Skip to content

Bump hydra-core from 1.3.2 to 1.3.5 - #18

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/hydra-core-1.3.5
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/hydra-core-1.3.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026 •

Copy link
Copy Markdown

Bumps hydra-core from 1.3.2 to 1.3.5.

Release notes

Sourced from hydra-core's releases.

Hydra 1.3.5

What's Changed

  • Warn Hydra 1.3 users relying on Hydra 1.1 behavior (#3347)

Full Changelog: hydra-ecosystem/hydra@v1.3.4...v1.3.5

Hydra 1.3.4

Security patch release for the 1.3 line.

  • Add a blocklist to hydra.utils.instantiate() for security-sensitive _target_ callables.

Users on Hydra 1.3 should upgrade from hydra-core<=1.3.3 to hydra-core==1.3.4.

Hydra 1.3.3 fixes source builds with modern setuptools by removing the setup.py dependency on pkg_resources. Fixes #3207.

Changelog

Sourced from hydra-core's changelog.

1.3.5 (2026-08-06)

API Change (Renames, deprecations and removals)

  • Warn Hydra 1.3 applications that rely on Hydra 1.1 compatibility before upgrading to Hydra 1.4. (#3334) 1.3.4 (2026-07-05) ==================

Bug Fixes

  • Add an instantiate target blocklist for security-sensitive callables. (#3259) 1.3.3 (2026-06-11) ==================

Bug Fixes

  • Remove the setup.py dependency on pkg_resources for source builds. (#3207)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 13, 2026
Bumps [hydra-core](https://github.com/facebookresearch/hydra) from 1.3.2 to 1.3.5.
- [Release notes](https://github.com/facebookresearch/hydra/releases)
- [Changelog](https://github.com/hydra-ecosystem/hydra/blob/v1.3.5/NEWS.md)
- [Commits](hydra-ecosystem/hydra@v1.3.2...v1.3.5)

---
updated-dependencies:
- dependency-name: hydra-core
  dependency-version: 1.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/hydra-core-1.3.5 branch from a19a9e6 to 6c596c0 Compare August 17, 2026 07:47
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Author

Superseded by #20.

@dependabot dependabot Bot closed this Sep 2, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/hydra-core-1.3.5 branch September 2, 2026 11:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants