Skip to content

security(deps): bump the training-dependencies group across 1 directory with 23 updates#463

Merged
WilliamBerryiii merged 2 commits into
mainfrom
dependabot/pip/training/rl/training-dependencies-b22562daef
Apr 14, 2026
Merged

security(deps): bump the training-dependencies group across 1 directory with 23 updates#463
WilliamBerryiii merged 2 commits into
mainfrom
dependabot/pip/training/rl/training-dependencies-b22562daef

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Bumps the training-dependencies group with 23 updates in the /training/rl directory:

Package From To
skrl 1.4.3 2.0.0
tensordict 0.11.0 0.12.1
google-auth 2.49.1 2.49.2
greenlet 3.3.2 3.4.0
msal 1.35.1 1.36.0
opentelemetry-api 1.40.0 1.41.0
opentelemetry-instrumentation 0.61b0 0.62b0
opentelemetry-instrumentation-asgi 0.61b0 0.62b0
opentelemetry-instrumentation-dbapi 0.61b0 0.62b0
opentelemetry-instrumentation-django 0.61b0 0.62b0
opentelemetry-instrumentation-fastapi 0.61b0 0.62b0
opentelemetry-instrumentation-flask 0.61b0 0.62b0
opentelemetry-instrumentation-psycopg2 0.61b0 0.62b0
opentelemetry-instrumentation-requests 0.61b0 0.62b0
opentelemetry-instrumentation-urllib 0.61b0 0.62b0
opentelemetry-instrumentation-urllib3 0.61b0 0.62b0
opentelemetry-instrumentation-wsgi 0.61b0 0.62b0
opentelemetry-proto 1.40.0 1.41.0
opentelemetry-sdk 1.40.0 1.41.0
opentelemetry-semantic-conventions 0.61b0 0.62b0
opentelemetry-util-http 0.61b0 0.62b0
pydantic 2.12.5 2.13.0
pydantic-core 2.45.0 2.46.0

Updates skrl from 1.4.3 to 2.0.0

Release notes

Sourced from skrl's releases.

skrl-v2.0.0

[2.0.0] - 2026-04-08

Summary of the most relevant features:

  • RL algorithm implementations in NVIDIA Warp
  • Differentiate between environment observations and states (also known as privileged observation)
  • Support for MuJoCo Playground and ManiSkill environments

Added

  • Implement RL algorithms in NVIDIA Warp
  • Add loader and wrapper for MuJoCo Playground environments
  • Add wrapper for ManiSkill environments
  • Add Tabular model instantiator (epsilon-greedy variant)
  • Add clip_mean_actions parameter to Gaussian and Multivariate Gaussian models
  • Add render_interval option to trainers to specify the rendering interval for the environments
  • Add compute_space_limits space utility to get Gymnasium spaces' limits
  • Add ScopedTimer utils to measure code execution time
  • Add SummaryWriter implementation to log data to TensorBoard without relying on third-party libraries
  • Log agent inference and algorithm update, and environment steeping time to TensorBoard

Changed

  • Update minimum supported Python version to 3.10
  • Drop support for PyTorch versions prior to 1.11 (the previous supported version was 1.10)
  • Call observation/state preprocessors once when computing the actions during training

Changed (breaking changes)

  • Refactor the library to differentiate between environment observations and states (also known as privileged observation)
  • Implement agent/multi-agent and trainer configurations using Python Data Classes
    • Unify the different learning rate settings under the learning_rate configuration
    • Rename lambda to gae_lambda
    • Remove the clip_predicted_values redundant configuration by checking for value_clip > 0
    • Remove specific exploration noise settings (initial_scale, final_scale and timesteps) in favor of generic scheduling functions
  • Update tabular model definition to operate in any number of parallel environments
  • Refactor multi-agent environment wrappers to support homogeneous and heterogeneous states spaces

Fixed

  • Add entropy loss to the policy loss for on-policy agents/mulit-agents in JAX
  • Fix time limits handling for termination and truncation signals
  • Fix the randomness of the environments by seeding right after initialization (on the first reset)

Removed

  • Remove NumPy backend for JAX implementation
  • Remove checkpoints/models migration support from other RL libraries
  • Remove support for Isaac Gym and Omniverse Isaac Gym environments (deprecated in favor of Isaac Lab)
  • Remove support for Brax and DeepMind environments (in favor of MuJoCo Playground environments)
  • Remove support for Bi-DexHands and robosuite environments
  • Remove Isaac Gym (web viewer, inverse kinematic) and Omniverse Isaac Gym (local environment instance, inverse kinematic) utils
Changelog

Sourced from skrl's changelog.

[2.0.0] - 2026-04-08

Summary of the most relevant features:

  • RL algorithm implementations in NVIDIA Warp
  • Differentiate between environment observations and states (also known as privileged observation)
  • Support for MuJoCo Playground and ManiSkill environments

Added

  • Implement RL algorithms in NVIDIA Warp
  • Add loader and wrapper for MuJoCo Playground environments
  • Add wrapper for ManiSkill environments
  • Add Tabular model instantiator (epsilon-greedy variant)
  • Add clip_mean_actions parameter to Gaussian and Multivariate Gaussian models
  • Add render_interval option to trainers to specify the rendering interval for the environments
  • Add compute_space_limits space utility to get Gymnasium spaces' limits
  • Add ScopedTimer utils to measure code execution time
  • Add SummaryWriter implementation to log data to TensorBoard without relying on third-party libraries
  • Log agent inference and algorithm update, and environment steeping time to TensorBoard

Changed

  • Update minimum supported Python version to 3.10
  • Drop support for PyTorch versions prior to 1.11 (the previous supported version was 1.10)
  • Call observation/state preprocessors once when computing the actions during training

Changed (breaking changes)

  • Refactor the library to differentiate between environment observations and states (also known as privileged observation)
  • Implement agent/multi-agent and trainer configurations using Python Data Classes
    • Unify the different learning rate settings under the learning_rate configuration
    • Rename lambda to gae_lambda
    • Remove the clip_predicted_values redundant configuration by checking for value_clip > 0
    • Remove specific exploration noise settings (initial_scale, final_scale and timesteps) in favor of generic scheduling functions
  • Update tabular model definition to operate in any number of parallel environments
  • Refactor multi-agent environment wrappers to support homogeneous and heterogeneous states spaces

Fixed

  • Add entropy loss to the policy loss for on-policy agents/mulit-agents in JAX
  • Fix time limits handling for termination and truncation signals
  • Fix the randomness of the environments by seeding right after initialization (on the first reset)

Removed

  • Remove NumPy backend for JAX implementation
  • Remove checkpoints/models migration support from other RL libraries
  • Remove support for Isaac Gym and Omniverse Isaac Gym environments (deprecated in favor of Isaac Lab)
  • Remove support for Brax and DeepMind environments (in favor of MuJoCo Playground environments)
  • Remove support for Bi-DexHands and robosuite environments
  • Remove Isaac Gym (web viewer, inverse kinematic) and Omniverse Isaac Gym (local environment instance, inverse kinematic) utils
Commits

Updates tensordict from 0.11.0 to 0.12.1

Release notes

Sourced from tensordict's releases.

TensorDict v0.12.1

Patch release with a torch.compile bug fix.

Bug Fixes

  • Fix unravel_keys inconsistency that prevented torch.compile from working correctly when called with a single key (#1674)

Installation

pip install tensordict==0.12.1

TensorDict v0.12.0

Highlights

TensorDict v0.12.0 introduces TypedTensorDict for schema-enforced tensor dictionaries, a full distributed collectives suite (broadcast, all_reduce, all_gather, scatter), TensorDictStore with Redis/Dragonfly/KeyDB backends, and major torch.compile and performance improvements. The UnbatchedTensor has been rewritten as a proper tensor subclass, and state_dict handling has been overhauled for consistency.

Breaking Changes

  • UnbatchedTensor is now a __torch_dispatch__-based tensor subclass (was previously a wrapper) (#1638, #1648)
  • state_dict is now flat by default, with auto-detection in load_state_dict for backwards compatibility
  • TensorClass state_dict now uses logical keys

Features

  • TypedTensorDict: Schema-enforced TensorDicts with type annotations, cross-class compatibility, and torch.compile support (#1657, #1659, #1660, #1662, #1663)
  • TensorDictStore: Redis/Dragonfly/KeyDB-backed TensorDict with TensorClass support, lazy stack storage, and optimized indexed ops
  • Distributed collectives: broadcast, all_reduce, all_gather, scatter, consolidated send/recv and init_remote/from_remote_init with UCXX transport support (#1611)
  • set_printoptions: Configurable TensorDict repr with verbose mode (#1654, #1655, #1665)
  • torch.func support: jacrev, jacfwd, and hessian now work with TensorDict (#1613)
  • vmap with unbatched data: TensorDicts containing unbatched tensors can now be vmapped (#1625)
  • TensorClass.select(as_tensordict=...) parameter (#1544)
  • TensorDictBase.is_non_tensor(key) for consistent non-tensor key detection

Bug Fixes

  • Fix HigherOrderOperator support in __torch_function__ (#1668)
  • Fix td[key] = [] handling (#1666)
  • Fix UnbatchedTensor.tolist() (#1664)
  • Fix UnbatchedTensor CUDA pickling for multiprocessing (#1656)
  • Fix UnbatchedTensor indexing without batch dim, GPU failures, getitem/stack (#1607, #1626, #1633)
  • Fix replace() recompiles under torch.compile (#1605)
  • Fix auto_batch_size regression with NonTensorStack (#1609)
  • Fix NonTensorData positional args causing graph breaks under torch.compile (#1630)
  • Fix state_dict error messages, params forwarding, detach
  • Pin pybind11>=2.13 for Python 3.13 compatibility

... (truncated)

Commits
  • 4d413dd [Release] Bump version to 0.12.1
  • 2a7c2ee [BugFix] unravel_keys inconsistency bug preventing torch.compile (#1674)
  • bb8825e [CI] Also disable ROCm wheel builds (tensordict is CPU-only)
  • 015507b [CI] Disable CUDA wheel builds (tensordict is CPU-only) (#1672)
  • 3f84f8d [CI] Fix wheel builds (#1671)
  • b0ebe66 [Release] Bump version to 0.12.0 (#1670)
  • 31b5ef5 [BugFix] Support HigherOrderOperator in torch_function (#1668)
  • 962bf40 [BugFix] Handle td[key] = [] properly (#1666)
  • fb51ac7 [Feature] set_printoptions(verbose=False) (#1665)
  • 32d9fb6 [BugFix] Fix UnbatchedTensor.tolist() (#1664)
  • Additional commits viewable in compare view

Updates google-auth from 2.49.1 to 2.49.2

Commits

Updates greenlet from 3.3.2 to 3.4.0

Changelog

Sourced from greenlet's changelog.

3.4.0 (2026-04-08)

  • Publish binary wheels for RiscV 64.

  • Fix multiple rare crash paths during interpreter shutdown.

    Note that this now relies on the atexit module, and introduces subtle API changes during interpreter shutdown (for example, getcurrent is no longer available once the atexit callback fires).

    See PR [#499](https://github.com/python-greenlet/greenlet/issues/499) <https://github.com/python-greenlet/greenlet/pull/499>_ by Nicolas Bouvrette.

  • Address the results of an automated code audit performed by Daniel Diniz. This includes several minor correctness changes that theoretically could have been crashing bugs, but typically only in very rare circumstances.

    See PR 502 <https://github.com/python-greenlet/greenlet/pull/502>_.

  • Fix several race conditions that could arise in free-threaded builds when using greenlet objects from multiple threads, some of which could lead to assertion failures or interpreter crashes.

    See issue 503 <https://github.com/python-greenlet/greenlet/issues/503>_, with thanks to Nitay Dariel and Daniel Diniz.

Commits
  • df6734e Preparing release 3.4.0
  • 0f86075 Merge pull request #504 from python-greenlet/freethreading-fixes
  • 4596574 TLBC: crash appears to still happen on CI 3.14t ubuntu. Re-enable workaround.
  • 2f4a1cf Make green_switch (python level greenlet.switch) and green_throw check for (p...
  • a0c2a2a Fix unused variable warning when asserts are disabled.
  • 8688581 gcc was complaining about an incomplete std::atomic type. make sure we includ...
  • 449c760 Make MainGreenlet._thread_state atomic; we use it for cross thread checking a...
  • f840e00 Add critical sections to greenlet attribute accessors.
  • 6b281d3 test_contextvars: No need for the fallback case where contextvars isn't avail...
  • f52615a Merge pull request #502 from python-greenlet/devdanzin-audit
  • Additional commits viewable in compare view

Updates msal from 1.35.1 to 1.36.0

Release notes

Sourced from msal's releases.

1.36.0

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-authentication-library-for-python@1.35.1...1.36.0

Commits
  • 4a2cb98 Update sku.py
  • a3ba722 Fix OIDC issuer domain spoofing in B2C host validation (#896)
  • 6a92f24 Use cryptographically secure randomness for PKCE, state, and nonce generation...
  • ecf515a Added withFmi method for cca app (#876)
  • eb78068 Potential fix for code scanning alert no. 74: Workflow does not contain permi...
  • 6de712e Add documentation for Managed Identity v2 Hackathon (#885)
  • 1f71ede Add ADO CI, SDL, and release pipelines with e2e test enablement (#890)
  • e4e692c Fix the PoP flow in the console app (#887)
  • See full diff in compare view

Updates opentelemetry-api from 1.40.0 to 1.41.0

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

  • opentelemetry-sdk: Add host resource detector support to declarative file configuration via detection_development.detectors[].host (#5002)
  • opentelemetry-sdk: Add container resource detector support to declarative file configuration via detection_development.detectors[].container, using entry point loading of the opentelemetry-resource-detector-containerid contrib package (#5004)
  • opentelemetry-sdk: Add create_tracer_provider/configure_tracer_provider to declarative file configuration, enabling TracerProvider instantiation from config files without reading env vars (#4985)
  • Enabled the flake8-tidy-import plugins rules for the ruff linter. These rules throw warnings for relative imports in the modules. (#5019)
  • opentelemetry-sdk: Fix AttributeError in ExplicitBucketHistogramAggregation when applied to non-Histogram instruments without explicit boundaries (#5034)
  • Fix BatchLogRecordProcessor default schedule_delay_millis from 5000ms to 1000ms to comply with the OTel specification. Note: logs may be exported 5x more frequently by default (e.g. for users who don't explicitly set the OTEL_BLRP_SCHEDULE_DELAY env var). (#4998)
  • opentelemetry-sdk: Add process resource detector support to declarative file configuration via detection_development.detectors[].process (#5001)
  • opentelemetry-sdk: Add shared _parse_headers helper for declarative config OTLP exporters (#5021)
  • opentelemetry-api: Replace a broad exception in attribute cleaning tests to satisfy pylint in the lint-opentelemetry-api CI job
  • opentelemetry-sdk: Add create_meter_provider/configure_meter_provider to declarative file configuration, enabling MeterProvider instantiation from config files without reading env vars (#4987)
  • opentelemetry-sdk: Add create_resource and create_propagator/configure_propagator to declarative file configuration, enabling Resource and propagator instantiation from config files without reading env vars (#4979)
  • opentelemetry-sdk: Map Python CRITICAL log level to OTel FATAL severity text per the specification (#4984)
  • opentelemetry-sdk: Add file configuration support with YAML/JSON loading, environment variable substitution, and schema validation against the vendored OTel config JSON schema (#4898)
  • Fix intermittent CI failures in getting-started and tracecontext jobs caused by GitHub git CDN SHA propagation lag by installing contrib packages from the already-checked-out local copy instead of a second git clone (#4958)
  • opentelemetry-sdk: fix type annotations on MetricReader and related types (#4938)
  • opentelemetry-sdk: implement log creation metric (#4935)
  • opentelemetry-sdk: implement metric reader metrics (#4970)
  • opentelemetry-sdk: implement processor metrics (#5012)
  • opentelemetry-sdk: upgrade vendored OTel configuration schema from v1.0.0-rc.3 to v1.0.0 (#4965)
  • improve check-links ci job (#4978)
  • Resolve some Pyright type errors in Span/ReadableSpan and utility stubs (#4973)
  • opentelemetry-exporter-prometheus: Fix metric name prefix (#4895)
  • opentelemetry-api, opentelemetry-sdk: Add deepcopy support for BoundedAttributes and BoundedList (#4934)
  • opentelemetry-proto-json, opentelemetry-codegen-json: Implement custom protoc plugin to generate OTLP JSON class definitions (#4910)
  • Add configurable max_export_batch_size to OTLP HTTP metrics exporter

... (truncated)

Commits
  • 1a178fc [release/v1.41.x-0.62bx] Prepare release 1.41.0/0.62b0 (#5064)
  • 37dea4b feat: add experimental logger configurator (#4980)
  • 7c860ca misc: update version for codegen-json and proto-json packages (#5061)
  • b3d98b3 [chore]: update readme (#5060)
  • dbbd1bc feat(config): Add MeterProvider support for declarative config (#4987)
  • 6faa58c feat(config): add host resource detector support for declarative config (#5002)
  • c0cbfbd feat(config): wire container resource detector via entry point loading (#5004)
  • f764e45 feat(config): Add TracerProvider support for declarative config (#4985)
  • e301732 Add MikeGoldsmith to approvers (#5038)
  • 8783a58 introduce alls-green action for required checks (#4988)
  • Additional commits viewable in compare view

Updates opentelemetry-instrumentation from 0.61b0 to 0.62b0

Release notes

Sourced from opentelemetry-instrumentation's releases.

opentelemetry-instrumentation-openai-v2 2.3b0

  • Fix AttributeError when handling LegacyAPIResponse (from with_raw_response) (#4017)
  • Add support for chat completions choice count and stop sequences span attributes (#4028)
  • Fix crash with streaming with_raw_response (#4033)
  • Bump to 1.30.0 semconv schema: gen_ai.request.seed instead of gen_ai.openai.request.seed (#4036)

opentelemetry-instrumentation-openai-v2 2.2b0

  • Fix service tier attribute names: use GEN_AI_OPENAI_REQUEST_SERVICE_TIER for request attributes and GEN_AI_OPENAI_RESPONSE_SERVICE_TIER for response attributes. (#3920)
  • Added support for OpenAI embeddings instrumentation (#3461)
  • Record prompt and completion events regardless of span sampling decision. (#3226)
  • Filter out attributes with the value of NotGiven instances (#3760)
  • Migrate off the deprecated events API to use the logs API (#3625)

opentelemetry-instrumentation-openai-agents-v2 0.1.0

  • Initial barebones package skeleton: minimal instrumentor stub, version module, and packaging metadata/entry point. (#3805)
  • Implement OpenAI Agents span processing aligned with GenAI semantic conventions. (#3817)
  • Input and output according to GenAI spec. (#3824)

opentelemetry-instrumentation-openai-v2 2.1b0

  • Coerce openai response_format to semconv format (#3073)
  • Add example to opentelemetry-instrumentation-openai-v2 (#3006)
  • Support for AsyncOpenAI/AsyncCompletions (#2984)
  • Add metrics (#3180)

opentelemetry-instrumentation-openai-v2 2.0b0

  • Use generic OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT environment variable to control if content of prompt, completion, and other messages is captured. (#2947)

  • Update OpenAI instrumentation to Semantic Conventions v1.28.0: add new attributes and switch prompts and completions to log-based events. (#2925)

  • Initial OpenAI instrumentation (#2759)

Changelog

Sourced from opentelemetry-instrumentation's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

Added

  • opentelemetry-instrumentation-asgi: Respect suppress_http_instrumentation context in ASGI middleware to skip server span creation when HTTP instrumentation is suppressed (#4375)
  • opentelemetry-instrumentation-confluent-kafka: Loosen confluent-kafka upper bound to <3.0.0 (#4289)
  • opentelemetry-instrumentation: Add support for wrapt 2.x (#4203)
  • opentelemetry-instrumentation-psycopg2: Add parameter capture_parameters to instrumentor. (#4212)
  • opentelemetry-instrumentation-botocore: Add support for instrumenting aiobotocore (#4049)
  • opentelemetry-instrumentation-sqlalchemy: implement new semantic convention opt-in migration (#4110)

Fixed

  • opentelemetry-docker-tests: Replace deprecated SpanAttributes from opentelemetry.semconv.trace with opentelemetry.semconv._incubating.attributes (#4339)
  • opentelemetry-instrumentation-confluent-kafka: Skip recv span creation when poll() returns no message or consume() returns an empty list, avoiding empty spans on idle polls (#4349)
  • Fix intermittent Core Contrib Test CI failures caused by GitHub git CDN SHA propagation lag by installing core packages from the already-checked-out local copy instead of a second git clone (#4305)
  • Don't import module in unwrap if not already imported (#4321)
  • opentelemetry-instrumentation-logging: Map Python CRITICAL log level to OTel FATAL severity text and WARNING to WARN (#4365)
  • opentelemetry-instrumentation-logging: Add recursion guard in LoggingHandler.emit to prevent deadlock (#4302)
  • opentelemetry-instrumentation-grpc: Fix bidirectional streaming RPCs raising AttributeError: 'generator' object has no attribute 'add_done_callback' (#4259)
  • opentelemetry-instrumentation-aiokafka: fix Unclosed AIOKafkaProducer warning and RuntimeWarning: coroutine was never awaited in tests (#4384)
  • opentelemetry-instrumentation-aiokafka: Fix compatibility with aiokafka 0.13 by calling _key_serializer/_value_serializer directly instead of the internal _serialize method whose signature changed in 0.13 from (topic, key, value) to (key, value, headers) (#4379)

Breaking changes

  • opentelemetry-instrumentation-boto: Remove instrumentation (#4303)
Commits

Updates opentelemetry-instrumentation-asgi from 0.61b0 to 0.62b0

Changelog

Sourced from opentelemetry-instrumentation-asgi's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

Added

  • opentelemetry-instrumentation-asgi: Respect suppress_http_instrumentation context in ASGI middleware to skip server span creation when HTTP instrumentation is suppressed (#4375)
  • opentelemetry-instrumentation-confluent-kafka: Loosen confluent-kafka upper bound to <3.0.0 (#4289)
  • opentelemetry-instrumentation: Add support for wrapt 2.x (#4203)
  • opentelemetry-instrumentation-psycopg2: Add parameter capture_parameters to instrumentor. (#4212)
  • opentelemetry-instrumentation-botocore: Add support for instrumenting aiobotocore (#4049)
  • opentelemetry-instrumentation-sqlalchemy: implement new semantic convention opt-in migration (#4110)

Fixed

  • opentelemetry-docker-tests: Replace deprecated SpanAttributes from opentelemetry.semconv.trace with opentelemetry.semconv._incubating.attributes (#4339)
  • opentelemetry-instrumentation-confluent-kafka: Skip recv span creation when poll() returns no message or consume() returns an empty list, avoiding empty spans on idle polls (#4349)
  • Fix intermittent Core Contrib Test CI failures caused by GitHub git CDN SHA propagation lag by installing core packages from the already-checked-out local copy instead of a second git clone (#4305)
  • Don't import module in unwrap if not already imported (#4321)
  • opentelemetry-instrumentation-logging: Map Python CRITICAL log level to OTel FATAL severity text and WARNING to WARN (#4365)
  • opentelemetry-instrumentation-logging: Add recursion guard in LoggingHandler.emit to prevent deadlock (#4302)
  • opentelemetry-instrumentation-grpc: Fix bidirectional streaming RPCs raising AttributeError: 'generator' object has no attribute 'add_done_callback' (#4259)
  • opentelemetry-instrumentation-aiokafka: fix Unclosed AIOKafkaProducer warning and RuntimeWarning: coroutine was never awaited in tests (#4384)
  • opentelemetry-instrumentation-aiokafka: Fix compatibility with aiokafka 0.13 by calling _key_serializer/_value_serializer directly instead of the internal _serialize method whose signature changed in 0.13 from (topic, key, value) to (key, value, headers) (#4379)

Breaking changes

  • opentelemetry-instrumentation-boto: Remove instrumentation (#4303)
Commits

Updates opentelemetry-instrumentation-dbapi from 0.61b0 to 0.62b0

Changelog

Sourced from opentelemetry-instrumentation-dbapi's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

Added

  • opentelemetry-instrumentation-asgi: Respect suppress_http_instrumentation context in ASGI middleware to skip server span creation when HTTP instrumentation is suppressed (#4375)
  • opentelemetry-instrumentation-confluent-kafka: Loosen confluent-kafka upper bound to <3.0.0 (#4289)
  • opentelemetry-instrumentation: Add support for wrapt 2.x (#4203)
  • opentelemetry-instrumentation-psycopg2: Add parameter capture_parameters to instrumentor. (#4212)
  • opentelemetry-instrumentation-botocore: Add support for instrumenting aiobotocore (#4049)
  • opentelemetry-instrumentation-sqlalchemy: implement new semantic convention opt-in migration (#4110)

Fixed

  • opentelemetry-docker-tests: Replace deprecated SpanAttributes from opentelemetry.semconv.trace with opentelemetry.semconv._incubating.attributes (#4339)
  • opentelemetry-instrumentation-confluent-kafka: Skip recv span creation when poll() returns no message or consume() returns an empty list, avoiding empty spans on idle polls (#4349)
  • Fix intermittent Core Contrib Test CI failures caused by GitHub git CDN SHA propagation lag by installing core packages from the already-checked-out local copy instead of a second git clone (#4305)
  • Don't import module in unwrap if not already imported (#4321)
  • opentelemetry-instrumentation-logging: Map Python CRITICAL log level to OTel FATAL severity text and WARNING to WARN (#4365)
  • opentelemetry-instrumentation-logging: Add recursion guard in LoggingHandler.emit to prevent deadlock (#4302)
  • opentelemetry-instrumentation-grpc: Fix bidirectional streaming RPCs raising AttributeError: 'generator' object has no attribute 'add_done_callback' (#4259)
  • opentelemetry-instrumentation-aiokafka: fix Unclosed AIOKafkaProducer warning and RuntimeWarning: coroutine was never awaited in tests (#4384)
  • opentelemetry-instrumentation-aiokafka: Fix compatibility with aiokafka 0.13 by calling _key_serializer/_value_serializer directly instead of the internal _serialize method whose signature changed in 0.13 from (topic, key, value) to (key, value, headers) (#4379)

Breaking changes

  • opentelemetry-instrumentation-boto: Remove instrumentation (#4303)
Commits

Updates opentelemetry-instrumentation-django from 0.61b0 to 0.62b0

Changelog

Sourced from opentelemetry-instrumentation-django's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

Added

  • opentelemetry-instrumentation-asgi: Respect suppress_http_instrumentation context in ASGI middleware to skip server span creation when HTTP instrumentation is suppressed (#4375)
  • opentelemetry-instrumentation-confluent-kafka: Loosen confluent-kafka upper bound to <3.0.0 (#4289)
  • opentelemetry-instrumentation: Add support for wrapt 2.x (#4203)
  • opentelemetry-instrumentation-psycopg2: Add parameter capture_parameters to instrumentor. (#4212)
  • opentelemetry-instrumentation-botocore: Add support for instrumenting aiobotocore (#4049)
  • opentelemetry-instrumentation-sqlalchemy: implement new semantic convention opt-in migration (#4110)

Fixed

  • opentelemetry-docker-tests: Replace deprecated SpanAttributes from opentelemetry.semconv.trace with opentelemetry.semconv._incubating.attributes (#4339)
  • opentelemetry-instrumentation-confluent-kafka: Skip recv span creation when poll() returns no message or consume() returns an empty list, avoiding empty spans on idle polls (#4349)
  • Fix intermittent Core Contrib Test CI failures caused by GitHub git CDN SHA propagation lag by installing core packages from the already-checked-out local copy instead of a second git clone (#4305)
  • Don't import module in unwrap if not already imported (#4321)
  • opentelemetry-instrumentation-logging: Map Python CRITICAL log level to OTel FATAL severity text and WARNING to WARN (#4365)
  • opentelemetry-instrumentation-logging: Add recursion guard in LoggingHandler.emit to prevent deadlock (#4302)
  • opentelemetry-instrumentation-grpc: Fix bidirectional streaming RPCs raising AttributeError: 'generator' object has no attribute 'add_done_callback' (#4259)
  • opentelemetry-instrumentation-aiokafka: fix Unclosed AIOKafkaProducer warning and RuntimeWarning: coroutine was never awaited in tests (#4384)
  • opentelemetry-instrumentation-aiokafka: Fix compatibility with aiokafka 0.13 by calling _key_serializer/_value_serializer directly instead of the internal _serialize method whose signature changed in 0.13 from (topic, key, value) to (key, value, headers) (#4379)

Breaking changes

  • opentelemetry-instrumentation-boto: Remove instrumentation (#4303)
Commits

Updates opentelemetry-instrumentation-fastapi from 0.61b0 to 0.62b0

Changelog

Sourced from opentelemetry-instrumentation-fastapi's changelog.

Version 1.41.0/0.62b0 (2026-04-09)

Added

  • opentelemetry-instrumentation-asgi: Respect suppress_http_instrumentation context in ASGI middleware to skip server span creation when HTTP instrumentation is suppressed (#4375)
  • opentelemetry-instrumentation-confluent-kafka: Loosen confluent-kafka upper bound to <3.0.0 (#4289)
  • opentelemetry-instrumentation: Add support for wrapt 2.x (#4203)
  • opentelemetry-instrumentation-psycopg2: Add parameter capture_parameters to instrumentor. (#4212)
  • opentelemetry-instrumentation-botocore: Add support for instrumenting aiobotocore (#4049)
  • opentelemetry-instrumentation-sqlalchemy: implement new semantic convention opt-in migration (#4110)

Fixed

  • opentelemetry-docker-tests: Replace deprecated SpanAttributes from opentelemetry.semconv.trace with Description has been truncated

@dependabot
chore(deps): bump the training-dependencies group across 1 directory …
3561cd7 
…with 23 updates

Bumps the training-dependencies group with 23 updates in the /training/rl directory:

| Package | From | To |
| --- | --- | --- |
| [skrl](https://github.com/Toni-SM/skrl) | `1.4.3` | `2.0.0` |
| [tensordict](https://github.com/pytorch/tensordict) | `0.11.0` | `0.12.1` |
| [google-auth](https://github.com/googleapis/google-auth-library-python) | `2.49.1` | `2.49.2` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.3.2` | `3.4.0` |
| [msal](https://github.com/AzureAD/microsoft-authentication-library-for-python) | `1.35.1` | `1.36.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.0` |
| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-asgi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-dbapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-django](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-fastapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-flask](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-psycopg2](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-requests](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-urllib](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-urllib3](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-instrumentation-wsgi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.0` |
| [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.0` |
| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.61b0` | `0.62b0` |
| [opentelemetry-util-http](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.13.0` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.45.0` | `2.46.0` |



Updates `skrl` from 1.4.3 to 2.0.0
- [Release notes](https://github.com/Toni-SM/skrl/releases)
- [Changelog](https://github.com/Toni-SM/skrl/blob/develop/CHANGELOG.md)
- [Commits](Toni-SM/skrl@1.4.3...2.0.0)

Updates `tensordict` from 0.11.0 to 0.12.1
- [Release notes](https://github.com/pytorch/tensordict/releases)
- [Commits](pytorch/tensordict@v0.11.0...v0.12.1)

Updates `google-auth` from 2.49.1 to 2.49.2
- [Release notes](https://github.com/googleapis/google-auth-library-python/releases)
- [Changelog](https://github.com/googleapis/google-auth-library-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-auth-library-python/commits)

Updates `greenlet` from 3.3.2 to 3.4.0
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.3.2...3.4.0)

Updates `msal` from 1.35.1 to 1.36.0
- [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases)
- [Changelog](https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/RELEASES.md)
- [Commits](AzureAD/microsoft-authentication-library-for-python@1.35.1...1.36.0)

Updates `opentelemetry-api` from 1.40.0 to 1.41.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.0)

Updates `opentelemetry-instrumentation` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-asgi` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-dbapi` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-django` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-fastapi` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-flask` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-psycopg2` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-requests` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-urllib` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-urllib3` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-instrumentation-wsgi` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-proto` from 1.40.0 to 1.41.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.0)

Updates `opentelemetry-sdk` from 1.40.0 to 1.41.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.0)

Updates `opentelemetry-semantic-conventions` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/commits)

Updates `opentelemetry-util-http` from 0.61b0 to 0.62b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `pydantic` from 2.12.5 to 2.13.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.5...v2.13.0)

Updates `pydantic-core` from 2.45.0 to 2.46.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

---
updated-dependencies:
- dependency-name: skrl
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: training-dependencies
- dependency-name: tensordict
  dependency-version: 0.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: google-auth
  dependency-version: 2.49.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: training-dependencies
- dependency-name: greenlet
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: msal
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: opentelemetry-api
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-asgi
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-dbapi
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-django
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-fastapi
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-flask
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-psycopg2
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-requests
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-urllib
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-urllib3
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-instrumentation-wsgi
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-proto
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: opentelemetry-sdk
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: opentelemetry-util-http
  dependency-version: 0.62b0
  dependency-type: direct:production
  dependency-group: training-dependencies
- dependency-name: pydantic
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
- dependency-name: pydantic-core
  dependency-version: 2.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: training-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency version updates python Pull requests that update python code training labels Apr 13, 2026
@github-actions github-actions Bot changed the title chore(deps): bump the training-dependencies group across 1 directory with 23 updates security(deps): bump the training-dependencies group across 1 directory with 23 updates Apr 13, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 13, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 23 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 291da88.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

training/rl/pyproject.toml

PackageVersionLicenseIssue Type
skrl2.0.0NullUnknown License
tensordict0.12.1NullUnknown License

training/rl/requirements.txt

PackageVersionLicenseIssue Type
greenlet3.4.0NullUnknown License
opentelemetry-api1.41.0NullUnknown License
opentelemetry-instrumentation0.62b0NullUnknown License
opentelemetry-instrumentation-asgi0.62b0NullUnknown License
opentelemetry-instrumentation-dbapi0.62b0NullUnknown License
opentelemetry-instrumentation-django0.62b0NullUnknown License
opentelemetry-instrumentation-fastapi0.62b0NullUnknown License
opentelemetry-instrumentation-flask0.62b0NullUnknown License
opentelemetry-instrumentation-psycopg20.62b0NullUnknown License
opentelemetry-instrumentation-requests0.62b0NullUnknown License
opentelemetry-instrumentation-urllib0.62b0NullUnknown License
opentelemetry-instrumentation-urllib30.62b0NullUnknown License
opentelemetry-instrumentation-wsgi0.62b0NullUnknown License
opentelemetry-proto1.41.0NullUnknown License
opentelemetry-sdk1.41.0NullUnknown License
opentelemetry-semantic-conventions0.62b0NullUnknown License
opentelemetry-util-http0.62b0NullUnknown License
pydantic2.13.0NullUnknown License
skrl2.0.0NullUnknown License
tensordict0.12.1NullUnknown License
msal1.36.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/skrl 2.0.0 UnknownUnknown
pip/tensordict 0.12.1 UnknownUnknown
pip/google-auth 2.49.2 🟢 7.3
Details
CheckScoreReason
Maintained⚠️ 0project is archived
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 5SAST tool is not run on all commits -- score normalized to 5
pip/greenlet 3.4.0 UnknownUnknown
pip/msal 1.36.0 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1016 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
pip/opentelemetry-api 1.41.0 UnknownUnknown
pip/opentelemetry-instrumentation 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-asgi 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-dbapi 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-django 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-fastapi 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-flask 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-psycopg2 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-requests 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-urllib 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-urllib3 0.62b0 UnknownUnknown
pip/opentelemetry-instrumentation-wsgi 0.62b0 UnknownUnknown
pip/opentelemetry-proto 1.41.0 UnknownUnknown
pip/opentelemetry-sdk 1.41.0 UnknownUnknown
pip/opentelemetry-semantic-conventions 0.62b0 UnknownUnknown
pip/opentelemetry-util-http 0.62b0 UnknownUnknown
pip/pydantic 2.13.0 UnknownUnknown
pip/pydantic-core 2.46.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/skrl 2.0.0 UnknownUnknown
pip/tensordict 0.12.1 UnknownUnknown

Scanned Files

  • training/rl/pyproject.toml
  • training/rl/requirements.txt

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 13, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.80%. Comparing base (10449df) to head (291da88).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #463   +/-   ##
=======================================
  Coverage   64.80%   64.80%           
=======================================
  Files         251      251           
  Lines       15441    15441           
  Branches     2060     2060           
=======================================
  Hits        10006    10006           
  Misses       5146     5146           
  Partials      289      289
Flag Coverage Δ
pester 82.24% <ø> (ø)
pytest 92.40% <ø> (ø)
pytest-dataviewer 63.87% <ø> (ø)
pytest-fuzz 1.59% <ø> (ø)
vitest 51.77% <ø> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@WilliamBerryiii WilliamBerryiii merged commit d5a8656 into main Apr 14, 2026
32 checks passed
@WilliamBerryiii WilliamBerryiii deleted the dependabot/pip/training/rl/training-dependencies-b22562daef branch April 14, 2026 21:29
@physical-ai-toolchain-release physical-ai-toolchain-release Bot mentioned this pull request Apr 15, 2026
Merged
WilliamBerryiii pushed a commit that referenced this pull request May 8, 2026
@physical-ai-toolchain-release @github-actions
chore(main): release 0.8.0 (#450)
f906f37 
🤖 I have created a release *beep* *boop*
---


##
[0.8.0](v0.7.4...v0.8.0)
(2026-05-08)


### ⚠ BREAKING CHANGES

* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))

### ✨ Features

* **agents:** add automated validation for high-risk Dependabot bumps
([#574](#574))
([8c3686a](8c3686a)),
closes
[#573](#573)
* **data:** add camera selector to annotation workspace and fix AV1
frame extraction
([#591](#591))
([c809d2f](c809d2f))
* **data:** seed dataviewer frontend test foundation and per-section
codecov flags
([#594](#594))
([c06c4e3](c06c4e3))
* **dataviewer:** add OWASP security middleware stack
([#439](#439))
([239edb9](239edb9))
* **infrastructure:** add conversion pipeline Terraform module
([#542](#542))
([244531e](244531e))
* **infrastructure:** upgrade OSMO to chart 1.2.1 / image 6.2 with
secure auth and skrl 2.0.0 compatibility
([#492](#492))
([edfd7a5](edfd7a5))
* **pipeline:** add ACSA setup for ROS2 bag sync to Blob
([#451](#451))
([c271a54](c271a54))
* **workflows:** add advisory Dependabot PR reviewer agentic workflow
([#498](#498))
([d4bb140](d4bb140))
* **workflows:** trigger AW Dependabot PR reviewer after PR Validation
([#580](#580))
([7ab3d16](7ab3d16))


### 🐛 Bug Fixes

* **ci:** correct stale version comment for
actions/create-github-app-token
([#506](#506))
([b2e9a54](b2e9a54))
* **ci:** restore data-pipeline and training broken tests by domain
folder restructure
([#547](#547))
([06d8472](06d8472))
* **docs:** update remaining stale 'Coming soon' labels in
docs/README.md
([#507](#507))
([02439d6](02439d6))
* **docs:** update stale coming soon label for Training section
([#472](#472))
([46db49b](46db49b))
* **evaluation:** scope SIL AzureML validation code path and script
reference
([#387](#387))
([9f138a9](9f138a9))
* **infrastructure:** OSMO workflow execution, PostgreSQL public access,
and quickstart corrections
([#477](#477))
([9ed2da6](9ed2da6))
* **scripts:** exclude CHANGELOG.md from changed-files msdate check
([#644](#644))
([8133bdc](8133bdc))
* **workflows:** allow dependabot[bot] to activate AW Dependabot PR
Review
([#586](#586))
([39dc022](39dc022))
* **workflows:** correct branches filter on AW Dependabot PR Review
workflow_run trigger
([#584](#584))
([fe06b52](fe06b52))
* **workflows:** normalize validate.yaml placeholder env/compute values
([#510](#510))
([340ff44](340ff44))
* **workflows:** recompile aw-dependabot-pr-review lock file
([#576](#576))
([d77c167](d77c167))
* **workflows:** switch AW Dependabot PR Review to pull_request_target
([#589](#589))
([3f1edd1](3f1edd1))


### 📚 Documentation

* **docs:** Fix deployment guide links
([#614](#614))
([0070b04](0070b04))
* document dependency-pinning-artifacts directory purpose
([#508](#508))
([50e0010](50e0010))


### 📦 Build System

* **training:** standardize on Python 3.12 across manifests, containers,
and runtime scripts
([#541](#541))
([7ad014a](7ad014a))


### 🔧 Operations

* **build:** add Copilot cloud agent setup-steps workflow
([#593](#593))
([c912668](c912668))


### 🔧 Miscellaneous

* **build:** exclude auto-generated CHANGELOG.md from cspell and seed
dictionary
([#582](#582))
([de1dd57](de1dd57))
* **build:** redesign codecov flags and split pytest CI per component
([#520](#520))
([357e745](357e745))
* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))
([50f8ad4](50f8ad4))
* **dataviewer:** repoint stale src/dataviewer references to
data-management/viewer
([#504](#504))
([88fa1b4](88fa1b4)),
closes
[#503](#503)
* **deps-dev:** bump basic-ftp from 5.3.0 to 5.3.1
([#618](#618))
([ca10f2a](ca10f2a))
* **deps-dev:** bump globals from 15.15.0 to 17.5.0 in
/data-management/viewer/frontend
([#527](#527))
([0e0b2ae](0e0b2ae))
* **deps-dev:** bump ip-address from 10.1.0 to 10.2.0
([#616](#616))
([816c9cf](816c9cf))
* **deps-dev:** bump lint-staged from 16.4.0 to 17.0.2 in the
root-npm-dependencies group across 1 directory
([#626](#626))
([0e2f293](0e2f293))
* **deps-dev:** bump pydantic from 2.13.3 to 2.13.4 in the
python-dependencies group across 1 directory
([#629](#629))
([c24f1c1](c24f1c1))
* **deps-dev:** bump the python-dependencies group across 1 directory
with 2 updates
([#514](#514))
([8410f4b](8410f4b))
* **deps:** bump azure-core from 1.39.0 to 1.40.0 in /evaluation in the
inference-dependencies group across 1 directory
([#597](#597))
([6141db4](6141db4))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer
([#424](#424))
([5fb6d58](5fb6d58))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer/backend
([#423](#423))
([b516ad5](b516ad5))
* **deps:** bump lucide-react from 0.469.0 to 1.8.0 in
/data-management/viewer/frontend
([#528](#528))
([1bdfc1e](1bdfc1e))
* **deps:** bump nginx from `8aa63af` to `5616878` in
/data-management/viewer/frontend
([#511](#511))
([9e7e20e](9e7e20e))
* **deps:** bump nginx from 1.27-alpine to 1.29-alpine in
/data-management/viewer/frontend
([#484](#484))
([0e5c3dd](0e5c3dd))
* **deps:** bump node from `435f353` to `e49fd70` in
/data-management/viewer/frontend
([#560](#560))
([2884649](2884649))
* **deps:** bump react-is from 18.3.1 to 19.2.5 in
/data-management/viewer/frontend
([#530](#530))
([d51318c](d51318c))
* **deps:** bump tensordict from 0.11.0 to 0.12.1 in /evaluation in the
inference-dependencies group across 1 directory
([#456](#456))
([b24e733](b24e733))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 2 updates
([#531](#531))
([171a1da](171a1da))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#516](#516))
([4f9a577](4f9a577))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#602](#602))
([6c27ab5](6c27ab5))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 2 updates
([#529](#529))
([8646971](8646971))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#601](#601))
([d28fb50](d28fb50))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#632](#632))
([4ca5f3e](4ca5f3e))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#515](#515))
([109ee81](109ee81))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 6 updates
([#630](#630))
([04d5dfd](04d5dfd))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 9 updates
([#563](#563))
([c08f450](c08f450))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 4 updates
([#627](#627))
([f5825fc](f5825fc))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 6 updates
([#599](#599))
([b859344](b859344))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#459](#459))
([2609c52](2609c52))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#517](#517))
([f54bf5d](f54bf5d))
* **deps:** bump the inference-dependencies group across 1 directory
with 11 updates
([#562](#562))
([087f53a](087f53a))
* **deps:** bump the inference-dependencies group across 1 directory
with 2 updates
([#628](#628))
([4a3be47](4a3be47))
* **deps:** bump the pip group across 2 directories with 1 update
([#494](#494))
([a14b6b0](a14b6b0))
* **docs:** update stale Python 3.11 references to 3.12
([#575](#575))
([6f85c95](6f85c95))
* **scripts:** remove redundant SC1091 disables in OSMO deploy scripts
([#509](#509))
([ae1cb82](ae1cb82))


### 🔒 Security

* **build:** pin dependencies and hash-verify downloads
([#465](#465))
([0289f49](0289f49))
* **build:** remediate dependency security advisories
([#479](#479))
([7196d6d](7196d6d))
* **deps-dev:** bump basic-ftp from 5.2.1 to 5.2.2
([#454](#454))
([cb158f1](cb158f1))
* **deps-dev:** bump basic-ftp from 5.2.2 to 5.3.0
([#495](#495))
([e983b8b](e983b8b))
* **deps-dev:** bump hypothesis from 6.152.3 to 6.152.4 in the
python-dependencies group
([#598](#598))
([83384d2](83384d2))
* **deps-dev:** bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the
root-npm-dependencies group
([#559](#559))
([32bde35](32bde35))
* **deps-dev:** bump picomatch from 2.3.1 to 2.3.2 in /docs/docusaurus
([#455](#455))
([66f86ca](66f86ca))
* **deps-dev:** bump postcss from 8.5.10 to 8.5.12 in
/data-management/viewer/frontend
([#569](#569))
([a652dba](a652dba))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#457](#457))
([749d231](749d231))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#485](#485))
([71b44fd](71b44fd))
* **deps-dev:** bump the python-dependencies group with 3 updates
([#564](#564))
([9fc52fd](9fc52fd))
* **deps-dev:** bump typescript from 6.0.2 to 6.0.3 in /docs/docusaurus
in the docusaurus-dependencies group
([#513](#513))
([5694dbc](5694dbc))
* **deps:** bump azureml/openmpi4.1.0-ubuntu22.04 from 20260303.v5 to
20260409.v4 in /evaluation/sil/docker
([#480](#480))
([25d4df8](25d4df8))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in /evaluation in
the uv group across 1 directory
([#538](#538))
([92c5b2e](92c5b2e))
* **deps:** bump diffusers from 0.35.2 to 0.38.0 in /training/il/lerobot
([#638](#638))
([6261d19](6261d19))
* **deps:** bump follow-redirects from 1.15.11 to 1.16.0 in
/docs/docusaurus
([#469](#469))
([0458908](0458908))
* **deps:** bump gitpython and mako for lerobot IL training
([#623](#623))
([9f8022b](9f8022b))
* **deps:** bump node from 24.14.1-slim to 25.9.0-slim in
/data-management/viewer/frontend
([#482](#482))
([1532d09](1532d09))
* **deps:** bump packaging from 26.0 to 26.1 in /evaluation in the
inference-dependencies group
([#483](#483))
([f4afb6c](f4afb6c))
* **deps:** bump pillow from 12.1.1 to 12.2.0
([#467](#467))
([39fb663](39fb663))
* **deps:** bump python from 3.11-slim to 3.14-slim in
/data-management/viewer/backend
([#481](#481))
([7af9dfc](7af9dfc))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 15 updates
([#428](#428))
([e4446a2](e4446a2))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 4 updates
([#487](#487))
([0f57c5b](0f57c5b))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 8 updates
([#566](#566))
([d6e7869](d6e7869))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#464](#464))
([24c208d](24c208d))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 2 updates
([#486](#486))
([90149f3](90149f3))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 6 updates
([#565](#565))
([f0bb36b](f0bb36b))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 10 updates
([#613](#613))
([e481f83](e481f83))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#534](#534))
([5478ab6](5478ab6))
* **deps:** bump the github-actions group with 2 updates
([#488](#488))
([4e6ce98](4e6ce98))
* **deps:** bump the github-actions group with 3 updates
([#567](#567))
([48c38dc](48c38dc))
* **deps:** bump the github-actions group with 3 updates
([#634](#634))
([00cfb49](00cfb49))
* **deps:** bump the github-actions group with 6 updates
([#603](#603))
([73eb79a](73eb79a))
* **deps:** bump the training-dependencies group across 1 directory with
23 updates
([#463](#463))
([d5a8656](d5a8656))
* **deps:** bump yaml from 2.8.2 to 2.8.3 in
/data-management/viewer/frontend
([#453](#453))
([10449df](10449df))
* pytest harness, dependabot advisories, and OSSF Scorecard remediations
([#501](#501))
([e8756e8](e8756e8))
* **scripts:** pin and hash-verify all shell script downloads
([#468](#468))
([0c2bb9c](0c2bb9c))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: physical-ai-toolchain-release[bot] <267194360+physical-ai-toolchain-release[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamBerryiii WilliamBerryiii WilliamBerryiii approved these changes

Assignees

No one assigned

Labels

dependencies Dependency version updates python Pull requests that update python code training

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @WilliamBerryiii