Skip to content

deps(lora): bump the lora-deps group across 1 directory with 10 updates - #1130

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-c7c78b0398
Closed

deps(lora): bump the lora-deps group across 1 directory with 10 updates#1130
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-c7c78b0398

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on datasets, transformers, peft, tqdm, sentence-transformers, bitsandbytes, matplotlib, fastapi, onnxruntime and azure-ai-ml to permit the latest version.
Updates datasets to 5.0.1

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

Docs

New Contributors

... (truncated)

Commits
  • 921c2a7 release: 5.0.1 (#8370)
  • c6fc5cd Preserve nullable integer columns in to_json/to_csv/to_sql (#8366)
  • 6747b87 Fix DatasetDict.push_to_hub leaving removed splits in the dataset card (#8367)
  • b305031 fix buckets on windows (#8369)
  • 030a3e5 Decode Json() columns in Dataset.to_pandas() (#8344)
  • 0f207a0 Rebatch arrow source before formatting in IterableDataset.filter to fix resum...
  • adad35d Keep integers on the python read path for fixed-shape ArrayXD columns with nu...
  • 8966746 Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 (#8358)
  • b8e861a Fix bucket dataset card handling and push metadata accounting (#8354)
  • 521a590 Keep flat numeric columns with nulls numeric in numpy format (#8352)
  • Additional commits viewable in compare view

Updates transformers to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

Commits

Updates peft to 0.20.0

Release notes

Sourced from peft's releases.

v0.20.0

Highlights

This release adds no less than nine new PEFT methods and puts a lot of work into the surrounding infrastructure, for example adding a new image generation benchmark for the method comparison suite and greatly improving the documentation structure.

New Methods

HiRA

@​hqsiswiliam added "HiRA: Parameter-Efficient Hadamard High-Rank Adaptation for Large Language Models" to PEFT (#2668). Instead of adding the low-rank product BA to the base weight, HiRA multiplies it elementwise (Hadamard product) with the frozen base weight. Because the base weight itself is full rank, the resulting update is no longer constrained to be low rank, while the trainable parameter count stays the same as LoRA's.

GLoRA

@​not-lain contributed GLoRA: "One-for-All: Generalized LoRA for Parameter-Efficient Fine-Tuning" in #3098. It is a flexible PEFT method that extends LoRA with configurable weight, activation, and bias adaptation, delivering richer fine-tuning with no extra inference cost. Use it when you need per-layer flexibility or stronger adaptation than vanilla LoRA. Skip it for non-Linear layers (e.g. Conv/Embedding) or when standard LoRA is already sufficient and simplicity matters.

BEFT

@​whubaichuan added "BEFT: Bias-Efficient Fine-Tuning of Language Models" in #3195. BEFT builds on the observation that fine-tuning bias terms alone can be competitive in low-data regimes, but goes further: rather than training all biases, it targets the value projection by default, as the authors found this to be most efficient. This brings the trainable parameter count down to roughly 0.01% of the total parameters.

MonteCLoRA

@​victor7246 integrated MonteCLoRA, "Robust and Efficient Fine-tuning of LLMs with Bayesian Reparameterization of Low-Rank Adaptation" in #2943. LoRA is known to be sensitive to hyperparameters like learning rate and batch size. This new LoRA variant addresses this by treating the low-rank parameters as a distribution rather than a point estimate, using Monte Carlo estimation to obtain a low-variance posterior estimate. This should make training noticeably more robust, at the cost of only O(rank) additional parameters.

VeLoRA

@​roymiles added VeLoRA: "Memory Efficient Training using Rank-1 Sub-Token Projections" in #3159. Unlike most PEFT methods, this LoRA variant targets activation memory rather than parameter count: intermediate activations are split into sub-tokens and compressed with a fixed rank-1 projection before being cached for the backward pass, then reconstructed during backpropagation. Conceptually, it is similar to gradient checkpointing, with a lower memory saving but running faster.

Uni-LoRA

@​KaiyangLi1992 contributed Uni-LoRA: "One Vector is All You Need" in #3257. The paper shows that parameter-efficient LoRA variants like VeRA and VB-LoRA can all be described as projecting the full LoRA parameter space down to a much smaller subspace, differing only in the choice of projection. Uni-LoRA uses a single global projection across the whole model instead of layer-wise ones, which allows cross-layer parameter sharing and thus very low parameter counts.

FRoD

@​Bane-Elvin added FRoD, "Full-Rank Efficient Fine-Tuning with Rotational Degrees for Fast Convergence", in #3270. Instead of adding low-rank deltas like LoRA, it reconstructs selected weights with shared rotational subspaces and sparse trainable coefficients. It is especially useful when fast convergence and a higher full-rank capacity ceiling are important, and its large sparse rotational subspace may also be promising for model merging. The main tradeoffs are the costly joint-decomposition initialization and slightly slower forward/backward passes than LoRA, so it may be less attractive for a one-off single-task fine-tune.

MiCA

@​sr-networks contributed MiCA, "MiCA Learns More Knowledge Than LoRA and Full Fine-Tuning", in #3260. MiCA is a LoRA variant that initializes B from the SVD of the base weight, taking the left singular vectors belonging to the smallest singular values, and then trains only A. The idea is that adapting these underused directions integrates new knowledge more effectively than adapting the dominant subspace, with less interference with existing capabilities.

DEFT

@​MAXNORM8650 added DEFT, "Decompositional Efficient Fine-Tuning for Text-to-Image Models", in #3342. This PEFT method splits a weight update into two learned low-rank parts: a projection that removes a sub-space of the frozen weight, and a low-rank update that injects new content in its place. Use DEFT for personalizing a text-to-image model from a few images while retaining the base model's instruction-following/editability with minimal forgetting. It is less of a fit if you don't need to preserve the base model's other capabilities (a plain additive adapter is simpler) or for layers beyond Linear/Conv1D. The PaRa method is also supported as a special case of DEFT.

Enhancements

Automatic LoRA target selection

@​oswaldoludwig added KappaTuneSelector in #3106 based on "The Condition Number as a Scale-Invariant Proxy for Information Encoding in Neural Units". The PR adds a new function, find_kappa_target_modules, which automatically identifies which modules best to target based on the condition number of the base weight matrices. This removes some of the guesswork from choosing target_modules when configuring LoRA or other PEFT methods.

... (truncated)

Commits

Updates tqdm to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

  • contrib.concurrent: major improvements
    • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
    • fix total based on shortest iterable length (#1473)
    • use default max_workers (#1543 <- #1530, #1518)
    • support timeout, buffersize (#1576)
    • improve ETA (#1708 <- #1161)
    • update as_completed (#1709 <- #1565)
    • add tqdm.concurrent.intepreter_map (#1777)
  • asyncio: support iterables with only __aiter__ (#1714 <- #1686)
  • support reset(float("inf")) (#1783 <- #1781, #651)
  • framework: test & reduce wheel size (#1782)
Commits
  • 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
  • c27393e misc tidy
  • 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
  • 9fc160b Update how we check for interpreter_map support in the tests
  • b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
  • 16d5486 Add support for nested progress bars
  • 9f5890f Add initial implementation for interpreter_map
  • 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
  • 4664b57 minor tidy
  • 426a098 Treat inf total as unknown in reset() too
  • Additional commits viewable in compare view

Updates sentence-transformers to 5.6.1

Release notes

Sourced from sentence-transformers's releases.

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

This patch release fixes silently degraded embeddings for RoBERTa-family models when flash attention is requested with transformers v5, notably every XLM-R based multilingual embedding model (BAAI/bge-m3, intfloat/multilingual-e5-large, etc.). The bug affected v5.5.0, v5.5.1, and v5.6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.1
Inference only, use one of:
pip install sentence-transformers==5.6.1
pip install sentence-transformers[onnx-gpu]==5.6.1
pip install sentence-transformers[onnx]==5.6.1
pip install sentence-transformers[openvino]==5.6.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.1
pip install sentence-transformers[audio]==5.6.1
pip install sentence-transformers[video]==5.6.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.1

Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

Since v5.5.0, the Transformer module flattens text-only batches into one packed sequence when flash attention is requested, skipping all padding overhead for a notable performance improvement. The position_ids of that packed sequence restart at 0 for every text, which is correct for the vast majority of models. RoBERTa-family architectures however compute positions as padding_idx + 1 + n for the n-th token, so every token read a position embedding shifted by padding_idx + 1 (usually 2). Nothing crashes, the embeddings are just silently worse.

from sentence_transformers import SentenceTransformer
An affected configuration: flash attention with an XLM-R based model
model = SentenceTransformer(
"BAAI/bge-m3",
model_kwargs={"attn_implementation": "flash_attention_2"},
)

Measured on BAAI/bge-m3:

Evaluation padded packed, 0-based positions packed, with this fix
stsb test Spearman 0.8485 0.7239 0.8485
NanoBEIR mean nDCG@10 0.6041 0.5414 0.6050

The quality loss recovers exactly once the offset is applied. The fix scans the loaded model's modules once for an int padding_idx stored next to a learned position_embeddings table, and offsets the packed position_ids when that pair is found. An audit of transformers finds 16 architectures with that pair (roberta, xlm_roberta, xlm_roberta_xl, camembert, roberta_prelayernorm, xmod, data2vec_text, longformer, luke, ibert, mpnet, markuplm, lilt, layoutlmv3, esm, and pp_doclayout_v2), all offset by exactly padding_idx + 1, and no 0-based or rotary architecture matches.

You are only affected if you encoded text with flash attention requested on transformers v5 with a RoBERTa-family checkpoint. The default padded path (e.g. sdpa) was never affected, and neither were MPNet models like all-mpnet-base-v2 despite mpnet appearing in the audit: transformers does not support flash attention for MPNet at all. If you did index a corpus with such a configuration, re-encode it after upgrading: pre-fix embeddings score notably worse and do not mix with post-fix embeddings.

What's Changed

... (truncated)

Commits
  • 7d3eb16 Release v5.6.1
  • 286dcf3 [tests] Skip bf16 + Windows + CPU forwards, as they can WindowsError on tor...
  • 30bad93 [ci] Exclude librosa/numba/llvmlite on Python 3.13 (#3835)
  • 9ca6bbc 🚨 Fix position_ids offsetting for RoBERTa-family models when flattening input...
  • See full diff in compare view

Updates bitsandbytes to 0.50.0

Release notes

Sourced from bitsandbytes's releases.

0.50.0: Faster 4-bit inference, CPU/ROCm/Apple Silicon improvements, and more!

This release brings a new fused 4-bit GEMM for inference on CUDA and ROCm, faster CPU ops on x86-64 and ARM64, reduced host-side overhead, and a much improved Apple Silicon backend. We've also added Windows on ARM CPU support, ROCm builds for Windows, additional ROCm and CUDA build variants, and new optimizer support on CPU and Intel XPU.

Highlights

🚀 New 4-bit GEMM kernels for inference (CUDA)

New fused 4-bit dequantize + GEMM kernels replace the old GEMV and dequantize + F.linear paths for small-to-medium batch sizes. 4-bit inference is up to 4x faster at batch sizes of 2 through 64 across Turing through Blackwell, with wins at batch size 1 in many cases too. Nested (double) quantization and bias are fused in as well, so nested quant sees an additional benefit. Kernel selection happens automatically at runtime based on shape, GPU architecture, and SM count. See #1949 for benchmarks and details.

🚀 Fused 4-bit SIMT GEMM on ROCm

The SIMT version of the new 4-bit GEMM has been ported to ROCm and wired into the same dispatch for small inference batches, validated on gfx1100, gfx1201, and gfx1151 (#1979).

AMD ROCm improvements

Stability and performance improvements bring AMD ROCm support out of preview; it is now considered stable.

  • ROCm wheels for Windows are now published for ROCm 7.2 and 7.14 (#1915, #2007).
  • Added ROCm 7.14 and dropped the ROCm 6.2 and 6.3 builds (#2007).
  • Expanded GPU target coverage to add RDNA2 consumer GPUs, additional RDNA3 and RDNA3.5 GPUs, and CDNA1 (gfx908) data center GPUs (#1886, #2007).

Apple Silicon (MPS)

Apple Silicon support is improved. The MPS backend added optimized Metal kernels from the Hub (#1875) and was substantially improved (#1960, #1983, #1994) so that all 4-bit and LLM.int8() configurations now work on MPS. On macOS 26+, install the kernels package for the best performance, which enables the optimized Metal kernels; otherwise a naive fallback is used. The MPS path requires torch >= 2.9.

The last remaining feature for support parity is the 8bit optimizers, which will land in a future release.

CPU performance on x86-64 and ARM64

Blockwise quantization and dequantization on CPU are considerably faster, mostly from better SIMD usage plus some compile flag tuning. Improvements range from 1.1x to over 20x depending on op, dtype, and hardware, with the largest gains on fp16 and on x86-64 CPUs without AVX-512. The LLM.int8() matmul on CPU was improved as well. See #1968 for benchmarks.

Reduced host-side CPU overhead

Reduced Python dispatch overhead, especially on the CUDA/ROCm backend (#1953).

Windows on ARM CPU support

Windows ARM64 CPU wheels are now built with NEON-optimized kernels (#1959), with nightly test coverage added (#1962).

New optimizer support

  • CPU optimizers are now supported for both 32-bit and 8-bit blockwise (#1901).
  • Intel XPU gained paged optimizer support (#1898) and support for the LARS and LAMB optimizers (#1902).
  • Fixed Lion to use decoupled weight decay (#1993, #2001).
  • Other optimizer fixes (#1869, #1998, #1855).

NVIDIA CUDA

  • Added CUDA 13.2 build wheels and nightly test coverage (#1925).
  • Smaller wheels: reduced the CUDA build matrix and added a closest-version fallback for library loading (#1980).

Intel XPU

  • Added a oneAPI 2026 build; wheels now package both the 2025 and 2026 variants and pick the right one at runtime based on the PyTorch XPU version (#2002).
  • Fixed gemv_4bit bf16 correctness on Intel Arc A-series (Alchemist) GPUs (#1942).

🚨 Breaking Changes

  • Minimum PyTorch version is now 2.4 (#1926).
  • Removed deprecated APIs: the research module, non-blockwise (block_wise=False) optimizers, and legacy dynamic quantization functions, along with their CUDA/HIP kernels (#1871, #1880).
  • Removed legacy sparse functionality (spmm_coo, spmm_coo_very_sparse) and dropped the cusparse/hipsparse dependencies (#1881).

... (truncated)

Changelog

Sourced from bitsandbytes's changelog.

v0.45.1

Improvements:

  • Compatibility for triton>=3.2.0
  • Moved package configuration to pyproject.toml
  • Build system: initial support for NVIDIA Blackwell B100 GPUs, RTX 50 Blackwell series GPUs and Jetson Thor Blackwell.
    • Note: Binaries built for these platforms are not included in this release. They will be included in future releases upon the availability of the upcoming CUDA Toolkit 12.7 and 12.8.

Bug Fixes:

  • Packaging: wheels will no longer include unit tests. (#1478)

Dependencies:

  • Sets the minimum PyTorch version to 2.0.0.

0.45.0

This is a significant release, bringing support for LLM.int8() to NVIDIA Hopper GPUs such as the H100.

As part of the compatibility enhancements, we've rebuilt much of the LLM.int8() code in order to simplify for future compatibility and maintenance. We no longer use the col32 or architecture-specific tensor layout formats while maintaining backwards compatibility. We additionally bring performance improvements targeted for inference scenarios.

Performance Improvements

This release includes broad performance improvements for a wide variety of inference scenarios. See this X thread for a detailed explanation.

Breaking Changes

🤗PEFT users wishing to merge adapters with 8-bit weights will need to upgrade to peft>=0.14.0.

Packaging Improvements

  • The size of our wheel has been reduced by ~43.5% from 122.4 MB to 69.1 MB! This results in an on-disk size decrease from ~396MB to ~224MB.
  • Binaries built with CUDA Toolkit 12.6.2 are now included in the PyPI distribution.
  • The CUDA 12.5.0 build has been updated to CUDA Toolkit 12.5.1.

Deprecations

  • A number of public API functions have been marked for deprecation and will emit FutureWarning when used. These functions will become unavailable in future releases. This should have minimal impact on most end-users.
  • The k-bit quantization features are deprecated in favor of blockwise quantization. For all optimizers, using block_wise=False is not recommended and support will be removed in a future release.
  • As part of the refactoring process, we've implemented many new 8bit operations. These operations no longer use specialized data layouts.

Full Changelog

0.44.1

Bug fixes:

... (truncated)

Commits

Updates matplotlib to 3.11.1

Release notes

Sourced from matplotlib's releases.

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

  • Fix tight layout of multiple subplots with sharey=True
  • Fix NoNorm cursor formatting for uint8 images
  • Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
  • Fix clipped Axis labels on 3D plots with tight layout
  • Fix inverted Axis on 3D plots
  • Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
  • Fix missing glyphs when subsetting Type 1 fonts in PDF
  • Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

Commits
  • 3c1757a REL: v3.11.1
  • 792c6b5 DOC: Prepare for 3.11.1
  • aaff9f6 Merge branch 'v3.11.0-doc' into v3.11.x
  • d4f4527 Merge pull request #32052 from meeseeksmachine/auto-backport-of-pr-32038-on-v...
  • 6ad4bcf Merge pull request #32050 from meeseeksmachine/auto-backport-of-pr-31304-on-v...
  • 7fb74d3 Merge pull request #32051 from meeseeksmachine/auto-backport-of-pr-32037-on-v...
  • c624aec Backport PR #32038: Fix occasional misalignment in reported mouse position (a...
  • 8eda2b7 Backport PR #32037: Bump the actions group with 3 updates
  • a0e7ae5 Backport PR #31304: Fix restoring 'auto' aspect in 3D axes after switching fr...
  • 9001323 Merge pull request #32047 from meeseeksmachine/auto-backport-of-pr-32025-on-v...
  • Additional commits viewable in compare view

Updates fastapi to 0.140.13

Release notes

Sourced from fastapi's releases.

0.140.13

Fixes

Docs

Commits
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • e92a0dc 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints (#15937)
  • 6215d8a 📝 Update release notes
  • 12242c4 📝 Fix format_sse_event docstring rendering of \n\n terminator (#15613)
  • 70a8f3d 📝 Update release notes
  • 4f0152c 📝 Add API reference page for fastapi.sse (#15930)
  • 5f25505 🔖 Release version 0.140.12 (#16095)
  • 76e2c83 📝 Update release notes
  • 0f3e7bd 🐛 Fix line splitting in format_sse_event to comply with SSE spec (#15515)
  • Additional commits viewable in compare view

Updates onnxruntime to 1.28.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.28.0

Announcements & Breaking Changes

  • Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
  • cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
  • An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
  • Deprecated / removed:
    • SkipLayerNorm strict mode is deprecated (#29388).
    • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
    • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
    • CUDA_QUANT_PREPROCESS is off by default (#29687).
  • NPM packages are now published from the CUDA 13 pipeline (#28773).
  • The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

  • Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
  • Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
  • Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
  • Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
  • Validated Col2Im inputs to prevent heap over-read (#28706)
  • Hardened CropAndResize against malformed crop_size tensors (#28766)
  • Validated BeamSearch vocab_size against logits width (#28774)
  • Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
  • Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
  • Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #294...

    Description has been truncated

@dependabot
deps(lora): bump the lora-deps group across 1 directory with 10 updates
ef6b6c5 
Updates the requirements on [datasets](https://github.com/huggingface/datasets), [transformers](https://github.com/huggingface/transformers), [peft](https://github.com/huggingface/peft), [tqdm](https://github.com/tqdm/tqdm), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [bitsandbytes](https://github.com/bitsandbytes-foundation/bitsandbytes), [matplotlib](https://github.com/matplotlib/matplotlib), [fastapi](https://github.com/fastapi/fastapi), [onnxruntime](https://github.com/microsoft/onnxruntime) and [azure-ai-ml](https://github.com/Azure/azure-sdk-for-python) to permit the latest version.

Updates `datasets` to 5.0.1
- [Release notes](https://github.com/huggingface/datasets/releases)
- [Commits](huggingface/datasets@5.0.0...5.0.1)

Updates `transformers` to 5.14.1
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.13.0...v5.14.1)

Updates `peft` to 0.20.0
- [Release notes](https://github.com/huggingface/peft/releases)
- [Commits](huggingface/peft@v0.19.1...v0.20.0)

Updates `tqdm` to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.4...v4.70.0)

Updates `sentence-transformers` to 5.6.1
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.6.0...v5.6.1)

Updates `bitsandbytes` to 0.50.0
- [Release notes](https://github.com/bitsandbytes-foundation/bitsandbytes/releases)
- [Changelog](https://github.com/bitsandbytes-foundation/bitsandbytes/blob/main/CHANGELOG.md)
- [Commits](bitsandbytes-foundation/bitsandbytes@0.49.2...0.50.0)

Updates `matplotlib` to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1)

Updates `fastapi` to 0.140.13
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.140.13)

Updates `onnxruntime` to 1.28.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.27.0...v1.28.0)

Updates `azure-ai-ml` to 1.34.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-ai-ml_1.34.0...azure-ai-ml_1.34.1)

---
updated-dependencies:
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: transformers
  dependency-version: 5.14.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: peft
  dependency-version: 0.20.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: sentence-transformers
  dependency-version: 5.6.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: bitsandbytes
  dependency-version: 0.50.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: fastapi
  dependency-version: 0.140.13
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: onnxruntime
  dependency-version: 1.28.0
  dependency-type: direct:production
  dependency-group: lora-deps
- dependency-name: azure-ai-ml
  dependency-version: 1.34.1
  dependency-type: direct:production
  dependency-group: lora-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Bryan-Roe as a code owner July 29, 2026 04:12
bryan-roe-bot[bot]
bryan-roe-bot Bot reviewed Jul 29, 2026
View reviewed changes
Comment thread ai-projects/llm-maker/WEBSITE_MAKER_README.md

# Use specific provider
maker = WebsiteMaker(provider_name='azure') # or 'openai', 'local'
maker = WebsiteMaker(provider_name="azure") # or 'openai', 'local'

@bryan-roe-bot bryan-roe-bot Bot Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

You can view more details about this finding in the Semgrep AppSec Platform.

@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 30, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/ai-projects/lora-training/microsoft_phi-silica-3.6_v1/lora-deps-c7c78b0398 branch July 30, 2026 04:11
@github-actions github-actions Bot added documentation Improvements or additions to documentation quantum-ai labels Jul 30, 2026
@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

🔐 CodeQL — Open Alerts on this PR

Severity Count
medium 57
high 95
error 109
warning 85
note 701

Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.
See the full list in the Security tab.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bryan-roe-bot bryan-roe-bot[bot] bryan-roe-bot[bot] left review comments
@Bryan-Roe Bryan-Roe Awaiting requested review from Bryan-Roe Bryan-Roe is a code owner

Assignees

@Bryan-Roe Bryan-Roe

Labels

autofix dependencies documentation Improvements or additions to documentation quantum-ai training

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Bryan-Roe