fix(deps, pyamber): update dependency transformers to v5.10.1 - #8313
fix(deps, pyamber): update dependency transformers to v5.10.1#8313renovate-bot wants to merge 3 commits into
Conversation
forking-renovate
Bot
added
dependencies
Backport auto-label reportThis
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8313 +/- ##
============================================
- Coverage 94.07% 93.63% -0.44%
+ Complexity 4814 4738 -76
============================================
Files 1196 1180 -16
Lines 48713 47175 -1538
Branches 5866 5647 -219
============================================
- Hits 45825 44173 -1652
- Misses 1436 1563 +127
+ Partials 1452 1439 -13
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Automated Reviewer SuggestionsBased on the
|
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🔴 | bs=10 sw=10 sl=64 | 488 | 0.298 | 17,794/53,930/53,930 us | 🔴 +98.3% / 🔴 +239.1% |
| 🔴 | bs=100 sw=10 sl=64 | 1,145 | 0.699 | 84,891/118,395/118,395 us | 🔴 +5.2% / 🟢 +19.3% |
| 🔴 | bs=1000 sw=10 sl=64 | 1,320 | 0.806 | 751,743/863,925/863,925 us | 🔴 +9.2% / 🟢 +32.9% |
Baseline details
Latest main fc7cfcd from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 488 tuples/sec | 590 tuples/sec | 750.65 tuples/sec | -17.3% | -35.0% |
| bs=10 sw=10 sl=64 | MB/s | 0.298 MB/s | 0.36 MB/s | 0.458 MB/s | -17.2% | -35.0% |
| bs=10 sw=10 sl=64 | p50 | 17,794 us | 16,153 us | 13,049 us | +10.2% | +36.4% |
| bs=10 sw=10 sl=64 | p95 | 53,930 us | 27,191 us | 15,902 us | +98.3% | +239.1% |
| bs=10 sw=10 sl=64 | p99 | 53,930 us | 27,191 us | 19,184 us | +98.3% | +181.1% |
| bs=100 sw=10 sl=64 | throughput | 1,145 tuples/sec | 1,172 tuples/sec | 960.3 tuples/sec | -2.3% | +19.2% |
| bs=100 sw=10 sl=64 | MB/s | 0.699 MB/s | 0.716 MB/s | 0.586 MB/s | -2.4% | +19.3% |
| bs=100 sw=10 sl=64 | p50 | 84,891 us | 81,292 us | 104,199 us | +4.4% | -18.5% |
| bs=100 sw=10 sl=64 | p95 | 118,395 us | 112,565 us | 110,645 us | +5.2% | +7.0% |
| bs=100 sw=10 sl=64 | p99 | 118,395 us | 112,565 us | 120,888 us | +5.2% | -2.1% |
| bs=1000 sw=10 sl=64 | throughput | 1,320 tuples/sec | 1,341 tuples/sec | 993.27 tuples/sec | -1.6% | +32.9% |
| bs=1000 sw=10 sl=64 | MB/s | 0.806 MB/s | 0.818 MB/s | 0.606 MB/s | -1.5% | +32.9% |
| bs=1000 sw=10 sl=64 | p50 | 751,743 us | 739,812 us | 1,012,191 us | +1.6% | -25.7% |
| bs=1000 sw=10 sl=64 | p95 | 863,925 us | 791,418 us | 1,054,057 us | +9.2% | -18.0% |
| bs=1000 sw=10 sl=64 | p99 | 863,925 us | 791,418 us | 1,081,313 us | +9.2% | -20.1% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,409.67,200,128000,488,0.298,17794.32,53929.56,53929.56
1,100,10,64,20,1746.21,2000,1280000,1145,0.699,84890.94,118394.90,118394.90
2,1000,10,64,20,15150.52,20000,12800000,1320,0.806,751742.73,863924.69,863924.69
transformers 5.5.0 -> 5.10.1 is a direct dep of amber/operator-requirements.txt, so the pyamber license drift check blocks until amber/LICENSE-binary-python claims the same version. transformers remains Apache-2.0, so the bullet stays in its existing section.
|
Pushed b165ceb on top of the bot's commit to fix the failing Root cause — Only the 3.12 leg goes red because Fix — one line: The other 22 drift lines in that same output ( Verification — before pushing, I re-ran
All six Generated-by: Claude Code (Opus 5) |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
4 participants
This PR contains the following updates:
==5.5.0→==5.10.1Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
CVE-2026-9856 / GHSA-xrqw-3rrv-vx5w
More information
Details
A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the
save_pretrained()methods ofPreTrainedTokenizerBaseandProcessorMixin, where keys from thechat_templatedictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a craftedtokenizer_config.jsonfile. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting fromProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
CVE-2026-9856 / GHSA-xrqw-3rrv-vx5w
More information
Details
A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the
save_pretrained()methods ofPreTrainedTokenizerBaseandProcessorMixin, where keys from thechat_templatedictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a craftedtokenizer_config.jsonfile. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting fromProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
huggingface/transformers (transformers)
v5.10.1Compare Source
Release v5.10.1
v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!
New Model additions
Gemma4 unified+ Gemma4 MTP
Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.
Key differences from standard Gemma 4:
Dense + LayerNormpipeline with factorized 2D positional embeddings, replacing the vision encoder.RMSNorm → Linearpipeline, replacing the mel spectrogram + Conformer encoder.Gemma4UnifiedMultimodalEmbedder(RMSNorm → Linear) for the final projection to text hidden space.You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.
Sapiens2
Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.
Links: Documentation | Paper
DeepSeek-OCR-2
DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.
Links: Documentation
Mellum
Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.
Links: Documentation
Mellumv2 code generation model (#46112) by @shadeMe in #46112Breaking changes
The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.
Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.
Parallelization
This release includes numerous bug fixes for model parallelism across multiple models (Gemma4, AltCLIP, ChineseClip, Blip-2, Whisper, Ovis2, Moshi) and parallel execution strategies, including fixes for tensor parallelism (TP), expert parallelism (EP), beam search under model parallel settings, and loss over-counting under TP/EP configurations. The continuous batching manager was also reworked for clearer control flow and improved TP race condition handling, and FSDP initialization via
from_pretrainedwas introduced.Revert] FSDP+Dtensor refactor related changes (#46246) by @vasqu in [#46246]create_bidirectional_mask(#46221) by @kaixuanliu in [#46221]Cache
Fixed a regression in encoder-decoder cache initialization where the decoder config was incorrectly applied to the cross-attention cache, and resolved a
RuntimeErrorcaused by buffer size limits when warming up the cache on MPS devices. Additional test infrastructure improvements were made to support read-only cache environments used in CI.RuntimeErroron mps (#46239) by @McPatate in [#46239]Quantization
Added support for DeepGEMM BF16, mixed FP8/FP4, and MegaMoE quantization via a grouped linear refactor, while fixing two bugs: an FP8 MoE reverse substring issue affecting DSv4 initialization, and a BitsAndBytes 4-bit/8-bit quantization bug that silently dropped chunked tensors from one-to-many weight converters.
Bugfixes and improvements
contributing.md,modular_transformers.md,multimodal_processing.md,add_vision_processing_components.md,add_audio_processing_components.md,modeling_rules.md,model_output_tracing.md,auto_docstring.md,testing.md,pr_checks.mdandadd_new_model.md. (#46345) by @filipinescu in [#46345]weightconverter.md,models.md,custom_models.md,monkey_patching.md,fusion_mapping.md,how_to_hack_models.md,model_sharing.mdandserialization.md. (#46309) by @filipinescu in [#46309]StaticCachebuilding an empty layer list whennum_kv_shared_layers == 0(#46235) by @tengomucho in [#46235]Configs] Fix layer type validation to include its mlp counterpart (#46220) by @vasqu in [#46220]num_items_in_batchover-counting for causal LM losses (#46204) by @qgallouedec in [#46204]maininstead of commit SHA for now (#46241) by @ydshieh in [#46241]Significant community contributions
The following contributors have made significant changes to the library over the last release:
contributing.md,modular_transformers.md,multimodal_processing.md,add_vision_processing_components.md,add_audio_processing_components.md,modeling_rules.md,model_output_tracing.md,auto_docstring.md,testing.md,pr_checks.mdandadd_new_model.md. (#46345)weightconverter.md,models.md,custom_models.md,monkey_patching.md,fusion_mapping.md,how_to_hack_models.md,model_sharing.mdandserialization.md. (#46309)create_bidirectional_mask(#46221)Mellumv2 code generation model (#46112)Revert] FSDP+Dtensor refactor related changes (#46246)Configs] Fix layer type validation to include its mlp counterpart (#46220)v5.10.0Compare Source
v5.9.0Compare Source
Release v5.9.0
New Model additions
Cohere2Moe
Command A+ is a Mixture-of-Experts (MoE) language model from Cohere that features a hybrid attention pattern combining sliding window and full attention layers. The model incorporates both shared and routed experts and supports a very large context window for processing extensive text sequences.
Links: Documentation
Parakeet tdt (#44171)
HRM-Text
HRM-Text is an improved autoregressive language-modeling variant of the Hierarchical Reasoning Model (HRM) that uses a hierarchical recurrent forward pass with two transformer stacks - one for slow, abstract planning (H) and one for fast, detailed computation (L) - reused inside a nested recurrence. It features PrefixLM attention where instruction tokens attend bidirectionally while response tokens attend causally, per-head sigmoid output gates, and parameterless RMSNorm. The model is designed as a base language model without instruction tuning or chat templates.
Links: Documentation | Paper
Breaking changes
The
text_embedsinput for SAM3, EdgeTAM, and SAM3-Lite-Text models now expects full text embeddings instead of just pooler outputs, aligning with other models in the library — users must update their inputs accordingly.Audio
Audio support was expanded with the addition of AudioFlamingoNext model checkpoints and improved compilability of audio/vision encoders via standalone pure functions. Additional improvements include better error messaging when loading audio from video files and new documentation for audio/video processors.
Generation
Fixed generation issues including
inputs_embedsandper_layer_inputshandling for Gemma4, anAttributeErrorin RAG'sgenerate()caused by missing config fields, and flaky VLM generation tests by blocking special image tokens during sampling.Bugfixes and improvements
masking_utils.py(#46066) by @Cyrilvallez in [#46066]huggingface.codomain in prose links (#46042) by @kiwigitops in [#46042]HRM Text] Add integration tests (#46033) by @vasqu in [#46033]_attn_implementationand fix request offset ingenerate_batch()(#45943) by @sergiopaniego in [#45943]per_layer_inputsfor every Gemma4 variants (#45927) by @Cyrilvallez in [#45927]Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.