Update sagemaker requirement from <3,>=2 to >=3.12.0,<4

[dependabot]

Updates the requirements on sagemaker to permit the latest version.

Release notes

Sourced from sagemaker's releases.

v3.12.0

New Features

• SageMaker Token Generator (#5868): Embed the aws-sagemaker-token-generator library into sagemaker.core so users can generate SageMaker bearer tokens without installing a separate wheel. Usage: from sagemaker.core.aws_sagemaker_token_generator import provide_token
• Feature Processor - Spark 3.5 / Python 3.12 support (#5816): Dynamic Spark image resolution based on installed PySpark and Python versions. Supports Spark 3.1/3.2/3.3/3.5 with Python 3.9 and 3.12. Auto-installs sagemaker-feature-store-pyspark for Spark remote jobs.

Bug Fixes

• Networking vpc_config AttributeError and telemetry region fallback (#5839): Fix AttributeError on vpc_config in networking and telemetry region fallback for classmethods.
• Add CustomAttributes field to DefaultPayloadsModel (#5870): Add missing CustomAttributes field to DefaultPayloadsModel.
• sagemaker-core: Preserve falsy values in serialize() output (#5860): Fix bug where False, 0, and "" were silently dropped by serialize() due to truthy check. This caused issues like optimize_model=False being sent as True.
• serve: Prevent code injection in capture_dependencies path interpolation (#5792): Security fix — use repr() escaping to prevent code injection via crafted directory names in ModelBuilder with dependencies={"auto": True}. (CWE-94, P414309851)
• VolumeSizeInGB missing from v3 deploy for JumpStart models (#5847): Fix VolumeSizeInGB not being passed through when deploying models with inference_volume_size from JumpStart config.

Changelog

Sourced from sagemaker's changelog.

v3.12.0 (2026-05-19)

New Features

• SageMaker Token Generator (#5868): Embed the aws-sagemaker-token-generator library into sagemaker.core so users can generate SageMaker bearer tokens without installing a separate wheel. Usage: from sagemaker.core.aws_sagemaker_token_generator import provide_token
• Feature Processor - Lake Formation credential vending (#5816): Add configurable use_lake_formation_credentials parameter to the @feature_processor decorator, enabling Lake Formation credential vending when set to True.
• Feature Processor - Spark 3.5 / Python 3.12 support (#5816): Dynamic Spark image resolution based on installed PySpark and Python versions. Supports Spark 3.1/3.2/3.3/3.5 with Python 3.9 and 3.12. Auto-installs sagemaker-feature-store-pyspark for Spark remote jobs.
• Feature Processor - Stored function signing key (#5816): Generate ECDSA signing key in ConfigUploader for function payload signature verification.
• Feature Store - Export IcebergProperties (#5816): Add IcebergProperties to the feature_store public API surface.

Documentation

• None

Bug Fixes

• Networking vpc_config AttributeError and telemetry region fallback (#5839): Fix AttributeError on vpc_config in networking and telemetry region fallback for classmethods.
• Add CustomAttributes field to DefaultPayloadsModel (#5870): Add missing CustomAttributes field to DefaultPayloadsModel.
• sagemaker-core: Preserve falsy values in serialize() output (#5860): Fix bug where False, 0, and "" were silently dropped by serialize() due to truthy check. This caused issues like optimize_model=False being sent as True.
• serve: Prevent code injection in capture_dependencies path interpolation (#5792): Security fix — use repr() escaping to prevent code injection via crafted directory names in ModelBuilder with dependencies={"auto": True}. (CWE-94, P414309851)
• VolumeSizeInGB missing from v3 deploy for JumpStart models (#5847): Fix VolumeSizeInGB not being passed through when deploying models with inference_volume_size from JumpStart config.

v3.11.0 (2026-05-12)

New Features

• Auto-detect subscription recipe hyperparameters in SFTTrainer for Nova Forge datamix support
• Create asymmetric ECDSA signing key in feature processor step compiler for remote function payload verification

Documentation

• Add Feature Store reference to Implement MLOps page
• Replace internal S3 URIs with user placeholders in SFT notebook

v3.10.1 (2026-05-07)

Bug Fixes

• Fix KMS key propagation in check steps (QualityCheckStep, ClarifyCheckStep)
• Fix JumpStart network isolation in ModelBuilder
• Fix base_model_arn construction to use private hub when SAGEMAKER_HUB_NAME is set
• Fix imports for Model Customization interfaces
• Fix handling of unrecognized JumpStart container images in ModelBuilder
• Increase default timeout for training jobs

v3.10.0 (2026-05-01)

New Features

• Make _PipelineExecution a public class
• Add CodeArtifact support for ModelTrainer and FrameworkProcessor requirements.txt installation

Bug Fixes

• Fix S3 bucket operations
• Fix potential S3 path traversal
• Wire FrameworkProcessor code_location into code upload paths
• Improve subprocess exception handling in git_utils

... (truncated)

Commits

• 657864a Release v3.12.0 - bump versions and update changelogs (#5876)
• 40b36ef Fix sm train tests (#5875)
• 9c9c50d feat: replace eval Rich spinner with plain print observability (matching trai...
• 85f99e3 feat: expose poll interval parameter on all trainers (#5859)
• 6522115 feat: add training job observability prints for script mode (#5861)
• ac53dc4 fix: Networking vpc_config AttributeError and telemetry region fallback for c...
• 37b43b7 feat: Add SageMaker token generator to sagemaker-core (#5868)
• 6308e6d fix: Add CustomAttributes field to DefaultPayloadsModel (#5870)
• 4171658 fix(sagemaker-core): preserve falsy values in serialize() output (#5860)
• bb0b615 fix(serve): prevent code injection in capture_dependencies path interpolation...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #272.