deps(lora-local-train): bump the lora-local-train-deps group across 1 directory with 4 updates

[dependabot]

Updates the requirements on transformers, peft, datasets and tqdm to permit the latest version.
Updates transformers to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

• Fix sdpa prefill with position_bias (#47359) by @​Cyrilvallez
• Fix assisted decoding for models with EncoderDecoder cache & OlmoHybrid (#47361) by @​Cyrilvallez
• [FP8] Bump kernels version (#47344) by @​vasqu
• Fix deepgemm on multiple devices (#47323) by @​IlyasMoutawwakil

Commits

• a08ace4 Release: v4.14.1
• 1ccf4f1 Fix deepgemm on multiple devices (#47323)
• c98cc10 [FP8] Bump kernels version (#47344)
• e035e45 Fix assisted decoding for models with EncoderDecoder cache & OlmoHybrid (#47361)
• 0eb5e03 Fix sdpa prefill with position_bias (#47359)
• 2fa8c19 v5.14.0
• 6c9318e fix feature extraction
• 8f23330 Small improvement (#47348)
• 76613e6 Add Inkling model (#47347)
• f5a67a4 🚨 Pass tp_plan from lm_heads (#47253)
• Additional commits viewable in compare view

Updates peft to 0.20.0

Release notes

Sourced from peft's releases.

v0.20.0

Highlights

This release adds no less than nine new PEFT methods and puts a lot of work into the surrounding infrastructure, for example adding a new image generation benchmark for the method comparison suite and greatly improving the documentation structure.

New Methods

HiRA

@​hqsiswiliam added "HiRA: Parameter-Efficient Hadamard High-Rank Adaptation for Large Language Models" to PEFT (#2668). Instead of adding the low-rank product BA to the base weight, HiRA multiplies it elementwise (Hadamard product) with the frozen base weight. Because the base weight itself is full rank, the resulting update is no longer constrained to be low rank, while the trainable parameter count stays the same as LoRA's.

GLoRA

@​not-lain contributed GLoRA: "One-for-All: Generalized LoRA for Parameter-Efficient Fine-Tuning" in #3098. It is a flexible PEFT method that extends LoRA with configurable weight, activation, and bias adaptation, delivering richer fine-tuning with no extra inference cost. Use it when you need per-layer flexibility or stronger adaptation than vanilla LoRA. Skip it for non-Linear layers (e.g. Conv/Embedding) or when standard LoRA is already sufficient and simplicity matters.

BEFT

@​whubaichuan added "BEFT: Bias-Efficient Fine-Tuning of Language Models" in #3195. BEFT builds on the observation that fine-tuning bias terms alone can be competitive in low-data regimes, but goes further: rather than training all biases, it targets the value projection by default, as the authors found this to be most efficient. This brings the trainable parameter count down to roughly 0.01% of the total parameters.

MonteCLoRA

@​victor7246 integrated MonteCLoRA, "Robust and Efficient Fine-tuning of LLMs with Bayesian Reparameterization of Low-Rank Adaptation" in #2943. LoRA is known to be sensitive to hyperparameters like learning rate and batch size. This new LoRA variant addresses this by treating the low-rank parameters as a distribution rather than a point estimate, using Monte Carlo estimation to obtain a low-variance posterior estimate. This should make training noticeably more robust, at the cost of only O(rank) additional parameters.

VeLoRA

@​roymiles added VeLoRA: "Memory Efficient Training using Rank-1 Sub-Token Projections" in #3159. Unlike most PEFT methods, this LoRA variant targets activation memory rather than parameter count: intermediate activations are split into sub-tokens and compressed with a fixed rank-1 projection before being cached for the backward pass, then reconstructed during backpropagation. Conceptually, it is similar to gradient checkpointing, with a lower memory saving but running faster.

Uni-LoRA

@​KaiyangLi1992 contributed Uni-LoRA: "One Vector is All You Need" in #3257. The paper shows that parameter-efficient LoRA variants like VeRA and VB-LoRA can all be described as projecting the full LoRA parameter space down to a much smaller subspace, differing only in the choice of projection. Uni-LoRA uses a single global projection across the whole model instead of layer-wise ones, which allows cross-layer parameter sharing and thus very low parameter counts.

FRoD

@​Bane-Elvin added FRoD, "Full-Rank Efficient Fine-Tuning with Rotational Degrees for Fast Convergence", in #3270. Instead of adding low-rank deltas like LoRA, it reconstructs selected weights with shared rotational subspaces and sparse trainable coefficients. It is especially useful when fast convergence and a higher full-rank capacity ceiling are important, and its large sparse rotational subspace may also be promising for model merging. The main tradeoffs are the costly joint-decomposition initialization and slightly slower forward/backward passes than LoRA, so it may be less attractive for a one-off single-task fine-tune.

MiCA

@​sr-networks contributed MiCA, "MiCA Learns More Knowledge Than LoRA and Full Fine-Tuning", in #3260. MiCA is a LoRA variant that initializes B from the SVD of the base weight, taking the left singular vectors belonging to the smallest singular values, and then trains only A. The idea is that adapting these underused directions integrates new knowledge more effectively than adapting the dominant subspace, with less interference with existing capabilities.

DEFT

@​MAXNORM8650 added DEFT, "Decompositional Efficient Fine-Tuning for Text-to-Image Models", in #3342. This PEFT method splits a weight update into two learned low-rank parts: a projection that removes a sub-space of the frozen weight, and a low-rank update that injects new content in its place. Use DEFT for personalizing a text-to-image model from a few images while retaining the base model's instruction-following/editability with minimal forgetting. It is less of a fit if you don't need to preserve the base model's other capabilities (a plain additive adapter is simpler) or for layers beyond Linear/Conv1D. The PaRa method is also supported as a special case of DEFT.

Enhancements

Automatic LoRA target selection

@​oswaldoludwig added KappaTuneSelector in #3106 based on "The Condition Number as a Scale-Invariant Proxy for Information Encoding in Neural Units". The PR adds a new function, find_kappa_target_modules, which automatically identifies which modules best to target based on the condition number of the base weight matrices. This removes some of the guesswork from choosing target_modules when configuring LoRA or other PEFT methods.

... (truncated)

Commits

• a5526d2 Imagegen results for new PEFT methods (#3483)
• 8587a36 Add get base model state dict (#3000)
• 3116c96 FIX AutoPeftModel forwards revision and token (#3442)
• 388ccc4 ENH Improve param validation for several PEFT methods (#3438)
• 051b2c5 CI Enable test coverage only on one of the runs (#3469)
• a1d4f86 AI: Update contribution guide based on recent experience (#3459)
• 4d49a3b Fix Gemma4 prefix tuning with per_layer_config (#3471)
• 18ab825 FIX Hotswapping of grouped Conv2d weights (#3416) (#3427)
• 14f7e14 fix: respect layer-specific LoRA-FA scaling in optimizer (#3315)
• 999b934 ENH Support grouped convolutions in LoHa and LoKr (#3440)
• Additional commits viewable in compare view

Updates datasets to 5.0.1

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

• Fix version string in init.py by @​qgallouedec in huggingface/datasets#8244
• fix conda build by @​lhoestq in huggingface/datasets#8250
• Fix JSON loader schema inference for files starting with a UTF-8 BOM (#8241) by @​archievi in huggingface/datasets#8243
• Support hermes traces by @​lhoestq in huggingface/datasets#8255
• Fix batch(by_column=...) crashing after shard/shuffle/split by @​pkooij in huggingface/datasets#8259
• fix traces streaming by @​lhoestq in huggingface/datasets#8277
• support droid agent traces by @​cfahlgren1 in huggingface/datasets#8263
• Fix CI: commit operation equality (hfh 1.20.0) and pytest parametrize collection error by @​Wauplin in huggingface/datasets#8283
• Fix lance auth by @​lhoestq in huggingface/datasets#8301
• Fix symlink-following arbitrary file write in archive extraction by @​AAtomical in huggingface/datasets#8303
• Bug Fix: Resuming Twice Resets the Dataloader by @​francesco-bertolotti in huggingface/datasets#8295
• Bump fsspec and simpler wds compr by @​lhoestq in huggingface/datasets#8337
• fix: validate Arrow IPC record batches by @​XciD in huggingface/datasets#8350
• Make the dataset fingerprint independent of Arrow chunking by @​SuryanshSS1011 in huggingface/datasets#8339
• Fix casting a nullable LargeList to a different inner type by @​vineethsaivs in huggingface/datasets#8346
• docs: replace AutoFeatureExtractor with AutoImageProcessor in image preprocessing docs by @​gautamkishore in huggingface/datasets#8326
• Fix column drop in Arrow path of axis=1 concatenation by @​ebarkhordar in huggingface/datasets#8342
• Raise on length mismatch in batched IterableDataset.map by @​sohumt123 in huggingface/datasets#8332
• Fix require_storage_embed recursing into require_storage_cast by @​vineethsaivs in huggingface/datasets#8349
• Fix path traversal via metadata file_name in folder-based builders by @​Kaif10 in huggingface/datasets#8325
• Support batched=True in Dataset.to_dict by @​vineethsaivs in huggingface/datasets#8333
• Fix hdf5 external files by @​lhoestq in huggingface/datasets#8355
• remove bad require_storage test by @​lhoestq in huggingface/datasets#8357
• ensure fiels are in repo by @​lhoestq in huggingface/datasets#8356
• Keep flat numeric columns with nulls numeric in numpy format by @​ebarkhordar in huggingface/datasets#8352
• Fix bucket dataset card handling and push metadata accounting by @​pjh4993 in huggingface/datasets#8354
• Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 by @​ebarkhordar in huggingface/datasets#8358
• Keep integers on the python read path for fixed-shape ArrayXD columns with nulls by @​ebarkhordar in huggingface/datasets#8363
• Rebatch arrow source before formatting in IterableDataset.filter to fix resume data loss by @​ebarkhordar in huggingface/datasets#8360
• Decode Json() columns in Dataset.to_pandas() by @​ebarkhordar in huggingface/datasets#8344
• fix buckets on windows by @​lhoestq in huggingface/datasets#8369
• Fix DatasetDict.push_to_hub leaving removed splits in the dataset card by @​pjh4993 in huggingface/datasets#8367
• Preserve nullable integer columns in to_json/to_csv/to_sql by @​ebarkhordar in huggingface/datasets#8366

Docs

• docs: fix duplicate "to" in IterableDataset push-to-hub example by @​DaoyuanLi2816 in huggingface/datasets#8252
• Clarify dataset creation vs loading workflows in create_dataset tutorial by @​zanvari in huggingface/datasets#8235

New Contributors

• @​DaoyuanLi2816 made their first contribution in huggingface/datasets#8252
• @​zanvari made their first contribution in huggingface/datasets#8235
• @​archievi made their first contribution in huggingface/datasets#8243
• @​pkooij made their first contribution in huggingface/datasets#8259
• @​AAtomical made their first contribution in huggingface/datasets#8303
• @​francesco-bertolotti made their first contribution in huggingface/datasets#8295
• @​XciD made their first contribution in huggingface/datasets#8350
• @​SuryanshSS1011 made their first contribution in huggingface/datasets#8339
• @​vineethsaivs made their first contribution in huggingface/datasets#8346

... (truncated)

Commits

• 921c2a7 release: 5.0.1 (#8370)
• c6fc5cd Preserve nullable integer columns in to_json/to_csv/to_sql (#8366)
• 6747b87 Fix DatasetDict.push_to_hub leaving removed splits in the dataset card (#8367)
• b305031 fix buckets on windows (#8369)
• 030a3e5 Decode Json() columns in Dataset.to_pandas() (#8344)
• 0f207a0 Rebatch arrow source before formatting in IterableDataset.filter to fix resum...
• adad35d Keep integers on the python read path for fixed-shape ArrayXD columns with nu...
• 8966746 Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 (#8358)
• b8e861a Fix bucket dataset card handling and push metadata accounting (#8354)
• 521a590 Keep flat numeric columns with nulls numeric in numpy format (#8352)
• Additional commits viewable in compare view

Updates tqdm to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

• contrib.concurrent: major improvements
  • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
  • fix total based on shortest iterable length (#1473)
  • use default max_workers (#1543 <- #1530, #1518)
  • support timeout, buffersize (#1576)
  • improve ETA (#1708 <- #1161)
  • update as_completed (#1709 <- #1565)
  • add tqdm.concurrent.intepreter_map (#1777)
• asyncio: support iterables with only __aiter__ (#1714 <- #1686)
• support reset(float("inf")) (#1783 <- #1781, #651)
• framework: test & reduce wheel size (#1782)

Commits

• 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
• c27393e misc tidy
• 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
• 9fc160b Update how we check for interpreter_map support in the tests
• b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
• 16d5486 Add support for nested progress bars
• 9f5890f Add initial implementation for interpreter_map
• 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
• 4664b57 minor tidy
• 426a098 Treat inf total as unknown in reset() too
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bryan-roe-bot]

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[github-actions]

🔐 CodeQL — Open Alerts on this PR

Severity	Count
medium	57
high	95
error	109
warning	85
note	701

Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.
See the full list in the Security tab.