[dependabot]

Bumps the ci-requirements group in /.github/workflows with 6 updates:

Package	From	To
numpy	2.2.5	2.5.4
torch	2.13.0	2.14.1
pytest	9.0.3	9.1.1
ninja	1.11.1.4	1.13.2
nanobind	2.10.2	3.1.0
scikit-build-core	0.11.6	1.1.1

Updates numpy from 2.2.5 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the dependency groups from pyproject.toml to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

• Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates torch from 2.13.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

• Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
• Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
• Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
  • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
  • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

• Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
• Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

PyTorch 2.14.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Security
• Developers

Highlights

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Backwards Incompatible Changes

torch.nn

• torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy="balanced"; use "compact" instead (#188283)

  The "balanced" policy was removed because "compact" provides the same weight-gradient accumulation precision with lower memory use on CUDA, already uses the equivalent scratch layout for mixed-precision inputs on other devices, and was never selected by "auto". Constructing the options with acc_policy="balanced" now raises ValueError: invalid acc_policy: 'balanced'; expected one of 'auto', 'accurate', 'compact'.

... (truncated)

Commits

• 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
• 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
• 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
• e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
• 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
• 2b3ec34 [release/2.14] Import SDPAParams in test_transformers to fix lint (#194970)
• 08187d9 [cuDNN] Add guards for cuDNN SDPA decode (#194963)
• 8ceea97 Pin cython < 3.3.0 for the Windows Triton wheel build (#194931)
• 99ecebc [Cherry-pick][release/2.14] [inductor] Fix loop-local load CSE lifetime (#194...
• ec283a7 Bump the Python 3.15 numpy pin to 2.5.2 (#194821)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates ninja from 1.11.1.4 to 1.13.2

Release notes

Sourced from ninja's releases.

v1.13.2

• Fix Ninja exit code when interrupted (issue #2681) #2690

v1.13.1

Bugfixes:

• Fix LINK : fatal error LNK1104: cannot open file on Windows in some cases #2616
• Compatibility with older distros for Linux ARM version #2619
• Restore "multiple rules generate" error with dyndep #2621

v1.13.0

• Ninja now automatically joins a GNU Make jobserver as a client (version 4.4 on non-Windows systems required for "fifo" style) #1139
• Print exit code of failed subcommands #1507
• New tool ninja -t compdb-targets like compdb, but takes a list of targets instead of rules #1544
• Support for ANSI (color) escape codes in NINJA_STATUS #713

See https://github.com/ninja-build/ninja/milestone/8?closed=1 for a complete list of changes.

v1.12.1

Bugfixes:

• Screen updates extremely slow on Windows #2435
• Dry run error if the build directory does not exist #2431
• New critical path scheduler performance improvements #2443

https://github.com/ninja-build/ninja/milestone/11?closed=1

v1.12.0

• Critical path scheduler which orders the jobs by their runtime history #2177 This may break your build if you haven't specified your dependencies correctly.
• Resiliency against inputs changing during the build #1943
• Reliable ETA and progress percentage in status #1963
• Support for path lengths over 260 characters on Windows #1900
• ARM binaries are now available for Windows and Linux, too
• Several bugfixes

See https://github.com/ninja-build/ninja/milestone/6?closed=1 for a complete list of changes.

Commits

• See full diff in compare view

Updates nanobind from 2.10.2 to 3.1.0

Changelog

Sourced from nanobind's changelog.

Version 3.1.0 (Sep 28, 2026)

• Python subclasses can now combine one nanobind base with additional :ref:Python mixins <python_mixins>, including cooperative super() calls on CPython and PyPy. Inheriting from multiple nanobind bases remains unsupported. (discussion [#1436](https://github.com/wjakob/nanobind/issues/1436) <https://github.com/wjakob/nanobind/discussions/1436>__)

• The low-level instance API gained :cpp:func:nb::inst_python_derived() <inst_python_derived>, which reports whether a nanobind instance belongs to a Python subclass of the bound type. (commit c442d7 <https://github.com/wjakob/nanobind/commit/c442d7577f50c01b64b6204e2f55e0f84f60e635>__).

• Added new low-level functions :cpp:func:nb::keep_alive_obj() <keep_alive_obj> and :cpp:func:nb::keep_alive_cb() <keep_alive_cb>, which expose the mechanism behind the :cpp:class:nb::keep_alive <keep_alive> annotation. (commit 25192f <https://github.com/wjakob/nanobind/commit/25192f432f7d4dec4d24227c972226e075274621>__).

• The new function :cpp:func:intrusive_counter::ref_count() returns the reference count of an intrusively reference-counted object while it is owned by C++. (commit 1f26fb <https://github.com/wjakob/nanobind/commit/1f26fb363752decf0cf825039f213fbd1708ee09>__).

• Fixed stale trampoline override caches on PyPy. Changing an attribute of a nanobind type now correctly invalidates the caches of its Python subclasses. (commit 701c89 <https://github.com/wjakob/nanobind/commit/701c896751defe26e9a216e81f0e133339ed3251>__).

• The std::map/std::unordered_map and std::set type casters can now also handle containers like std::flat_map whose iterators return temporary values. (PR [#1434](https://github.com/wjakob/nanobind/issues/1434) <https://github.com/wjakob/nanobind/pull/1434>__).

• The :ref:Bazel documentation <bazel> was rewritten and now presents an approach based on the Bazel Central Registry. (PR [#1435](https://github.com/wjakob/nanobind/issues/1435) <https://github.com/wjakob/nanobind/pull/1435>__).

• Miscellaneous minor improvements. (PRs [#1429](https://github.com/wjakob/nanobind/issues/1429) <https://github.com/wjakob/nanobind/pull/1429>, [#1428](https://github.com/wjakob/nanobind/issues/1428) <https://github.com/wjakob/nanobind/pull/1428>, [#1414](https://github.com/wjakob/nanobind/issues/1414) <https://github.com/wjakob/nanobind/pull/1414>, [#1431](https://github.com/wjakob/nanobind/issues/1431) <https://github.com/wjakob/nanobind/issues/1431>)

Version 3.0.1 (Aug 28, 2026)

• Fixed an issue where the std::chrono::duration caster interpreted a Python float even when implicit conversion was not desired. (PR [#1420](https://github.com/wjakob/nanobind/issues/1420) <https://github.com/wjakob/nanobind/pull/1420>__).

• Minor tweak to the NB_SLOT_ALIAS macro so that clang-cl can compile nanobind 3.0.0 code on Windows. This compiler is now also tested by the CI.

... (truncated)

Commits

• 68480a9 v3.1.0 release
• 32c595d Support Python mixins alongside a nanobind base
• 701c896 Fix trampoline cache invalidation of subclasses on PyPy
• 1f26fb3 Add intrusive_counter::ref_count()
• c1cd12b Overhaul Bazel documentation
• 65b8067 Update nb_set.h
• e3daa99 Fix the reference type in dict_caster's item loop
• 991c73a Expose __doc__ on bound methods via a getset descriptor
• c3ec792 Fix conversion warning with 32-bit Eigen::Index
• 5775550 Remove verbose CMake notification message
• Additional commits viewable in compare view

Updates scikit-build-core from 0.11.6 to 1.1.1

Release notes

Sourced from scikit-build-core's releases.

Version 1.1.1

This patch release improves performance and fixes two minor regressions from 1.1.0. Free-threaded builds work again on CMake versions between 3.30 and 4.1.2 (please update CMake to 4.1.2+, though). A checkout inside an ignored directory is again left out of the SDist. Wheel builds are also faster, especially on Windows, because package sources are no longer copied to a staging directory first.

Fixes:

• Only set Python_FIND_ABI for free-threaded builds on CMake 4.1.2+, since older versions fail to find Development.Module when it is set (#1597) by @​henryiii in #1598
• SDist: a repository boundary that the outer repository ignores is excluded with its full subtree (#1593) by @​henryiii in #1594. Also improves performance.

Performance:

• Write package sources directly to wheels without staging copies (#1591) by @​sepcnt in #1592

CI and testing:

• Suppress sphinx-llm unknown node warnings by @​henryiii in #1595
• Use CMake 4.2 on windows-11-arm by @​henryiii in #1590

Full Changelog: scikit-build/scikit-build-core@v1.1.0...v1.1.1

Version 1.1.0

Packages can now declare their own config-settings in a tool.scikit-build.config-setting table. This gives packages the opportunity to add a documented interface in place of raw CMake defines. The new scikit-build settings list command shows all the config-settings that a project accepts. New settings include cmake.fresh, if.not overrides, and sdist.resolve-symlinks = "error". import-names and import-namespaces (PEP 794) are filled from Python if set as dynamic. project.version is now kept exactly as written in the metadata (1.1+). Editable loaders expose their search paths, redirect mode gives a deterministic __path__ order, and you can set up a persistent install tree even without rebuild-on-import. Other bugs and performance issues are addressed.

Features:

• New settings:
  • tool.scikit-build.config-setting for package-declared config-settings by @​henryiii in #1489
  • cmake.fresh to configure from scratch by @​henryiii in #1516
  • if.not overrides by @​henryiii in #1539
• CLI:
  • scikit-build settings list lists supported config-settings by @​henryiii in #1522
  • scikit-build build requires accepts -C/--config-setting to pass config-settings to the backend hook, and --type {static,dynamic,both} to select the static build-system.requires, the dynamic hook output, or both by @​henryiii in #1584
• SDist:
  • sdist.resolve-symlinks = "error" fails the SDist build if an included path is a symlink, and lists each link with its target. This includes sdist.force-include sources and the files under them. Directory links are not followed. Requires minimum-version 1.1 or unset (#1581) by @​henryiii in #1583
• Metadata:
  • import-names and import-namespaces (PEP 794) listed in project.dynamic are computed from the Python packages (#1536) by @​henryiii in #1578
  • project.version is kept as written in the Version metadata field and in SKBUILD_PROJECT_VERSION_FULL, so a calendar version such as 2024.01.05 keeps its leading zeros. Filenames stay normalized. Requires minimum-version 1.1 or unset by @​henryiii in #1572
• Editable:
  • Loaders expose their search paths as a paths attribute by @​henryiii in #1567
  • An explicit editable.rebuild = false is honored with editable.rebuild-dir, so a persistent install tree can be used without rebuild-on-import (#1576) by @​henryiii in #1577
• File API:
  • Complete the file-api models and keep reference data by @​henryiii in #1521
• Drop Python 3.8 by @​henryiii in #1281

Fixes:

• Builder:
  • Compute the wheel tag from the build environment (tool.scikit-build.env) by @​henryiii in #1575
  • Honor a CMAKE_GENERATOR define when computing build requirements by @​henryiii in #1557
  • Read Py_GIL_DISABLED="0" as not free-threaded by @​henryiii in #1574

... (truncated)

Commits

• 67040d0 docs: changelog for 1.1.1 (#1599)
• 82de0b8 fix: only set Python_FIND_ABI on CMake 4.1.2+ (#1598)
• d586691 fix(sdist): exclude subtree of an ignored repository boundary (#1594)
• e750d34 perf: Write package sources directly to wheels without staging copies (#1592)
• 214286b chore(deps): bump the github-actions group with 3 updates (#1596)
• 4b21180 docs: suppress sphinx-llm unknown node warnings (#1595)
• 0f65cb1 ci: use CMake 4.2 on windows-11-arm (#1590)
• b43c0e8 docs: changelog credit for #1587, regenerate for 1.1 (#1589)
• 0c3a237 docs: changelog for 1.1.0 (#1579)
• b7254fb fix: use SOSABI instead of SOABI in abi3t template (#1587)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions