Build(deps): Bump the python group across 1 directory with 6 updates

[dependabot]

Updates the requirements on torch, trl, transformers, datasets, setuptools and setuptools-scm to permit the latest version.
Updates torch to 2.13.0

Release notes

Sourced from torch's releases.

PyTorch 2.13.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Tracked Regressions

ROCm wheels break torch.compile on CPU in environments without a GPU

Running a torch==2.13.0+rocm7.2 wheel in an environment where no GPU is available (torch.cuda.is_available() is False) breaks torch.compile on the CPU path: the first compile raises RuntimeError: Can't detect vectorized ISA for CPU (#189194). This is a regression from torch==2.12.1+rocm7.2, which compiles CPU code fine (detecting e.g. VecAVX2) in the same setup. The 2.13 ROCm wheel appears to rely on something present in the ROCm builder image to detect the CPU vectorized ISA, so it works when run on a ROCm image but fails on a plain CPU-only image.

Workaround: run the +rocm wheel on a ROCm image, or install a standard CPU/CUDA build for GPU-less environments.

Backwards Incompatible Changes

• Stop building CPython 3.13t (free-threaded) binaries (#182951)

  Upstream pypa/manylinux removed CPython 3.13t (free-threaded) on 2026-05-07, because 3.13t was experimental and has been superseded by the now-non-experimental CPython 3.14t. As a result, PyTorch 2.13 no longer ships cp313t wheels (Linux, Triton, and related artifacts). Users on the free-threaded interpreter should move to Python 3.14t.

  PyTorch 2.12:

  # cp313t (free-threaded 3.13) wheels were available
  python3.13t -m pip install torch

  PyTorch 2.13:

... (truncated)

Changelog

Sourced from torch's changelog.

Releasing PyTorch

• Release Compatibility Matrix
  • PyTorch CUDA Support Matrix
• Release Cadence
• General Overview
  • Frequently Asked Questions
• Cutting a release branch preparations
• Cutting release branches
  • pytorch/pytorch
  • PyTorch ecosystem libraries
  • Making release branch specific changes for PyTorch
  • Making release branch specific changes for ecosystem libraries
• Running Launch Execution team Core XFN sync
• Drafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries
  • Release Candidate Storage
  • Release Candidate health validation
  • Cherry Picking Fixes
    • How to do Cherry Picking
  • Cherry Picking Reverts
• Preparing and Creating Final Release Candidate
• Promoting RCs to Stable
• Additional Steps to prepare for release day
  • Modify release matrix
  • Open Google Colab issue
• Patch Releases
  • Patch Release Criteria
  • Patch Release Process
    • Patch Release Process Description
    • Triage
    • Issue Tracker for Patch releases
    • Building a release schedule / cherry picking
    • Building Binaries / Promotion to Stable
• Hardware / Software Support in Binary Build Matrix
  • Python
  • Accelerator Software
    • Special support cases
  • Operating Systems
• Submitting Tutorials
• Special Topics
  • Updating submodules for a release
  • Triton dependency for the release

Release Compatibility Matrix

Following is the Release Compatibility Matrix for PyTorch releases:

... (truncated)

Commits

• cf30153 [release/2.13] Strip +PTX from CUDA arch list on release/RC builds (#188914) ...
• 3e3e24b [release/2.13] Restrict cuda-bindings to Python < 3.15 for CUDA 12.9 builds (...
• 7986b06 [release/2.13] Bump binary build timeout 280 -> 400 minutes (#188551)
• 0bdbc26 [release/2.13] Add CUDA 12.9 to TORCH_CUDA_ARCH_LIST tables (#188443)
• 9cabb45 [release/2.13] Update manywheel docker image pin to 78e737ad (#188409)
• 78e737a [release/2.13] Revert "Tighten generalized scatter graph target (#184075)" (#...
• 0bb9b5b [release/2.13] Revert "dynamo: round-trip torch.cuda.stream ctx mgr across gr...
• aaac2bf [release/2.13] Revert "[Reland] Port D104346887/PR 182675 for index_add fast ...
• 9330813 Fix build_with_debinfo.py broken by CONFIGURE_DEPENDS globbing (#188192)
• 4e077a7 Remove setuptools upper bound (#188190)
• Additional commits viewable in compare view

Updates trl to 1.9.0

Release notes

Sourced from trl's releases.

v1.9.0

Features

Iterable / streaming datasets in GRPO and RLOO

Long-standing request finally landed. GRPO and RLOO rely on RepeatSampler to repeat each prompt num_generations times and group them across processes — but samplers can't attach to iterable datasets (no length, no indexing), and the old behavior silently bypassed the sampler, quietly corrupting advantage computation.

A new repeat_iterable_dataset generator reproduces RepeatSampler's exact ordering by transforming the stream itself instead of reordering indices. Trainers wrap iterable datasets via IterableDataset.from_generator, force dispatch_batches=False, and shard the stream per-process to preserve prompt groups after cross-process gathering.

from datasets import load_dataset
from trl import GRPOConfig, GRPOTrainer
dataset = load_dataset("trl-lib/DeepMath-103K", split="train", streaming=True)
trainer = GRPOTrainer(
model="Qwen/Qwen3-4B",
args=GRPOConfig(max_steps=1000),  # required for iterable datasets
train_dataset=dataset,
reward_funcs=accuracy_reward,
)

max_steps is required for iterable datasets (no length). A clear error also fires if dispatch_batches=True is combined with an iterable dataset.

by @​albertvillanova in huggingface/trl#6351

Environment-owned datasets

When an environment_factory is provided, the environment can now own the data. train_dataset becomes optional: reset() returns the prompt. No more fabricating a dummy dataset just to drive the loop.

class WordleEnv:
    def reset(self, **kwargs) -> str:      # returns the prompt
        self._target = sample(words)
        return f"Guess a {len(self._target)}-letter word."
    def get_reward(self) -> float:
        return 1.0 if self._solved else 0.0
    def guess(self, word: str) -> str:     # exposed tool
        self._solved = word == self._target
        return _feedback(word, self._target)
trainer = GRPOTrainer(
model="Qwen/Qwen3-4B",
args=GRPOConfig(max_steps=1000),
environment_factory=WordleEnv,          # no train_dataset needed
)

Applies to both GRPOTrainer and AsyncGRPOTrainer. A provided train_dataset still works exactly as before; multi-environment routing datasets can now be environment-only (no prompt column required).

... (truncated)

Commits

• 35def3e Release: v1.9 (#6495)
• 1f44f15 [DistillationTrainer refactor] Fix num_items_in_batch to count generated co...
• 56d93a0 [DistillationTrainer refactor] Deprecate messages-format datasets (#6474)
• 860f1b6 [DistillationTrainer refactor] Accept a prompt column alongside messages ...
• d08f613 Filter triton AnnAssign DeprecationWarning on Python 3.14 (#6467)
• c4a97ee Filter reworded torch.jit.script_method warning on Python 3.14 (#6465)
• 3151ed3 Fix misleading name of BEMACallback bias_power=0.0 test (#6464)
• edbce2b Silence PEFT ensure_weight_tying warning in DPO and KTO liger tests (#6463)
• d2b72b7 Raise when DPO/KTO cannot precompute correct reference log-probs at eval time...
• d9294d1 [DistillationTrainer refactor] Remove lmbda and the off-policy training bra...
• Additional commits viewable in compare view

Updates transformers to 5.14.1

Release notes

Sourced from transformers's releases.

Patch release: v5.14.1

Patch release v5.14.1

This patch solves a few issues which appeared when integrating Inkling model, most notably an issue affecting models using EncoderDecoderCache during assisted generation. It also fixes an issue that could appear during prefill with StaticCache and sdpa without padding for Inkling which uses a position_bias. It contains the following commits:

• Fix sdpa prefill with position_bias (#47359) by @​Cyrilvallez
• Fix assisted decoding for models with EncoderDecoder cache & OlmoHybrid (#47361) by @​Cyrilvallez
• [FP8] Bump kernels version (#47344) by @​vasqu
• Fix deepgemm on multiple devices (#47323) by @​IlyasMoutawwakil

Commits

• a08ace4 Release: v4.14.1
• 1ccf4f1 Fix deepgemm on multiple devices (#47323)
• c98cc10 [FP8] Bump kernels version (#47344)
• e035e45 Fix assisted decoding for models with EncoderDecoder cache & OlmoHybrid (#47361)
• 0eb5e03 Fix sdpa prefill with position_bias (#47359)
• 2fa8c19 v5.14.0
• 6c9318e fix feature extraction
• 8f23330 Small improvement (#47348)
• 76613e6 Add Inkling model (#47347)
• f5a67a4 🚨 Pass tp_plan from lm_heads (#47253)
• Additional commits viewable in compare view

Updates datasets to 5.0.0

Release notes

Sourced from datasets's releases.

5.0.0

Datasets Features

Agent traces

• Parse Agent traces messages for SFT using teich by @​lhoestq in huggingface/datasets#8232

  • Agent traces from claude_code/pi/codex and others can now be loaded with load_dataset
  • Using the teich library (new optional dependency), traces are parsed to messages to enable training on traces using e.g. trl
  • Load the data:

  >>> from datasets import load_dataset
  >>> ds = load_dataset("lhoestq/agent-traces-example", split="train")
  >>> ds[0]["messages"]
  [{'role': 'user', 'content': 'Download a random dataset from Hugging Face, use DuckDB to inspect it, and come back with a short report about it. Be concise and include: dataset name, what files/format you found, row count or rough size if you can determine it,...'
   ...]

  • Train on agent traces:

  trl sft --dataset-name lhoestq/agent-traces-example ...

  • find all the Agent traces datasets on HF here: https://huggingface.co/datasets?format=format:agent-traces&sort=trending

Next-level shuffling in streaming mode

• Use multiple input shards for shuffle buffer by @​lhoestq in huggingface/datasets#8194

  ds = load_dataset(..., streaming=True)
  ds = ds.shuffle(seed=42)
  # or configure local buffer shuffling manually, default is:
  ds = ds.shuffle(seed=42, buffer_size=1000, max_buffer_input_shards=10)

  before👎:

  after✨:

  toy example comparison

  from datasets import IterableDataset
  ds = IterableDataset.from_dict({"i": range(123_456_789)}, num_shards=1024)
  ds = ds.shuffle(seed=42)
  print("Cold start ids:")

... (truncated)

Commits

• 68ac1a9 Release: 5.0.0 (#8239)
• cfe4492 Support composed splits in streaming datasets (#8220)
• fd67320 Keep None as a real null in Json() columns instead of the string "null" (#8231)
• 10cdc81 Fix iterable skip over full Arrow blocks (#8236)
• b7c064d Parse agent traces messages for SFT using teich (#8232)
• 31e92f1 fix: embed_external_files=True for mesh support (#8224)
• d168d5f feat: add TsFile (Apache IoTDB) packaged builder with per-device wide format ...
• 992f3cf fix(map): fix progress bar exceeding total when load_from_cache_file=False (#...
• 8474a91 Fix single lance file form pylance 7.0 (#8225)
• d4284e9 feat: add 3D mesh support and MeshFolder builder (#8055)
• Additional commits viewable in compare view

Updates setuptools from 80.9.0 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates setuptools-scm from 9.2.0 to 10.2.1

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.2.1

Fixed

• Omit scm_version.json and scm_file_list.json from wheel .dist-info while still including them in sdists for fallback discovery. (#1473)

setuptools-scm v10.2.0

Added

• Restore Python 3.8 and 3.9 support, re-enabling use as a build dependency for projects like scikit-build that still support these versions. (#1445)

Miscellaneous

• Move PKG-INFO discovery tests from vcs-versioning to setuptools-scm where the entry points are registered. (#1446)

setuptools-scm v10.1.2

Fixed

• Fix DeprecationWarning leak by threading VcsEnvironment through VersionInferenceConfig and using env.make_reader() in _should_write_to_source. (#1424)

setuptools-scm v10.1.1

Fixed

• Update CI to use PyPy 3.11 as cryptography has no PyPy 3.10 build available (#1421)

setuptools-scm v10.1.0

Added

• Add backward-compatible shims in setuptools_scm.git, setuptools_scm.hg, setuptools_scm.hg_git, and setuptools_scm.scm_workdir so that external code calling get_scm_version(config) or run_describe(config) with an explicit Configuration continues to work. The shim automatically wires _config and VcsEnvironment onto the workdir. (#compat-shims)
• Write scm_version.json and scm_file_list.json into egg-info directories during egg_info, enabling sdist fallback version inference when no VCS is present. Add ScmEggInfoMixin for workdir-based file finding in find_sources(). (#egg-info-metadata)
• Add write_to_source pyproject.toml option to control whether version files are written to the source tree. When unset, a deprecation warning advises setting it explicitly before the default changes in a future major release. The SETUPTOOLS_SCM_WRITE_TO_SOURCE environment variable overrides this setting. (#1301)
• Adopt the workdir-centric pipeline from vcs-versioning: version discovery now follows an explicit env → config → workdir → version chain instead of relying on ambient globals and parse entry points. The egg_info command writes scm_version.json and scm_file_list.json metadata so sdists can infer versions without a VCS checkout. Requires vcs-versioning >= 2.0.0.dev0. (#1378)

Fixed

• Fix worktree file listing test to expect relative paths from the file finder. The test now passes on Linux; Windows remains xfail due to a subprocess limitation with worktree directories. (#620)
• Remove the _warn_on_old_setuptools() check that incorrectly warned when a custom build-backend caused setuptools.__version__ to return the project version instead of setuptools' version. The minimum setuptools version is now enforced via build-system requirements. (#1192)
• Wrap version in setuptools.sic() when normalize = false to prevent setuptools from re-normalizing the version after our hook returns. This preserves CalVer zero-padding (e.g. 2024.01.05) and other non-canonical version strings in dist.metadata.version. (#1354)
• Skip writing non-package version files to build_lib, fixing incorrect inclusion of root-level version files in wheels. (#1364)

Documentation

• Rewrite the GitHub Actions CI/CD example to use a dedicated build job (via build-and-inspect-python-package) and OIDC Trusted Publishers instead of building in publishing jobs with long-lived API tokens. (#1215)

setuptools-scm v10.0.5

... (truncated)

Commits

• ac108b2 Merge pull request #1475 from pypa/release/main
• b3beed6 Prepare release: setuptools-scm v10.2.1
• ec67f8c Merge pull request #1474 from RonnyPfannschmidt/fix/1473-omit-scm-metadata-fr...
• 08f22bd fix: lazy-import bdist_wheel and simplify unlink
• 82768f0 fix: omit SCM egg-info JSON from wheels
• 5b91e2f Merge pull request #1460 from pypa/dependabot/uv/uv-f4f52c089d
• 4ac1724 Merge pull request #1463 from pypa/release/main
• 474cc9c Prepare release: vcs-versioning v2.2.2
• 29c8f6c Merge pull request #1462 from RonnyPfannschmidt/fix/vcs-versioning-pytest-tim...
• 25d32ee fix: add missing pytest-timeout to vcs-versioning test dependencies (#1461)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1d7eda2a7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep the build backend compatible with Python 3.9

For Python 3.9 source/editable installs, this exact build requirement now asks pip to install setuptools==83.0.0, but setuptools 83 requires Python 3.10+, while this project still advertises requires-python = ">=3.9,<3.15". That makes pip install from sdist/Git fail before the package metadata can be built for any Python 3.9 user; either keep setuptools below 83 for the build env or drop Python 3.9 support in the project metadata.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Update the core TRL constraint too

The default dependency now permits TRL 1.8, but the core extra still has trl>=0.18.2,!=0.19.0,<=0.24.0, and huggingface/base/intelgpu all pull that extra transitively. In contexts that install .[core] (including this repo's CI setup), pip has to satisfy both constraints and will stay capped at 0.24.0, so the new TRL range is not actually exercised for those install modes; update or de-duplicate the extra constraint along with this line.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Exclude the broken datasets 4.4/4.5 releases

This widened range re-admits datasets==4.4.0 through 4.5.0, but the repo already has a drift test documenting that this exact range triggers _thread.RLock_recursion_count failures in the Arrow loader and should be avoided. Any user with an environment constraint that resolves to 4.4.x or 4.5.0 can now install an unsupported datasets version, so preserve the exclusion when widening the upper bound.

Useful? React with 👍 / 👎.