From e59775178e00de4286cef02a9ddcbf10bd52b094 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:42:26 +0000 Subject: [PATCH 1/6] chore(deps): update datasketch requirement Updates the requirements on [datasketch](https://github.com/ekzhu/datasketch) to permit the latest version. - [Release notes](https://github.com/ekzhu/datasketch/releases) - [Commits](https://github.com/ekzhu/datasketch/compare/v1.6.0...v2.0.0) --- updated-dependencies: - dependency-name: datasketch dependency-version: 2.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f1e2ce1e..cac144b8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -159,7 +159,7 @@ ingestion = [ # operators auditing larger datasets where MinHash's recall/precision # trade-off is the industry standard (NeMo Curator, Dolma, RedPajama). ingestion-scale = [ - "datasketch>=1.6.0,<2.0.0", + "datasketch>=1.6.0,<3.0.0", ] # Optional Presidio ML-NER PII detector. Adds the unstructured-identifier From 1bd624861d17800d67ec8b6797a8ce6b99fd3338 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:42:42 +0000 Subject: [PATCH 2/6] chore(deps): update xxhash requirement Updates the requirements on [xxhash](https://github.com/ifduyue/python-xxhash) to permit the latest version. - [Release notes](https://github.com/ifduyue/python-xxhash/releases) - [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst) - [Commits](https://github.com/ifduyue/python-xxhash/compare/v3.0.0...v4.0.1) --- updated-dependencies: - dependency-name: xxhash dependency-version: 4.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f1e2ce1e..bd2b8260 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -150,7 +150,7 @@ ingestion = [ "ebooklib>=0.18,<1.0.0", "beautifulsoup4>=4.12.0,<5.0.0", "langdetect>=1.0.9,<2.0.0", - "xxhash>=3.0.0,<4.0.0", + "xxhash>=3.0.0,<5.0.0", ] # Optional MinHash LSH near-duplicate detector for >50K-row corpora. From 745095d60f677838c79a8576d90b62d9484f4bd9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:42:49 +0000 Subject: [PATCH 3/6] chore(deps): update pytest-randomly requirement Updates the requirements on [pytest-randomly](https://github.com/pytest-dev/pytest-randomly) to permit the latest version. - [Changelog](https://github.com/pytest-dev/pytest-randomly/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest-randomly/compare/3.15.0...5.0.0) --- updated-dependencies: - dependency-name: pytest-randomly dependency-version: 5.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f1e2ce1e..c8ed7f9d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -187,7 +187,7 @@ dev = [ # surface in CI instead of waiting for a Python micro-bump or runner # change to flip collection order. Run locally via # ``pytest --randomly-seed=`` to reproduce a failure. - "pytest-randomly>=3.15.0,<4.0.0", + "pytest-randomly>=3.15.0,<6.0.0", # Bounded on purpose. ruff 0.16.0 began formatting Python blocks *inside # Markdown*, taking the format check from 277 files to 562 — on an unchanged # tree that is 32 newly "unformatted" documents and a red lint job nobody From 0ecfc7b4adc5310563533cdfb58b3ba36ea75dde Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 09:42:57 +0000 Subject: [PATCH 4/6] chore(deps): update pypdf requirement Updates the requirements on [pypdf](https://github.com/py-pdf/pypdf) to permit the latest version. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](https://github.com/py-pdf/pypdf/compare/4.0.0...6.20.1) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.20.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f1e2ce1e..c2fd5ce3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -145,7 +145,7 @@ export = [ # so a bare install still works. # OCR is intentionally out of scope (handle externally with Tesseract). ingestion = [ - "pypdf>=4.0.0,<6.0.0", + "pypdf>=4.0.0,<7.0.0", "python-docx>=1.0.0,<2.0.0", "ebooklib>=0.18,<1.0.0", "beautifulsoup4>=4.12.0,<5.0.0", From b87547be6023a795de2c79efa48a890ab29da28e Mon Sep 17 00:00:00 2001 From: Cemil ILIK Date: Sun, 18 Oct 2026 14:06:13 +0300 Subject: [PATCH 5/6] docs(changelog): note the dependency ranges that now admit a newer major Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bdcc5ea1..b6e68c78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,11 @@ All notable changes to ForgeLM are documented here. ### Changed +- Admit newer majors of four optional or dev dependencies: `pypdf` 6 and `xxhash` 4 (the `ingestion` extra), `datasketch` 2 (the + `ingestion-scale` extra) and `pytest-randomly` 4 and 5 (the `dev` extra). The ingestion, data-audit and doctor test modules pass on pypdf + 6.21.1, xxhash 4.0.1 and datasketch 2.0.0 with the same results as on the previous majors; CI installs datasketch 2.0.0 and + pytest-randomly 5.0.0 for the full suite. `huggingface_hub` stays below 2 (the supported transformers lines pin it there or leave + it untested). - Raise the `transformers` floor from `>=5.3.0` to `>=5.10.1` (and `huggingface_hub` from `>=1.3.0` to `>=1.5.0`, which transformers 5.10 requires). `5.3.0` was described as the CVE fix floor but still admitted CVE-2026-5241 (a LightGlue `config.json` overrides `trust_remote_code: false`, fixed in 5.5.0) and CVE-2026-9856 (a `chat_template` name in From 76bcbdb0791c7b90ca132cd047a16d61394cdf6d Mon Sep 17 00:00:00 2001 From: Cemil ILIK Date: Sun, 18 Oct 2026 14:06:40 +0300 Subject: [PATCH 6/6] docs(changelog): say plainly that huggingface_hub 2 is untested Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b6e68c78..c8eac06e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,8 +40,7 @@ All notable changes to ForgeLM are documented here. - Admit newer majors of four optional or dev dependencies: `pypdf` 6 and `xxhash` 4 (the `ingestion` extra), `datasketch` 2 (the `ingestion-scale` extra) and `pytest-randomly` 4 and 5 (the `dev` extra). The ingestion, data-audit and doctor test modules pass on pypdf 6.21.1, xxhash 4.0.1 and datasketch 2.0.0 with the same results as on the previous majors; CI installs datasketch 2.0.0 and - pytest-randomly 5.0.0 for the full suite. `huggingface_hub` stays below 2 (the supported transformers lines pin it there or leave - it untested). + pytest-randomly 5.0.0 for the full suite. `huggingface_hub` stays below 2: ForgeLM has not been tested with it. - Raise the `transformers` floor from `>=5.3.0` to `>=5.10.1` (and `huggingface_hub` from `>=1.3.0` to `>=1.5.0`, which transformers 5.10 requires). `5.3.0` was described as the CVE fix floor but still admitted CVE-2026-5241 (a LightGlue `config.json` overrides `trust_remote_code: false`, fixed in 5.5.0) and CVE-2026-9856 (a `chat_template` name in