[dependabot]

Updates the requirements on transformers, trl and huggingface-hub to permit the latest version.
Updates transformers to 5.19.0

Release notes

Sourced from transformers's releases.

Release v5.19.0

New Model additions

EmbeddingGemma2

EmbeddingGemma 2 is a multimodal embedding model from Google built on the Gemma 4 architecture. It encodes text, images, audio, and video, individually or combined in one input, into a shared 768-dimensional vector space for cross-modal retrieval, semantic similarity, clustering, and classification. It uses Matryoshka Representation Learning, so embeddings can be truncated to 512, 256, or 128 dimensions. It also offers configurable visual and video token budgets, and unused vision or audio towers can be disabled at load time to save memory.

Links: Documentation

• Smthn smthn (#49364) by @​vasqu in #49364

Breaking changes

All MoE models whose routers compute logits now return them when output_router_logits=True, following the Qwen3-MoE pattern (a router_logits recorder on the base model, MoeModelOutputWithPast from the backbone, and a MoE causal LM output from the head), so code that relied on the previous outputs or their absence should read the router logits from these output classes.

• 🚨 Return router logits from every MoE model that computes them (#48920) by @​qgallouedec

Owlv2ForObjectDetection.embed_image_query now selects the query box with the highest objectness score, as in the original OWLv2 notebook, instead of the OWL-ViT heuristic, so image-guided query embeddings and detections may differ from earlier releases.

• 🚨 Select the OWLv2 image query by objectness (#49200) by @​qgallouedec

The "paged|" prefix for SDPA and flash attention implementations is deprecated, so users should set the regular attention implementation (e.g. sdpa or flash_attention_2) for continuous batching instead of paged|sdpa or paged|flash_attention_2.

• 🚨 Attention 🚨 Deprecate "paged|" prefix for SDPA and flash (#49112) by @​remi-or

The regular flash and SDPA attention functions (flash_attention.py, sdpa_attention.py) now support continuous batching directly, and "paged|..." implementations for these are redirected to them, while eager still requires the "paged|eager" prefix.

• 🚨 Attention 🚨 Make regular attention support CB (#49101) by @​remi-or

In continuous batching, the cache update for the index-based and block-table paths is now fused into a single call, which slightly changes the cache update function's behavior and affects any custom code that calls the separate update paths.

• 🚨 [CB] 🚨 Fuse update for index and block table path (#49088) by @​remi-or

Continuous batching internals changed in preparation for removing "paged": `max

• 🚨 [CB] 🚨 Little fixes before removing "paged" (#49069) by @​remi-or

Parallelization

Expert parallelism gains a token-dispatch implementation, selected via the new ep_dispatch_experts plan rule and now the default for Qwen3 MoE and Mellum, which removes the requirement that EP size equal TP size. The Trainer was also adapted to work with expert parallelism, and the docs now note that PEFT adapters support tensor parallelism. A CI-related fix for pipeline-parallel chart2table inference was also included.

• [distributed]: adapt Trainer to work Expert Parallel (#48873) by @​3outeille in #48873
• [distributed] Add expert-parallel token dispatch, default for Qwen3 MoE (#48865) by @​3outeille in #48865
• Fix pp chart2table inference (#49225) by @​zucchini-nlp in #49225
• [docs] TP for PEFT adapters (#49060) by @​stevhliu in #49060

Cache

... (truncated)

Commits

• c4c4605 v5.19.0
• 92cd495 Smthn smthn (#49364)
• a7e8ff2 Revert "[CI] Temporarily disable AMD scheduled CI trigger" (#49271) (#49362)
• 571c5cc ALM testx fIxing... (#49355)
• b4526a7 Fix DataCollatorForLanguageModeling ignoring seed=0 (#49349)
• 5a27d2d Fix explicit kernelization modes for evaluation models (#49339)
• 23c21ac fix(cohere_compass): add video to input_modalities (#49320) (#49323)
• f1d0d9f GPT-OSS: read the clamped SwiGLU's alpha and limit from the config (#49346)
• 9921402 [distributed] Default MoE ep_plans to token dispatch (#49160)
• 8625785 [distributed]: adapt Trainer to work Expert Parallel (#48873)
• Additional commits viewable in compare view

Updates trl to 1.15.0

Release notes

Sourced from trl's releases.

v1.15.0

Features

⚡ Fused LM head: up to 6.9× longer sequences on the same GPU

SFT, DPO, KTO, GRPO, RLOO and Distillation now score tokens with a fused LM head: a Triton kernel projects the hidden states through the LM head in tiles and reduces to per-token log-probs and entropy directly, so the [batch, seq, vocab] logits tensor is never built. It is on by default, there is nothing to turn on.

Max trainable sequence length (gemma-3-1b, 262k vocabulary, 79 GiB of GPU memory, bf16, batch size 1, gradient checkpointing, sdpa):

Trainer	v1.14.2	v1.15.0
DPO	10,240	59,392	5.80×
KTO (batch size 2)	9,216	63,488	6.89×
GRPO (scoring only)	28,672	114,688	4.00×
RLOO (scoring only)	23,552	100,352	4.26×
SFT (loss_type="nll")	20,480	107,520	5.25×
SFT (default chunked_nll)	107,520	107,520	1.00×

At 8,192 tokens, peak memory drops 52% to 82% and steps are 2.3% to 10.9% faster:

Trainer	Peak GiB v1.14.2 → v1.15.0	Tokens/s
DPO	48.97 → 12.00 (-75.5%)	1.035×
KTO	64.91 → 11.98 (-81.5%)	1.045×
GRPO	24.15 → 10.30 (-57.4%)	1.023×
RLOO	29.28 → 14.02 (-52.1%)	1.029×
SFT (nll)	30.33 → 8.87 (-70.7%)	1.029×

The gain is largest for small models with large vocabularies. SFT's previous default (chunked_nll) already avoided full logits, so it is unchanged. Scoring needs Triton on a GPU (Linux with CUDA, ROCm or XPU).

💥 What this changes for you. The full-logits scoring path, the use_liger_kernel chunked path and _forward_redirection are gone from GRPO, RLOO, DPO and KTO:

• A PEFT adapter on lm_head now raises. Use modules_to_save=["lm_head"] instead.
• use_liger_kernel=True is deprecated in these four trainers and will be removed in v2.0.0. Liger's layer kernels still apply, but fused_linear_cross_entropy is forced to False (it would replace the fused head) and setting it explicitly raises. Use model_init_kwargs={"use_kernels": True}.
• In DPO and KTO, compute_metrics and compute_loss(..., return_outputs=True) still receive the full logits, from an extra forward pass taken only when they are used. Both warn that this is deprecated and will be removed in v2.0.0.

Nothing else the trainers logged is lost: the kernel gained log_sum_sq_probs (WPO weighting), mean_logits (logits/chosen, logits/rejected) and is_top1 (DPO's mean_token_accuracy) as opt-in outputs, each checked against the full logits in tests.

1× B300 with the PyTorch allocator capped at 79 GiB (about an H100 80GB's usable memory), google/gemma-3-1b-pt built from its config with random bf16 weights, lr 1e-6, AdamW, synthetic token ids at exact length. Max length: one fresh process per attempt, 2 training steps, doubling from 8k then bisection to 1024 tokens, arms interleaved round-robin in the same job. Throughput: 12 steps, first 2 discarded, median of 3 A/B/A/B repeats in the same job. Noise floor (A vs A) is 0.1% to 0.8%, below every gap reported. GRPO/RLOO replace generation with fixed random completions, so only scoring is measured.

Not measured: H100 hardware itself, flash-attention (sdpa only), real generation, multi-GPU.

• Compute the chunked log-probabilities with a Triton kernel by @​qgallouedec in huggingface/trl#7386

... (truncated)

Commits

• dae7b6a Release: v1.15 (#7594)
• 69518b3 Update "What's New" for the fused LM head (#7593)
• 2a72cca Declare gradient accumulation loss scaling with loss_is_scaled_for_ga (#7508)
• ebf09f6 Drop the deprecated use_liger_kernel from the docs (#7535)
• b5c51de Compute the distillation divergence with a Triton kernel (#7465)
• 77b9010 Run the async GRPO rollout loop tests on the real tokenizer and response pars...
• a57bc7f Build the async rollout loops in tests through init (#7555)
• 727a61d Keep SFT's MoE aux loss independent of world size and gradient accumulation (...
• 7552d05 Build real configs instead of SimpleNamespace in the GOLD and GKD tests (#7564)
• 179e1b3 Make SDFT importable without peft and align SSD (#7562)
• Additional commits viewable in compare view

Updates huggingface-hub to 2.2.0

Release notes

Sourced from huggingface-hub's releases.

[v2.2.0] hf jobs stats snapshots, download and HfFileSystem fixes

A small release this week, mostly bug fixes and quality-of-life improvements. hf jobs stats now returns right away instead of streaming forever, concurrent downloads reliably use hf_xet, and HfFileSystem caching is more predictable. Two behavior changes are listed under Breaking changes.

📊 hf jobs stats prints a snapshot by default

hf jobs stats used to stream metrics until the job finished, so scripts and agents calling it on a running job hung until their own timeout. It now prints the latest sample of each job once and exits, like hf jobs logs and hf spaces logs. Use -f/--follow for the previous live view. Snapshot output also supports --format json|agent|quiet, which outputs the raw API metrics.

On the Python side, HfApi.fetch_job_metrics gets the same follow parameter as fetch_job_logs. It defaults to False and returns only the current sample. Pass follow=True to stream until the job completes.

>>> hf jobs stats 6ac3bd9afbc85ba6823a9ad4
JOB ID                CPU % NUM CPU MEM % MEM USAGE      NET I/O         GPU UTIL % GPU MEM % GPU MEM USAGE
--------------------- ----- ------- ----- -------------- --------------- ---------- --------- -------------
6ac3bd9afbc85ba682... 0%    2.0     0.01% 1.0MB / 16.0GB 0.0bps / 0.0bps N/A        N/A       N/A
Hint: Use `hf jobs stats -f celinah/6ac3bd9afbc85ba6823a9ad4` to follow live stats.
Stream live stats until the job completes
>>> hf jobs stats -f 6ac3bd9afbc85ba6823a9ad4

>>> from huggingface_hub import fetch_job_metrics
>>> for metrics in fetch_job_metrics(job_id=job.id, follow=True):
...     print(metrics)

Other Jobs fixes in this release: hf jobs logs and hf spaces logs without -f no longer hang while the job keeps printing, hf jobs stats no longer fails when one of the requested jobs has finished, and hf jobs stats --json prints [] when no job is running.

• [CLI] Snapshot by default in hf jobs stats, add -f/--follow by @​hanouticelina in #5090
• [CLI] Fix empty hf jobs stats --json output with no running jobs by @​hanouticelina in #5094
• [Jobs] Fix no-follow logs hanging while the job keeps printing by @​hanouticelina in #5092
• [Jobs] Ignore 406 from metrics endpoint for finished jobs by @​hanouticelina in #5091

📚 Documentation: Jobs guide

⚡ Concurrent downloads always use hf_xet

In a fresh process, the first concurrent hf_hub_download calls could read a placeholder version for hf_xet while another thread was still looking it up. Those calls treated hf_xet as missing and downloaded through the plain HTTP path. This mostly affected parallel downloads such as snapshot_download, where some of the files skipped Xet. The version lookup is now cached only once it is resolved, so every download sees the real value.

• Fix race in _get_version that makes concurrent downloads skip hf_xet by @​BramVanroy in #5102

📂 HfFileSystem cache fixes

Three fixes to how HfFileSystem caches listings and missing paths:

• ls() on a newly created empty bucket returns an empty list instead of raising FileNotFoundError.
• Directory listings are now replaced in the cache instead of appended to. Before, ls() after find() or ls(refresh=True) could return duplicate entries, refresh=True kept deleted files, and listing a single bucket file cached it as the whole folder's listing.
• exists(path, refresh=True) and invalidate_cache(path) now clear cached "not found" results. Before, a repo, branch or bucket created in the same process stayed missing until a full invalidate_cache().

</tr></table> 

... (truncated)

Commits

• acfdf30 Release: v2.2.0
• 193d9d9 Release: v2.2.0.rc0
• 5be3565 [Cache] Speed up delete_revisions with a set lookup (#5118)
• dab6a96 [CLI] Don't glob-expand arguments on Windows (#5117)
• cca4d3a [Download] Fix offline snapshot_download with a pinned revision (#5113)
• c6cc03e Fix argument name in raise_text_generation_error docstring (#5108)
• 8abbfe5 Fix race in _get_version that makes concurrent downloads skip hf_xet (#5102)
• bb3a875 [Docs] Fix from_pretrained integration example (#5105)
• cf992a9 [HfFileSystem] Make refresh=True clear cached not-found results (#5106)
• af74167 [Tests] Wait for bucket listings after writes (#5095)
• Additional commits viewable in compare view

Updates the requirements on mlflow to permit the latest version.
Updates mlflow to 3.17.0

Release notes

Sourced from mlflow's releases.

MLflow 3.17.0 includes several major features and improvements.

Major New Features

• Jev Decisions Across Evaluation, Gateway, and Tracing: Use TypeSafe models in built-in scorers and custom judges with typed Boolean or categorical feedback. (#26100, @​B-Step62)
• Fine-Grained Permissions for Shared Resources: Control access to contained resource types, including runs, traces, and versions, with wildcard grants and explicit DENY. (#26157, @​rrrkharse)
• Faster Analytics for Large Trace Datasets: Reduce SQL analytics query overhead with opt-in daily summaries and raw-query fallback. (#25991, @​HumairAK)
• Clearer Evaluation Results: Associate aggregate logged-model evaluation metrics with the managed dataset that produced them. (#25927, @​joshuawong-db)
• Assistant Improvements for Shared Servers: Keep saved conversations scoped to the signed-in user and reset the active session when accounts change. (#26009, @​kriscon-db)

Database upgrade: SQL-backed servers require a coordinated schema upgrade with all writers stopped and a restorable backup, even when daily rollups remain disabled. Run mlflow db upgrade <database-url> before restarting all replicas on the new MLflow version. Mixed-version rolling upgrades are not supported. Follow the database upgrade instructions.

Other Assorted Features & Improvements:

• [Tracing / UI] Add rich rendering for TypeSafe System One traces (#26276, @​B-Step62)
• [Build] Show issue-triage progress in a GitHub issue comment (#26454, @​copilot-swe-agent)
• [Docs / Evaluation] Allow custom base_url for direct TypeSafe judges (#26445, @​B-Step62)
• [Docs / Gateway] Allow custom typesafe_api_base for TypeSafe Gateway endpoints (#26442, @​B-Step62)
• [Evaluation / Tracking] Support name IN (...) filters for evaluation-dataset search (#26374, @​HumairAK)
• [Docs / Evaluation / Gateway / UI] Support TypeSafe and OpenRouter Jev judges through Gateway System One (#26243, @​joshuawong-db)
• [Build / Docs / Tracing / Tracking] Add @mlflow/typesafe tracing integration for TypeSafe AI (#26342, @​B-Step62)
• [Build / Docs] Publish Helm charts after stable release images (#26064, @​joshuawong-db)
• [Tracing / UI] Add TraceImage to custom trace views (#26297, @​chris-chieu)
• [Tracing] Simplify tracing setup defaults in setup.sh (#26341, @​B-Step62)
• [Build / Docs / Tracing / Tracking] Add TypeSafe SDK autologging support (#26129, @​B-Step62)
• [Tracing / Tracking] Expose OTLP ingestion metrics for Prometheus (#25192, @​ashtarkb)
• [Tracing] Compute LLM trace costs client-side for SageMaker tracking (#26178, @​B-Step62)
• [Model Registry / Models] Add uc_model_service UC model-version dependency support (#26140, @​TomeHirata)
• [Models] Add DatabricksUCModelService resource type (#26137, @​TomeHirata)
• [Docs / Tracing / Tracking] Maintain SQL trace analytics daily rollups (#25489, @​NeriCarcasci)
• [Docs / Tracing / Tracking] Serve trace analytics reads from opt-in SQL daily rollups (#25239, @​NeriCarcasci)
• [Gateway / UI] Add TypeSafe Jev support to the AI Gateway (#26048, @​xq-yin)
• [Tracking] Support order_by in search_prompts() across the client, fluent, and GenAI APIs (#25967, @​avanish-garg)
• [Docs / Gateway] Add OpenAI-compatible model discovery to the MLflow Gateway (#25940, @​RussellLuo)
• [Gateway] Add Anthropic Messages passthrough to AmazonBedrockProvider (#25863, @​rhamzatov)
• [Tracking] Support logged model artifacts in the createPresignedUploadUrl endpoint (#24765, @​henishborad)
• [Tracking] Add mlflow.restore_experiment() and mlflow.restore_run() to the fluent API (#25852, @​avanish-garg)
• [Build] Configure topology spread constraints in the Helm chart (#25778, @​daanknoope)
• [Docs / Tracing] Add source metadata to TypeScript agent traces (#25825, @​B-Step62)
• [Model Registry / UI] Add a source logged model link to the model version page (#25727, @​rrioh)
• [Build / Docs] charts: Expose Helm liveness/readiness/startup probes as configuration variables (#25560, @​creater29)
• [Gateway / UI] Allow administrators to disable AI Gateway with MLFLOW_ENABLE_AI_GATEWAY (#25236, @​DaoDaoNoCode)
• [UI] Add dataset ID to UI (#25234, @​janald99)
• [Tracing] Add first-class span description support to @mlflow.trace and mlflow.start_span (#25548, @​Rohitkanithi)

Bug fixes:

• [Evaluation] Use the baseline's magnitude in min_relative_change checks (#26252, @​mavericksea-ai)
• [UI] Support wrapped MCP registry server definitions (#25764, @​mprahl)
• [Tracing / Tracking] Fix decimal metric sums and reduce SQL trace query and rollup overhead (#26369, @​HumairAK)

... (truncated)

Changelog

Sourced from mlflow's changelog.

3.17.0 (2026-10-06)

MLflow 3.17.0 includes several major features and improvements.

Major New Features

• Jev Decisions Across Evaluation, Gateway, and Tracing: Use TypeSafe models in built-in scorers and custom judges with typed Boolean or categorical feedback. (#26100, @​B-Step62)
• Fine-Grained Permissions for Shared Resources: Control access to contained resource types, including runs, traces, and versions, with wildcard grants and explicit DENY. (#26157, @​rrrkharse)
• Faster Analytics for Large Trace Datasets: Reduce SQL analytics query overhead with opt-in daily summaries and raw-query fallback. (#25991, @​HumairAK)
• Clearer Evaluation Results: Associate aggregate logged-model evaluation metrics with the managed dataset that produced them. (#25927, @​joshuawong-db)
• Assistant Improvements for Shared Servers: Keep saved conversations scoped to the signed-in user and reset the active session when accounts change. (#26009, @​kriscon-db)

Database upgrade: SQL-backed servers require a coordinated schema upgrade with all writers stopped and a restorable backup, even when daily rollups remain disabled. Run mlflow db upgrade <database-url> before restarting all replicas on the new MLflow version. Mixed-version rolling upgrades are not supported. Follow the database upgrade instructions.

Other Assorted Features & Improvements:

• [Tracing / UI] Add rich rendering for TypeSafe System One traces (#26276, @​B-Step62)
• [Build] Show issue-triage progress in a GitHub issue comment (#26454, @​copilot-swe-agent)
• [Docs / Evaluation] Allow custom base_url for direct TypeSafe judges (#26445, @​B-Step62)
• [Docs / Gateway] Allow custom typesafe_api_base for TypeSafe Gateway endpoints (#26442, @​B-Step62)
• [Evaluation / Tracking] Support name IN (...) filters for evaluation-dataset search (#26374, @​HumairAK)
• [Docs / Evaluation / Gateway / UI] Support TypeSafe and OpenRouter Jev judges through Gateway System One (#26243, @​joshuawong-db)
• [Build / Docs / Tracing / Tracking] Add @mlflow/typesafe tracing integration for TypeSafe AI (#26342, @​B-Step62)
• [Build / Docs] Publish Helm charts after stable release images (#26064, @​joshuawong-db)
• [Tracing / UI] Add TraceImage to custom trace views (#26297, @​chris-chieu)
• [Tracing] Simplify tracing setup defaults in setup.sh (#26341, @​B-Step62)
• [Build / Docs / Tracing / Tracking] Add TypeSafe SDK autologging support (#26129, @​B-Step62)
• [Tracing / Tracking] Expose OTLP ingestion metrics for Prometheus (#25192, @​ashtarkb)
• [Tracing] Compute LLM trace costs client-side for SageMaker tracking (#26178, @​B-Step62)
• [Model Registry / Models] Add uc_model_service UC model-version dependency support (#26140, @​TomeHirata)
• [Models] Add DatabricksUCModelService resource type (#26137, @​TomeHirata)
• [Docs / Tracing / Tracking] Maintain SQL trace analytics daily rollups (#25489, @​NeriCarcasci)
• [Docs / Tracing / Tracking] Serve trace analytics reads from opt-in SQL daily rollups (#25239, @​NeriCarcasci)
• [Gateway / UI] Add TypeSafe Jev support to the AI Gateway (#26048, @​xq-yin)
• [Tracking] Support order_by in search_prompts() across the client, fluent, and GenAI APIs (#25967, @​avanish-garg)
• [Docs / Gateway] Add OpenAI-compatible model discovery to the MLflow Gateway (#25940, @​RussellLuo)
• [Gateway] Add Anthropic Messages passthrough to AmazonBedrockProvider (#25863, @​rhamzatov)
• [Tracking] Support logged model artifacts in the createPresignedUploadUrl endpoint (#24765, @​henishborad)
• [Tracking] Add mlflow.restore_experiment() and mlflow.restore_run() to the fluent API (#25852, @​avanish-garg)
• [Build] Configure topology spread constraints in the Helm chart (#25778, @​daanknoope)
• [Docs / Tracing] Add source metadata to TypeScript agent traces (#25825, @​B-Step62)
• [Model Registry / UI] Add a source logged model link to the model version page (#25727, @​rrioh)
• [Build / Docs] charts: Expose Helm liveness/readiness/startup probes as configuration variables (#25560, @​creater29)
• [Gateway / UI] Allow administrators to disable AI Gateway with MLFLOW_ENABLE_AI_GATEWAY (#25236, @​DaoDaoNoCode)
• [UI] Add dataset ID to UI (#25234, @​janald99)
• [Tracing] Add first-class span description support to @mlflow.trace and mlflow.start_span (#25548, @​Rohitkanithi)

Bug fixes:

• [Evaluation] Use the baseline's magnitude in min_relative_change checks (#26252, @​mavericksea-ai)

... (truncated)

Commits

• 6dd94c6 Bump version to 3.17.0 (#26464)
• 83764b3 Update ML package versions for 3.17.0 (#26458)
• 40cea47 Replace triage’s nginx gateway proxy with an in-memory Node proxy (#26457)
• b56ead6 Include skills submodule in wheel builds (#26456)
• edaaf64 Use the baseline's magnitude in min_relative_change checks (#26252)
• ab118da Update bundled mlflow/assistant/skills to latest upstream (#26455)
• da15884 Add rich rendering for TypeSafe System One traces (#26276)
• 69c5b42 Show triage progress in an issue comment (#26454)
• f0b891d Update model catalog from upstream sources (#26453)
• 297144c Allow custom base_url for direct TypeSafe judges (#26445)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions