Bump minimum torch version from 2.3 to 2.8 to address GHSA-887c-mr87-cxwp

.readthedocs.yml

@@ -18,4 +18,4 @@ conda:
 build:
   os: ubuntu-24.04
   tools:
-    python: "mambaforge-23.11"
+    python: "miniforge3-25.11"

README.md

@@ -100,7 +100,7 @@ It provides a minimal number of features compared to SB3 but can be much faster
 
 ## Installation
 
-**Note:** Stable-Baselines3 supports PyTorch >= 2.3
+**Note:** Stable-Baselines3 supports PyTorch >= 2.8
 
 ### Prerequisites
 Stable Baselines3 requires Python 3.10+.

docs/conda_env.yml

@@ -1,14 +1,12 @@
 name: root
 channels:
-  - pytorch
   - conda-forge
 dependencies:
-  - cpuonly=1.0=0
-  - pip=24.2
-  - python=3.11
-  - pytorch=2.5.0=py3.11_cpu_0
+  - pip=26.1.2
+  - python=3.12
+  - pytorch-cpu=2.9.1
   - pip:
-    - gymnasium>=0.29.1,<1.1.0
+    - gymnasium>=0.29.1,<2.0
     - cloudpickle
     - opencv-python-headless
     - pandas

docs/guide/install.md

@@ -4,7 +4,7 @@
 
 ## Prerequisites
 
-Stable-Baselines3 requires python 3.10+ and PyTorch >= 2.3
+Stable-Baselines3 requires python 3.10+ and PyTorch >= 2.8
 
 ### Windows
 

docs/misc/changelog.md

@@ -2,12 +2,13 @@
 
 # Changelog
 
-## Release 2.9.0a2 (WIP)
+## Release 2.9.0a3 (WIP)
 
 ### Breaking Changes:
 - Relaxed Gymnasium version range (from `"gymnasium>=0.29.1,<1.3.0"` to `"gymnasium>=0.29.1,<2.0"`)
 - `pandas` and `matplotlib` are no longer core dependencies; they are now optional and only required for loading results and plotting (moved to `stable-baselines3[extra]`).
 - Moved `read_json` and `read_csv` helper functions to test files
+- Raised `torch` minimum version from 2.3 to 2.8 to mitigate https://github.com/advisories/GHSA-887c-mr87-cxwp
 
 ### New Features:
 

setup.py

@@ -81,7 +81,7 @@
     install_requires=[
         "gymnasium>=0.29.1,<2.0",
         "numpy>=1.20,<3.0",
-        "torch>=2.3,<3.0",
+        "torch>=2.8,<3.0",
         # For saving models
         "cloudpickle",
     ],

stable_baselines3/version.txt

@@ -1 +1 @@
-2.9.0a2
+2.9.0a3