chore(deps): bump torch to 2.13.0 and setuptools to 83.0.0 - #92
Conversation
torch 2.12.1 pinned setuptools<82, which held setuptools at the vulnerable 81.0.0. torch 2.13.0 relaxes that to setuptools>=77.0.3, so both the torch and the setuptools advisories clear in one relock.
tox resolves dev extras fresh instead of from uv.lock, so CI now installs ruff 0.16.0, which formats python code blocks inside markdown; the 0.15.22 pinned in the lock does not. Three docs files fail the gate on main as a result, with no code change behind it. Both versions accept the reformatted files, so this does not flip-flop between local and CI runs.
|
CI confirmed the pre-existing failure called out above: pytest passed (685 passed, 22 skipped) and only Cause: tox uses Added a second commit that reformats those three files. Both ruff versions accept the result, so local and CI runs will not flip-flop. Separately worth considering: pinning the gate to the lock ( |
tox resolves the dev extra fresh rather than from uv.lock, so an upstream ruff release changes the gate's verdict with no code change here. On the same working tree, ruff 0.15.22 (what uv.lock resolves) reports 'All checks passed' while 0.16.0 reports 1772 errors, because 0.16 widened the default rule set (1009 UP006, 413 UP035, 130 RUF012, 75 I001) and started formatting python blocks inside markdown. main is red for every PR as a result. Pinning to the 0.15 line restores the gate. The durable fix is to install the gate from the lock and to select ruff rules explicitly instead of inheriting the defaults; this pin should be lifted as part of that cleanup.
|
Follow-up for lifting the |
2 participants
Clears the last two open Dependabot alerts that the existing PRs do not cover.
What was blocking setuptools
setuptoolssits at 81.0.0 in the lock and the sdist-exclusion-bypass advisory needs 83.0.0.uv lock --upgrade-package setuptoolsalone is a no-op, becausetorch==2.12.1declaressetuptools<82:torch 2.13.0relaxes that tosetuptools>=77.0.3, so both advisories clear in one relock. torch 2.13.0 also fixes thetorch.jit.scriptmemory-corruption advisory (low).This supersedes #89, which bumps torch alone. The grouped PR #91 does not include setuptools.
What this does
uv lock --upgrade-package torch --upgrade-package setuptools: torch 2.12.1 -> 2.13.0, setuptools 81.0.0 -> 83.0.0, plus cuda-toolkit 13.0.2 -> 13.0.3.0 as a transitive consequence.Verification
tox: pytest passes.ruff format --checkfails on three markdown files, and that failure is pre-existing on main, unrelated to this change. tox resolves dev extras fresh rather than from the lock, so it now installs ruff 0.16.0, which formats markdown code blocks differently from the 0.15.22 pinned inuv.lock. The same three files fail onmainat the same commit. Worth a separate reformat PR.