Skip to content

Bump the all group across 1 directory with 6 updates - #335

Merged
thomas-chauchefoin-tob merged 1 commit into
masterfrom
dependabot/uv/all-6de265330e
Oct 22, 2026
Merged

Bump the all group across 1 directory with 6 updates#335
thomas-chauchefoin-tob merged 1 commit into
masterfrom
dependabot/uv/all-6de265330e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 6 updates in the / directory:

Package From To
torch 2.13.0 2.14.1
torchvision 0.28.0 0.29.1
ruff 0.16.0 0.17.0
ty 0.0.65 0.0.88
py7zr 1.1.3 1.1.4
huggingface-hub 1.25.1 2.2.0

Updates torch from 2.13.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

  • Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
  • Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
  • Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
    • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
    • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

  • Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
  • Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

PyTorch 2.14.0 Release Notes

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

  • torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

    The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

... (truncated)

Commits
  • 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
  • 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
  • 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
  • e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
  • 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
  • 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
  • 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
  • 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
  • 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
  • ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
  • Additional commits viewable in compare view

Updates torchvision from 0.28.0 to 0.29.1

Release notes

Sourced from torchvision's releases.

TorchVision 0.29.1 Release

This is a patch release, which is compatible with PyTorch 2.14.1. There are no new features added.

Packaging

  • Relax the PyTorch requirement from torch==2.14.0 to torch>=2.14. TorchVision is now ABI stable with respect to PyTorch 2.14, so it no longer pins an exact PyTorch version (#9683, cherry-pick of #9680)

TorchVision 0.29: ABI stability!

TorchVision 0.29 is out! It comes with two major changes: ABI stability, and deprecation of the image decoders and encoders (now in TorchCodec)!

ABI Stability with torch 2.14

TorchVision is now ABI stable w.r.t. torch 2.14! This means that torchvision 0.29 will be compatible with future versions of torch: 2.15, 2.16, etc. You won’t need to install a new version of TorchVision when you upgrade torch.

As a result, we might stop releasing TorchVision in sync with pytorch. But TorchVision is still actively maintained and developed: we’ll still be pushing releases, just not with the same cadence.

Thanks to Adrian Abeyta @​adabeyta for the fantastic porting effort!

PRs: #9524, #9597, #9598, #9605, #9612, #9610, #9614, #9584, #9617, #9618, #9619, #9620, #9582, #9573, #9625, #9623, #9626, #9583, #9633, #9572, #9549, #9533, #9535, #9539, #9543, #9550, #9552, #9555, #9557, #9558, #9554

Image decoders and encoders are deprecated. Use TorchCodec!

The image decoders and encoders in torchvision.io are now deprecated, and they will be removed in a future release. They are now available in torchcodec >= 0.16, where they are significantly more capable. You’ll just need to pip install torchcodec, and you can refer to this migration guide for migrating your code (most APIs for decoding are the same).

This finalizes a clear separation of concerns for the three media-processing libraries of PyTorch: torchcodec is for decoding and encoding all media (images, videos, and audio), while torchvision and torchaudio focus on the transforms.

Bug fixes

[ops] Fix for deformable convolution kernels always running on default stream (#9522) [ops, MPS] Fix gradient overaccumulation in ROI ops (#9563, #9510) [transforms] Fix JPEG transform for non-contiguous batches (#9615)

Contributors

🎉 We're grateful for our community, which helps us improve Torchvision by submitting issues and PRs, and providing feedback and suggestions. The following persons have contributed patches for this release:

Adrian Abeyta, Andrey Talman, Dmitry Nikolaev, Irakli Salia, Jeff Daily , Kasra Ghodsi, Nicolas Hug, Nikita Shulga, Simon Byrne, Yutao Xu, Zhewen

Commits
  • 1f1a920 Set the pin to torch>=2.14 (#9680) (#9683)
  • 1b4390d [release/0.29] Build against the release/2.14 test-infra branch (#9682)
  • 0bb1ccf Update version to 0.29.1 (#9678)
  • fc73f5a Merge branch 'release/0.29' of github.com:pytorch/vision into release/0.29
  • f9b2669 [Cherry-pick for 0.29] (#9634)
  • e1b5802 Revert "Update version.txt for 0.30.0 (#9607)"
  • 2757376 Merge remote-tracking branch 'origin' into release/0.29
  • 9e21b88 Consolidate CUDA helpers and remove the legacy _C extension in place of Stabl...
  • 541c083 Port deform_conv2d (CUDA) to stable ABI. (#9626)
  • 2f411e7 Port ps_roi_pool (CUDA) to stable ABI. (#9623)
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates ty from 0.0.65 to 0.0.88

Release notes

Sourced from ty's releases.

0.0.88

Release Notes

Released on 2026-10-15.

Bug fixes

  • Avoid panics and hangs involving recursive type aliases and intersections (#29057)
  • Fix false invalid-mutable-override errors when overriding object attributes (#29373)
  • Fix attribute assignment and deletion checks through bounded or constrained type variables (#29345)
  • Detect instance layout conflicts hidden by additional base classes (#29372)
  • Fix false missing-argument errors when Pydantic models override inherited attributes with ClassVar (#29367)
  • Preserve known module owners when uv reports owners outside the resolution (#29296)

Diagnostic improvements

  • Report assignments to individually frozen Pydantic fields (#29305)

Core type checking

  • Improve type inference for intersection arguments to generic functions (#28677)
  • Preserve inherited annotations for unannotated subclass attributes when a base has type Any or Unknown (#28973)
  • Preserve common return-type structure when gradual arguments match multiple overloads (#29342)
  • Check upper bounds when inferring type variables from caller type variables (#29014)

Contributors

Install ty 0.0.88

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.88/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.88/ty-installer.ps1 | iex"

Download ty 0.0.88

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.88

Released on 2026-10-15.

Bug fixes

  • Avoid panics and hangs involving recursive type aliases and intersections (#29057)
  • Fix false invalid-mutable-override errors when overriding object attributes (#29373)
  • Fix attribute assignment and deletion checks through bounded or constrained type variables (#29345)
  • Detect instance layout conflicts hidden by additional base classes (#29372)
  • Fix false missing-argument errors when Pydantic models override inherited attributes with ClassVar (#29367)
  • Preserve known module owners when uv reports owners outside the resolution (#29296)

Diagnostic improvements

  • Report assignments to individually frozen Pydantic fields (#29305)

Core type checking

  • Improve type inference for intersection arguments to generic functions (#28677)
  • Preserve inherited annotations for unannotated subclass attributes when a base has type Any or Unknown (#28973)
  • Preserve common return-type structure when gradual arguments match multiple overloads (#29342)
  • Check upper bounds when inferring type variables from caller type variables (#29014)

Contributors

0.0.87

Released on 2026-10-13.

LSP server

  • Clamp notebook cell positions to the end of the cell (#29307)
  • Fix deadlock when requests arrive before workspace configuration (#29303)
  • Fix notebook cell lookups after cells with cell magics (#29308)
  • Fix panic on completions past the end of a notebook's last cell (#29306)

Diagnostic improvements

  • Add opt-in mismatched-sentinel-name rule (#27206)
  • Deduplicate identical argument type diagnostics (#29337)
  • Enable invalid-mutable-override by default (#29335)

... (truncated)

Commits

Updates py7zr from 1.1.3 to 1.1.4

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

  • Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).
    • canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.
    • Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.
    • Archive member names containing a .. component are now rejected outright.
  • Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).
  • Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

  • Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)
  • Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)
  • Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)
  • Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)
  • Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits
  • c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
  • c51e4f6 Merge commit from fork
  • f4204fa Merge commit from fork
  • 5c78459 Merge commit from fork
  • 23610d1 fix: raise Bad7zFile when decompression makes no progress
  • f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
  • e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
  • 8ff8a30 docs: add guidelines for writing and organizing security regression tests
  • 0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
  • 3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
  • Additional commits viewable in compare view

Updates huggingface-hub from 1.25.1 to 2.2.0

Release notes

Sourced from huggingface-hub's releases.

[v2.2.0] hf jobs stats snapshots, download and HfFileSystem fixes

A small release this week, mostly bug fixes and quality-of-life improvements. hf jobs stats now returns right away instead of streaming forever, concurrent downloads reliably use hf_xet, and HfFileSystem caching is more predictable. Two behavior changes are listed under Breaking changes.

📊 hf jobs stats prints a snapshot by default

hf jobs stats used to stream metrics until the job finished, so scripts and agents calling it on a running job hung until their own timeout. It now prints the latest sample of each job once and exits, like hf jobs logs and hf spaces logs. Use -f/--follow for the previous live view. Snapshot output also supports --format json|agent|quiet, which outputs the raw API metrics.

On the Python side, HfApi.fetch_job_metrics gets the same follow parameter as fetch_job_logs. It defaults to False and returns only the current sample. Pass follow=True to stream until the job completes.

>>> hf jobs stats 6ac3bd9afbc85ba6823a9ad4
JOB ID                CPU % NUM CPU MEM % MEM USAGE      NET I/O         GPU UTIL % GPU MEM % GPU MEM USAGE
--------------------- ----- ------- ----- -------------- --------------- ---------- --------- -------------
6ac3bd9afbc85ba682... 0%    2.0     0.01% 1.0MB / 16.0GB 0.0bps / 0.0bps N/A        N/A       N/A
Hint: Use `hf jobs stats -f celinah/6ac3bd9afbc85ba6823a9ad4` to follow live stats.
Stream live stats until the job completes
>>> hf jobs stats -f 6ac3bd9afbc85ba6823a9ad4

>>> from huggingface_hub import fetch_job_metrics
>>> for metrics in fetch_job_metrics(job_id=job.id, follow=True):
...     print(metrics)

Other Jobs fixes in this release: hf jobs logs and hf spaces logs without -f no longer hang while the job keeps printing, hf jobs stats no longer fails when one of the requested jobs has finished, and hf jobs stats --json prints [] when no job is running.

📚 Documentation: Jobs guide

⚡ Concurrent downloads always use hf_xet

In a fresh process, the first concurrent hf_hub_download calls could read a placeholder version for hf_xet while another thread was still looking it up. Those calls treated hf_xet as missing and downloaded through the plain HTTP path. This mostly affected parallel downloads such as snapshot_download, where some of the files skipped Xet. The version lookup is now cached only once it is resolved, so every download sees the real value.

  • Fix race in _get_version that makes concurrent downloads skip hf_xet by @​BramVanroy in #5102

📂 HfFileSystem cache fixes

Three fixes to how HfFileSystem caches listings and missing paths:

  • ls() on a newly created empty bucket returns an empty list instead of raising FileNotFoundError.
  • Directory listings are now replaced in the cache instead of appended to. Before, ls() after find() or ls(refresh=True) could return duplicate entries, refresh=True kept deleted files, and listing a single bucket file cached it as the whole folder's listing.
  • exists(path, refresh=True) and invalidate_cache(path) now clear cached "not found" results. Before, a repo, branch or bucket created in the same process stayed missing until a full invalidate_cache().
</tr></table>

... (truncated)

Commits
  • acfdf30 Release: v2.2.0
  • 193d9d9 Release: v2.2.0.rc0
  • 5be3565 [Cache] Speed up delete_revisions with a set lookup (#5118)
  • dab6a96 [CLI] Don't glob-expand arguments on Windows (#5117)
  • cca4d3a [Download] Fix offline snapshot_download with a pinned revision (#5113)
  • c6cc03e Fix argument name in raise_text_generation_error docstring (#5108)
  • 8abbfe5 Fix race in _get_version that makes concurrent downloads skip hf_xet (#5102)
  • bb3a875 [Docs] Fix from_pretrained integration example (#5105)
  • cf992a9 [HfFileSystem] Make refresh=True clear cached not-found results (#5106)
  • af74167 [Tests] Wait for bucket listings after writes (#5095)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all group across 1 directory with 6 updates
6f20363 
Bumps the all group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [torch](https://github.com/pytorch/pytorch) | `2.13.0` | `2.14.1` |
| [torchvision](https://github.com/pytorch/vision) | `0.28.0` | `0.29.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.17.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.65` | `0.0.88` |
| [py7zr](https://github.com/miurahr/py7zr) | `1.1.3` | `1.1.4` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.25.1` | `2.2.0` |



Updates `torch` from 2.13.0 to 2.14.1
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.13.0...v2.14.1)

Updates `torchvision` from 0.28.0 to 0.29.1
- [Release notes](https://github.com/pytorch/vision/releases)
- [Commits](pytorch/vision@v0.28.0...v0.29.1)

Updates `ruff` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.17.0)

Updates `ty` from 0.0.65 to 0.0.88
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.65...0.0.88)

Updates `py7zr` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/miurahr/py7zr/releases)
- [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst)
- [Commits](miurahr/py7zr@v1.1.3...v1.1.4)

Updates `huggingface-hub` from 1.25.1 to 2.2.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.25.1...v2.2.0)

---
updated-dependencies:
- dependency-name: torch
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: torchvision
  dependency-version: 0.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ty
  dependency-version: 0.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: py7zr
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: huggingface-hub
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 22, 2026
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Oct 22, 2026
@thomas-chauchefoin-tob
thomas-chauchefoin-tob merged commit 8a6c349 into master Oct 22, 2026
9 checks passed
@thomas-chauchefoin-tob
thomas-chauchefoin-tob deleted the dependabot/uv/all-6de265330e branch October 22, 2026 17:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thomas-chauchefoin-tob thomas-chauchefoin-tob thomas-chauchefoin-tob approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thomas-chauchefoin-tob