Bump the all group across 1 directory with 5 updates

[dependabot]

Bumps the all group with 5 updates in the / directory:

Package	From	To
torch	2.13.0	2.14.1
torchvision	0.28.0	0.29.1
ruff	0.16.0	0.16.10
ty	0.0.65	0.0.85
huggingface-hub	1.25.1	2.1.1

Updates torch from 2.13.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

• Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
• Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
• Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
  • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
  • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

• Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
• Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

PyTorch 2.14.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Security
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

• torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

  The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

... (truncated)

Commits

• 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
• 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
• 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
• e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
• 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
• 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
• 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
• 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
• 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
• ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
• Additional commits viewable in compare view

Updates torchvision from 0.28.0 to 0.29.1

Release notes

Sourced from torchvision's releases.

TorchVision 0.29.1 Release

This is a patch release, which is compatible with PyTorch 2.14.1. There are no new features added.

Packaging

• Relax the PyTorch requirement from torch==2.14.0 to torch>=2.14. TorchVision is now ABI stable with respect to PyTorch 2.14, so it no longer pins an exact PyTorch version (#9683, cherry-pick of #9680)

TorchVision 0.29: ABI stability!

TorchVision 0.29 is out! It comes with two major changes: ABI stability, and deprecation of the image decoders and encoders (now in TorchCodec)!

ABI Stability with torch 2.14

TorchVision is now ABI stable w.r.t. torch 2.14! This means that torchvision 0.29 will be compatible with future versions of torch: 2.15, 2.16, etc. You won’t need to install a new version of TorchVision when you upgrade torch.

As a result, we might stop releasing TorchVision in sync with pytorch. But TorchVision is still actively maintained and developed: we’ll still be pushing releases, just not with the same cadence.

Thanks to Adrian Abeyta @​adabeyta for the fantastic porting effort!

PRs: #9524, #9597, #9598, #9605, #9612, #9610, #9614, #9584, #9617, #9618, #9619, #9620, #9582, #9573, #9625, #9623, #9626, #9583, #9633, #9572, #9549, #9533, #9535, #9539, #9543, #9550, #9552, #9555, #9557, #9558, #9554

Image decoders and encoders are deprecated. Use TorchCodec!

The image decoders and encoders in torchvision.io are now deprecated, and they will be removed in a future release. They are now available in torchcodec >= 0.16, where they are significantly more capable. You’ll just need to pip install torchcodec, and you can refer to this migration guide for migrating your code (most APIs for decoding are the same).

This finalizes a clear separation of concerns for the three media-processing libraries of PyTorch: torchcodec is for decoding and encoding all media (images, videos, and audio), while torchvision and torchaudio focus on the transforms.

Bug fixes

[ops] Fix for deformable convolution kernels always running on default stream (#9522) [ops, MPS] Fix gradient overaccumulation in ROI ops (#9563, #9510) [transforms] Fix JPEG transform for non-contiguous batches (#9615)

Contributors

🎉 We're grateful for our community, which helps us improve Torchvision by submitting issues and PRs, and providing feedback and suggestions. The following persons have contributed patches for this release:

Adrian Abeyta, Andrey Talman, Dmitry Nikolaev, Irakli Salia, Jeff Daily , Kasra Ghodsi, Nicolas Hug, Nikita Shulga, Simon Byrne, Yutao Xu, Zhewen

Commits

• 1f1a920 Set the pin to torch>=2.14 (#9680) (#9683)
• 1b4390d [release/0.29] Build against the release/2.14 test-infra branch (#9682)
• 0bb1ccf Update version to 0.29.1 (#9678)
• fc73f5a Merge branch 'release/0.29' of github.com:pytorch/vision into release/0.29
• f9b2669 [Cherry-pick for 0.29] (#9634)
• e1b5802 Revert "Update version.txt for 0.30.0 (#9607)"
• 2757376 Merge remote-tracking branch 'origin' into release/0.29
• 9e21b88 Consolidate CUDA helpers and remove the legacy _C extension in place of Stabl...
• 541c083 Port deform_conv2d (CUDA) to stable ABI. (#9626)
• 2f411e7 Port ps_roi_pool (CUDA) to stable ABI. (#9623)
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits

• 3265ed1 Bump version to 0.16.10 (#29055)
• e786964 Authorize shared PR security-review workflow to publish findings (#29052)
• a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
• b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
• 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
• 317e0a3 [ty] Bound nested callable signature display (#29049)
• 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
• 56180bc [ty] Specialize instance members once (#29043)
• aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
• 2d25346 [ty] Improve unresolved-import documentation (#29039)
• Additional commits viewable in compare view

Updates ty from 0.0.65 to 0.0.85

Release notes

Sourced from ty's releases.

0.0.85

Release Notes

Released on 2026-10-06.

Preview features

• Refresh uv project metadata when uv files change (#28529)

Bug fixes

• Avoid recursive lambda class decorator panics (#28984)
• Compare observable notebook state for equality (#28874)
• Detect recursive alias cycles through intersections (#28916)
• Fix anchoring of include and exclude patterns after the project's root changed (#28995)
• Fix stack overflow when inferring dynamic class metaclasses (#28917)
• Normalize recursive dataclass transform metadata (#28920)
• Normalize recursive TypedDicts during cycle recovery (#28918)
• Preserve cycle markers in ParamSpec specialization (#29024)

CLI

• Prefer existing @ paths over response files in Ruff and ty (#28877)

LSP server

• Add namespace package support to import completions. (#28202)
• Avoid stale I/O diagnostics when closing deleted files (#28988)
• Contain rendered code within Markdown fences (#28869)
• Refresh Python settings when virtual environments change (#28650)

Diagnostic improvements

• Add opt-in truthiness-test-of-none-union rule (#28889)
• Avoid disjoint-cast diagnostics in situations where the value could have been inferred as being compatible with the casted type if it had only been inferred with the right type context (#28851)
• Bound nested callable signature display (#29049)
• Explain outdated uv versions in metadata errors (#28959)
• Improve display of string literal types that include unicode characters or double quotes (#29089)
• Improve uv metadata diagnostics (#28990)
• Preserve constrained type-variable failure diagnostics (#28768)
• Preserve generic inference errors during diagnostic recovery (#28811)
• Report deprecated overloads in decorator applications (#28999)

Core type checking

• Bound methods without a receiver are not callable (#28981)
• Fix member lookup on union-bounded type variables (#29018)
• Fix type variable inference for final class objects (#29097)
• Freshen ParamSpec identities consistently (#28826)
• Honor generic property setters in protocol compatibility (#28562)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.85

Released on 2026-10-06.

Preview features

• Refresh uv project metadata when uv files change (#28529)

Bug fixes

• Avoid recursive lambda class decorator panics (#28984)
• Compare observable notebook state for equality (#28874)
• Detect recursive alias cycles through intersections (#28916)
• Fix anchoring of include and exclude patterns after the project's root changed (#28995)
• Fix stack overflow when inferring dynamic class metaclasses (#28917)
• Normalize recursive dataclass transform metadata (#28920)
• Normalize recursive TypedDicts during cycle recovery (#28918)
• Preserve cycle markers in ParamSpec specialization (#29024)

CLI

• Prefer existing @ paths over response files in Ruff and ty (#28877)

LSP server

• Add namespace package support to import completions. (#28202)
• Avoid stale I/O diagnostics when closing deleted files (#28988)
• Contain rendered code within Markdown fences (#28869)
• Refresh Python settings when virtual environments change (#28650)

Diagnostic improvements

• Add opt-in truthiness-test-of-none-union rule (#28889)
• Avoid disjoint-cast diagnostics in situations where the value could have been inferred as being compatible with the casted type if it had only been inferred with the right type context (#28851)
• Bound nested callable signature display (#29049)
• Explain outdated uv versions in metadata errors (#28959)
• Improve display of string literal types that include unicode characters or double quotes (#29089)
• Improve uv metadata diagnostics (#28990)
• Preserve constrained type-variable failure diagnostics (#28768)
• Preserve generic inference errors during diagnostic recovery (#28811)
• Report deprecated overloads in decorator applications (#28999)

Core type checking

• Bound methods without a receiver are not callable (#28981)
• Fix member lookup on union-bounded type variables (#29018)
• Fix type variable inference for final class objects (#29097)
• Freshen ParamSpec identities consistently (#28826)
• Honor generic property setters in protocol compatibility (#28562)
• Infer nominal generic specializations from bounded type variables (#28812)

... (truncated)

Commits

• d7fc5ef Bump version to 0.0.85 (#4679)
• bc4fd9e Include reproducers in daily fuzz issues (#4671)
• 03d47ff Group uv workflow and pre-commit updates (#4670)
• a86a22f Update dependency astral-sh/uv to v0.12.23 (#4669)
• 1447551 Enable Renovate updates for the release preparation uv version (#4668)
• 9f2b16a Set FORCE_COLOR for fuzzing environment (#4663)
• 05add1d Add a daily ty fuzzing workflow (#4643)
• ad39415 Correct file exclusion guide examples (#4638)
• 2ea9c49 Update language server feature documentation (#4637)
• 449e387 Correct type inference and narrowing FAQ (#4639)
• Additional commits viewable in compare view

Updates huggingface-hub from 1.25.1 to 2.1.1

Release notes

Sourced from huggingface-hub's releases.

v2.1.1

[CLI] Rename 'hf spaces zero-gpu-quota' to 'hf spaces zero-gpu quota'- #5055

Full Changelog: huggingface/huggingface_hub@v2.1.0...v2.1.1

[v2.1.0] Better Jobs tooling, ZeroGPU quota tracking, and revamped Model Catalog

📊 Jobs: retries, rescheduling, and port exposure

Hugging Face Jobs get a batch of quality-of-life improvements this release. Jobs can now retry automatically on failure with the new attempts parameter, and you can start a fresh Job from an existing Job's saved spec (including secrets and hardware settings) with rerun_job / hf jobs rerun. Scheduled Jobs can be rescheduled — change the cron expression or preset without recreating the Job — via update_scheduled_job_schedule / hf jobs scheduled reschedule. Finally, you can now expose ports on Jobs: use expose for token-protected access and expose_public for unauthenticated access, both at creation time and on a running Job with update_job_expose / hf jobs expose.

# Retry a job up to 2 times on failure, and rerun it later from its saved spec
>>> hf jobs run --attempts 3 --detach python:3.12 python train.py
>>> hf jobs rerun <job_id>
Reschedule a scheduled job to run every day at 9:00
>>> hf jobs scheduled reschedule <scheduled_job_id> "0 9 * * 1"
Expose ports on a running Job (8000 token-protected, 9000 public)
>>> hf jobs expose <job_id> 8000 --public 9000

• [Jobs] Add rerun and retry attempts by @​Wauplin in #5025
• [Jobs] Allow rescheduling scheduled jobs by @​Wauplin in #5026
• [Jobs] Manage public and private exposed ports by @​Wauplin in #5027

📚 Documentation: Jobs guide

🤗 Track your ZeroGPU quota

The Hub now exposes a ZeroGPU quota endpoint, and huggingface_hub wraps it with a new HfApi.get_zero_gpu_quota() method returning a ZeroGpuQuota dataclass (values in GPU-seconds). This is particularly useful for apps, MCP servers and agents built on top of ZeroGPU Spaces: check how much quota is left and when it resets, and warn your users before they hit the daily limit. The same information is available from the CLI with hf spaces zero-gpu-quota, which also prints a hint to purchase credits when the quota is running low.

>>> from huggingface_hub import get_zero_gpu_quota
>>> quota = get_zero_gpu_quota()
ZeroGpuQuota(base=2400, remaining=1810, resets_at=datetime.datetime(2026, 9, 30, 9, 12, 3, tzinfo=datetime.timezone.utc), overquota_used=0)

>>> hf spaces zero-gpu quota
✓ ZeroGPU quota (in GPU-seconds)
  remaining: 1810
  base: 2400
  resets_at: 2026-09-30T18:12:03+00:00
  overquota_used: 0

• [Spaces] Add get_zero_gpu_quota and hf spaces zero-gpu-quota by @​Wauplin in #5040
• [CLI] Rename 'hf spaces zero-gpu-quota' to 'hf spaces zero-gpu quota'- #5055 [Shipped as part of v2.1.1]

... (truncated)

Commits

• bd4a760 Release: v2.1.1
• cb1755f [CLI] Rename 'hf spaces zero-gpu-quota' to 'hf spaces zero-gpu quota' (#5055)
• 43372b6 Release: v2.1.0
• efa122c Release: v2.1.0.rc0
• 0b26b50 [Spaces] Add get_zero_gpu_quota and hf spaces zero-gpu-quota (#5040)
• 604252e [HfApi] Add visibility to create_bucket (#5053)
• 4c88ea6 [Repos] Warn when duplicated repo files are still being copied (#5041)
• 3bb08e2 [Endpoints] Migrate catalog to the new /api/v1 API (#4928)
• b5e3a12 [HfApi] Support resource_group_id in duplicate_repo (#5038)
• 60fdb08 [Docs] Fix duplicated words in docstring and comments (#5052)
• Additional commits viewable in compare view