You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hugegraph.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2025/04/18 17:38:04 UTC
[PR] chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml [incubator-hugegraph-ai]
dependabot[bot] opened a new pull request, #213:
URL: https://github.com/apache/incubator-hugegraph-ai/pull/213
Bumps [torch](https://github.com/pytorch/pytorch) from 2.2.0 to 2.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p>
<blockquote>
<h2>PyTorch 2.6.0 Release</h2>
<ul>
<li>Highlights</li>
<li>Tracked Regressions</li>
<li>Backwards Incompatible Change</li>
<li>Deprecations</li>
<li>New Features</li>
<li>Improvements</li>
<li>Bug fixes</li>
<li>Performance</li>
<li>Documentation</li>
<li>Developers</li>
</ul>
<h2><strong>Highlights</strong></h2>
<p>We are excited to announce the release of PyTorch® 2.6 (<a href="https://github.com/pytorch/pytorch/releases/tag/v2.6.0">release notes</a>)! This release features multiple improvements for PT2: <code>torch.compile</code> can now be used with Python 3.13; new performance-related knob <code>torch.compiler.set_stance</code>; several AOTInductor enhancements. Besides the PT2 improvements, another highlight is FP16 support on X86 CPUs.</p>
<p>NOTE: Starting with this release we are not going to publish on Conda, please see <a href="https://redirect.github.com/pytorch/pytorch/issues/138506">[Announcement] Deprecating PyTorch’s official Anaconda channel</a> for the details.</p>
<p>For this release the experimental Linux binaries shipped with CUDA 12.6.3 (as well as Linux Aarch64, Linux ROCm 6.2.4, and Linux XPU binaries) are built with CXX11_ABI=1 and are <a href="https://dev-discuss.pytorch.org/t/pytorch-linux-wheels-switching-to-new-wheel-build-platform-manylinux-2-28-on-november-12-2024/2581">using the Manylinux 2.28 build platform</a>. If you build PyTorch extensions with custom C++ or CUDA extensions, please update these builds to use CXX_ABI=1 as well and report any issues you are seeing. For the next PyTorch 2.7 release we plan to switch all Linux builds to Manylinux 2.28 and CXX11_ABI=1, please see <a href="https://redirect.github.com/pytorch/pytorch/issues/123649">[RFC] PyTorch next wheel build platform: manylinux-2.28</a> for the details and discussion.</p>
<p>Also in this release as an important security improvement measure we have changed the default value for <code>weights_only</code> parameter of <code>torch.load</code>. This is a backward compatibility-breaking change, please see <a href="https://dev-discuss.pytorch.org/t/bc-breaking-change-torch-load-is-being-flipped-to-use-weights-only-true-by-default-in-the-nightlies-after-137602/2573">this forum post</a> for more details.</p>
<p>This release is composed of 3892 commits from 520 contributors since PyTorch 2.5. We want to sincerely thank our dedicated community for your contributions. As always, we encourage you to try these out and report any issues as we improve PyTorch. More information about how to get started with the PyTorch 2-series can be found at our <a href="https://pytorch.org/get-started/pytorch-2.0/">Getting Started</a> page.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pytorch/pytorch/commit/1eba9b3aa3c43f86f4a2c807ac8e12c4a7767340"><code>1eba9b3</code></a> change the test wheel to release wheel when release wheel available (<a href="https://redirect.github.com/pytorch/pytorch/issues/145884">#145884</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/2236df1770800ffea5697b11b0bb0d910b2e59e1"><code>2236df1</code></a> [CUDA] Change slim-wheel libraries load order (<a href="https://redirect.github.com/pytorch/pytorch/issues/145662">#145662</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/32070409668513144e48390380a3911fc5cd03e0"><code>3207040</code></a> [CD] Fix slim-wheel cuda_nvrtc import problem (<a href="https://redirect.github.com/pytorch/pytorch/issues/145614">#145614</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/ca3c3a63b8087d405babf95fcce263cf1b8dd35e"><code>ca3c3a6</code></a> [Release-Only] Remove ptx from Linux CUDA 12.6 binary builds (<a href="https://redirect.github.com/pytorch/pytorch/issues/145616">#145616</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/7be6b5db475a5885379751953f67656ca1ce6edd"><code>7be6b5d</code></a> Fix IdentationError of code example (<a href="https://redirect.github.com/pytorch/pytorch/issues/145525">#145525</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/dcb8ad070f15e8444dcb4e415bde38142cda5e9d"><code>dcb8ad0</code></a> update get start xpu (<a href="https://redirect.github.com/pytorch/pytorch/issues/145286">#145286</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04"><code>8d4b8a9</code></a> Prevent legacy_load when weights_only=True (correctly) (<a href="https://redirect.github.com/pytorch/pytorch/issues/145111">#145111</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/9c34a2076b37c040b1b9a48b729656fe9e992949"><code>9c34a20</code></a> Revert "Prevent _legacy_load with weights_only=True (<a href="https://redirect.github.com/pytorch/pytorch/issues/144993">#144993</a>)"</li>
<li><a href="https://github.com/pytorch/pytorch/commit/cd15d7b29fea0886d1ae655da9bec767caa8c672"><code>cd15d7b</code></a> Prevent _legacy_load with weights_only=True (<a href="https://redirect.github.com/pytorch/pytorch/issues/144993">#144993</a>)</li>
<li><a href="https://github.com/pytorch/pytorch/commit/a2639bc255cd9eb93250c3bd1aea01f74538ad76"><code>a2639bc</code></a> [Release/2.6] Enable python-3.13t aarch64 builds (<a href="https://redirect.github.com/pytorch/pytorch/issues/144878">#144878</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.2.0...v2.6.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/incubator-hugegraph-ai/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For additional commands, e-mail: issues-help@hugegraph.apache.org
Re: [PR] chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml [incubator-hugegraph-ai]
Posted by "imbajin (via GitHub)" <gi...@apache.org>.
imbajin commented on PR #213:
URL: https://github.com/apache/incubator-hugegraph-ai/pull/213#issuecomment-2820059942
@dependabot ignore this major version
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For additional commands, e-mail: issues-help@hugegraph.apache.org
Re: [PR] chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml [incubator-hugegraph-ai]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #213:
URL: https://github.com/apache/incubator-hugegraph-ai/pull/213#issuecomment-2815906553
<h1>Dependency Review</h1>
The following issues were found:<ul><li>❌ 1 vulnerable package(s)</li><li>✅ 0 package(s) with incompatible licenses</li><li>✅ 0 package(s) with invalid SPDX license definitions</li><li>⚠️ 1 package(s) with unknown licenses.</li></ul>
See the Details below.<h2>Vulnerabilities</h2>
<h4><em>hugegraph-ml/requirements.txt</em></h4>
<table><tr><th>Name</th><th>Version</th><th>Vulnerability</th><th>Severity</th></tr><tr><td><a href="https://github.com/pytorch/pytorch">torch</a></td><td>2.6.0</td><td><a href="https://github.com/advisories/GHSA-887c-mr87-cxwp">PyTorch Improper Resource Shutdown or Release vulnerability</a></td><td>moderate</td></tr><tr><td colspan="2"><td><a href="https://github.com/advisories/GHSA-3749-ghw9-m3mg">PyTorch susceptible to local Denial of Service</a></td><td>low</td></tr></table>
<h2>License Issues</h2>
<h4><em>hugegraph-ml/requirements.txt</em></h4>
<table><tr><td>Package</td><td>Version</td><td>License</td><td>Issue Type</td></tr><tr><td><a href="https://github.com/pytorch/pytorch">torch</a></td><td>2.6.0</td><td>Null</td><td>Unknown License</td></tr></table>
<blockquote><strong>Denied Licenses</strong>: GPL-3.0, AGPL-1.0, AGPL-3.0, LGPL-2.0, CC-BY-3.0</blockquote>
<h2>OpenSSF Scorecard</h2>
<table><tr><th>Package</th><th>Version</th><th>Score</th><th>Details</th></tr>
<tr><td><a href="https://github.com/pytorch/pytorch"> pip/torch </a></td><td>2.6.0</td>
<td>:green_circle: 6.4</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Binary-Artifacts</td><td>:green_circle: 9</td><td>binaries present in source code</td></tr><tr><td>Branch-Protection</td><td>:warning: -1</td><td>internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration</td></tr><tr><td>CI-Tests</td><td>:warning: -1</td><td>no pull request found</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no badge detected</td></tr><tr><td>Code-Review</td><td>:green_circle: 10</td><td>all last 30 commits are reviewed through Prow</td></tr><tr><td>Contributors</td><td>:green_circle: 10</td><td>35 different organizations found -- score normalized to 10</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Dependency-Update-Tool</td><td>:warning: 0</td><td>no update tool det
ected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) out of 30 and 15 issue activity out of 30 found in the last 90 days -- score normalized to 10</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>no published package detected</td></tr><tr><td>Pinned-Dependencies</td><td>:warning: -1</td><td>internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration</td></tr><tr><td>SAST</td><td>:warning: 0</td><td>no SAST tool detected</td></tr><tr><td>Security-Policy</td><td>:green_circle: 10</td><td>security policy file detected</td></tr><tr><td>Signed-Releases</td><td>:warning: 0</td><td>0 out of 5 artifacts are signed -- score normalized to 0</td></tr><tr><td>Token-Permissions</td><td>:warning: -1</td><td>internal error: error during branchesHan
dler.setup: internal error: githubv4.Query: Resource not accessible by integration</td></tr><tr><td>Vulnerabilities</td><td>:green_circle: 10</td><td>no vulnerabilities detected</td></tr><tr><td>Webhooks</td><td>:warning: -1</td><td>check is not supported for this request: SCORECARD_V6 is not set, not running the Webhook check</td></tr></table></details></td></tr>
</table><h2>Scanned Files</h2>
<ul><li>hugegraph-ml/requirements.txt</li></ul>
<!-- dependency-review-pr-comment-marker -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For additional commands, e-mail: issues-help@hugegraph.apache.org
Re: [PR] chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml [incubator-hugegraph-ai]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] commented on PR #213:
URL: https://github.com/apache/incubator-hugegraph-ai/pull/213#issuecomment-2820060031
OK, I won't notify you about version 2.x.x again, unless you re-open this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For additional commands, e-mail: issues-help@hugegraph.apache.org
Re: [PR] chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml [incubator-hugegraph-ai]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] closed pull request #213: chore(deps): bump torch from 2.2.0 to 2.6.0 in /hugegraph-ml
URL: https://github.com/apache/incubator-hugegraph-ai/pull/213
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@hugegraph.apache.org
For additional commands, e-mail: issues-help@hugegraph.apache.org