Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the pytorch group across 1 directory with 12 updates #342

Closed
wants to merge 2 commits into from
Closed

Bump the pytorch group across 1 directory with 12 updates #342

wants to merge 2 commits into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 27, 2024 •
edited
Loading

Bumps the pytorch group with 12 updates in the /pytorch directory:

Package From To
onnxruntime-extensions 0.11.0 0.12.0
onnxruntime 1.18.1 1.19.0
tokenizers 0.19.1 0.20.0
transformers 4.44.0 4.44.2
torchvision 0.16.0.post3+cxx11.abi 0.19.0+cpu
torchaudio 2.1.0.post3+cxx11.abi 2.4.0+cpu
intel-extension-for-pytorch 2.1.40+xpu 2.4.0+cpu
oneccl-bind-pt 2.1.400+xpu 2.4.0+cpu
setuptools 69.5.1 73.0.1
numpy 1.26.4 2.1.0
jupyterlab 4.3.0b0 4.3.0b1
torchtext 0.18.0 0.18.0+cpu

Updates onnxruntime-extensions from 0.11.0 to 0.12.0

Commits

Updates onnxruntime from 1.18.1 to 1.19.0

Release notes

Sourced from onnxruntime's releases.

ONNX Runtime v1.19

Announcements

  • Training (pypi) packages are delayed from package manager release due to some publishing errors. Feel free to contact @​maanavd if you need release candidates for some workflows ASAP. In the meantime, binaries are attached to this post. This message will be deleted once this ceases to be the case. Thanks for your understanding :)
  • Second note that the wrong commit was initially tagged with v1.19.0. The final commit has since been correctly tagged: microsoft/onnxruntime@26250ae. This shouldn't effect much, but sorry for the inconvenience!

Build System & Packages

  • Numpy support for 2.x has been added
  • Qualcomm SDK has been upgraded to 2.25
  • ONNX has been upgraded from 1.16 → 1.16.1
  • Default GPU packages use CUDA 12.x and Cudnn 9.x (previously CUDA 11.x/CuDNN 8.x) CUDA 11.x/CuDNN 8.x packages are moved to the aiinfra VS feed.
  • TensorRT 10.2 support added
  • Introduced Java CUDA 12 packages on Maven.
  • Discontinued support for Xamarin. (Xamarin reached EOL on May 1, 2024)
  • Discontinued support for macOS 11 and increasing the minimum supported macOS version to 12. (macOS 11 reached EOL in September 2023)
  • Discontinued support for iOS 12 and increasing the minimum supported iOS version to 13.

Core

Performance

  • Added QDQ support for INT4 quantization in CPU and CUDA Execution Providers
  • Implemented FlashAttention on CPU to improve performance for GenAI prompt cases
  • Improved INT4 performance on CPU (X64, ARM64) and NVIDIA GPUs

Execution Providers

  • TensorRT

    • Updated to support TensorRT 10.2
    • Remove calls to deprecated api’s
    • Enable refittable embedded engine when ONNX model provided as byte stream

  • CUDA

    • Upgraded cutlass to 3.5.0 for performance improvement of memory efficient attention.
    • Updated MultiHeadAttention and Attention operators to be thread-safe.
    • Added sdpa_kernel provider option to choose kernel for Scaled Dot-Product Attention.
    • Expanded op support - Tile (bf16)

  • CPU

    • Expanded op support - GroupQueryAttention, SparseAttention (for Phi-3 small)

  • QNN

    • Updated to support QNN SDK 2.25
    • Expanded op support - HardSigmoid, ConvTranspose 3d, Clip (int32 data), Matmul (int4 weights), Conv (int4 weights), prelu (fp16)
    • Expanded fusion support – Conv + Clip/Relu fusion

  • OpenVINO

    • Added support for OpenVINO 2024.3
    • Support for enabling EpContext using session options

  • DirectML

... (truncated)

Commits

Updates tokenizers from 0.19.1 to 0.20.0

Release notes

Sourced from tokenizers's releases.

Release v0.20.0: faster encode, better python support

Release v0.20.0

This release is focused on performances and user experience.

Performances:

First off, we did a bit of benchmarking, and found some place for improvement for us! With a few minor changes (mostly #1587) here is what we get on Llama3 running on a g6 instances on AWS https://github.com/huggingface/tokenizers/blob/main/bindings/python/benches/test_tiktoken.py : image

Python API

We shipped better deserialization errors in general, and support for __str__ and __repr__ for all the object. This allows for a lot easier debugging see this:

>>> from tokenizers import Tokenizer;
>>> tokenizer = Tokenizer.from_pretrained("bert-base-uncased");
>>> print(tokenizer)
Tokenizer(version="1.0", truncation=None, padding=None, added_tokens=[{"id":0, "content":"[PAD]", "single_word":False, "lstrip":False, "rstrip":False, ...}, {"id":100, "content":"[UNK]", "single_word":False, "lstrip":False, "rstrip":False, ...}, {"id":101, "content":"[CLS]", "single_word":False, "lstrip":False, "rstrip":False, ...}, {"id":102, "content":"[SEP]", "single_word":False, "lstrip":False, "rstrip":False, ...}, {"id":103, "content":"[MASK]", "single_word":False, "lstrip":False, "rstrip":False, ...}], normalizer=BertNormalizer(clean_text=True, handle_chinese_chars=True, strip_accents=None, lowercase=True), pre_tokenizer=BertPreTokenizer(), post_processor=TemplateProcessing(single=[SpecialToken(id="[CLS]", type_id=0), Sequence(id=A, type_id=0), SpecialToken(id="[SEP]", type_id=0)], pair=[SpecialToken(id="[CLS]", type_id=0), Sequence(id=A, type_id=0), SpecialToken(id="[SEP]", type_id=0), Sequence(id=B, type_id=1), SpecialToken(id="[SEP]", type_id=1)], special_tokens={"[CLS]":SpecialToken(id="[CLS]", ids=[101], tokens=["[CLS]"]), "[SEP]":SpecialToken(id="[SEP]", ids=[102], tokens=["[SEP]"])}), decoder=WordPiece(prefix="##", cleanup=True), model=WordPiece(unk_token="[UNK]", continuing_subword_prefix="##", max_input_chars_per_word=100, vocab={"[PAD]":0, "[unused0]":1, "[unused1]":2, "[unused2]":3, "[unused3]":4, ...}))
>>> tokenizer
Tokenizer(version="1.0", truncation=None, padding=None, added_tokens=[{"id":0, "content":"[PAD]", "single_word":False, "lstrip":False, "rstrip":False, "normalized":False, "special":True}, {"id":100, "content":"[UNK]", "single_word":False, "lstrip":False, "rstrip":False, "normalized":False, "special":True}, {"id":101, "content":"[CLS]", "single_word":False, "lstrip":False, "rstrip":False, "normalized":False, "special":True}, {"id":102, "content":"[SEP]", "single_word":False, "lstrip":False, "rstrip":False, "normalized":False, "special":True}, {"id":103, "content":"[MASK]", "single_word":False, "lstrip":False, "rstrip":False, "normalized":False, "special":True}], normalizer=BertNormalizer(clean_text=True, handle_chinese_chars=True, strip_accents=None, lowercase=True), pre_tokenizer=BertPreTokenizer(), post_processor=TemplateProcessing(single=[SpecialToken(id="[CLS]", type_id=0), Sequence(id=A, type_id=0), SpecialToken(id="[SEP]", type_id=0)], pair=[SpecialToken(id="[CLS]", type_id=0), Sequence(id=A, type_id=0), SpecialToken(id="[SEP]", type_id=0), Sequence(id=B, type_id=1), SpecialToken(id="[SEP]", type_id=1)], special_tokens={"[CLS]":SpecialToken(id="[CLS]", ids=[101], tokens=["[CLS]"]), "[SEP]":SpecialToken(id="[SEP]", ids=[102], tokens=["[SEP]"])}), decoder=WordPiece(prefix="##", cleanup=True), model=WordPiece(unk_token="[UNK]", continuing_subword_prefix="##", max_input_chars_per_word=100, vocab={"[PAD]":0, "[unused0]":1, "[unused1]":2, ...}))

The pre_tokenizer.Sequence and normalizer.Sequence are also more accessible now:

from tokenizers import normalizers
norm = normalizers.Sequence([normalizers.Strip(), normalizers.BertNormalizer()])
norm[0]
norm[1].lowercase=False

What's Changed

... (truncated)

Commits
  • a5adaac version 0.20.0
  • a8def07 Merge branch 'fix_release' of github.com:huggingface/tokenizers into branch_v...
  • fe50673 Fix CI
  • b253835 push cargo
  • fc3bb76 update dependencies
  • bfd9cde Perf improvement 16% by removing offsets. (#1587)
  • bd27fa5 add deserialize for pre tokenizers (#1603)
  • 56c9c70 Tests + Deserialization improvement for normalizers. (#1604)
  • 49dafd7 Fix strip python type (#1602)
  • bded212 Support None to reset pre_tokenizers and normalizers, and index sequences (...
  • Additional commits viewable in compare view

Updates transformers from 4.44.0 to 4.44.2

Release notes

Sourced from transformers's releases.

Release v4.44.2

Patch release v4.44.2, mostly 2 regressions that were not caught for Jamba and for processors!

Patch release v4.44.1

Here are the different fixes, mostly Gemma2 context length, nits here and there, and generation issues

Full Changelog: huggingface/transformers@v4.44.0...v4.44.1

Commits

Updates torchvision from 0.16.0.post3+cxx11.abi to 0.19.0+cpu

Updates torchaudio from 2.1.0.post3+cxx11.abi to 2.4.0+cpu

Updates intel-extension-for-pytorch from 2.1.40+xpu to 2.4.0+cpu

Updates oneccl-bind-pt from 2.1.400+xpu to 2.4.0+cpu

Updates setuptools from 69.5.1 to 73.0.1

Changelog

Sourced from setuptools's changelog.

v73.0.1

Bugfixes

  • Remove abc.ABCMeta metaclass from abstract classes. pypa/setuptools#4503 <https://github.com/pypa/setuptools/pull/4503>_ had an unintended consequence of causing potential TypeError: metaclass conflict: the metaclass of a derived class must be a (non-strict) subclass of the metaclasses of all its bases -- by :user:Avasam (#4579)

v73.0.0

Features

  • Mark abstract base classes and methods with abc.ABC and abc.abstractmethod -- by :user:Avasam (#4503)
  • Changed the order of type checks in setuptools.command.easy_install.CommandSpec.from_param to support any collections.abc.Iterable of str param -- by :user:Avasam (#4505)

Bugfixes

  • Prevent an error in bdist_wheel if compression is set to a str (even if valid) after finalizing options but before running the command. -- by :user:Avasam (#4383)
  • Raises an exception when py_limited_api is used in a build with Py_GIL_DISABLEDpython/cpython#111506#4420)
  • pypa/distutils#284

Deprecations and Removals

  • setuptools is replacing the usages of :pypi:ordered_set with simple instances of dict[Hashable, None]. This is done to remove the extra dependency and it is possible because since Python 3.7, dict maintain insertion order. (#4574)

Misc

v72.2.0

Features

... (truncated)

Commits
  • ebddeb3 Bump version: 73.0.0 → 73.0.1
  • 18963fb Merge pull request #4580 from Avasam/no-ABCMeta
  • b7ee00d Remove ABCMeta metaclass, keep abstractmethods
  • 477f713 Override distribution attribute type in all distutils-based commands (#4577)
  • 429ac58 Override distribution attribute type in all distutils-based commands
  • 4147b09 Bump version: 72.2.0 → 73.0.0
  • 2ad8c10 Merge pull request #4576 from pypa/bugfix/distutils-284
  • 8afe0c3 Merge pull request #4574 from abravalheri/ordered_set
  • ad611bc Merge https://github.com/pypa/distutils into bugfix/distutils-284
  • 30b7331 Ensure a missing target is still indicated as 'sources are newer' even when t...
  • Additional commits viewable in compare view

Updates numpy from 1.26.4 to 2.1.0

Release notes

Sourced from numpy's releases.

2.1.0 (Aug 18, 2024)

NumPy 2.1.0 Release Notes

NumPy 2.1.0 provides support for the upcoming Python 3.13 release and drops support for Python 3.9. In addition to the usual bug fixes and updated Python support, it helps get us back into our usual release cycle after the extended development of 2.0. The highlights for this release are:

  • Support for the array-api 2023.12 standard.
  • Support for Python 3.13.
  • Preliminary support for free threaded Python 3.13.

Python versions 3.10-3.13 are supported in this release.

New functions

New function numpy.unstack

A new function np.unstack(array, axis=...) was added, which splits an array into a tuple of arrays along an axis. It serves as the inverse of [numpy.stack]{.title-ref}.

(gh-26579)

Deprecations

  • The fix_imports keyword argument in numpy.save is deprecated. Since NumPy 1.17, numpy.save uses a pickle protocol that no longer supports Python 2, and ignored fix_imports keyword. This keyword is kept only for backward compatibility. It is now deprecated.

    (gh-26452)

  • Passing non-integer inputs as the first argument of [bincount]{.title-ref} is now deprecated, because such inputs are silently cast to integers with no warning about loss of precision.

    (gh-27076)

Expired deprecations

  • Scalars and 0D arrays are disallowed for numpy.nonzero and numpy.ndarray.nonzero.

    (gh-26268)

  • set_string_function internal function was removed and PyArray_SetStringFunction was stubbed out.

... (truncated)

Commits
  • 2f7fe64 Merge pull request #27236 from charris/prepare-2.1.0
  • b6f434f REL: Prepare for the NumPy 2.1.0 release [wheel build]
  • 3cf9394 Merge pull request #27234 from charris/backport-25984
  • 7443dcc Merge pull request #27233 from charris/backport-27223
  • 85b1cab BUG: Allow fitting of degree zero polynomials with Polynomial.fit
  • 395a81d DOC: reword discussion about shared arrays to hopefully be clearer
  • 5af2e96 Move NUMUSERTYPES thread safety discussion to legacy DType API docs
  • d902c24 DOC: add docs on thread safety in NumPy
  • c080180 Merge pull request #27229 from charris/backport-27226
  • 44ce7e8 BUG: Fix PyArray_ZeroContiguousBuffer (resize) with struct dtypes
  • Additional commits viewable in compare view

Updates jupyterlab from 4.3.0b0 to 4.3.0b1

Release notes

Sourced from jupyterlab's releases.

v4.3.0b1

4.3.0b1

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

(GitHub contributors page for this release)

@​cmarmo | @​davidbrochart | @​dependabot | @​itsmevichu | @​JasonWeill | @​joaopalmeiro | @​jtpio | @​jupyterlab-probot | @​krassowski | @​maitreya2954

Changelog

Sourced from jupyterlab's changelog.

4.3.0b1

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

(GitHub contributors page for this release)

@​cmarmo | @​davidbrochart | @​dependabot | @​itsmevichu | @​JasonWeill | @​joaopalmeiro | @​jtpio | @​jupyterlab-probot | @​krassowski | @​maitreya2954

Commits
  • f7ca6ad [ci skip] Publish 4.3.0b1
  • 594d340 User-facing changelog for JupyterLab 4.3 (#16709)
  • f06c3e6 Merge commit from fork
  • 53819cc Use locale name instead of display/native name to toggle language (#16710)
  • 91f1c7c Fix stream output (#16692)
  • 16611e1 Add a guard on uninitialized nodes when resizing, remove log (#16693)
  • 6c60d71 Update contents model on file change due to save from RTC (#16695)
  • 88eb874 Add null checks for "input" variable (#16705)
  • a3b2d64 Null checks to guard against cell toolbar errors on startup (#16704)
  • 3c12e59 Clean up SVG icons from @jupyterlab/ui-components and update SVGO (#16678)
  • Additional commits viewable in compare view

Updates torchtext from 0.18.0 to 0.18.0+cpu

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the pytorch group across 1 directory with 12 updates
dffbf80 
Bumps the pytorch group with 12 updates in the /pytorch directory:

| Package | From | To |
| --- | --- | --- |
| [onnxruntime-extensions](https://github.com/microsoft/onnxruntime-extensions) | `0.11.0` | `0.12.0` |
| [onnxruntime](https://github.com/microsoft/onnxruntime) | `1.18.1` | `1.19.0` |
| [tokenizers](https://github.com/huggingface/tokenizers) | `0.19.1` | `0.20.0` |
| [transformers](https://github.com/huggingface/transformers) | `4.44.0` | `4.44.2` |
| torchvision | `0.16.0.post3+cxx11.abi` | `0.19.0+cpu` |
| torchaudio | `2.1.0.post3+cxx11.abi` | `2.4.0+cpu` |
| intel-extension-for-pytorch | `2.1.40+xpu` | `2.4.0+cpu` |
| oneccl-bind-pt | `2.1.400+xpu` | `2.4.0+cpu` |
| [setuptools](https://github.com/pypa/setuptools) | `69.5.1` | `73.0.1` |
| [numpy](https://github.com/numpy/numpy) | `1.26.4` | `2.1.0` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.3.0b0` | `4.3.0b1` |
| torchtext | `0.18.0` | `0.18.0+cpu` |



Updates `onnxruntime-extensions` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/microsoft/onnxruntime-extensions/releases)
- [Commits](https://github.com/microsoft/onnxruntime-extensions/commits)

Updates `onnxruntime` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/microsoft/onnxruntime/releases)
- [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseManagement.md)
- [Commits](microsoft/onnxruntime@v1.18.1...v1.19.0)

Updates `tokenizers` from 0.19.1 to 0.20.0
- [Release notes](https://github.com/huggingface/tokenizers/releases)
- [Changelog](https://github.com/huggingface/tokenizers/blob/main/RELEASE.md)
- [Commits](huggingface/tokenizers@v0.19.1...v0.20.0)

Updates `transformers` from 4.44.0 to 4.44.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.44.0...v4.44.2)

Updates `torchvision` from 0.16.0.post3+cxx11.abi to 0.19.0+cpu

Updates `torchaudio` from 2.1.0.post3+cxx11.abi to 2.4.0+cpu

Updates `intel-extension-for-pytorch` from 2.1.40+xpu to 2.4.0+cpu

Updates `oneccl-bind-pt` from 2.1.400+xpu to 2.4.0+cpu

Updates `setuptools` from 69.5.1 to 73.0.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v69.5.1...v73.0.1)

Updates `numpy` from 1.26.4 to 2.1.0
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v1.26.4...v2.1.0)

Updates `jupyterlab` from 4.3.0b0 to 4.3.0b1
- [Release notes](https://github.com/jupyterlab/jupyterlab/releases)
- [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.3.0-beta.0...@jupyterlab/lsp@4.3.0-beta.1)

Updates `torchtext` from 0.18.0 to 0.18.0+cpu

---
updated-dependencies:
- dependency-name: onnxruntime-extensions
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: onnxruntime
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: tokenizers
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: transformers
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pytorch
- dependency-name: torchvision
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: torchaudio
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: intel-extension-for-pytorch
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: oneccl-bind-pt
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pytorch
- dependency-name: setuptools
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pytorch
- dependency-name: numpy
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pytorch
- dependency-name: jupyterlab
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pytorch
- dependency-name: torchtext
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pytorch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 27, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Aug 27, 2024 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 3 package(s) with unknown licenses.
See the Details below.

License Issues

pytorch/serving/torchserve-xpu-requirements.txt

PackageVersionLicenseIssue Type
intel_extension_for_pytorch2.4.0+cpuNullUnknown License

pytorch/xpu-requirements.txt

PackageVersionLicenseIssue Type
intel_extension_for_pytorch2.4.0+cpuNullUnknown License
oneccl_bind_pt2.4.0+cpuNullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/onnxruntime 1.19.0 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 10all last 30 commits are reviewed through GitHub
Maintained🟢 1030 commit(s) out of 30 and 8 issue activity out of 30 found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ 00 out of 5 artifacts are signed or have provenance
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/onnxruntime-extensions 0.12.0 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 7binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/tokenizers 0.20.0 🟢 5.4
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 46 existing vulnerabilities detected
pip/transformers 4.44.2 🟢 4.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities⚠️ 0466 existing vulnerabilities detected
pip/jupyterlab 4.3.0b1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 9Found 25/26 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 9license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during GetBranch(4.2.x): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST🟢 10SAST tool is run on all commits
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities⚠️ 19 existing vulnerabilities detected
pip/torchtext 0.18.0+cpu 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 8Found 25/30 approved changesets -- score normalized to 8
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 8SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
pip/torchvision 0.19.0+cpu 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 4Found 14/30 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Binary-Artifacts🟢 9binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/intel_extension_for_pytorch 2.4.0+cpu UnknownUnknown
pip/numpy 2.1.0 🟢 8.1
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
CI-Tests🟢 109 out of 9 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 10all changesets reviewed
Contributors🟢 10project has 93 contributing companies or organizations
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 9security policy file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities🟢 100 existing vulnerabilities detected
pip/setuptools 73.0.1 🟢 6
Details
CheckScoreReason
Code-Review🟢 4Found 7/15 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/torchaudio 2.4.0+cpu 🟢 5.3
Details
CheckScoreReason
Maintained🟢 54 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/torchvision 0.19.0+cpu 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 4Found 14/30 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Binary-Artifacts🟢 9binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/intel_extension_for_pytorch 2.4.0+cpu UnknownUnknown
pip/oneccl_bind_pt 2.4.0+cpu UnknownUnknown
pip/setuptools 73.0.1 🟢 6
Details
CheckScoreReason
Code-Review🟢 4Found 7/15 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/torchaudio 2.4.0+cpu 🟢 5.3
Details
CheckScoreReason
Maintained🟢 54 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/torchvision 0.19.0+cpu 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 4Found 14/30 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Binary-Artifacts🟢 9binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

pytorch/hf-genai-requirements.txt
  • onnxruntime@1.19.0
  • onnxruntime-extensions@0.12.0
  • tokenizers@0.20.0
  • transformers@4.44.2
  • onnxruntime@1.18.1
  • onnxruntime-extensions@0.11.0
  • tokenizers@0.19.1
  • transformers@4.44.0
pytorch/jupyter-requirements.txt
  • jupyterlab@4.3.0b1
  • jupyterlab@4.3.0b0
pytorch/serving/torchserve-requirements.txt
  • torchtext@0.18.0+cpu
  • torchvision@0.19.0+cpu
  • torchtext@0.18.0
  • torchvision@0.19.0
pytorch/serving/torchserve-xpu-requirements.txt
  • setuptools@69.5.1
  • intel_extension_for_pytorch@2.4.0+cpu
  • numpy@2.1.0
  • setuptools@73.0.1
  • torchaudio@2.4.0+cpu
  • torchvision@0.19.0+cpu
  • intel_extension_for_pytorch@2.1.40+xpu
  • numpy@1.26.4
  • torchaudio@2.1.0.post3+cxx11.abi
  • torchvision@0.16.0.post3+cxx11.abi
pytorch/xpu-requirements.txt
  • setuptools@69.5.1
  • intel_extension_for_pytorch@2.4.0+cpu
  • oneccl_bind_pt@2.4.0+cpu
  • setuptools@73.0.1
  • torchaudio@2.4.0+cpu
  • torchvision@0.19.0+cpu
  • intel_extension_for_pytorch@2.1.40+xpu
  • oneccl_bind_pt@2.1.400+xpu
  • torchaudio@2.1.0.post3+cxx11.abi
  • torchvision@0.16.0.post3+cxx11.abi

@sramakintel sramakintel self-requested a review August 28, 2024 15:48
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 2, 2024

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Sep 2, 2024
@dependabot dependabot bot deleted the dependabot/pip/pytorch/pytorch-29b52461c4 branch September 2, 2024 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tylertitsworth tylertitsworth Awaiting requested review from tylertitsworth

@jitendra42 jitendra42 Awaiting requested review from jitendra42 jitendra42 is a code owner

@sharvil10 sharvil10 Awaiting requested review from sharvil10 sharvil10 is a code owner

@sramakintel sramakintel Awaiting requested review from sramakintel sramakintel is a code owner

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sramakintel