chore(deps): bump the version-updates group across 1 directory with 5 updates#2254
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Dependency ReviewThe following issues were found:
License Issuesscripts/evals/moderation/uv.lock
OpenSSF ScorecardScorecard details
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2254 +/- ##
==========================================
+ Coverage 81.32% 81.39% +0.07%
==========================================
Files 130 120 -10
Lines 19142 19066 -76
Branches 12 0 -12
==========================================
- Hits 15567 15519 -48
+ Misses 3572 3547 -25
+ Partials 3 0 -3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Eval Execution✅ Status: Passed
No changed AI artifacts required evaluation. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Review
Scope: scripts/evals/moderation/ — Python packages only. No GitHub Actions, .devcontainer/, or copilot-setup-steps.yml changes; SHA pinning and environment synchronization are unaffected.
Version summary
| Package | From | To | Classification |
|---|---|---|---|
torch |
2.12.0 | 2.12.1 | patch ✅ |
transformers |
4.57.6 | 5.12.1 | major (4→5) |
pytest |
9.0.3 | 9.1.1 | minor ✅ |
ruff |
0.15.15 | 0.15.20 | patch ✅ |
atheris |
3.0.0 | 3.1.0 | minor |
Findings
transformers 4→5 (major): Flagged inline. Please verify moderation eval API compatibility with Transformers 5 before merging.
atheris 3.1.0 — CP311 wheel absent: The updated uv.lock shows atheris 3.1.0 provides wheels only for CP312, CP313, and CP314. The CP311 wheel present in 3.0.0 is no longer listed, and no sdist entry appears in the lock file. Since requires-python = ">=3.11", environments running Python 3.11 may fail to install the fuzz dependency group. Please confirm this is acceptable (e.g., CI runs on 3.12+) before merging.
New transitive deps: annotated-doc, anyio, and click are new entries in uv.lock, likely pulled in by transformers 5.x. All are well-established packages under Apache-2.0/MIT licenses — no concern.
Safety checks
- ✅ Licenses: all packages remain Apache-2.0 / BSD / MIT — compatible with this project's MIT license.
- ✅ SHA pinning: no GitHub Actions references modified.
- ✅ Environment sync: no
.devcontainer/orcopilot-setup-steps.ymlchanges. - ✅ Dependabot reports no known vulnerabilities.
Two items need human confirmation (transformers API compatibility, atheris Python 3.11 availability) before merging.
Generated by Dependabot PR Review for issue #2254 · 227.8 AIC · ⌖ 12.7 AIC · ⊞ 48.6K
| "transformers>=4.40,<5", | ||
| "torch==2.12.1", | ||
| "transformers>=5.12.1,<6", | ||
| ] |
There was a problem hiding this comment.
transformers 4.x → 5.x
The constraint changes from >=4.40,<5 to >=5.12.1,<6, pinning against Hugging Face Transformers 5. This is a major release and the API surface (model loading, AutoModel, tokenizer signatures, pipeline interfaces) may have breaking changes relative to 4.x.
Please verify that the moderation eval code is compatible with the Transformers 5 API before merging.
|
@dependabot recreate |
dependabot
Bot
force-pushed
the
dependabot/uv/scripts/evals/moderation/version-updates-a8775f59f4
branch
from
fa9f6de to
d679284
Compare
There was a problem hiding this comment.
Dependency Review — scripts/evals/moderation group bump
Summary
| Package | From | To | Classification |
|---|---|---|---|
torch |
2.12.0 |
2.12.1 |
✅ Patch |
transformers |
4.57.6 |
5.12.1 |
|
pytest |
9.0.3 |
9.1.1 |
✅ Minor |
ruff |
0.15.15 |
0.15.20 |
✅ Patch |
atheris |
3.0.0 |
3.1.0 |
✅ Minor |
Safety Checks
- Licenses: All packages use BSD-3 (
torch), Apache 2.0 (transformers,atheris), or MIT (pytest,ruff) — all compatible with the project's MIT license. ✅ - SHA pinning: No GitHub Actions workflow files changed — not applicable. ✅
- Environment sync: No changes to
.devcontainer/orcopilot-setup-steps.yml— not applicable. ✅ - Vulnerabilities: Dependabot reports no known vulnerabilities introduced by this bump. ✅
Findings
torch (patch): Bug-fix release addressing nondeterministic outputs on NVIDIA B200 GPUs (Triton 3.7.1 update), an illegal memory access regression, and a fill_ byte-dtype view fix. Clean and safe to merge.
transformers (major — flag for human review): The previous constraint >=4.40,<5 deliberately excluded v5. This PR upgrades to >=5.12.1,<6, crossing the major version boundary. The lock file reflects 12 new transitive dependencies (notably httpx/anyio replacing requests/urllib3) and 4 removals, indicating transformers v5 replaced its HTTP stack. The Dependabot PR body only includes patch-level release notes for v5.12.1; the v5.0 migration notes are not summarized. Human verification that the moderation eval's detoxify + transformers integration is compatible with the v5 API is recommended before merging. See inline comment on pyproject.toml line 9.
pytest (minor): Constraint tightened from >=8.0 to >=9.1.1. pytest 9.1.0 has a noted backward-incompatible change for --doctest-modules with autouse fixtures — but this project's addopts does not include --doctest-modules, so this is unlikely to have any impact. ✅
ruff and atheris: Routine patch/minor bumps with no breaking changes. ✅
Verdict
Safety checks pass for all packages except the transformers major version bump, which requires human confirmation that the v4→v5 API transition is handled correctly in the moderation eval code. This review does not block the PR — it flags the major bump for human attention before merge.
Generated by Dependabot PR Review for issue #2254 · 290.7 AIC · ⌖ 13 AIC · ⊞ 46.2K
| "torch==2.12.0", | ||
| "transformers>=4.40,<5", | ||
| "torch==2.12.1", | ||
| "transformers>=5.12.1,<6", |
There was a problem hiding this comment.
transformers v4 → v5
The previous constraint >=4.40,<5 explicitly excluded v5. This PR changes it to >=5.12.1,<6, crossing the major version boundary.
New transitive dependencies pulled in by transformers v5 (12 added, 4 removed from lock file):
- Added:
httpx,anyio,h11,httpcore,typer,rich,click,shellingham,markdown-it-py,mdurl,annotated-doc,typing-extensions - Removed:
requests,urllib3,charset-normalizer(transformers v5 migrated fromrequeststohttpx)
Please verify that the detoxify integration and any direct transformers API calls in the moderation eval code remain compatible with the v5 API before merging.
… updates Bumps the version-updates group with 5 updates in the /scripts/evals/moderation directory: | Package | From | To | | --- | --- | --- | | [torch](https://github.com/pytorch/pytorch) | `2.12.0` | `2.12.1` | | [transformers](https://github.com/huggingface/transformers) | `4.57.6` | `5.12.1` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.15` | `0.15.20` | | [atheris](https://github.com/google/atheris) | `3.0.0` | `3.1.0` | Updates `torch` from 2.12.0 to 2.12.1 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.12.0...v2.12.1) Updates `transformers` from 4.57.6 to 5.12.1 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v4.57.6...v5.12.1) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) Updates `ruff` from 0.15.15 to 0.15.20 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.15...0.15.20) Updates `atheris` from 3.0.0 to 3.1.0 - [Commits](https://github.com/google/atheris/commits) --- updated-dependencies: - dependency-name: atheris dependency-version: 3.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: ruff dependency-version: 0.15.20 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: torch dependency-version: 2.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: transformers dependency-version: 5.12.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/uv/scripts/evals/moderation/version-updates-a8775f59f4
branch
from
d679284 to
dada696
Compare
There was a problem hiding this comment.
Dependency Review — Safety Check Results
This review covers the 5 dependency bumps in scripts/evals/moderation/.
Version Bump Summary
| Package | From | To | Classification |
|---|---|---|---|
torch |
2.12.0 | 2.12.1 | Patch |
transformers |
4.57.6 | 5.12.1 | Major (v4 → v5) |
pytest |
9.0.3 | 9.1.1 | Minor |
ruff |
0.15.15 | 0.15.20 | Patch |
atheris |
3.0.0 | 3.1.0 | Minor |
Safety Checks
- ✅ Licenses: All compatible with MIT — torch (BSD-3-Clause), transformers (Apache-2.0), pytest (MIT), ruff (MIT), atheris (Apache-2.0).
- ✅ SHA pinning: No GitHub Actions files modified; not applicable.
- ✅ Environment sync: No changes to
.devcontainer/orcopilot-setup-steps.yml; not applicable. - ✅ Vulnerabilities: Dependabot reports no known vulnerabilities introduced by these bumps.
- ✅ No new dependencies: All bumped packages were already present.
⚠️ Flag for Human Attention — Major Version Bump: transformers
transformers crosses the v4→v5 major version boundary (4.57.6 → 5.12.1). Notable signals from the lock file diff:
typeris added as a new runtime dependency;filelockandrequestsare removed.- New transitive packages appear (
annotated-doc,anyio,click,colorama).
The HuggingFace v5 release may include breaking API changes for the moderation eval code. A human reviewer should confirm that scripts/evals/moderation/ tests pass against transformers==5.12.1 before merging.
All other bumps (torch patch, pytest minor, ruff patch, atheris minor) are straightforward and passed all safety checks.
Generated by Dependabot PR Review for issue #2254 · 139.5 AIC · ⌖ 14.5 AIC · ⊞ 48.4K
2 participants
Bumps the version-updates group with 5 updates in the /scripts/evals/moderation directory:
2.12.02.12.14.57.65.12.19.0.39.1.10.15.150.15.203.0.03.1.0Updates
torchfrom 2.12.0 to 2.12.1Release notes
Sourced from torch's releases.
Commits
7269437Update triton to 3.7.1 release (#186814)88f16c2[MPS] Fix fill_ on byte-dtype views with misaligned storage offset (#186821)ccf6e67[release-only] Update version to 2.12.1 (#186813)88a6dc7Revive CUDA 12.9 nightly binary builds (#186015)ded5505[CD] Drop CPython 3.13t from binary build matrix (#182951) (#186654)Updates
transformersfrom 4.57.6 to 5.12.1Release notes
Sourced from transformers's releases.
... (truncated)
Commits
ddb849av5.12.1d81db16mistral common backend fix (#46667)07c294cFixpeftlower bound (#46605)e0e7504Revert "fix security issue with allow all kernels"7904f30fix security issue with allow all kernelsd77d573fix kernel pathf7999c7v5.12.04c5d4fdAdd minimax m3vl (#46600)5957e6f[CI] capture checkers output in OTEL (#46601)2d68208Lfm2: threadseq_idxthrough ShortConv for packed/varlen inputs (#46588)Updates
pytestfrom 9.0.3 to 9.1.1Release notes
Sourced from pytest's releases.
... (truncated)
Commits
cf470ecPrepare release version 9.1.1e0c8ce6Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...1b82d16Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...501c4bcMerge pull request #14596 from bluetech/doc-classmethodb61f588Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir9a567e0[automated] Update plugin list (#14617) (#14618)ef8b299Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...66abd07Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup79fbf93Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...0d312ebMerge pull request #14611 from bluetech/parametrize-argvalues-typingUpdates
rufffrom 0.15.15 to 0.15.20Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
f82a36bBump 0.15.20 (#26376)af32943Improve the summarise-ecosystem-results skill (#26378)485ebabRemoveRUF076name from schema (#26371)ef81835[ty] Implement rust-analyzer's "Click for full compiler diagnostic" feature (...572b31e[ruff] Removepytest-fixture-autouse(RUF076) (#26240)f703f21Allow human-readable names in rule selectors (#25887)0d726b2[ty] Reuse equality semantics for membership compatibility (#25955)dbe6e98[ty] Infer definite equality comparison results (#26337)e700ea3[ty] Prove TypedDict structural patterns exhaustive (#26285)6a0d2ec[ty] Widen inferred class-valued instance attributes (#26338)Updates
atherisfrom 3.0.0 to 3.1.0Commits