Skip to content

deps(deps): bump the ml-stack group across 1 directory with 7 updates#19

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ml-stack-b9c3c0c455
Open

deps(deps): bump the ml-stack group across 1 directory with 7 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ml-stack-b9c3c0c455

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the ml-stack group with 7 updates in the / directory:

Package From To
scikit-learn 1.7.2 1.9.0
joblib 1.5.2 1.5.3
torch 2.9.1 2.12.0
transformers 4.57.3 5.12.1
huggingface-hub 0.36.0 1.19.0
safetensors 0.7.0 0.8.0
tokenizers 0.22.2 0.23.1

Updates scikit-learn from 1.7.2 to 1.9.0

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.0

We're happy to announce the 1.9.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_9_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.9.html

This release adds narwhals as a new dependency that will help to improve dataframe interoperability across the project.

This version supports Python versions 3.11 to 3.14.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Release 1.8.0

We're happy to announce the 1.8.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_8_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.8.html

This version supports Python versions 3.11 to 3.14 and features support of free-threaded CPython.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn
Commits
  • 77def0e trigger wheel builder [cd build]
  • ee7c0b0 generate changelog
  • 3d7fb04 bump version
  • 8954e7b DOC Release highlights for 1.9 (#34147)
  • 73a3eab Fix: Array-API - avoid failing for numpy fit + predict with sparse or array-l...
  • 8839aae DOC Thread-safety requirement for open_listener message consumer callback (#3...
  • 4d2476a DOC Refactor array API docs page (#34054)
  • f9f812f 🔒 🤖 CI Update lock files for scipy-dev CI build(s) 🔒 🤖 ...
  • d779dc3 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
  • 6a03cf0 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
  • Additional commits viewable in compare view

Updates joblib from 1.5.2 to 1.5.3

Changelog

Sourced from joblib's changelog.

Release 1.5.3 - 2025/12/15

  • The Memory object won't overwrite an already existing .gitignore file in its cache directory anymore. joblib/joblib#1742

  • Harden the safety checks in eval_expr(pre_dispatch) to prevent excessive memory allocation and potential crashes by limiting the allowed length of the expression and the maximum numeric value of sub-expressions and not evaluating expressions with non-numeric literals. joblib/joblib#1744

  • Vendor cloudpickle 3.1.2 to fix a pickling problem with interactively defined abstract base classes and type annotations in Python 3.14+.

Commits

Updates torch from 2.9.1 to 2.12.0

Release notes

Sourced from torch's releases.

PyTorch 2.12.0 Release Notes

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

Build Frontend

  • Strengthened SVE compile checks in FindARM.cmake, which may reject previously accepted but incorrect SVE configurations (#176646)

    Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.

  • Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (#178925)

    Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure CUDA_HOME points to that installation.

    Version 2.11:

    CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop

    Version 2.12:

    CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop

  • Enforced a C++20 minimum in CMake build files (#178662)

... (truncated)

Commits
  • 0d62256 [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (#183346)
  • 7661cd9 [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (#181886)
  • 9da6087 Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes #182250) (#182369)
  • e4c37cc Avoid raw stream name collisions in Inductor (#182178)
  • 822d047 [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (#182285) (#182311)
  • 5c5e523 Add enable_gqa parameter to SDPA MPS meta registration (#181550)
  • eece52e [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...
  • b39330b [Inductor] Call latest c_shim version for versioned fallback ops (#181548)
  • 06f10d0 Revert "[FSDP2] add fqn to communication ops" (#182100) (#182157)
  • 449e339 Revert "[Inductor] Improve materialization heuristic for a chain of computaio...
  • Additional commits viewable in compare view

Updates transformers from 4.57.3 to 5.12.1

Release notes

Sourced from transformers's releases.

Patch release v5.12.1

Updated the lower bound for PEFT and a fix for auto tokenizer to properly resolve the mistral tokenizer (when mistral-common is installed). This is similar to v.5.10.3 minus the fixes that were already included in the main release - vLLM will first target 5.10.3 🤗

Full Changelog: huggingface/transformers@v5.12.0...v5.12.1

Patch release v5.10.3

A few fixes needed for vLLM to sync with transformers 🤗

Full Changelog: huggingface/transformers@v5.10.2...v5.10.3

Release v5.12.0

New Model additions

MiniMax-M3-VL

MiniMax-M3-VL is the vision-language member of the MiniMax-M3 family that pairs a CLIP-style vision tower with 3D rotary position embeddings with the MiniMax-M3 text backbone. It uses a mixed dense/sparse Mixture-of-Experts decoder with SwiGLU-OAI gated experts and a lightning indexer for block-sparse attention. The model processes images through a Conv3d patch embedding system and includes specialized components for efficient multimodal understanding and generation.

Links: Documentation

PP-OCRv6: update documentation and slow tests (#46576)

The official weights for PP-OCRv6 are out: PP-OCRv6 is a lightweight OCR system that combines architectural innovation with data-centric optimization. It redesigns the backbone, detection neck, and recognition neck around a unified MetaFormer-style building block with structural reparameterization. Three model tiers (medium, small, tiny) share the same block primitives, covering deployment scenarios from server to edge.

  • PP-OCRv6: update documentation and slow tests (#46576) by @ zhang-prog

Add Parakeet-RNNT (#46331)

ParakeetForRNNT: a Fast Conformer Encoder + an RNN-T (RNN Transducer) decoder

... (truncated)

Commits

Updates huggingface-hub from 0.36.0 to 1.19.0

Release notes

Sourced from huggingface-hub's releases.

[v1.19.0] Trusted Publishers, hf:// URIs, and expose-ports for Jobs

🔐 Keyless CI/CD auth via OIDC token exchange

CI workflows can now authenticate to the Hub without storing an HF_TOKEN secret, using Trusted Publishers. Set HF_OIDC_RESOURCE to the repo (or username) you want to scope the token to, and huggingface_hub performs the OIDC exchange under the hood — no token, no setup code. GitHub Actions is supported out of the box (with permissions: id-token: write), and other providers can pass a pre-minted ID token via HF_OIDC_ID_TOKEN. Exchanged tokens are short-lived (1 hour), repo-scoped, and cached locally with automatic refresh.

# Publish a model without storing any HF_TOKEN secret
- name: Push the model
  env:
    HF_OIDC_RESOURCE: acme/awesome-model
  run: hf upload acme/awesome-model ./model .

📚 Documentation: Trusted Publishers

🖥️ hf:// URIs for upload and download

hf upload and hf download now accept an hf:// URI in place of the positional repo ID. The URI encodes repo type, revision, and file path in a single string following the grammar hf://[<TYPE>/]<ID>[@<REVISION>][/<PATH>], so you no longer need separate --repo-type and --revision flags. When a URI is provided, it is the single source of truth — passing --repo-type or --revision on top of it raises an error, and a path in the URI cannot be combined with positional filenames (download) or path_in_repo (upload).

# Download a single file from a dataset at a given revision
hf download hf://datasets/HuggingFaceM4/FineVision@refs/pr/1/data/train.parquet
Download an entire repo
hf download hf://datasets/google/fleurs
Upload a file to a dataset on a specific branch
hf upload hf://datasets/Wauplin/my-cool-dataset@my-branch/data/train.csv ./train.csv

📚 Documentation: CLI guide — hf:// URIs · Download guide · Upload guide

🚀 Expose job ports through the jobs proxy

Jobs can now expose container ports through the public jobs proxy using --expose <port> (CLI) or expose=[8000] (Python API). Each exposed port is reachable at https://<job_id>--<port>.hf.jobs and requires an HF token with read access to the job's namespace. This works on hf jobs run, hf jobs uv run, and their scheduled variants. Job responses now surface expose_urls on JobStatus.

# Expose a web server running on port 8000
> hf jobs run --expose 8000 python:3.12 python -m http.server 8000
✓ Job started
  id: 6a2aa7cec4f53f9fc5aa4cff
  url: https://huggingface.co/jobs/Wauplin/6a2aa7cec4f53f9fc5aa4cff
Hint: Exposed ports are reachable at (requires an HF token with read access to the job):
  https://6a2aa7cec4f53f9fc5aa4cff--8000.hf.jobs
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

... (truncated)

Commits
  • b1909eb Release: v1.19.0
  • fe27c47 OIDC: Include error_description in HTTP error messages (#4341)
  • 68dd701 Release: v1.19.0.rc1
  • 934797e Release: v1.19.0.rc0
  • 69ef7d7 [Agent] Dynamic agent harness registry (#4325)
  • f6b439c [fix] Transient locaion error due to CDN (#4339)
  • f1f2c43 Fix ignored-pattern warning grammar in download CLI (#4337)
  • 92009d4 [Tests] Add xet/no_xet pytest markers to filter Xet vs non-Xet tests (#4336)
  • e3b6d5b [Auth] Keyless CI/CD auth via OIDC token exchange (#4326)
  • 8e4ca5c [CI] Remove .github/workflows/python-prerelease.yml (#4335)
  • Additional commits viewable in compare view

Updates safetensors from 0.7.0 to 0.8.0

Release notes

Sourced from safetensors's releases.

v0.8.0

News

safetensors joins the PyTorch foundation!

Read more on that: https://huggingface.co/blog/safetensors-joins-pytorch-foundation

What's changed

Safetensors 0.8.0 brings direct to Metal loading on Apple Silicon, GIL-free serialization, broader hardware and dtype coverage, and a stronger Python API.

Breaking

The serialize and serialize_file functions now release the GIL during writes, enabling true multithreaded saves from Python. Their input contract has also changed: tensor metadata is now passed via a TensorSpec class (exported from safetensors) instead of plain dicts, making API more explicit and robust to misinputs. This is a breaking change for anyone calling the low-level serialize / serialize_file API directly; the high-level wrappers (safetensors.torch, safetensors.numpy, safetensors.paddle) are updated internally and their public API is unchanged.

The minimum supported Python version is now 3.10 (was 3.9). Python 3.9 reached end-of-life in October 2025.

TensorIndexer::Narrow now carries a step: NonZeroUsize parameter, so a slice is now start:stop:step. This is a fix as this silent error was hidden behind the Storage::Torch variant which offloaded slicing logic to torch directly.

CI

On the platform side, this release adds Windows ARM64 wheel builds, riscv64 Linux wheels, and CI has been hardened with pinned GitHub Actions SHAs.

Also dropped the anaconda CI we had as there's already an automatic tracker via conda-forge.

New features

  • Direct MPS load on Apple Silicon: tensors are directly loaded in an MTLBuffer and handed to the frameworks that support it (only torch atm) via DLPack, skipping needless copies.
  • New backend parameter introduced, for the addition of the pread backend. We now support loading files via pread(2) syscall instead of just mmap. Useful for specific archs/platforms.
  • get_slice now handles ellipsis [...] and strided slices [:, ::8] wherever safetensors does the slicing itself (pread for any framework, MPS, and mmap outside torch/paddle), which silently dropped the step or rejected ... before.
  • MUSA device support for MooreThreads GPUs.
  • New dtype support includes float8_e4m3fnuz and float8_e5m2fnuz (AMD FNUZ FP8 formats).
  • The reader is now explicitly lenient about leading whitespace in the JSON header, which keeps the door open for future page-aligned writes.

Improvements/perf

  • File writes on macOS now use F_NOCACHE for direct I/O, yielding roughly 30% faster save_file on Apple Silicon.
  • The packaging dependency has been dropped from the [torch] extra, replaced by a simple hasattr probe for efficiency.

What's Changed

... (truncated)

Changelog

Sourced from safetensors's changelog.

0.8.0-dev.0 → 0.8.0


Update lockfiles again:

cargo check
cd bindings/python &amp;&amp; uv lock
</code></pre>
<p>Commit:</p>
<pre><code>Set version to 0.8.0
</code></pre>
<p>The Python version is not set in <code>pyproject.toml</code> directly — maturin reads it from <code>bindings/python/Cargo.toml</code> at build time.</p>
<h3>4. Create the release on GitHub</h3>
<p>Go to the <a href="https://github.com/huggingface/safetensors/releases">GitHub Releases page</a> and draft a new release:</p>
<ul>
<li><strong>Choose the release branch</strong> (e.g. <code>git_v0.8.0</code>)</li>
<li><strong>Create a new tag</strong> on publish: <code>v0.8.0</code></li>
<li><strong>Generate release notes</strong> from the previous tag (e.g. <code>v0.7.0</code>)</li>
<li>Add any notable highlights at the top of the generated notes</li>
</ul>
<p>Structure for manual notes:</p>
<pre lang="markdown"><code>## Breaking changes
- ...

New features


    

  • ...
    • 



Bug fixes


    

  • ...
    • 



Internal / CI


    

  • ...
    
</code></pre>
    
<p>Click <strong>Publish release</strong>. This creates the tag, which triggers the three release workflows.</p>
    
<h3>5. Monitor the CI</h3>
    
<p>The tag triggers two workflow runs in the <a href="https://github.com/huggingface/safetensors/actions&quot;&gt;Actions tab</a>:</p>
    
<ul>
    
<li><strong>CI</strong> (Python release) — builds wheels for every platform × Python version, uploads to PyPI. Can take up to over 30 minutes.</li>
    
</ul>
    
<!-- raw HTML omitted -->
    
</blockquote>
    
<p>... (truncated)</p>
    
</details>
    
<details>
    
<summary>Commits</summary>
    • 



<ul>

<li><a href="https://github.com/safetensors/safetensors/commit/a406ca3e7a90598be0cd05a50069cb9bf5ef6ba6&quot;&gt;&lt;code&gt;a406ca3&lt;/code&gt;&lt;/a> fix(release): move crates.io to trusted publisher OIDC</li>

<li><a href="https://github.com/safetensors/safetensors/commit/d0368d14c0a417fb2ca2a6627e9513d17f74f9b7&quot;&gt;&lt;code&gt;d0368d1&lt;/code&gt;&lt;/a> feat: <code>0.8.0</code></li>

<li><a href="https://github.com/safetensors/safetensors/commit/5ec3ec14c506d09598df6d96f36cd9a4ea94aafa&quot;&gt;&lt;code&gt;5ec3ec1&lt;/code&gt;&lt;/a> fix(release): move to pypi trusted publisher OIDC (<a href="https://redirect.github.com/huggingface/safetensors/issues/778&quot;&gt;#778&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/e37dc536ce598ef1d71a9ad712987571f2f05808&quot;&gt;&lt;code&gt;e37dc53&lt;/code&gt;&lt;/a> feat: bump main to <code>0.9.0-dev.0</code> (<a href="https://redirect.github.com/huggingface/safetensors/issues/777&quot;&gt;#777&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/6e32aa7b029d323238233110c1cdecae22cbe564&quot;&gt;&lt;code&gt;6e32aa7&lt;/code&gt;&lt;/a> refactor: replace <code>_host_alias_storage</code> w/ <code>MTLBuffer</code> (<a href="https://redirect.github.com/huggingface/safetensors/issues/767&quot;&gt;#767&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/24b0b2857fef49be734b9ab72ce97c09bb25f5b9&quot;&gt;&lt;code&gt;24b0b28&lt;/code&gt;&lt;/a> fix: write to tempfile + rename to preserve mmap source (<a href="https://redirect.github.com/huggingface/safetensors/issues/764&quot;&gt;#764&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/73132135947275c5dda135438e4c2e4bd70a2b10&quot;&gt;&lt;code&gt;7313213&lt;/code&gt;&lt;/a> Update free-threading tests for Python 3.14 (<a href="https://redirect.github.com/huggingface/safetensors/issues/699&quot;&gt;#699&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/e9091e13ec359e9e5b8b45413fcbe340444dde1c&quot;&gt;&lt;code&gt;e9091e1&lt;/code&gt;&lt;/a> feat: add <code>backend</code> with pread file (<a href="https://redirect.github.com/huggingface/safetensors/issues/760&quot;&gt;#760&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/1b0fe9c6acf3ac2ec7f4a0fd13bccfc0b65ce765&quot;&gt;&lt;code&gt;1b0fe9c&lt;/code&gt;&lt;/a> fix(ci): security audit slack message format (<a href="https://redirect.github.com/huggingface/safetensors/issues/757&quot;&gt;#757&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/7efac22872a53ae3b30a15f8e786404322f10458&quot;&gt;&lt;code&gt;7efac22&lt;/code&gt;&lt;/a> [MPS] Fast load of the tensors (<a href="https://redirect.github.com/huggingface/safetensors/issues/756&quot;&gt;#756&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/huggingface/safetensors/compare/v0.7.0...v0.8.0&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates tokenizers from 0.22.2 to 0.23.1



Release notes

Sourced from tokenizers's releases.




Release v0.23.1


TL;DR


tokenizers 0.23.1 is the first proper stable release in the 0.23 line — 0.23.0 only ever shipped as rc0 because the release pipeline itself was broken (Node side hadn't shipped multi-platform binaries since 2023, Python side was on pyo3 0.27 without free-threaded support). 0.23.1 is the version where everything actually goes out the door together: full Node multi-platform wheels for the first time in years, Python 3.14 (regular and free-threaded 3.14t), full type hints for every Python class, and a stack of measurable perf wins on the BPE / added-vocab hot paths.


There is no functional 0.23.0 published — we tag 0.23.1 directly so users don't accidentally pull a never-shipped version.




🚨 Breaking changes


    

  • Drop Python 3.9 (#1952) — requires-python = ">=3.10"; 3.9 users stay on 0.22.x.
    • 

  • add_tokens normalizes content at insertion (#1995) — re-saved tokenizer.json may differ in the added_tokens block. Existing files load unchanged.
    • 

  • Type stubs are precise (#1928, #1997) — methods that returned Any now return real types; mypy --strict may surface previously-hidden errors. Stub layout also moved from tokenizers/<sub>/__init__.pyi to tokenizers/<sub>.pyi. This breaks the surface of some of the processors like RobertaProcessign's __init__ .
    • 

  • 3.14t-only: setters/getters return PyResult<T> because of Arc<RwLock<Tokenizer>>; a poisoned lock surfaces as PyException instead of a panic.
    • 





⚡ Performance — measured locally on this Mac, not lifted from PRs


Run with cargo bench --bench <name> -- --save-baseline v0_22_2 on v0.22.2, then --baseline v0_22_2 on v0.23.1. Numbers are point-in-time wall clock on a single laptop; relative deltas are what matters, absolute numbers will differ on CI hardware.


Added-vocabulary deserialize — the headline win (#1995, #1999)


bench: improve added_vocab_deserialize to reflect real-world workloads (#2000) is now representative of how transformers actually loads tokenizer.json files. The combined effect of daachorse for the matching automaton plus the normalize-on-insert refactor is enormous on this workload:






benchmark
v0.22.2
v0.23.1
change






100k tokens, special, no norm
~410 ms
248 ms
−40%




100k tokens, non-special, no norm
~7.1 s
273 ms
−96%




100k tokens, special, NFKC
~395 ms
235 ms
−40%




100k tokens, non-special, NFKC
~7.4 s
290 ms
−96%




400k tokens, special, no norm
~15 s
980 ms
−94%






Real-world impact: loading a Llama-3-style tokenizer with a large set of added tokens dropped from "noticeable pause" to "instant".


BPE encode






benchmark
v0.22.2
v0.23.1
change






BPE GPT2 encode batch, no cache
530 ms
446 ms
−16%




BPE GPT2 encode batch (cached)
690 ms
685 ms
noise




BPE GPT2 encode (single)
1.95 s
1.94 s
noise




BPE Train (small)
32.6 ms
31.5 ms
−3%




BPE Train (big)
1.01 s
988 ms
−2%






The BPE per-thread cache PR (#2028) shows much larger wins on highly-parallel workloads (+47–62% at 88+ threads on a server box, per the PR's own measurements on Vera). Single-thread batch numbers above are flat or slightly improved because cache-hit overhead was already low without contention.


Llama-3 encode





... (truncated)





Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    •

@dependabot
deps(deps): bump the ml-stack group across 1 directory with 7 updates
3373086 
Bumps the ml-stack group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.7.2` | `1.9.0` |
| [joblib](https://github.com/joblib/joblib) | `1.5.2` | `1.5.3` |
| [torch](https://github.com/pytorch/pytorch) | `2.9.1` | `2.12.0` |
| [transformers](https://github.com/huggingface/transformers) | `4.57.3` | `5.12.1` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `0.36.0` | `1.19.0` |
| [safetensors](https://github.com/huggingface/safetensors) | `0.7.0` | `0.8.0` |
| [tokenizers](https://github.com/huggingface/tokenizers) | `0.22.2` | `0.23.1` |



Updates `scikit-learn` from 1.7.2 to 1.9.0
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.7.2...1.9.0)

Updates `joblib` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](joblib/joblib@1.5.2...1.5.3)

Updates `torch` from 2.9.1 to 2.12.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.9.1...v2.12.0)

Updates `transformers` from 4.57.3 to 5.12.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.57.3...v5.12.1)

Updates `huggingface-hub` from 0.36.0 to 1.19.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v0.36.0...v1.19.0)

Updates `safetensors` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/huggingface/safetensors/releases)
- [Changelog](https://github.com/safetensors/safetensors/blob/main/RELEASE.md)
- [Commits](safetensors/safetensors@v0.7.0...v0.8.0)

Updates `tokenizers` from 0.22.2 to 0.23.1
- [Release notes](https://github.com/huggingface/tokenizers/releases)
- [Changelog](https://github.com/huggingface/tokenizers/blob/main/RELEASE.md)
- [Commits](huggingface/tokenizers@v0.22.2...v0.23.1)

---
updated-dependencies:
- dependency-name: scikit-learn
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ml-stack
- dependency-name: joblib
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ml-stack
- dependency-name: torch
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ml-stack
- dependency-name: transformers
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ml-stack
- dependency-name: huggingface-hub
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ml-stack
- dependency-name: safetensors
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ml-stack
- dependency-name: tokenizers
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ml-stack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants