/pydantic-settings#863
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#865
• docs: clarify environment variable helper descriptions by @​vip892766gma in pydantic/pydantic-settings#867
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#870
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#875
• Skip list_secrets call when case_sensitive=True by @​ecerulm in pydantic/pydantic-settings#862
• GoogleSecretManagerSettingsSource: read project_id from previous sources by @​ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

• f725ca1 Prepare release 2.15.0 (#930)
• 28f35c2 Bump the python-packages group with 4 updates (#929)
• 9056db0 test: move function-local imports to the top of test modules (#927)
• f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
• ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
• 798dcea Bump the python-packages group with 4 updates (#924)
• a190041 Bump the github-actions group with 4 updates (#925)
• 5d93332 Bump the python-packages group with 4 updates (#921)
• d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
• 2256a4e Bump the python-packages group with 3 updates (#915)
• Additional commits viewable in compare view

Updates typer from 0.25.1 to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

• ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

• 📝 Add Library Skills documentation. PR #1906 by @​tiangolo.
• 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation. PR #1904 by @​phalberg.
• 📝 Recommend uv projects by default in docs. PR #1903 by @​tiangolo.
• 📝 Update help docs. PR #1902 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #1909 by @​tiangolo.

0.27.0

Breaking Changes

• 💥 Update metavar printing. PR #1863 by @​svlandeg.

Internal

• ⬆ Bump the python-packages group across 1 directory with 5 updates. PR #1896 by @​dependabot[bot].
• ⬆️ Bump ty to 0.0.53. PR #1877 by @​YuriiMotov.
• ⬆ Bump the github-actions group across 1 directory with 4 updates. PR #1897 by @​dependabot[bot].
• 🔧 Set Dependabot schedule interval to "monthly". PR #1873 by @​YuriiMotov.
• ⬆ Bump pre-commit hooks. PR #1895 by @​tiangolo.
• 👷 Add GH workflow to bump pre-commit hook versions. PR #1872 by @​YuriiMotov.
• 👷 Fix latest-changes checkout target. PR #1883 by @​tiangolo.
• ⬆️ Update issue-manager to 0.8.1. PR #1880 by @​tiangolo.
• ⬆ Bump the github-actions group across 1 directory with 8 updates. PR #1874 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 5 updates. PR #1876 by @​dependabot[bot].
• ⬆️ Update latest-changes to 0.6.1. PR #1879 by @​tiangolo.
• ⬆ Bump https://github.com/crate-ci/typos from v1.46.0 to 1.47.2 in the pre-commit group across 1 directory. PR #1834 by @​dependabot[bot].
• ⬆ Bump pydantic-settings from 2.14.1 to 2.14.2. PR #1849 by @​dependabot[bot].

0.26.8

Fixes

• 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #1410 by @​svlandeg.
• 🐛 Fix formatting in NoSuchOption.format_message(). PR #1843 by @​foomunleong.

Docs

• 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #1850 by @​tiangolo.
• 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #1826 by @​phalberg.

Internal

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.1 (2026-08-03)

Features

• ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

• 📝 Add Library Skills documentation. PR #1906 by @​tiangolo.
• 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation. PR #1904 by @​phalberg.
• 📝 Recommend uv projects by default in docs. PR #1903 by @​tiangolo.
• 📝 Update help docs. PR #1902 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #1909 by @​tiangolo.

0.27.0 (2026-07-15)

Breaking Changes

• 💥 Update metavar printing. PR #1863 by @​svlandeg.

Internal

• ⬆ Bump the python-packages group across 1 directory with 5 updates. PR #1896 by @​dependabot[bot].
• ⬆️ Bump ty to 0.0.53. PR #1877 by @​YuriiMotov.
• ⬆ Bump the github-actions group across 1 directory with 4 updates. PR #1897 by @​dependabot[bot].
• 🔧 Set Dependabot schedule interval to "monthly". PR #1873 by @​YuriiMotov.
• ⬆ Bump pre-commit hooks. PR #1895 by @​tiangolo.
• 👷 Add GH workflow to bump pre-commit hook versions. PR #1872 by @​YuriiMotov.
• 👷 Fix latest-changes checkout target. PR #1883 by @​tiangolo.
• ⬆️ Update issue-manager to 0.8.1. PR #1880 by @​tiangolo.
• ⬆ Bump the github-actions group across 1 directory with 8 updates. PR #1874 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 5 updates. PR #1876 by @​dependabot[bot].
• ⬆️ Update latest-changes to 0.6.1. PR #1879 by @​tiangolo.
• ⬆ Bump https://github.com/crate-ci/typos from v1.46.0 to 1.47.2 in the pre-commit group across 1 directory. PR #1834 by @​dependabot[bot].
• ⬆ Bump pydantic-settings from 2.14.1 to 2.14.2. PR #1849 by @​dependabot[bot].

0.26.8 (2026-06-25)

Fixes

• 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #1410 by @​svlandeg.
• 🐛 Fix formatting in NoSuchOption.format_message(). PR #1843 by @​foomunleong.

Docs

• 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #1850 by @​tiangolo.
• 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #1826 by @​phalberg.

... (truncated)

Commits

• fe2aa0e 🔖 Release version 0.27.1 (#1919)
• 680dc99 📝 Update release notes
• ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
• 32d80ef 📝 Update release notes
• 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
• ac329a0 📝 Update release notes
• c37ae2f 📝 Add Library Skills documentation (#1906)
• 0974a7e 📝 Update release notes
• 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
• 9051baa 📝 Update release notes
• Additional commits viewable in compare view

Updates chronos-forecasting from 2.3.0 to 2.3.1

Release notes

Sourced from chronos-forecasting's releases.

v2.3.1

What's Changed

• Fix training from a lazy dataset & add example with memmapped datasets.Dataset by @​shchur in amazon-science/chronos-forecasting#515

Full Changelog: amazon-science/chronos-forecasting@v2.3.0...v2.3.1

Commits

• 7dc4435 Fix training from a lazy dataset (#515)
• See full diff in compare view

Updates torch from 2.12.1 to 2.13.0

Release notes

Sourced from torch's releases.

PyTorch 2.13.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Tracked Regressions

ROCm wheels break torch.compile on CPU in environments without a GPU

Running a torch==2.13.0+rocm7.2 wheel in an environment where no GPU is available (torch.cuda.is_available() is False) breaks torch.compile on the CPU path: the first compile raises RuntimeError: Can't detect vectorized ISA for CPU (#189194). This is a regression from torch==2.12.1+rocm7.2, which compiles CPU code fine (detecting e.g. VecAVX2) in the same setup. The 2.13 ROCm wheel appears to rely on something present in the ROCm builder image to detect the CPU vectorized ISA, so it works when run on a ROCm image but fails on a plain CPU-only image.

Workaround: run the +rocm wheel on a ROCm image, or install a standard CPU/CUDA build for GPU-less environments.

Backwards Incompatible Changes

• Stop building CPython 3.13t (free-threaded) binaries (#182951)

  Upstream pypa/manylinux removed CPython 3.13t (free-threaded) on 2026-05-07, because 3.13t was experimental and has been superseded by the now-non-experimental CPython 3.14t. As a result, PyTorch 2.13 no longer ships cp313t wheels (Linux, Triton, and related artifacts). Users on the free-threaded interpreter should move to Python 3.14t.

  PyTorch 2.12:

  # cp313t (free-threaded 3.13) wheels were available
  python3.13t -m pip install torch

  PyTorch 2.13:

... (truncated)

Commits

• cf30153 [release/2.13] Strip +PTX from CUDA arch list on release/RC builds (#188914) ...
• 3e3e24b [release/2.13] Restrict cuda-bindings to Python < 3.15 for CUDA 12.9 builds (...
• 7986b06 [release/2.13] Bump binary build timeout 280 -> 400 minutes (#188551)
• 0bdbc26 [release/2.13] Add CUDA 12.9 to TORCH_CUDA_ARCH_LIST tables (#188443)
• 9cabb45 [release/2.13] Update manywheel docker image pin to 78e737ad (#188409)
• 78e737a [release/2.13] Revert "Tighten generalized scatter graph target (#184075)" (#...
• 0bb9b5b [release/2.13] Revert "dynamo: round-trip torch.cuda.stream ctx mgr across gr...
• aaac2bf [release/2.13] Revert "[Reland] Port D104346887/PR 182675 for index_add fast ...
• 9330813 Fix build_with_debinfo.py broken by CONFIGURE_DEPENDS globbing (#188192)
• 4e077a7 Remove setuptools upper bound (#188190)
• Additional commits viewable in compare view

Updates licensecheck from 2026.0.5 to 2026.0.8

Release notes

Sourced from licensecheck's releases.

2026.0.8

Full Changelog: FHPythonUtils/LicenseCheck@2026.0.7...2026.0.8

Full Changelog: FHPythonUtils/LicenseCheck@2026.0.7...2026.0.8

2026.0.7

What's Changed

• Allow waiting for sqlite locks in request cache by @​atom-andrew in FHPythonUtils/LicenseCheck#149

Full Changelog: FHPythonUtils/LicenseCheck@2026.0.6...2026.0.7

What's Changed

• Allow waiting for sqlite locks in request cache by @​atom-andrew in FHPythonUtils/LicenseCheck#149

Full Changelog: FHPythonUtils/LicenseCheck@2026.0.6...2026.0.7

2026.0.6

Full Changelog: FHPythonUtils/LicenseCheck@2026.0.5...2026.0.6

Full Changelog: https://github.com/FHPythonUtils/LicenseCheck/compa...

Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, python:uv. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.