Skip to content

Bump the pip group across 8 directories with 12 updates - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/examples/flax/vision/pip-fff3baaa36
Open

Bump the pip group across 8 directories with 12 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/examples/flax/vision/pip-fff3baaa36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown

Bumps the pip group with 1 update in the /examples/research_projects/codeparrot directory: transformers.
Bumps the pip group with 9 updates in the /examples/research_projects/decision_transformer directory:

Package From To
aiohttp 3.8.5 3.14.3
cryptography 42.0.0 50.0.0
gitpython 3.1.32 3.1.58
keras 2.8.0 3.15.0
nltk 3.7 3.10.0
onnx 1.13.0 1.22.0
pillow 10.0.1 12.3.0
pyasn1 0.4.8 0.6.4
ray 1.11.0 2.56.0

Bumps the pip group with 1 update in the /examples/research_projects/distillation directory: gitpython.
Bumps the pip group with 2 updates in the /examples/research_projects/lxmert directory: mistune and tornado.
Bumps the pip group with 2 updates in the /examples/research_projects/visual_bert directory: mistune and tornado.
Bumps the pip group with 1 update in the /examples/research_projects/vqgan-clip directory: transformers.
Bumps the pip group with 1 update in the /examples/tensorflow directory: transformers.
Bumps the pip group with 1 update in the /examples/tensorflow/language-modeling-tpu directory: transformers.

Updates transformers from 4.19.0 to 5.5.0

Release notes

Sourced from transformers's releases.

Release v5.5.0

New Model additions

Gemma4

Gemma 4 is a multimodal model with pretrained and instruction-tuned variants, available in 1B, 13B, and 27B parameters. The architecture is mostly the same as the previous Gemma versions. The key differences are a vision processor that can output images of fixed token budget and a spatial 2D RoPE to encode vision-specific information across height and width axis.

You can find all the original Gemma 4 checkpoints under the Gemma 4 release.

The key difference from previous Gemma releases is the new design to process images of different sizes using a fixed-budget number of tokens. Unlike many models that squash every image into a fixed square (like 224×224), Gemma 4 keeps the image's natural aspect ratio while making it the right size. There a a couple constraints to follow:

  • The total number of pixels must fit within a patch budget
  • Both height and width must be divisible by 48 (= patch size 16 × pooling kernel 3)

[!IMPORTANT] Gemma 4 does not apply the standard ImageNet mean/std normalization that many other vision models use. The model's own patch embedding layer handles the final scaling internally (shifting values to the [-1, 1] range).

The number of "soft tokens" (aka vision tokens) an image processor can produce is configurable. The supported options are outlined below and the default is 280 soft tokens per image.

Soft Tokens Patches (before pooling) Approx. Image Area
70 630 ~161K pixels
140 1,260 ~323K pixels
280 2,520 ~645K pixels
560 5,040 ~1.3M pixels
1,120 10,080 ~2.6M pixels

To encode positional information for each patch in the image, Gemma 4 uses a learned 2D position embedding table. The position table stores up to 10,240 positions per axis, which allows the model to handle very large images. Each position is a learned vector of the same dimensions as the patch embedding. The 2D RoPE which Gemma 4 uses independently rotate half the attention head dimensions for the x-axis and the other half for the y-axis. This allows the model to understand spatial relationships like "above," "below," "left of," and "right of."

NomicBERT

NomicBERT is a BERT-inspired encoder model that applies Rotary Position Embeddings (RoPE) to create reproducible long context text embeddings. It is the first fully reproducible, open-source text embedding model with 8192 context length that outperforms both OpenAI Ada-002 and OpenAI text-embedding-3-small on short-context MTEB and long context LoCo benchmarks. The model generates dense vector embeddings for various tasks including search, clustering, and classification using specific instruction prefixes.

Links: Documentation | Paper

MusicFlamingo

Music Flamingo is a fully open large audio–language model designed for robust understanding and reasoning over music. It builds upon the Audio Flamingo 3 architecture by including Rotary Time Embeddings (RoTE), which injects temporal position information to enable the model to handle audio sequences up to 20 minutes. The model features a unified audio encoder across speech, sound, and music with special sound boundary tokens for improved audio sequence modeling.

Links: Documentation | Paper

... (truncated)

Commits
  • c1c3424 update
  • 20bff68 update release workflow
  • 8956441 v5.5.0
  • 5135e5e casually dropping the most capable open weights on the planet (#45192)
  • a594e09 Internalise the NomicBERT model (#43067)
  • 4932e97 Fix resized LM head weights being overwritten by post_init (#45079)
  • 57e8413 [Qwen3.5 MoE] Add _tp_plan to ForConditionalGeneration (#45124)
  • b10552e Fix TypeError: 'NoneType' object is not iterable in GenerationMixin.generate ...
  • 423f2a3 fix(models): Fix dtype mismatch in SwitchTransformers and TimmWrapperModel (#...
  • ade7a05 Generalize gemma vision mask to videos (#45185)
  • Additional commits viewable in compare view

Updates aiohttp from 3.8.5 to 3.14.3
Updates cryptography from 42.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates gitpython from 3.1.32 to 3.1.58

Release notes

Sourced from gitpython's releases.

Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.57...3.1.58

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

... (truncated)

Commits
  • 30be45d prepare changelog for upcoming release
  • fc2f02c Merge pull request #2197 from Cyrus580529/shared-symlink-guard
  • b10e250 test: use the shared guard instead of local copies
  • e3e5da8 test: skip tests that need symlink privileges
  • 30d05e3 test: add a shared symlink capability guard
  • 9a8f6fe Merge pull request #2204 from gitpython-developers/security-fixes
  • f2550b6 Guard pathspec file inputs in high-level commands
  • d9ddb55 Guard unsafe git init options
  • 9b5dcaf Guard read-tree index output paths
  • 96a888f Check joined short-option values before Git execution
  • Additional commits viewable in compare view

Updates keras from 2.8.0 to 3.15.0

Release notes

Sourced from keras's releases.

v3.15.0

Highlights

  • Keras-to-Torch Export: New export_torch enables exporting Keras models to native PyTorch nn.Module format, along with LiteRT (TFLite) export support for the PyTorch backend.
  • Sliding Window Attention: Added sliding_window parameter to MultiHeadAttention and GroupedQueryAttention for efficient long-context attention.
  • Flash / Fused SDPA: Causal-only MHA/GQA now automatically dispatches to Flash Attention (cuDNN SDPA), and the manual attention path correctly applies causal masking.
  • Multi-Optimizer Training: New MultiOptimizer supports assigning different optimizers to sub-networks.
  • New Math Operations: Added unique, pinv, matrix_rank, fabs, fmax, fmin, erfc, dsplit, percentile, nanpercentile, sobel_edges, and ssim (structural similarity) to keras.ops.
  • Security Hardening: Comprehensive hardening of model reloading against HDF5 exploits, tar/zip traversal attacks, insecure deserialization.

New Features and Operations

Multi-Backend Operations

  • New NumPy Operations: Added unique, fabs, fmax, fmin, dsplit, erfc, percentile, nanpercentile in keras.ops.numpy.
  • New Linear Algebra Operations: Added pinv (pseudo-inverse) and matrix_rank in keras.ops.linalg.
  • New Image Operations: Added sobel_edges for edge detection and ssim (structural similarity) in keras.ops.image.
  • Negative Axes in Transpose: keras.ops.transpose now supports negative axis values.

Layers and Attention

  • Sliding Window Attention: MultiHeadAttention and GroupedQueryAttention layers support the sliding_window parameter for efficient long-sequence processing.
  • Flash Attention Engagement: Causal-only attention in MHA/GQA now uses Flash SDPA for significant speedups.
  • Fused Bidirectional LSTM/GRU: JAX backend now fuses Bidirectional LSTM into a single cuDNN call; fused bidirectional GRU added for Torch backend.
  • CTC Beam Search Decoder: Added CTC beam search decoding for the Torch backend.

Training and Optimizers

  • MultiOptimizer: Supports training sub-networks with different optimizers.
  • SKLearn Classifier: Added predict_proba method to SKLearnClassifier.

Export and Deployment

  • Keras-to-Torch Export: Export Keras models to native PyTorch nn.Module via model.export(..., format="torch").
  • LiteRT (TFLite) Export for PyTorch: Added LiteRT export support for models using the PyTorch backend.
  • LiteRT Compatibility Fix: Fixed LiteRT export for Keras 3 + TF 2.20 + Python 3.13.
  • ONNX Export: Support for dict/list inputs in Torch ONNX export; documented static input signature requirement for LiteRT PyTorch export.

Distribution and Parallelism

  • ModelParallel Improvements: Defined contiguous replica-group data shard ID convention; added distribution information (num_processes, num_model_replicas, data_shard_id).
  • Initializer Distribution Layout: Initializers can now handle the distribution layout directly with JAX.
  • TF Dataset Distribution: Refactored TF dataset distribution with centralized sharding routing; fixed data distribution for model training in JAX.

OpenVINO Backend Support

... (truncated)

Commits
  • 9d1bbf9 Add erfinv tests and TensorFlow CPU fallback for half precision (#23086)
  • b34af30 Fix pad_sequences string dtype check (np.bytes_ instead of duplicate np.str_)...
  • f512e93 Fix wrong parameter names in ops.select and ops.argpartition docstrings (#23091)
  • 915ec7e Support native Grouped-Query Attention (GQA) Key/Value head broadcast. (#23081)
  • 49d668d Add JAX multi-process distribution tests (#23105)
  • b49fde7 Refactor rematerialization logic into Operation and support more modes (#23107)
  • e0bfa2d Add to the list of APIs that should not be part of a reloaded model. (#23115)
  • 69d7fd6 Suppress spurious 'Skipping nested container' warning on freshly-saved files ...
  • 048d142 Delete temp files after loading model from remote path. (#23113)
  • 46f5eac Bump GitHub Actions versions to the latest (#23104)
  • Additional commits viewable in compare view

Updates nltk from 3.7 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI
  • Warn on unpickling user-provided pickles
  • Add HuggingFace datasets integration (nltk.huggingface)
  • Align TnT with Brants (2000) specifications
  • Fix PorterStemmer irregular-form lowercasing in NLTK mode
  • Fix TransitionParser sparse index dtype for scikit-learn 1.9
  • Fix TextCat tie handling
  • Fix WordNet object comparisons for incompatible types
  • Cache WordNet max depth lazily for lch_similarity()
  • Fix CCG variable direction, substitution, and type-raising bugs
  • Fix Jaro similarity for single-character and empty-string cases
  • Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd,

... (truncated)

Commits
  • bd49f90 allow escaped brackets in Tree.fromstring (#3694)
  • 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
  • 52227d2 Use os.name for Windows path handling (#3605)
  • 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
  • a167389 Treat missing unzip output as stale (#3607)
  • c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
  • 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
  • 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
  • 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
  • f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
  • Additional commits viewable in compare view

Updates onnx from 1.13.0 to 1.22.0

Release notes

Sourced from onnx's releases.

v1.22.0

ONNX v1.22.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.

What's Changed

Breaking Changes and Deprecations

Spec and Operator

Two new operators LinearAttention-27 and CausalConvWithState-27 were introduced.

Reference Implementation

Utilities and Tools

Build, CI and Tests

... (truncated)

Commits

Updates pillow from 10.0.1 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

@dependabot
Bump the pip group across 8 directories with 12 updates
e5b99e4 
---
updated-dependencies:
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: keras
  dependency-version: 3.15.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: onnx
  dependency-version: 1.22.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ray
  dependency-version: 2.56.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mistune
  dependency-version: 3.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mistune
  dependency-version: 3.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants