Skip to content

Bump the pip group across 7 directories with 9 updates - #598

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-aitk/requirements/pip-0d979cb508
Open

Bump the pip group across 7 directories with 9 updates#598
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-aitk/requirements/pip-0d979cb508

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 6 updates in the /.aitk/requirements directory:

Package From To
aiohttp 3.14.0 3.14.3
pillow 12.2.0 12.3.0
tornado 6.5.5 6.5.7
transformers 4.51.3 5.5.0
cryptography 49.0.0 50.0.0
nltk 3.9.4 3.10.0

Bumps the pip group with 3 updates in the /.aitk/requirements/AMD directory: aiohttp, transformers and nltk.
Bumps the pip group with 3 updates in the /.aitk/requirements/General directory: aiohttp, pillow and transformers.
Bumps the pip group with 4 updates in the /.aitk/requirements/Intel directory: aiohttp, pillow, tornado and transformers.
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B-Instruct/OpenVINO directory: transformers.
Bumps the pip group with 8 updates in the /microsoft-Phi-4-mini-instruct/QAIRT directory:

Package From To
aiohttp 3.13.3 3.14.3
pillow 8.4.0 12.3.0
tornado 6.5.4 6.5.7
transformers 4.46.0 5.5.0
cryptography 45.0.7 50.0.0
bleach 6.3.0 6.4.0
paramiko 3.5.1 5.0.0
webob 1.8.9 1.8.11

Bumps the pip group with 7 updates in the /mistralai-Mistral-7B-Instruct-v0.3/QAIRT directory:

Package From To
aiohttp 3.14.0 3.14.3
pillow 12.2.0 12.3.0
tornado 6.5.5 6.5.7
transformers 4.44.0 5.5.0
cryptography 45.0.7 50.0.0
bleach 6.3.0 6.4.0
paramiko 3.5.1 5.0.0

Updates aiohttp from 3.14.0 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Updates tornado from 6.5.5 to 6.5.7

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits
  • 48fc2d4 Merge pull request #3633 from bdarnell/curl-reset-65
  • 4ae1ddd Release notes and version bump for 6.5.7
  • 3154caa curl_httpclient: Reset the curl object before putting it on the freelist
  • 7d869c0 Merge pull request #3631 from bdarnell/cve-links
  • 288241f docs: Use the correct link syntax
  • 8da981c docs: Add CVE links to 6.5.6 release notes
  • aba2569 Merge pull request #3626 from bdarnell/fixes-656
  • a24b260 httpclient_test: Accept an additional error message variant
  • a74240a Release notes and version bump for 6.5.6.
  • e8fc7ed simple_httpclient: Strip auth headers on cross-origin redirects
  • Additional commits viewable in compare view

Updates transformers from 4.51.3 to 5.5.0

Release notes

Sourced from transformers's releases.

Release v5.5.0

New Model additions

Gemma4

Gemma 4 is a multimodal model with pretrained and instruction-tuned variants, available in 1B, 13B, and 27B parameters. The architecture is mostly the same as the previous Gemma versions. The key differences are a vision processor that can output images of fixed token budget and a spatial 2D RoPE to encode vision-specific information across height and width axis.

You can find all the original Gemma 4 checkpoints under the Gemma 4 release.

The key difference from previous Gemma releases is the new design to process images of different sizes using a fixed-budget number of tokens. Unlike many models that squash every image into a fixed square (like 224×224), Gemma 4 keeps the image's natural aspect ratio while making it the right size. There a a couple constraints to follow:

  • The total number of pixels must fit within a patch budget
  • Both height and width must be divisible by 48 (= patch size 16 × pooling kernel 3)

[!IMPORTANT] Gemma 4 does not apply the standard ImageNet mean/std normalization that many other vision models use. The model's own patch embedding layer handles the final scaling internally (shifting values to the [-1, 1] range).

The number of "soft tokens" (aka vision tokens) an image processor can produce is configurable. The supported options are outlined below and the default is 280 soft tokens per image.

Soft Tokens Patches (before pooling) Approx. Image Area
70 630 ~161K pixels
140 1,260 ~323K pixels
280 2,520 ~645K pixels
560 5,040 ~1.3M pixels
1,120 10,080 ~2.6M pixels

To encode positional information for each patch in the image, Gemma 4 uses a learned 2D position embedding table. The position table stores up to 10,240 positions per axis, which allows the model to handle very large images. Each position is a learned vector of the same dimensions as the patch embedding. The 2D RoPE which Gemma 4 uses independently rotate half the attention head dimensions for the x-axis and the other half for the y-axis. This allows the model to understand spatial relationships like "above," "below," "left of," and "right of."

NomicBERT

NomicBERT is a BERT-inspired encoder model that applies Rotary Position Embeddings (RoPE) to create reproducible long context text embeddings. It is the first fully reproducible, open-source text embedding model with 8192 context length that outperforms both OpenAI Ada-002 and OpenAI text-embedding-3-small on short-context MTEB and long context LoCo benchmarks. The model generates dense vector embeddings for various tasks including search, clustering, and classification using specific instruction prefixes.

Links: Documentation | Paper

MusicFlamingo

Music Flamingo is a fully open large audio–language model designed for robust understanding and reasoning over music. It builds upon the Audio Flamingo 3 architecture by including Rotary Time Embeddings (RoTE), which injects temporal position information to enable the model to handle audio sequences up to 20 minutes. The model features a unified audio encoder across speech, sound, and music with special sound boundary tokens for improved audio sequence modeling.

Links: Documentation | Paper

... (truncated)

Commits
  • c1c3424 update
  • 20bff68 update release workflow
  • 8956441 v5.5.0
  • 5135e5e casually dropping the most capable open weights on the planet (#45192)
  • a594e09 Internalise the NomicBERT model (#43067)
  • 4932e97 Fix resized LM head weights being overwritten by post_init (#45079)
  • 57e8413 [Qwen3.5 MoE] Add _tp_plan to ForConditionalGeneration (#45124)
  • b10552e Fix TypeError: 'NoneType' object is not iterable in GenerationMixin.generate ...
  • 423f2a3 fix(models): Fix dtype mismatch in SwitchTransformers and TimmWrapperModel (#...
  • ade7a05 Generalize gemma vision mask to videos (#45185)
  • Additional commits viewable in compare view

Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.3 2026-08-12

  • docs: wrap Chat-80 HOWTO output
  • Sandbox Stanford JAR execution to nltk_data directories
  • Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
  • Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string distances (CWE-407/CWE-400)
  • Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
  • fix(security): sandbox MaltParser's Java execution (CVE-2026-12252, CVE-2026-12841)
  • fix(security): trust the system temp dir only when it is private (CWE-377/CWE-378)
  • fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
  • fix(security): validate per-call java() options and replace the -XX:/-D allowlist with a minimal one (CWE-88)
  • Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59, CWE-776, CWE-918)

Thanks to the following contributors to 3.10.3: Mohammad Favas S, leduckhuong, Ziyu Lin, dougtrainer28-cmyk, Chaitanya Kadian, 0xRenSec, Arpit Jain, Jace, nguyencanhthuong, Liling Tan, medimedi, Eric Kafe.

Version 3.10.2 2026-08-05

  • Remove inisec.py and document PYTHONSAFEPATH instead
  • Skip draft step in release workflow
  • Fix symlink escape in FramenetCorpusReader (CWE-59)
  • Guard tempfile.gettempdir() when building pathsec allowed roots
  • add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

  • Expand ~ in env-var paths
  • Validate types after WordNet app pickle deserialization
  • Fix uncontrolled search path in HunposTagger
  • Use exact thirds in masi_distance
  • Avoid retaining bllip import exceptions
  • Fix word_tokenize: pad opening single quote before multi-letter words.
  • Implement Tree.pformat_latex_forest.
  • Prevent module hijacking in inline imports.
  • Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI

... (truncated)

Commits
  • bd49f90 allow escaped brackets in Tree.fromstring (#3694)
  • 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
  • 52227d2 Use os.name for Windows path handling (#3605)
  • 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
  • a167389 Treat missing unzip output as stale (#3607)
  • c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
  • 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
  • 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
  • 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
  • f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.0 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates transformers from 4.57.6 to 5.5.0

Release notes

Sourced from transformers's releases.

Release v5.5.0

New Model additions

Gemma4

Gemma 4 is a multimodal model with pretrained and instruction-tuned variants, available in 1B, 13B, and 27B parameters. The architecture is mostly the same as the previous Gemma versions. The key differences are a vision processor that can output images of fixed token budget and a spatial 2D RoPE to encode vision-specific information across height and width axis.

You can find all the original Gemma 4 checkpoints under the Gemma 4 release.

The key difference from previous Gemma releases is the new design to process images of different sizes using a fixed-budget number of tokens. Unlike many models that squash every image into a fixed square (like 224×224), Gemma 4 keeps the image's natural aspect ratio while making it the right size. There a a couple constraints to follow:

  • The total number of pixels must fit within a patch budget
  • Both height and width must be divisible by 48 (= patch size 16 × pooling kernel 3)

[!IMPORTANT] Gemma 4 does not apply the standard ImageNet mean/std normalization that many other vision models use. The model's own patch embedding layer handles the final scaling internally (shifting values to the [-1, 1] range).

The number of "soft tokens" (aka vision tokens) an image processor can produce is configurable. The supported options are outlined below and the default is 280 soft tokens per image.

Soft Tokens Patches (before pooling) Approx. Image Area
70 630 ~161K pixels
140 1,260 ~323K pixels
280 2,520 ~645K pixels
560 5,040 ~1.3M pixels
1,120 10,080 ~2.6M pixels

To encode positional information for each patch in the image, Gemma 4 uses a learned 2D position embedding table. The position table stores up to 10,240 positions per axis, which allows the model to handle very large images. Each position is a learned vector of the same dimensions as the patch embedding. The 2D RoPE which Gemma 4 uses independently rotate half the attention head dimensions for the x-axis and the other half for the y-axis. This allows the model to understand spatial relationships like "above," "below," "left of," and "right of."

NomicBERT

NomicBERT is a BERT-inspired encoder model that applies Rotary Position Embeddings (RoPE) to create reproducible long context text embeddings. It is the first fully reproducible, open-source text embedding model with 8192 context length that outperforms both OpenAI Ada-002 and OpenAI text-embedding-3-small on short-context MTEB and long context LoCo benchmarks. The model generates dense vector embeddings for various tasks including search, clustering, and classification using specific instruction prefixes.

Links: Documentation | Paper

MusicFlamingo

Music Flamingo is a fully open large audio–language model designed for robust understanding and reasoning over music. It builds upon the Audio Flamingo 3 architecture by including Rotary Time Embeddings (RoTE), which injects temporal position information to enable the model to handle audio sequences up to 20 minutes. The model features a unified audio encoder across speech, sound, and music with special sound boundary tokens for improved audio sequence modeling.

Links: Documentation | Paper

... (truncated)

Commits
  • c1c3424 update
  • 20bff68 update release workflow
  • 8956441 v5.5.0
  • 5135e5e casually dropping the most capable open weights on the planet (#45192)
  • a594e09 Internalise the NomicBERT model (#43067)
  • 4932e97 Fix resized LM head weights being overwritten by post_init (#45079)
  • 57e8413 [Qwen3.5 MoE] Add _tp_plan to ForConditionalGeneration (#45124)
  • b10552e Fix TypeError: 'NoneType' object is not iterable in GenerationMixin.generate ...
  • 423f2a3 fix(models): Fix dtype mismatch in SwitchTransformers and TimmWrapperModel (#...
  • ade7a05 Generalize gemma vision mask to videos (#45185)
  • Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0

What's Changed

@dependabot
Bump the pip group across 7 directories with 9 updates
ed1ddc7 
Bumps the pip group with 6 updates in the /.aitk/requirements directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.3` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |
| [transformers](https://github.com/huggingface/transformers) | `4.51.3` | `5.5.0` |
| [cryptography](https://github.com/pyca/cryptography) | `49.0.0` | `50.0.0` |
| [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.0` |

Bumps the pip group with 3 updates in the /.aitk/requirements/AMD directory: [aiohttp](https://github.com/aio-libs/aiohttp), [transformers](https://github.com/huggingface/transformers) and [nltk](https://github.com/nltk/nltk).
Bumps the pip group with 3 updates in the /.aitk/requirements/General directory: [aiohttp](https://github.com/aio-libs/aiohttp), [pillow](https://github.com/python-pillow/Pillow) and [transformers](https://github.com/huggingface/transformers).
Bumps the pip group with 4 updates in the /.aitk/requirements/Intel directory: [aiohttp](https://github.com/aio-libs/aiohttp), [pillow](https://github.com/python-pillow/Pillow), [tornado](https://github.com/tornadoweb/tornado) and [transformers](https://github.com/huggingface/transformers).
Bumps the pip group with 1 update in the /meta-llama-Llama-3.1-8B-Instruct/OpenVINO directory: [transformers](https://github.com/huggingface/transformers).
Bumps the pip group with 8 updates in the /microsoft-Phi-4-mini-instruct/QAIRT directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.3` | `3.14.3` |
| [pillow](https://github.com/python-pillow/Pillow) | `8.4.0` | `12.3.0` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.7` |
| [transformers](https://github.com/huggingface/transformers) | `4.46.0` | `5.5.0` |
| [cryptography](https://github.com/pyca/cryptography) | `45.0.7` | `50.0.0` |
| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |
| [paramiko](https://github.com/paramiko/paramiko) | `3.5.1` | `5.0.0` |
| [webob](https://github.com/Pylons/webob) | `1.8.9` | `1.8.11` |

Bumps the pip group with 7 updates in the /mistralai-Mistral-7B-Instruct-v0.3/QAIRT directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.3` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |
| [transformers](https://github.com/huggingface/transformers) | `4.44.0` | `5.5.0` |
| [cryptography](https://github.com/pyca/cryptography) | `45.0.7` | `50.0.0` |
| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |
| [paramiko](https://github.com/paramiko/paramiko) | `3.5.1` | `5.0.0` |



Updates `aiohttp` from 3.14.0 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `tornado` from 6.5.5 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.5...v6.5.7)

Updates `transformers` from 4.51.3 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `cryptography` from 49.0.0 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

Updates `nltk` from 3.9.4 to 3.10.0
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@3.9.4...v3.10.0)

Updates `aiohttp` from 3.14.0 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `transformers` from 4.57.6 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `nltk` from 3.9.4 to 3.10.0
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@3.9.4...v3.10.0)

Updates `aiohttp` from 3.14.0 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `transformers` from 4.51.3 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `aiohttp` from 3.14.0 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `tornado` from 6.5.5 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.5...v6.5.7)

Updates `transformers` from 5.0.0rc3 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `transformers` from 4.52.3 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `aiohttp` from 3.13.3 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `pillow` from 8.4.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `tornado` from 6.5.4 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.5...v6.5.7)

Updates `transformers` from 4.46.0 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `cryptography` from 45.0.7 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `paramiko` from 3.5.1 to 5.0.0
- [Commits](paramiko/paramiko@3.5.1...5.0.0)

Updates `webob` from 1.8.9 to 1.8.11
- [Changelog](https://github.com/Pylons/webob/blob/1.8.11/CHANGES.txt)
- [Commits](Pylons/webob@1.8.9...1.8.11)

Updates `aiohttp` from 3.14.0 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `tornado` from 6.5.5 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.5...v6.5.7)

Updates `transformers` from 4.44.0 to 5.5.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.51.3...v5.5.0)

Updates `cryptography` from 45.0.7 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `paramiko` from 3.5.1 to 5.0.0
- [Commits](paramiko/paramiko@3.5.1...5.0.0)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: paramiko
  dependency-version: 5.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: webob
  dependency-version: 1.8.11
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: transformers
  dependency-version: 5.5.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: paramiko
  dependency-version: 5.0.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 27, 2026
Copilot AI lite review requested due to automatic review settings August 27, 2026 22:27
@dependabot dependabot Bot added the python Pull requests that update python code label Aug 27, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 27, 2026 22:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 27, 2026
Copilot AI reviewed Aug 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates pinned Python dependencies across multiple environment-specific requirements*.txt files (AITK venv definitions and model/recipe requirements) to keep runtime stacks current and consistent across recipes.

Changes:

  • Bumps core libraries across multiple requirement sets (notably transformers to 5.5.0, plus aiohttp, pillow, tornado, cryptography, nltk, etc.).
  • Updates additional dependencies in several stacks (e.g., protobuf, sentencepiece, bokeh, and torch in some environments).
  • Aligns requirement sets for different runtimes/hardware profiles (General, Intel, Nvidia GPU, AMD, QAIRT, OpenVINO).

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
mistralai-Mistral-7B-Instruct-v0.3/QAIRT/requirements.txt Bumps multiple QAIRT dependencies (incl. transformers, aiohttp, etc.).
microsoft-Phi-4-mini-instruct/QAIRT/requirements.txt Bumps multiple QAIRT dependencies (incl. transformers, aiohttp, etc.).
meta-llama-Llama-3.1-8B-Instruct/OpenVINO/requirements.txt Updates OpenVINO recipe pins (incl. torch, transformers).
.aitk/requirements/requirements-WinMLCLI.txt Updates WinML CLI venv dependency pins.
.aitk/requirements/requirements-WCR.txt Updates WCR venv dependency pins.
.aitk/requirements/requirements-WCR-SAM.txt Updates SAM patch venv pins (primarily transformers).
.aitk/requirements/requirements-WCR_INIT.txt Updates init/bootstrap venv pins (primarily protobuf).
.aitk/requirements/requirements-QNN.txt Updates QNN venv dependency pins.
.aitk/requirements/requirements-QNN_LLM.txt Updates QNN LLM venv pins (incl. protobuf, tornado).
.aitk/requirements/requirements-Profiling.txt Updates profiling venv pins (incl. protobuf, tornado).
.aitk/requirements/requirements-NvidiaGPU.txt Updates Nvidia GPU venv pins (incl. torch, transformers).
.aitk/requirements/requirements-NvidiaGPU-Qwen3.txt Updates Qwen3 Nvidia GPU patch pins (primarily transformers).
.aitk/requirements/requirements-NvidiaGPU-GptqModel.txt Updates GPTQ model venv pins (incl. protobuf, transformers).
.aitk/requirements/requirements-NvidiaGPU-AutoGptq.txt Updates AutoGPTQ patch pins (primarily sentencepiece).
.aitk/requirements/requirements-IntelNPU.txt Updates Intel NPU venv pins (incl. torch, transformers).
.aitk/requirements/requirements-IntelNPU-WP.txt Updates Intel NPU WP patch pins (primarily transformers).
.aitk/requirements/Intel/Test_py3.12.9.txt Updates Intel test venv pins.
.aitk/requirements/Intel/Test_py3.12.9-Transformers4.49.txt Updates Transformers4.49 feature patch pin.
.aitk/requirements/General/CUDA_py3.12.9.txt Updates General CUDA venv pins.
.aitk/requirements/General/CPU_py3.12.9.txt Updates General CPU venv pins.
.aitk/requirements/General/CPU_py3.12.9-SAM.txt Updates General CPU SAM patch pins (primarily transformers).
.aitk/requirements/General/CPU_py3.12.9-genai.txt Updates General CPU genai patch pins (incl. transformers).
.aitk/requirements/AMD/Quark_py3.12.13.txt Updates AMD Quark venv pins (incl. torch, transformers).

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .aitk/requirements/General/CUDA_py3.12.9.txt
Comment on lines +78 to +79
# torch==2.13.0
torch==2.13.0
Comment thread .aitk/requirements/General/CPU_py3.12.9.txt
threadpoolctl==3.6.0
tokenizers==0.21.4
torch==2.7.0
torch==2.13.0
Comment thread .aitk/requirements/Intel/Test_py3.12.9.txt
Comment on lines +68 to +69
# torch==2.13.0
torch==2.13.0
Comment thread .aitk/requirements/AMD/Quark_py3.12.13.txt
tabulate==0.10.0
tokenizers==0.22.2
torch==2.7.1+cu128
torch==2.13.0
Comment thread .aitk/requirements/General/CPU_py3.12.9-genai.txt
@@ -1,5 +1,5 @@
onnxruntime-genai-winml==0.14.1
transformers==5.14.1
transformers==5.5.0
Comment thread .aitk/requirements/Intel/Test_py3.12.9-Transformers4.49.txt
@@ -1 +1 @@
transformers==5.0.0rc3
transformers==5.5.0
Comment thread mistralai-Mistral-7B-Instruct-v0.3/QAIRT/requirements.txt
Comment on lines +13 to 15
bleach==6.4.0
bokeh==3.10.0
certifi==2026.1.4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant