security(deps): bump the training-dependencies group across 1 directory with 76 updates#608
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
…with 76 updates Bumps the training-dependencies group with 76 updates in the /training/rl directory: | Package | From | To | | --- | --- | --- | | [numpy](https://github.com/numpy/numpy) | `1.26.4` | `2.4.4` | | [azure-core](https://github.com/Azure/azure-sdk-for-python) | `1.39.0` | `1.40.0` | | [marshmallow](https://github.com/marshmallow-code/marshmallow) | `3.26.2` | `4.3.0` | | [packaging](https://github.com/pypa/packaging) | `26.1` | `26.2` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `47.0.0` | | [rsl-rl-lib](https://github.com/leggedrobotics/rsl_rl) | `5.0.1` | `5.2.0` | | [tensordict](https://github.com/pytorch/tensordict) | `0.12.1` | `0.12.2` | | [azure-core-tracing-opentelemetry](https://github.com/Azure/azure-sdk-for-python) | `1.0.0b12` | `1.0.0b13` | | [azure-storage-file-datalake](https://github.com/Azure/azure-sdk-for-python) | `12.22.0` | `12.23.0` | | [cachetools](https://github.com/tkem/cachetools) | `6.2.6` | `7.1.1` | | [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.4.22` | | [click](https://github.com/pallets/click) | `8.3.2` | `8.3.3` | | [cuda-pathfinder](https://github.com/NVIDIA/cuda-python) | `1.5.3` | `1.5.4` | | [cuda-toolkit](https://developer.nvidia.com/cuda-toolkit) | `13.0.2` | `13.2.1` | | [databricks-sdk](https://github.com/databricks/databricks-sdk-py) | `0.102.0` | `0.106.0` | | [farama-notifications](https://github.com/Farama-Foundation/Farama-Notifications) | `0.0.4` | `0.0.6` | | [fastapi](https://github.com/fastapi/fastapi) | `0.135.3` | `0.136.1` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.28.0` | `3.29.0` | | [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.3.0` | `2026.4.0` | | [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.46` | `3.1.49` | | [google-auth](https://github.com/googleapis/google-auth-library-python) | `2.49.2` | `2.50.0` | | [greenlet](https://github.com/python-greenlet/greenlet) | `3.4.0` | `3.5.0` | | [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `25.3.0` | | [gymnasium](https://github.com/Farama-Foundation/Gymnasium) | `1.2.3` | `1.3.0` | | [huey](https://github.com/coleifer/huey) | `2.6.0` | `3.0.0` | | [idna](https://github.com/kjd/idna) | `3.11` | `3.13` | | [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `9.0.0` | | [mako](https://github.com/sqlalchemy/mako) | `1.3.11` | `1.3.12` | | [matplotlib](https://github.com/matplotlib/matplotlib) | `3.10.8` | `3.10.9` | | [mpmath](https://github.com/mpmath/mpmath) | `1.3.0` | `1.4.1` | | [nvidia-cublas](https://developer.nvidia.com/cuda-zone) | `13.1.0.3` | `13.4.1.1` | | [nvidia-cuda-cupti](https://developer.nvidia.com/cuda-zone) | `13.0.85` | `13.2.75` | | [nvidia-cuda-nvrtc](https://developer.nvidia.com/cuda-zone) | `13.0.88` | `13.2.78` | | [nvidia-cuda-runtime](https://developer.nvidia.com/cuda-zone) | `13.0.96` | `13.2.75` | | [nvidia-cudnn-cu13](https://developer.nvidia.com/cuda-zone) | `9.19.0.56` | `9.21.1.3` | | [nvidia-cufft](https://developer.nvidia.com/cuda-zone) | `12.0.0.61` | `12.2.0.46` | | [nvidia-cufile](https://developer.nvidia.com/cuda-zone) | `1.15.1.6` | `1.17.1.22` | | [nvidia-curand](https://developer.nvidia.com/cuda-zone) | `10.4.0.35` | `10.4.2.55` | | [nvidia-cusolver](https://developer.nvidia.com/cuda-zone) | `12.0.4.66` | `12.2.0.1` | | [nvidia-cusparse](https://developer.nvidia.com/cuda-zone) | `12.6.3.3` | `12.7.10.1` | | [nvidia-cusparselt-cu13](https://developer.nvidia.com/cusparselt) | `0.8.0` | `0.9.1` | | [nvidia-nccl-cu13](https://developer.nvidia.com/cuda-zone) | `2.28.9` | `2.30.4` | | [nvidia-nvjitlink](https://developer.nvidia.com/cuda-zone) | `13.0.88` | `13.2.78` | | [nvidia-nvshmem-cu13](https://developer.nvidia.com/cuda-zone) | `3.4.5` | `3.6.5` | | [nvidia-nvtx](https://developer.nvidia.com/cuda-zone) | `13.0.85` | `13.2.75` | | [onnx-ir](https://github.com/onnx/ir-py) | `0.2.0` | `0.2.1` | | [onnxscript](https://github.com/microsoft/onnxscript) | `0.6.2` | `0.7.0` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.1` | | [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-asgi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-dbapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-django](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-fastapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-flask](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-logging](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-psycopg2](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-requests](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-urllib](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-urllib3](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-instrumentation-wsgi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-python) | `1.41.0` | `1.41.1` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.1` | | [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.61b0` | `0.62b1` | | [opentelemetry-util-http](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` | | [pandas](https://github.com/pandas-dev/pandas) | `2.3.3` | `3.0.2` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.6` | `7.34.1` | | [pyarrow](https://github.com/apache/arrow) | `22.0.0` | `24.0.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.13.1` | `2.13.3` | | [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.1` | `2.46.3` | | [pytz](https://github.com/stub42/pytz) | `2025.2` | `2026.2` | | [setuptools](https://github.com/pypa/setuptools) | `81.0.0` | `82.0.1` | | [skops](https://github.com/skops-dev/skops) | `0.13.0` | `0.14.0` | | [tzdata](https://github.com/python/tzdata) | `2026.1` | `2026.2` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.44.0` | `0.46.0` | | [wcwidth](https://github.com/jquast/wcwidth) | `0.6.0` | `0.7.0` | | [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.3` | `2.1.2` | Updates `numpy` from 1.26.4 to 2.4.4 - [Release notes](https://github.com/numpy/numpy/releases) - [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst) - [Commits](numpy/numpy@v1.26.4...v2.4.4) Updates `azure-core` from 1.39.0 to 1.40.0 - [Release notes](https://github.com/Azure/azure-sdk-for-python/releases) - [Commits](Azure/azure-sdk-for-python@azure-core_1.39.0...azure-core_1.40.0) Updates `marshmallow` from 3.26.2 to 4.3.0 - [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst) - [Commits](marshmallow-code/marshmallow@3.26.2...4.3.0) Updates `packaging` from 26.1 to 26.2 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@26.1...26.2) Updates `cryptography` from 46.0.7 to 47.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.7...47.0.0) Updates `rsl-rl-lib` from 5.0.1 to 5.2.0 - [Release notes](https://github.com/leggedrobotics/rsl_rl/releases) - [Commits](leggedrobotics/rsl_rl@v5.0.1...v5.2.0) Updates `tensordict` from 0.12.1 to 0.12.2 - [Release notes](https://github.com/pytorch/tensordict/releases) - [Commits](pytorch/tensordict@v0.12.1...v0.12.2) Updates `azure-core-tracing-opentelemetry` from 1.0.0b12 to 1.0.0b13 - [Release notes](https://github.com/Azure/azure-sdk-for-python/releases) - [Commits](Azure/azure-sdk-for-python@azure-core-tracing-opentelemetry_1.0.0b12...azure-core-tracing-opentelemetry_1.0.0b13) Updates `azure-storage-file-datalake` from 12.22.0 to 12.23.0 - [Release notes](https://github.com/Azure/azure-sdk-for-python/releases) - [Commits](Azure/azure-sdk-for-python@azure-storage-file-datalake_12.22.0...azure-storage-file-datalake_12.23.0) Updates `cachetools` from 6.2.6 to 7.1.1 - [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst) - [Commits](tkem/cachetools@v6.2.6...v7.1.1) Updates `certifi` from 2026.2.25 to 2026.4.22 - [Commits](certifi/python-certifi@2026.02.25...2026.04.22) Updates `click` from 8.3.2 to 8.3.3 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst) - [Commits](pallets/click@8.3.2...8.3.3) Updates `cuda-pathfinder` from 1.5.3 to 1.5.4 - [Release notes](https://github.com/NVIDIA/cuda-python/releases) - [Commits](NVIDIA/cuda-python@cuda-pathfinder-v1.5.3...cuda-pathfinder-v1.5.4) Updates `cuda-toolkit` from 13.0.2 to 13.2.1 Updates `databricks-sdk` from 0.102.0 to 0.106.0 - [Release notes](https://github.com/databricks/databricks-sdk-py/releases) - [Changelog](https://github.com/databricks/databricks-sdk-py/blob/main/CHANGELOG.md) - [Commits](databricks/databricks-sdk-py@v0.102.0...v0.106.0) Updates `farama-notifications` from 0.0.4 to 0.0.6 - [Release notes](https://github.com/Farama-Foundation/Farama-Notifications/releases) - [Commits](Farama-Foundation/Farama-Notifications@0.0.4...0.0.6) Updates `fastapi` from 0.135.3 to 0.136.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.135.3...0.136.1) Updates `filelock` from 3.28.0 to 3.29.0 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.28.0...3.29.0) Updates `fsspec` from 2026.3.0 to 2026.4.0 - [Commits](fsspec/filesystem_spec@2026.3.0...2026.4.0) Updates `gitpython` from 3.1.46 to 3.1.49 - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.46...3.1.49) Updates `google-auth` from 2.49.2 to 2.50.0 - [Release notes](https://github.com/googleapis/google-auth-library-python/releases) - [Changelog](https://github.com/googleapis/google-auth-library-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/googleapis/google-auth-library-python/commits) Updates `greenlet` from 3.4.0 to 3.5.0 - [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst) - [Commits](python-greenlet/greenlet@3.4.0...3.5.0) Updates `gunicorn` from 23.0.0 to 25.3.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@23.0.0...25.3.0) Updates `gymnasium` from 1.2.3 to 1.3.0 - [Release notes](https://github.com/Farama-Foundation/Gymnasium/releases) - [Commits](Farama-Foundation/Gymnasium@v1.2.3...v1.3.0) Updates `huey` from 2.6.0 to 3.0.0 - [Release notes](https://github.com/coleifer/huey/releases) - [Changelog](https://github.com/coleifer/huey/blob/master/CHANGELOG.md) - [Commits](coleifer/huey@2.6.0...3.0.0) Updates `idna` from 3.11 to 3.13 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.11...v3.13) Updates `importlib-metadata` from 8.7.1 to 9.0.0 - [Release notes](https://github.com/python/importlib_metadata/releases) - [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst) - [Commits](python/importlib_metadata@v8.7.1...v9.0.0) Updates `mako` from 1.3.11 to 1.3.12 - [Release notes](https://github.com/sqlalchemy/mako/releases) - [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES) - [Commits](https://github.com/sqlalchemy/mako/commits) Updates `matplotlib` from 3.10.8 to 3.10.9 - [Release notes](https://github.com/matplotlib/matplotlib/releases) - [Commits](matplotlib/matplotlib@v3.10.8...v3.10.9) Updates `mpmath` from 1.3.0 to 1.4.1 - [Release notes](https://github.com/mpmath/mpmath/releases) - [Changelog](https://github.com/mpmath/mpmath/blob/1.4.1/CHANGES) - [Commits](mpmath/mpmath@1.3.0...1.4.1) Updates `nvidia-cublas` from 13.1.0.3 to 13.4.1.1 Updates `nvidia-cuda-cupti` from 13.0.85 to 13.2.75 Updates `nvidia-cuda-nvrtc` from 13.0.88 to 13.2.78 Updates `nvidia-cuda-runtime` from 13.0.96 to 13.2.75 Updates `nvidia-cudnn-cu13` from 9.19.0.56 to 9.21.1.3 Updates `nvidia-cufft` from 12.0.0.61 to 12.2.0.46 Updates `nvidia-cufile` from 1.15.1.6 to 1.17.1.22 Updates `nvidia-curand` from 10.4.0.35 to 10.4.2.55 Updates `nvidia-cusolver` from 12.0.4.66 to 12.2.0.1 Updates `nvidia-cusparse` from 12.6.3.3 to 12.7.10.1 Updates `nvidia-cusparselt-cu13` from 0.8.0 to 0.9.1 Updates `nvidia-nccl-cu13` from 2.28.9 to 2.30.4 Updates `nvidia-nvjitlink` from 13.0.88 to 13.2.78 Updates `nvidia-nvshmem-cu13` from 3.4.5 to 3.6.5 Updates `nvidia-nvtx` from 13.0.85 to 13.2.75 Updates `onnx-ir` from 0.2.0 to 0.2.1 - [Release notes](https://github.com/onnx/ir-py/releases) - [Commits](onnx/ir-py@v0.2.0...v0.2.1) Updates `onnxscript` from 0.6.2 to 0.7.0 - [Release notes](https://github.com/microsoft/onnxscript/releases) - [Commits](microsoft/onnxscript@v0.6.2...v0.7.0) Updates `opentelemetry-api` from 1.40.0 to 1.41.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/v1.41.1/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.1) Updates `opentelemetry-instrumentation` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-asgi` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-dbapi` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-django` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-fastapi` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-flask` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-logging` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-psycopg2` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-requests` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-urllib` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-urllib3` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-instrumentation-wsgi` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `opentelemetry-proto` from 1.41.0 to 1.41.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/v1.41.1/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.41.0...v1.41.1) Updates `opentelemetry-sdk` from 1.40.0 to 1.41.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/v1.41.1/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.1) Updates `opentelemetry-semantic-conventions` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python/commits) Updates `opentelemetry-util-http` from 0.61b0 to 0.62b1 - [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits) Updates `pandas` from 2.3.3 to 3.0.2 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](pandas-dev/pandas@v2.3.3...v3.0.2) Updates `protobuf` from 6.33.6 to 7.34.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pyarrow` from 22.0.0 to 24.0.0 - [Release notes](https://github.com/apache/arrow/releases) - [Commits](apache/arrow@apache-arrow-22.0.0...apache-arrow-24.0.0) Updates `pydantic` from 2.13.1 to 2.13.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.1...v2.13.3) Updates `pydantic-core` from 2.46.1 to 2.46.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@core-v2.46.1...core-v2.46.3) Updates `pytz` from 2025.2 to 2026.2 - [Release notes](https://github.com/stub42/pytz/releases) - [Commits](stub42/pytz@release_2025.2...release_2026.2) Updates `setuptools` from 81.0.0 to 82.0.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v81.0.0...v82.0.1) Updates `skops` from 0.13.0 to 0.14.0 - [Release notes](https://github.com/skops-dev/skops/releases) - [Changelog](https://github.com/skops-dev/skops/blob/main/docs/changes.rst) - [Commits](skops-dev/skops@v0.13.0...v0.14) Updates `tzdata` from 2026.1 to 2026.2 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.1...2026.2) Updates `uvicorn` from 0.44.0 to 0.46.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.44.0...0.46.0) Updates `wcwidth` from 0.6.0 to 0.7.0 - [Release notes](https://github.com/jquast/wcwidth/releases) - [Commits](jquast/wcwidth@0.6.0...0.7.0) Updates `wrapt` from 1.17.3 to 2.1.2 - [Release notes](https://github.com/GrahamDumpleton/wrapt/releases) - [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst) - [Commits](GrahamDumpleton/wrapt@1.17.3...2.1.2) --- updated-dependencies: - dependency-name: numpy dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: azure-core dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: marshmallow dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: packaging dependency-version: '26.2' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: cryptography dependency-version: 47.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: rsl-rl-lib dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: tensordict dependency-version: 0.12.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: azure-core-tracing-opentelemetry dependency-version: 1.0.0b13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: azure-storage-file-datalake dependency-version: 12.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: cachetools dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: certifi dependency-version: 2026.4.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: click dependency-version: 8.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: cuda-pathfinder dependency-version: 1.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: cuda-toolkit dependency-version: 13.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: databricks-sdk dependency-version: 0.106.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: farama-notifications dependency-version: 0.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: fastapi dependency-version: 0.136.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: filelock dependency-version: 3.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: fsspec dependency-version: 2026.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: gitpython dependency-version: 3.1.49 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: google-auth dependency-version: 2.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: greenlet dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: gunicorn dependency-version: 25.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: gymnasium dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: huey dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: idna dependency-version: '3.13' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: importlib-metadata dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: mako dependency-version: 1.3.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: matplotlib dependency-version: 3.10.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: mpmath dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cublas dependency-version: 13.4.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cuda-cupti dependency-version: 13.2.75 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cuda-nvrtc dependency-version: 13.2.78 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cuda-runtime dependency-version: 13.2.75 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cudnn-cu13 dependency-version: 9.21.1.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cufft dependency-version: 12.2.0.46 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cufile dependency-version: 1.17.1.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-curand dependency-version: 10.4.2.55 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: nvidia-cusolver dependency-version: 12.2.0.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cusparse dependency-version: 12.7.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-cusparselt-cu13 dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-nccl-cu13 dependency-version: 2.30.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-nvjitlink dependency-version: 13.2.78 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-nvshmem-cu13 dependency-version: 3.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: nvidia-nvtx dependency-version: 13.2.75 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: onnx-ir dependency-version: 0.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: onnxscript dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: opentelemetry-api dependency-version: 1.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-asgi dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-dbapi dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-django dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-fastapi dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-flask dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-logging dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-psycopg2 dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-requests dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-urllib dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-urllib3 dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-instrumentation-wsgi dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-proto dependency-version: 1.41.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: opentelemetry-sdk dependency-version: 1.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: opentelemetry-semantic-conventions dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: opentelemetry-util-http dependency-version: 0.62b1 dependency-type: direct:production dependency-group: training-dependencies - dependency-name: pandas dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: protobuf dependency-version: 7.34.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: pyarrow dependency-version: 24.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: pydantic dependency-version: 2.13.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: pydantic-core dependency-version: 2.46.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: training-dependencies - dependency-name: pytz dependency-version: '2026.2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: setuptools dependency-version: 82.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies - dependency-name: skops dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: tzdata dependency-version: '2026.2' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: uvicorn dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: wcwidth dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: training-dependencies - dependency-name: wrapt dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: training-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
github-actions
Bot
changed the title
Contributor
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuestraining/rl/pyproject.toml
training/rl/requirements.txt
OpenSSF ScorecardScorecard details
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #608 +/- ##
==========================================
+ Coverage 65.16% 67.70% +2.53%
==========================================
Files 251 263 +12
Lines 15597 16827 +1230
Branches 2152 2290 +138
==========================================
+ Hits 10164 11392 +1228
Misses 5142 5142
- Partials 291 293 +2
*This pull request uses carry forward flags. Click here to find out more. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
⚠️ Maintainer review recommended
Advisory Review Summary
This grouped Dependabot PR bumps 76 packages in training/rl/ (training-rl-abi surface). No GHSA or CVE advisories were referenced in the PR body. The Isaac Sim ABI guard in train.sh is violated by the numpy bump, and CI has not yet completed.
Affected surfaces: training-rl-abi (pip/uv under training/rl/)
| Package | From | To | Risk | Surface |
|---|---|---|---|---|
| numpy | 1.26.4 | 2.4.4 | HIGH — ABI guard violation | training-rl-abi |
| pandas | 2.3.3 | 3.0.2 | Medium — major, breaking API changes | training-rl-abi |
| marshmallow | 3.26.2 | 4.3.0 | Medium — major, direct dep, breaking API changes | training-rl-abi |
| pyarrow | 22.0.0 | 24.0.0 | Medium — 2 major jumps, ABI-sensitive | training-rl-abi |
| protobuf | 6.33.6 | 7.34.1 | Low-Medium — major, C-extension ABI change | training-rl-abi |
| wrapt | 1.17.3 | 2.1.2 | Low — major, opentelemetry-instrumentation dep | training-rl-abi |
| cachetools | 6.2.6 | 7.1.1 | Low — major, mlflow dep | training-rl-abi |
| importlib-metadata | 8.7.1 | 9.0.0 | Low — major, mlflow/otel dep | training-rl-abi |
| huey | 2.6.0 | 3.0.0 | Low — major, mlflow dep | training-rl-abi |
| gunicorn | 23.0.0 | 25.3.0 | Low — 2 major jumps, mlflow dep | training-rl-abi |
| 66 other packages | — | — | Info — minor/patch bumps | training-rl-abi |
numpy
No advisory. Pure ABI risk.
NumPy 2.4.4 is a patch release within the 2.4.x series. The major breaking changes — revised C API, removal of
np.bool,np.int,np.floataliases, newcopy=Falsesemantics — landed in NumPy 2.0.0.
Release: github.com/numpy/numpy/releases/tag/v2.4.4
Repo-specific risk — Isaac Sim ABI guard broken:
training/rl/scripts/train.sh enforces numpy>=1.26.0,<2.0.0 (lines 80–86) to preserve Isaac Sim 4.x C-extension compatibility. The subsequent step (lines 94–96) runs:
uv pip install --no-cache-dir --no-deps --requirement requirements.txtBecause requirements.txt now pins numpy==2.4.4, this step silently overrides the 1.x pin installed in lines 80–86. Isaac Sim ships pre-compiled extensions against NumPy 1.x ABI. Loading those extensions under NumPy 2.x will produce ImportError or silent data corruption at runtime.
The train.sh ABI guard must be updated to <3.0.0 only after Isaac Sim 4.x validates NumPy 2.x support, or this bump must be reverted.
Validation Signal
- PR Validation:
in_progress:in_progress— CI not yet complete.⚠️ Deterministic CI conclusion not yet available; verdict is advisory only. - Static impact:
training/rl/requirements.txtpinsnumpy==2.4.4;training/rl/scripts/train.shline 80 pinsnumpy>=1.26.0,<2.0.0. These are directly contradictory. The runtime install order means 2.4.4 wins — the ABI guard is bypassed.
marshmallow
No advisory. Direct dependency bump (pyproject.toml line 12 and requirements.txt line 205).
marshmallow 4.0 removed all APIs deprecated in the 3.x series: strict kwarg, Schema.Meta field ordering, @pre_load(pass_many=True) signature, dump/load positional many argument. Code using any deprecated 3.x patterns will raise AttributeError or TypeError.
azure-ai-ml==1.32.0 (also a direct dep) internally imports marshmallow — verify it pins marshmallow<4 or explicitly supports 4.x.
Changelog: github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst
Validation Signal
- PR Validation:
in_progress:in_progress - Static impact: Direct dep — any training code using marshmallow 3.x deprecated APIs will fail at import or first schema use.
pandas
No advisory. Transitive via mlflow.
pandas 3.0 breaking changes:
- Copy-on-Write is now the default — mutating a slice no longer mutates the parent DataFrame
StringDtypeis the new default for string columns (changesdtypecomparisons)- datetime inference resolution changed from
nstous- All pandas 2.x deprecations removed
Release: github.com/pandas-dev/pandas/releases/tag/v3.0.0
Validation Signal
- PR Validation:
in_progress:in_progress - Static impact: Transitive via mlflow; low direct-usage risk in RL training code, but any evaluation or logging code reading mlflow artifacts as DataFrames may see unexpected dtype or timestamp behaviour.
pyarrow
No advisory. Transitive via mlflow. Two major version jump (22 → 24). pyarrow's C-extension ABI is tightly coupled to the NumPy version it was compiled against. The combined numpy 1.x → 2.x and pyarrow 22 → 24 bump compounds ABI risk.
Validation Signal
- PR Validation:
in_progress:in_progress - Static impact: Transitive via mlflow; no direct usage detected in
training/rl/. ABI risk is elevated when combined with the numpy 2.x change.
Other notable major bumps
| Package | From | To | Note |
|---|---|---|---|
| protobuf | 6.33.6 | 7.34.1 | C-extension ABI; used by tensorboard, databricks-sdk, grpcio, mlflow |
| wrapt | 1.17.3 | 2.1.2 | Dropped Python < 3.8 support; opentelemetry-instrumentation dependency chain |
| cachetools | 6.2.6 | 7.1.1 | Removed LRUCache.popitem; mlflow-skinny dep |
| importlib-metadata | 8.7.1 | 9.0.0 | Removed deprecated packages_distributions; mlflow-skinny dep |
| huey | 2.6.0 | 3.0.0 | Task queue API changes; mlflow dep |
| gunicorn | 23.0.0 | 25.3.0 | Two major jumps; worker lifecycle changes; mlflow dep |
| onnxscript | 0.6.2 | 0.7.0 | Minor bump; pre-1.0, rsl-rl-lib dep |
| cryptography | 46.0.7 | 47.0.0 | Major bump; azure-identity, pyjwt dep |
| gymnasium | 1.2.3 | 1.3.0 | Minor; skrl dep |
| rsl-rl-lib | 5.0.1 | 5.2.0 | Minor; direct dep |
| tensordict | 0.12.1 | 0.12.2 | Patch; GPU-sensitive direct dep |
Transitive-only lockfile note
The majority of the 76 packages are transitive — they appear in requirements.txt but not in pyproject.toml direct dependencies. The requirements.txt is autogenerated by uv pip compile pyproject.toml -o requirements.txt. These are lockfile-only updates for transitive packages; all manifest-level changes are confined to training/rl/pyproject.toml.
Advisory verdict: COMMENT — CI is still in progress; numpy 2.4.4 violates the Isaac Sim ABI guard enforced by training/rl/scripts/train.sh (lines 80–86), and train.sh must be updated or the numpy bump reverted before this PR is safe to merge. Multiple other major version bumps (marshmallow 4, pandas 3, pyarrow 24, protobuf 7) warrant targeted smoke-test validation on GPU nodes.
🔍 - Generated by Copilot
Note
🔒 Integrity filter blocked 1 item
The following item were blocked because they don't meet the GitHub integrity level.
- #608
pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
To allow these resources, lower min-integrity in your GitHub frontmatter:
tools:
github:
min-integrity: approved # merged | approved | unapproved | noneGenerated by AW Dependabot PR Review for issue #608 · ● 857.9K
| dependencies = [ | ||
| "numpy==1.26.4", | ||
| "azure-core==1.39.0", | ||
| "numpy==2.4.4", |
Contributor
There was a problem hiding this comment.
training/rl/scripts/train.sh enforces numpy>=1.26.0,<2.0.0 at runtime (lines 80–86) to preserve Isaac Sim 4.x C-extension ABI compatibility. NumPy 2.0 introduced a revised C API that is incompatible with pre-compiled Isaac Sim extensions.
However, train.sh subsequently installs requirements.txt with --no-deps (lines 94–96), which will install numpy==2.4.4 and override the 1.x pin. The net result is that the Isaac Sim ABI guard is silently bypassed at training time.
Action required before merging:
- Update the pin in
train.shlines 80–86 from<2.0.0to<3.0.0only if Isaac Sim 4.x has been validated against NumPy 2.x, or - Revert this bump until Isaac Sim confirms NumPy 2.x support.
References: [NumPy 2.0 migration guide]((numpy.org/redacted), training/rl/scripts/train.sh lines 80–86.
| # mako | ||
| # werkzeug | ||
| marshmallow==3.26.2 | ||
| marshmallow==4.3.0 |
Contributor
There was a problem hiding this comment.
marshmallow 3.26.2 → 4.3.0 — major version bump (direct dependency)
marshmallow is a direct dependency in pyproject.toml. marshmallow 4.0 removed all APIs deprecated in the 3.x series, including Schema.Meta field ordering, strict mode, pre/post decorator variants, and changed dump / load to no longer accept positional arguments.
azure-ai-ml (also in requirements.txt) vendors marshmallow internally — verify it declares compatibility with marshmallow 4.x via its own metadata before merging.
Changelog: github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst
| # robotics-training-rl (pyproject.toml) | ||
| # azure-monitor-opentelemetry-exporter | ||
| pyarrow==22.0.0 | ||
| pyarrow==24.0.0 |
Contributor
There was a problem hiding this comment.
pyarrow 22.0.0 → 24.0.0 — two major version jumps (ABI-sensitive)
pyarrow is in the high-risk surface list for python-runtime. Crossing two major versions increases the likelihood of C-extension ABI incompatibilities, particularly when pyarrow is used alongside NumPy (both share native memory interfaces). This bump is transitive via mlflow.
Verify that mlflow==3.11.1 (the version already pinned) declares support for pyarrow>=24.
| # tensorboard | ||
| # tensordict | ||
| pandas==2.3.3 | ||
| pandas==3.0.2 |
Contributor
There was a problem hiding this comment.
pandas 2.3.3 → 3.0.2 — major version bump (transitive via mlflow)
pandas 3.0 breaking changes:
- Copy-on-Write is now the default (removes
SettingWithCopyWarning; mutating a slice no longer mutates the original) - Dedicated
StringDtypeis the new default for string columns - datetime resolution inference changed (
ns→usby default) - All 2.x deprecations removed
Any mlflow logging code or evaluation scripts that use DataFrame.copy() semantics or rely on ns-resolution timestamps may behave differently.
Release notes: github.com/pandas-dev/pandas/releases/tag/v3.0.0
| networkx==3.6.1 | ||
| # via torch | ||
| numpy==1.26.4 | ||
| numpy==2.4.4 |
Contributor
There was a problem hiding this comment.
numpy 2.4.4 in lockfile conflicts with train.sh ABI guard
This lockfile entry sets numpy==2.4.4 (NumPy 2.x). The runtime script training/rl/scripts/train.sh attempts to enforce numpy>=1.26.0,<2.0.0 (lines 80–86) for Isaac Sim ABI safety, but the uv pip install --no-deps --requirement requirements.txt step (lines 94–96) will overwrite that install with this 2.4.4 pin.
NumPy 2.0 release notes: github.com/numpy/numpy/releases/tag/v2.4.4 — patch release only; the major breaking changes landed in 2.0.0.
28 tasks
32 tasks
katriendg
pushed a commit
that referenced
this pull request
May 8, 2026
## Description Addresses two OpenSSF Scorecard advisories surfaced against `training/il/lerobot/requirements.txt`: - `gitpython` `3.1.47` → `3.1.49` (transitive via `mlflow-skinny`, `wandb`) - `mako` `1.3.11` → `1.3.12` (transitive via `alembic`) Root cause for the lag: `.github/dependabot.yml` covered `/training/rl` (which received its own bump in #608) but had no `/training/il/lerobot` entry, so no automated security PRs were ever raised for the imitation-learning requirements file. This PR adds the missing entry so future CVEs in this directory are picked up automatically. `evaluation/uv.lock` was regenerated alongside the requirements bump to keep the evaluation virtual environment consistent. The lockfile reconciliation pulled in: - `gitpython` `3.1.46` → `3.1.50` - `mako` `1.3.10` → `1.3.12` - `azure-core` `1.39.0` → `1.40.0` (benign upstream pin reconciliation) No `Closes #` — this work is driven by OpenSSF Scorecard advisories, not a tracked GitHub issue. ## Type of Change - [x] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] 🚀 Feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 📚 Documentation update - [ ] ♻️ Refactoring (no functional changes) - [ ] 🔧 Configuration change - [ ] 🧪 Test addition or modification - [ ] 🏗️ Infrastructure change ## Component(s) Affected - [ ] data-pipeline/ - [ ] data-management/ - [ ] synthetic-data/ - [x] training/ (`training/il/lerobot/requirements.txt`) - [ ] evaluation/ - [ ] fleet-deployment/ - [ ] fleet-intelligence/ - [ ] infrastructure/ - [ ] docs/ - [ ] Other: `.github/dependabot.yml`, `evaluation/uv.lock` ## Testing Performed N/A — dependency version bumps only. - `uv lock` regeneration succeeded for `evaluation/uv.lock` (no resolver conflicts). - CI dependency-pinning workflow (`Dependency Pinning Validation`) and CodeQL run on PR will validate the change. - `dependabot.yml` change is a config-only addition that takes effect on next scheduled run. ## Documentation Impact - [x] No documentation changes needed - [ ] README updated - [ ] Architecture docs updated (`docs/cloud/architecture.md`) - [ ] Implementation guide updated - [ ] API documentation updated - [ ] New documentation added: <path> ## Bug Fix Checklist - [x] Linked to OpenSSF Scorecard advisories (`gitpython`, `mako`) - [x] No regression test added (transitive dependency version bump; upstream test suites apply) - [x] No user-visible behavior change ## Checklist - [x] My code follows the project's style guidelines (no source code changes; config and lockfile only) - [x] I have performed a self-review of my own code - [x] I have made corresponding changes to the documentation (none required) - [x] My changes generate no new warnings - [x] Any dependent changes have been merged and published in downstream modules (parallel PR #608 covers `/training/rl`)
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/pip/training/rl/training-dependencies-79ecaa5a1e
branch
WilliamBerryiii
added a commit
that referenced
this pull request
May 13, 2026
#612) ## Description The `aw-dependabot-pr-review` agentic workflow used to fire on `pull_request_target`, which meant the resolver step captured a snapshot of `PR Validation` while it was still `pending` or `in_progress:*`, and the advisory review was posted before the orchestrator ever finished. PR #608 was the canonical example: the review correctly applied the Isaac Sim *numpy 2.x* ABI guard, but its CI banner quoted a stale `in_progress:in_progress` conclusion. This PR migrates the workflow to `workflow_run` keyed on `PR Validation` *completed*, reads the orchestrator's terminal conclusion straight from `context.payload.workflow_run.conclusion`, and pre-resolves failing per-surface check-runs once in the resolver step. The persona rubric is rewritten to consume those env vars and to map every terminal conclusion explicitly - `pending` and `in_progress:*` branches are gone because they are now unreachable. Related to #579. ## Type of Change - [ ] 🐛 Bug fix (non-breaking change fixing an issue) - [ ] ✨ New feature (non-breaking change adding functionality) - [ ] 💥 Breaking change (fix or feature causing existing functionality to change) - [ ] 📚 Documentation update - [ ] 🏗️ Infrastructure change (Terraform/IaC) - [x] ♻️ Refactoring (no functional changes) ## Component(s) Affected - [ ] `infrastructure/terraform/prerequisites/` - Azure subscription setup - [ ] `infrastructure/terraform/` - Terraform infrastructure - [ ] `infrastructure/setup/` - OSMO control plane / Helm - [ ] `workflows/` - Training and evaluation workflows - [ ] `training/` - Training pipelines and scripts - [ ] `docs/` - Documentation ## Changes ### Workflow trigger and resolver > Switching to `workflow_run` runs the agent step against the trusted, default-branch copy of the workflow, so the gh-aw compiler can auto-inject fork-PR exclusion and the `repository.id` guard. - Replaced `pull_request_target` with `workflow_run` on **`workflows: ["PR Validation"]`**, `types: [completed]`, `branches: ["dependabot/**"]`. The `branches:` filter on `workflow_run` matches the *triggering run's `head_branch`* (not the base), so `dependabot/**` is the only value that fires for Dependabot PRs — using `main` here was the [#583](#583) regression fixed in [#584](#584). The workflow-level `if:` filters on `workflow_run.event == 'pull_request'`, `workflow_run.actor.login == 'dependabot[bot]'`, and a whitelist of seven terminal conclusions. - Kept `on.bots: ["dependabot[bot]"]` and `on.roles: [admin, maintainer, write]` at the top level — gh-aw's `pre_activation` guard checks the triggering actor against `on.bots` / `on.roles` independently of the workflow `if:`, so dropping these would resurrect the [#585](#585) / [#586](#586) `User permission 'none'` activation block. - Added `checks: read` to `permissions:` for server-side check-run enumeration; existing `contents`, `pull-requests`, and `actions` scopes are unchanged. - Rewrote the *resolve-pr* step. It reads `context.payload.workflow_run`, prefers `workflow_run.pull_requests[0]`, and falls back to `search.issuesAndPullRequests` keyed on `head_sha` for the fork case. Both paths re-hydrate via `pulls.get` so `body` and `draft` are reliable. - Dropped the previous `listWorkflowRunsForRepo` lookup. **`PR_VALIDATION_CONCLUSION`** now reads directly from `run.conclusion`, which under `types: [completed]` is always one of `success`, `failure`, `cancelled`, `timed_out`, `neutral`, `skipped`, or `action_required`. - Added two new env vars exported by the resolver: - **`PR_VALIDATION_FAILING_CHECKS`** — JSON array of `{name, html_url, conclusion}` from `checks.listForRef(ref=pr.head.sha)` filtered to completed non-success/non-neutral/non-skipped runs. - **`PR_BODY`** — PR body hydrated server-side so the agent does not depend on the integrity-filtered MCP read of the PR. - New skip reasons in `PR_DEPENDABOT_SKIP_REASON`: `not-a-pr-run` and `pr-resolution-failed`, alongside the existing `not-dependabot` / `draft`. - Retargeted `safe-outputs`: - `submit-pull-request-review.target` → `${{ env.PR_NUMBER }}` - `add-comment.target` → `${{ env.PR_NUMBER }}` (was `triggering`, which is undefined under `workflow_run`) - `create-pull-request-review-comment.target` → `"*"` ### Persona verdict rubric > The agent now reasons over a *final* CI signal, so the rubric collapses to a clean terminal-conclusion map. - Rewrote the *Validation Signal* section in `.github/agents/dependabot-pr-reviewer.agent.md`. The persona is told the workflow runs after `PR Validation` reaches a terminal conclusion, and is explicitly forbidden from calling `checks.listForRef` or `commits/{sha}/check-runs` — it reads `PR_VALIDATION_FAILING_CHECKS` from the environment instead. - Reframed the *Surface to Check Run Map* as an informational lookup for mapping a failing check name back to its dependency surface. The persona no longer walks it via the API. - Rewrote the *Verdict Adjustment* block as an explicit terminal-conclusion map: - `success` + no static concern + no sticky high-risk trigger → `APPROVE`-eligible, citing the orchestrator conclusion plus an empty `PR_VALIDATION_FAILING_CHECKS`. - `failure | cancelled | timed_out | action_required` → `COMMENT`; body MUST quote every entry from `PR_VALIDATION_FAILING_CHECKS` (`name` plus `html_url`). - `neutral | skipped | unknown` or `PR_DEPENDABOT_SKIP_REASON == 'pr-resolution-failed'` → `COMMENT` with a `> [!CAUTION]` banner: *Deterministic CI signal unavailable (`{conclusion}`); review is advisory only.* - Preserved the sticky Isaac Sim ABI guard verbatim — a `numpy` 2.x bump still keeps the verdict at `COMMENT` and forces the `⚠️ Maintainer review recommended` banner regardless of CI conclusion. ### Workflow documentation and lock files - Rewrote the *Trigger Posture* and step-by-step prose in `aw-dependabot-pr-review.md` to describe the `workflow_run` execution model, the gh-aw compiler's auto-injected fork-PR exclusion and `repository.id` guard, and the new env-var contract. - Bumped `github/gh-aw-actions/setup` `v0.68.3` → `v0.71.1` in `.github/aw/actions-lock.json` (SHA `ba90f21…` → `239aec4…`), picked up by recompilation. - Regenerated `.github/workflows/aw-dependabot-pr-review.lock.yml` via the gh-aw compiler — diff reflects the trigger swap, the new env vars, and the setup-action SHA bump. No hand edits. ## Testing Performed - [ ] Terraform `plan` reviewed (no unexpected changes) - [ ] Terraform `apply` tested in dev environment - [ ] Training scripts tested locally with Isaac Sim - [ ] OSMO workflow submitted successfully - [ ] Smoke tests passed (`smoke_test_azure.py`) > None of the templated test surfaces apply — this PR only touches `.github/agents/` and `.github/workflows/`. Validation evidence: `npm run lint:md` and `npm run lint:yaml` pass on the changed files; the `aw-dependabot-pr-review.lock.yml` artifact is regenerated rather than hand-edited and matches the gh-aw compiler output for the new source. The behavioural change is observable on the next Dependabot PR — the advisory review will fire after `PR Validation` completes and quote the orchestrator's terminal conclusion plus any failing per-surface checks. ## Documentation Impact - [x] No documentation changes needed - [ ] Documentation updated in this PR - [ ] Documentation issue filed ## Bug Fix Checklist *Not a bug fix — this is a refactor of an agentic-workflow trigger surface.* - [ ] Linked to issue being fixed - [ ] Regression test included, OR - [ ] Justification for no regression test: ## Checklist - [x] My code follows the [project conventions](copilot-instructions.md) - [x] Commit messages follow [conventional commit format](instructions/commit-message.instructions.md) - [x] I have performed a self-review - [x] Documentation impact assessed above - [x] No new linting warnings introduced ## Related Issues Related to #579 ## Notes > The `min-integrity: approved` setting on `tools.github` is intentionally preserved. The agent's MCP PR-body read is therefore filtered, which is why the resolver hydrates `PR_BODY` from the REST API server-side — the persona consumes the env var rather than relying on the filtered MCP payload. - Lowering `min-integrity` to `unapproved` was rejected on prompt-injection grounds; the resolver-side hydration is the chosen mitigation. - `workflow_run` runs in default-branch context, which means changes to the AW workflow itself cannot be exercised by a Dependabot PR — this is the secure-by-design tradeoff documented in the GitHub Security Lab "preventing pwn requests" guide and aligns with the gh-aw `workflow_run` recommendation. ## Follow-up Tasks - Validate behaviour on a grouped Dependabot update that produces multiple `PR Validation` runs against the same head SHA — confirm that only the latest completed run drives the advisory review. - After the first live Dependabot PR runs through the new trigger, compare the posted review's CI banner against the orchestrator's final conclusion and the failing-check list to confirm the staleness regression observed in PR #608 is gone. - Confirm that `safe-outputs.submit-pull-request-review` and `add-comment` post successfully under `workflow_run` — the `target: ${{ env.PR_NUMBER }}` overrides are the [#588](#588) / [#589](#589) mitigation; a *Not in pull request context* skip in `safe_outputs` would mean the env var did not resolve. --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Bill Berry <WilliamBerryiii@users.noreply.github.com> Co-authored-by: Chris Montazer <17170709+rezatnoMsirhC@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the training-dependencies group with 76 updates in the /training/rl directory:
1.26.42.4.41.39.01.40.03.26.24.3.026.126.246.0.747.0.05.0.15.2.00.12.10.12.21.0.0b121.0.0b1312.22.012.23.06.2.67.1.12026.2.252026.4.228.3.28.3.31.5.31.5.413.0.213.2.10.102.00.106.00.0.40.0.60.135.30.136.13.28.03.29.02026.3.02026.4.03.1.463.1.492.49.22.50.03.4.03.5.023.0.025.3.01.2.31.3.02.6.03.0.03.113.138.7.19.0.01.3.111.3.123.10.83.10.91.3.01.4.113.1.0.313.4.1.113.0.8513.2.7513.0.8813.2.7813.0.9613.2.759.19.0.569.21.1.312.0.0.6112.2.0.461.15.1.61.17.1.2210.4.0.3510.4.2.5512.0.4.6612.2.0.112.6.3.312.7.10.10.8.00.9.12.28.92.30.413.0.8813.2.783.4.53.6.513.0.8513.2.750.2.00.2.10.6.20.7.01.40.01.41.10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b10.61b00.62b11.41.01.41.11.40.01.41.10.61b00.62b10.61b00.62b12.3.33.0.26.33.67.34.122.0.024.0.02.13.12.13.32.46.12.46.32025.22026.281.0.082.0.10.13.00.14.02026.12026.20.44.00.46.00.6.00.7.01.17.32.1.2Updates
numpyfrom 1.26.4 to 2.4.4Release notes
Sourced from numpy's releases.
... (truncated)
Changelog
Sourced from numpy's changelog.
... (truncated)
Commits
be93fe2Merge pull request #31090 from charris/prepare-2.4.4f5245dcREL: Prepare for the NumPy 2.4.4 release02e838bMerge pull request #31084 from charris/backport-31056fa74b2dMAINT: numpy.i: Replace deprecatedsprintfwithsnprintf(#31056)533a6dbMerge pull request #31079 from charris/backport-208019e496cbTST: fix POWER VSX feature mapping (#30801)8052c4bMerge pull request #31058 from charris/backport-310217f13b5aMAINT: Skip test on PyPy.4c5fdd6MAINT: Remove unused import of tracemalloc.a3ca5edUpdate numpy/_core/src/multiarray/shape.cUpdates
azure-corefrom 1.39.0 to 1.40.0Release notes
Sourced from azure-core's releases.
Commits
c14e6ba[Core] Prepare release (#46612)a08ffff[Core] Set kwarg explicitly in method signatures (#46633)2bdb89e[Core] Prepare release (#46631)73df99a[Core] Add + refactor query param sanitization (#46482)3db7fb5Updatecoreflask server startup (#46263)e18edb6Swap CI toCFS(#45995)bd33bafNO_CI [Doc] Update references to wiki pages (#46169)f51d146Make HttpLoggingPolicy log level configurable (#44115)20f80d9Add doc for the envs supported in azure-core (#45975)e8b2c42[Core] Make _enforce_https a module level function (#45890)Updates
marshmallowfrom 3.26.2 to 4.3.0Changelog
Sourced from marshmallow's changelog.
... (truncated)
Commits
b596fdbBump version and update changelog256f0aaAdd pre/post_load parameters to Field (#2799)c847ad4Typing improvements to marshmallow.validate (#2940)eb86322Remove redundant docs job (#2939)a44ad62Avoid infinite recursion in nesting docs (#2938)3360e34Bump version and update changelog7b9ce45Fix changelog typos and update releasing docsf07eadcFix validate.Email to accept IDNs (#2937)4acb783Fix Unreachable Warning (#2935)3492faeRemove redundant python-version (#2932)Updates
packagingfrom 26.1 to 26.2Release notes
Sourced from packaging's releases.
Changelog
Sourced from packaging's changelog.
Commits
84a87eeBump for release4a616b6docs: a few more updates to prepare for 26.2 (#1176)9de6f44ci: use native uv integration in rtd (#1175)bc76e14chore: update changelog for 26.2 (#1161)3f00091tests: add a pickle check (#1174)48a8a06fix: make Requirements/Markers pickle-safe (#1171)823b44efix: make Tags pickle-safe (#1170)4bed32dfix: make Specifier / SpecifierSet pickle-safe (#1168)963118efix: re-export ExceptionGroup for now (#1164)66e34a8docs(specifiers): add is_unsatisfiable() usage example (#1166)Updates
cryptographyfrom 46.0.7 to 47.0.0Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
59c5f5ebump for 47.0.0 release (#14730)9025578Add MLKEM1024-P384 hybrid KEM support in HPKE (#14722)ef66de4Recommend Argon2id over PBKDF2HMAC as KDF (#14724)d996a37Add ubuntu-resolute to CI workflow (#14729)e86da41chore(deps): bump libc from 0.2.185 to 0.2.186 (#14725)1c33c9aBump downstream dependencies in CI (#14728)67fb6beBump x509-limbo and/or wycheproof in CI (#14727)6cb20b3Bump BoringSSL, OpenSSL, AWS-LC in CI (#14726)d6f372dUpdate supported OpenSSL versions in installation docs (#14721)ebd2619openssl 3.3 is out of upstream support (#14720)Updates
rsl-rl-libfrom 5.0.1 to 5.2.0Release notes
Sourced from rsl-rl-lib's releases.
Commits
8068577Add clip and constant std functionalities to Gaussian Distribution (#201)64f8ee4Bump version to 5.1.01e77222Clean up PPO by moving extension logic to the extension files (#200)0234a93Add Torch compile for PPO and Distillation (#199)c7beb6fminor docs fixesUpdates
tensordictfrom 0.12.1 to 0.12.2Release notes
Sourced from tensordict's releases.
Commits
8ee33fa[Release] Bump version to 0.12.2dcb6ddd[BugFix] fix ragged_idx of consolidated tensor (#1675)85ea4e7[CI] Temporarily use vmoens/test-infra fork for macOS buildsUpdates
azure-core-tracing-opentelemetryfrom 1.0.0b12 to 1.0.0b13Release notes
Sourced from azure-core-tracing-opentelemetry's releases.
Commits
c14e6ba[Core] Prepare release (#46612)a08ffff[Core] Set kwarg explicitly in method signatures (#46633)2bdb89e[Core] Prepare release (#46631)73df99a[Core] Add + refactor query param sanitization (#46482)3db7fb5Updatecoreflask server startup (#46263)e18edb6Swap CI toCFS(#45995)bd33bafNO_CI [Doc] Update references to wiki pages (#46169)f51d146Make HttpLoggingPolicy log level configurable (#44115)20f80d9Add doc for the envs supported in azure-core (#45975)e8b2c42[Core] Make _enforce_https a module level function (#45890)Updates
azure-storage-file-datalakefrom 12.22.0 to 12.23.0Commits
b3301acSTG 100 GA Release Date for 2026-01-06beb8dfa[Storage][STG 100] Prepare branch for GA + cherry-pick block size change (#44...6c9b459Increment package version after release of azure-monitor-opentelemetry-export...b9dcce8Bump cspell from 9.3.2 to 9.4.0 in /eng/common/spelling (#44264)04be001[py sdk - TA] add 2025-11-01 to Readme (#44259)31e2155adding more agent creation traces (#44263)2f728baUseazpysdkBandit Check in CI (#44214)771fa84Fix unhelpful error when no stress packages are found (#43538)8646fbeSync eng/common directory with azure-sdk-tools for PR 13142 (#44244)874cfcf[Storage] Update Swagger and Release Date (#44243)Updates
cachetoolsfrom 6.2.6 to 7.1.1Changelog
Sourced from cachetools's changelog.
... (truncated)
Commits
2e6a2d2Release v7.1.1.cc06558Minor typing improvements.193dd62Fix #393: Improve ambiguous overloads for decorators.1ea3422Bump release date.d987446Release v7.1.0.3d79e80Update Copilot Instructions.83fe6bcAdd tox pyright check.bd3fbc4Improve typing support.09dd6feImprove original type stubs from typeshed.873c701Add typeshed typings.Updates
certififrom 2026.2.25 to 2026.4.22Commits
5dddfb02026.04.22 (#410)f99eccdBump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (#404)918bed0Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#405)0a49067Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (#403)acf6ce8Bump actions/download-artifact from 8.0.0 to 8.0.1 (#398)feb0ed2Bump actions/download-artifact from 7.0.0 to 8.0.0 (#397)d9c11a5Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#396)Updates
clickfrom 8.3.2 to 8.3.3Release notes
Sourced from click's releases.
Changelog
Sourced from click's changelog.
Commits
c06d2d0Release 8.3.3f1f191eApply format guidelines to commits since latest 8.3.2 release (#3343)...Description has been truncated