From 41e43e3349bacd235c75dbd908adca76af07f2d2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Jul 2026 03:25:20 +0000 Subject: [PATCH] chore(deps): bump the pip group across 6 directories with 11 updates Bumps the pip group with 1 update in the /docker/pytorch/2.11/cpu directory: [torch](https://github.com/pytorch/pytorch). Bumps the pip group with 1 update in the /docker/pytorch/2.11/cuda directory: [torch](https://github.com/pytorch/pytorch). Bumps the pip group with 2 updates in the /docker/ray directory: [torch](https://github.com/pytorch/pytorch) and [pip](https://github.com/pypa/pip). Bumps the pip group with 8 updates in the /docker/sklearn/1.4-2-py312 directory: | Package | From | To | | --- | --- | --- | | [urllib3](https://github.com/urllib3/urllib3) | `1.26.17` | `2.7.0` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.4.2` | `1.5.0` | | [flask](https://github.com/pallets/flask) | `1.1.1` | `3.1.3` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `3.20.2` | `5.29.6` | | [pyarrow](https://github.com/apache/arrow) | `17.0.0` | `23.0.1` | | [werkzeug](https://github.com/pallets/werkzeug) | `2.0.3` | `3.1.6` | | [wheel](https://github.com/pypa/wheel) | `0.45.1` | `0.46.2` | Bumps the pip group with 5 updates in the /docker/xgboost directory: | Package | From | To | | --- | --- | --- | | [urllib3](https://github.com/urllib3/urllib3) | `1.26.20` | `2.7.0` | | [flask](https://github.com/pallets/flask) | `1.1.1` | `3.1.3` | | [jinja2](https://github.com/pallets/jinja) | `2.11.3` | `3.1.6` | | [pyarrow](https://github.com/apache/arrow) | `22.0.0` | `23.0.1` | | [werkzeug](https://github.com/pallets/werkzeug) | `0.15.6` | `3.1.6` | Bumps the pip group with 4 updates in the /docker/xgboost/3.0-5 directory: [urllib3](https://github.com/urllib3/urllib3), [flask](https://github.com/pallets/flask), [jinja2](https://github.com/pallets/jinja) and [werkzeug](https://github.com/pallets/werkzeug). Updates `torch` from 2.11.0 to 2.12.1 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](https://github.com/pytorch/pytorch/compare/v2.11.0...v2.12.1) Updates `torch` from 2.11.0 to 2.12.1 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](https://github.com/pytorch/pytorch/compare/v2.11.0...v2.12.1) Updates `torch` from 2.10.0 to 2.12.1 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](https://github.com/pytorch/pytorch/compare/v2.11.0...v2.12.1) Updates `pip` from 26.0.1 to 26.1 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](https://github.com/pypa/pip/compare/26.0.1...26.1) Updates `urllib3` from 1.26.17 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.17...2.7.0) Updates `cryptography` from 46.0.7 to 48.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/46.0.7...48.0.1) Updates `scikit-learn` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/scikit-learn/scikit-learn/releases) - [Commits](https://github.com/scikit-learn/scikit-learn/compare/1.4.2...1.5.0) Updates `flask` from 1.1.1 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/flask/compare/1.1.1...3.1.3) Updates `protobuf` from 3.20.2 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pyarrow` from 17.0.0 to 23.0.1 - [Release notes](https://github.com/apache/arrow/releases) - [Commits](https://github.com/apache/arrow/compare/go/v17.0.0...apache-arrow-23.0.1) Updates `werkzeug` from 2.0.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/werkzeug/compare/2.0.3...3.1.6) Updates `wheel` from 0.45.1 to 0.46.2 - [Release notes](https://github.com/pypa/wheel/releases) - [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst) - [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2) Updates `urllib3` from 1.26.20 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.17...2.7.0) Updates `flask` from 1.1.1 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/flask/compare/1.1.1...3.1.3) Updates `jinja2` from 2.11.3 to 3.1.6 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/jinja/compare/2.11.3...3.1.6) Updates `pyarrow` from 22.0.0 to 23.0.1 - [Release notes](https://github.com/apache/arrow/releases) - [Commits](https://github.com/apache/arrow/compare/go/v17.0.0...apache-arrow-23.0.1) Updates `werkzeug` from 0.15.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/werkzeug/compare/2.0.3...3.1.6) Updates `urllib3` from 1.26.20 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.17...2.7.0) Updates `flask` from 1.1.1 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/flask/compare/1.1.1...3.1.3) Updates `jinja2` from 2.11.3 to 3.1.6 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/jinja/compare/2.11.3...3.1.6) Updates `werkzeug` from 0.15.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/werkzeug/compare/2.0.3...3.1.6) --- updated-dependencies: - dependency-name: torch dependency-version: 2.12.1 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.12.1 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.12.1 dependency-type: direct:production dependency-group: pip - dependency-name: pip dependency-version: '26.1' dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: scikit-learn dependency-version: 1.5.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: pyarrow dependency-version: 23.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: wheel dependency-version: 0.46.2 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: jinja2 dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: pyarrow dependency-version: 23.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: jinja2 dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] --- docker/pytorch/2.11/cpu/pyproject.toml | 6 +++--- docker/pytorch/2.11/cuda/pyproject.toml | 6 +++--- docker/pytorch/2.12/cpu/pyproject.toml | 4 ++-- docker/pytorch/2.12/cuda/pyproject.toml | 4 ++-- docker/ray/pyproject.toml | 6 +++--- docker/sklearn/1.4-2-py312/requirements.txt | 18 +++++++++--------- docker/xgboost/3.0-5/requirements.txt | 16 ++++++++-------- docker/xgboost/pyproject.toml | 14 +++++++------- test/xgboost/requirements.txt | 2 +- 9 files changed, 38 insertions(+), 38 deletions(-) diff --git a/docker/pytorch/2.11/cpu/pyproject.toml b/docker/pytorch/2.11/cpu/pyproject.toml index 8183de57ae34..03f0b8d084be 100644 --- a/docker/pytorch/2.11/cpu/pyproject.toml +++ b/docker/pytorch/2.11/cpu/pyproject.toml @@ -3,7 +3,7 @@ name = "pytorch-dlc-cpu" version = "2.11.0" requires-python = ">=3.12,<3.13" dependencies = [ - "torch==2.11.0", + "torch==2.12.1", "torchvision==0.26.0", "torchaudio==2.11.0", "deepspeed==0.18.8", @@ -28,7 +28,7 @@ dependencies = [ [project.optional-dependencies] sagemaker = [ "smclarify", - "sagemaker>=3.4.0", + "sagemaker>=3.15.0", "sagemaker-pytorch-training", "sagemaker-training", "mlflow>=3.9.0", @@ -44,7 +44,7 @@ sagemaker = [ "s3fs>=2026.2.0", "aiohttp>=3.14.0", "tornado>=6.5.6", # CVE GHSA-3x9g-8vmp-wqvf, GHSA-mgf9-4vpg-hj56 (transitive) - "cryptography>=48.0.1", # CVE GHSA-537c-gmf6-5ccf (transitive) + "cryptography>=49.0.0", # CVE GHSA-537c-gmf6-5ccf (transitive) ] [tool.uv] diff --git a/docker/pytorch/2.11/cuda/pyproject.toml b/docker/pytorch/2.11/cuda/pyproject.toml index 149a9712056b..25e451b11f30 100644 --- a/docker/pytorch/2.11/cuda/pyproject.toml +++ b/docker/pytorch/2.11/cuda/pyproject.toml @@ -3,7 +3,7 @@ name = "pytorch-dlc" version = "2.11.0" requires-python = ">=3.12,<3.13" dependencies = [ - "torch==2.11.0", + "torch==2.12.1", "torchvision==0.26.0", "torchaudio==2.11.0", "deepspeed==0.18.8", @@ -24,7 +24,7 @@ dependencies = [ [project.optional-dependencies] sagemaker = [ "smclarify", - "sagemaker>=3.4.0", + "sagemaker>=3.15.0", "sagemaker-pytorch-training", "sagemaker-training", "mlflow>=3.9.0", @@ -40,7 +40,7 @@ sagemaker = [ "s3fs>=2026.2.0", "aiohttp>=3.14.0", "tornado>=6.5.6", # CVE GHSA-3x9g-8vmp-wqvf, GHSA-mgf9-4vpg-hj56 (transitive) - "cryptography>=48.0.1", # CVE GHSA-537c-gmf6-5ccf (transitive) + "cryptography>=49.0.0", # CVE GHSA-537c-gmf6-5ccf (transitive) ] [tool.uv] diff --git a/docker/pytorch/2.12/cpu/pyproject.toml b/docker/pytorch/2.12/cpu/pyproject.toml index aa94b3e4366a..9602d89ea6fd 100644 --- a/docker/pytorch/2.12/cpu/pyproject.toml +++ b/docker/pytorch/2.12/cpu/pyproject.toml @@ -28,7 +28,7 @@ dependencies = [ [project.optional-dependencies] sagemaker = [ "smclarify", - "sagemaker>=3.4.0", + "sagemaker>=3.15.0", "sagemaker-pytorch-training", "sagemaker-training", "mlflow>=3.9.0", @@ -44,7 +44,7 @@ sagemaker = [ "s3fs>=2026.2.0", "aiohttp>=3.14.0", "tornado>=6.5.6", # CVE GHSA-3x9g-8vmp-wqvf, GHSA-mgf9-4vpg-hj56 (transitive) - "cryptography>=48.0.1", # CVE GHSA-537c-gmf6-5ccf (transitive) + "cryptography>=49.0.0", # CVE GHSA-537c-gmf6-5ccf (transitive) ] [tool.uv] diff --git a/docker/pytorch/2.12/cuda/pyproject.toml b/docker/pytorch/2.12/cuda/pyproject.toml index b12eb485f943..10ad1f3d9a72 100644 --- a/docker/pytorch/2.12/cuda/pyproject.toml +++ b/docker/pytorch/2.12/cuda/pyproject.toml @@ -24,7 +24,7 @@ dependencies = [ [project.optional-dependencies] sagemaker = [ "smclarify", - "sagemaker>=3.4.0", + "sagemaker>=3.15.0", "sagemaker-pytorch-training", "sagemaker-training", "mlflow>=3.9.0", @@ -40,7 +40,7 @@ sagemaker = [ "s3fs>=2026.2.0", "aiohttp>=3.14.0", "tornado>=6.5.6", # CVE GHSA-3x9g-8vmp-wqvf, GHSA-mgf9-4vpg-hj56 (transitive) - "cryptography>=48.0.1", # CVE GHSA-537c-gmf6-5ccf (transitive) + "cryptography>=49.0.0", # CVE GHSA-537c-gmf6-5ccf (transitive) ] [tool.uv] diff --git a/docker/ray/pyproject.toml b/docker/ray/pyproject.toml index 45e4b78a973e..eec7e7da3c69 100644 --- a/docker/ray/pyproject.toml +++ b/docker/ray/pyproject.toml @@ -4,7 +4,7 @@ version = "1.1.0" requires-python = "==3.13.*" dependencies = [ "awscli==1.44.49", - "pip==26.0.1", + "pip==26.1", "boto3==1.42.59", "fastapi==0.133.1", "httpx==0.28.1", @@ -15,9 +15,9 @@ dependencies = [ "pyyaml==6.0.3", "msgpack>=1.2.1", "ray[serve]==2.55.1", - "scikit-learn==1.8.0", + "scikit-learn==1.9.0", "soundfile==0.13.1", - "torch==2.10.0", + "torch==2.12.1", "torchaudio==2.10.0", "torchcodec==0.10.0", "torchvision==0.25.0", diff --git a/docker/sklearn/1.4-2-py312/requirements.txt b/docker/sklearn/1.4-2-py312/requirements.txt index c1348d5f6c1a..0a2a56b642f7 100644 --- a/docker/sklearn/1.4-2-py312/requirements.txt +++ b/docker/sklearn/1.4-2-py312/requirements.txt @@ -1,30 +1,30 @@ boto3==1.28.57 botocore>=1.31.57,<1.32.0 certifi -cryptography==46.0.7 -Flask==1.1.1 +cryptography==48.0.1 +Flask==3.1.3 gevent==23.9.1 gunicorn==23.0.0 itsdangerous==2.0.1 -jinja2<3.0 +jinja2<4.0 MarkupSafe<2.0 model-archiver==1.0.3 multi-model-server==1.1.1 numpy==2.1.0 pandas==2.3.2 -protobuf==3.20.2 +protobuf==5.29.6 psutil==5.7.2 -pyarrow==17.0.0 +pyarrow==23.0.1 python-dateutil PyYAML==6.0.1 retrying==1.3.3 sagemaker-containers==2.8.6.post2 sagemaker-inference==1.2.0 sagemaker-training==4.8.0 -scikit-learn==1.4.2 +scikit-learn==1.5.0 scipy>=1.9.0 setuptools==80.9.0 six==1.16.0 -urllib3==1.26.17 -Werkzeug==2.0.3 -wheel==0.45.1 +urllib3==2.7.0 +Werkzeug==3.1.6 +wheel==0.46.2 diff --git a/docker/xgboost/3.0-5/requirements.txt b/docker/xgboost/3.0-5/requirements.txt index 95b9ea1f1161..63e2ae8b8c90 100644 --- a/docker/xgboost/3.0-5/requirements.txt +++ b/docker/xgboost/3.0-5/requirements.txt @@ -1,15 +1,15 @@ boto3==1.17.52 botocore==1.20.52 certifi==2025.4.26 -cryptography==48.0.1 +cryptography==49.0.0 cuda-python==12.6.0 dask-cuda==24.12.00 dask[dataframe]==2024.11.2 -Flask==1.1.1 +Flask==3.1.3 gevent==23.9.1 gunicorn==23.0.0 itsdangerous==2.0.1 -jinja2==2.11.3 +jinja2==3.1.6 MarkupSafe==1.1.1 matplotlib==3.9.2 multi-model-server==1.1.2 @@ -21,13 +21,13 @@ psutil==5.8.0 pynvml==11.4.1 python-dateutil==2.8.2 PyYAML==6.0.1 -requests==2.33.0 +requests==2.34.2 retrying==1.3.3 sagemaker-containers==2.8.6.post2 sagemaker-inference==1.5.5 -scikit-learn==1.5.2 +scikit-learn==1.9.0 scipy==1.15.0 setuptools<81 -urllib3==1.26.20 -Werkzeug==0.15.6 -wheel==0.46.2 +urllib3==2.7.0 +Werkzeug==3.1.6 +wheel==0.47.0 diff --git a/docker/xgboost/pyproject.toml b/docker/xgboost/pyproject.toml index d75349c91018..7e129606726e 100644 --- a/docker/xgboost/pyproject.toml +++ b/docker/xgboost/pyproject.toml @@ -7,7 +7,7 @@ dependencies = [ "boto3==1.38.0", "botocore==1.38.0", "certifi==2025.4.26", - "cryptography==48.0.1", + "cryptography==49.0.0", "cuda-python==12.9.0", "dask-cuda==26.4.0", "dask[dataframe]==2026.1.1", @@ -24,19 +24,19 @@ dependencies = [ "pynvml==12.0.0", "python-dateutil==2.9.0", "PyYAML==6.0.1", - "requests==2.33.0", + "requests==2.34.2", "retrying==1.3.3", "sagemaker-containers==2.8.6.post2", "sagemaker-inference==1.5.5", - "scikit-learn==1.8.0", + "scikit-learn==1.9.0", "scipy==1.15.0", "setuptools>=80.9.0,<81", "urllib3==2.7.0", - "Werkzeug==3.1.8", - "pyarrow==22.0.0", - "protobuf>=3.20.0,<=3.20.3", + "Werkzeug==3.1.6", + "pyarrow==23.0.1", + "protobuf<=7.35.1,>=7.35.1", "fonttools>=4.60.2", - "idna>=3.15", + "idna>=3.18", "tornado>=6.5.6", "msgpack>=1.2.1", ] diff --git a/test/xgboost/requirements.txt b/test/xgboost/requirements.txt index d371ab0d94a9..ee6e074430a1 100644 --- a/test/xgboost/requirements.txt +++ b/test/xgboost/requirements.txt @@ -1 +1 @@ -sagemaker>=2,<3 +sagemaker>=3.15.0,<4