Bump transformers from 5.5.0 to 5.10.1 in /python - #14358
Conversation
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): ca8ef4673379
Model: claude-opus-4.8
Overview
This Dependabot change touches only python/uv.lock: it advances transformers across the 4→5 major boundary to 5.10.1 (piggy-backing a huggingface-hub 0.x→1.x bump) and simplifies redundant sys_platform environment markers. The marker churn was verified to be a semantic no-op because the resolution universe is pinned to exactly {darwin, linux, win32}, so dropping the three-way disjunction changes no install set. The one residual risk is real and confirmed by reproduction: transformers 5.x deleted the text2text-generation (the connector's default) and summarization pipeline tasks, so HuggingFaceTextCompletion now fails at construction for two of its three advertised tasks, and the mocked unit tests hide it.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 high) across 1 file. Details are attached to the affected lines below.
Affected areas: python/uv.lock
| @@ -7391,29 +7381,28 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "transformers" | |||
| version = "4.57.6" | |||
| version = "5.10.1" | |||
There was a problem hiding this comment.
Bumping transformers to 5.10.1 crosses the 4→5 major boundary, which removed the text2text-generation and summarization pipeline tasks — in 5.10.1, transformers.pipelines.SUPPORTED_TASKS contains only text-generation of the three (verified against the pinned version). HuggingFaceTextCompletion defaults to task="text2text-generation" and calls pipeline(task=task, ...) at python/semantic_kernel/connectors/ai/hugging_face/services/hf_text_completion.py:72, so constructing the service with the default task — or with task="summarization" — now raises KeyError: "Unknown task ..." on the first call. Two of the connector's three advertised tasks are broken at construction. The existing unit tests patch pipeline, so CI stays green while the real connector fails. Please either cap the dependency at transformers[torch] >=4.28,<5.0 in python/pyproject.toml (keeping the lock on 4.57.6), or update the connector to map the removed seq2seq tasks onto a 5.x-supported task and add a non-mocked construction test before adopting 5.x.
Bumps [transformers](https://github.com/huggingface/transformers) from 5.5.0 to 5.10.1. - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v5.5.0...v5.10.1) --- updated-dependencies: - dependency-name: transformers dependency-version: 5.10.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
ca8ef46 to
ba2b1c7
Compare
|
Looks like transformers is up-to-date now, so this is no longer needed. |
|
Superseded by #14385 |
### Motivation and Context Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies. ### Description Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest `main`. The incompatible MCP 2.x and Python 3.10 `onnxruntime-genai` updates are excluded, the private-feed-only `@humanfs/node` update is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency. ### Related Issue Supersedes: - microsoft#14177 - microsoft#14179 - microsoft#14180 - microsoft#14190 - microsoft#14209 - microsoft#14230 - microsoft#14233 - microsoft#14254 - microsoft#14257 - microsoft#14259 - microsoft#14260 - microsoft#14261 - microsoft#14271 - microsoft#14272 - microsoft#14273 - microsoft#14274 - microsoft#14276 - microsoft#14280 - microsoft#14282 - microsoft#14299 - microsoft#14300 - microsoft#14335 - microsoft#14337 - microsoft#14338 - microsoft#14339 - microsoft#14357 - microsoft#14358 - microsoft#14361 - microsoft#14365 - microsoft#14366 - microsoft#14367 - microsoft#14368 - microsoft#14369 ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rogerbarreto <19890735+rogerbarreto@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
Bumps transformers from 5.5.0 to 5.10.1.
Release notes
Sourced from transformers's releases.
... (truncated)
Commits
90c3ae5Patch because we had to yank 5.10 because the release branch was not up to date0bd94b3v5.10.01423d22who needs encoders? (#46385)50eb20aFix dsv4 dequant + tp/ep (#46378)74464e8Fix wrong changes produced by style/repo. check bot (#46371)1b8ec34Fix path traversal when saving Bark voice preset embeddings (#46237)e820678Add Sapiens2 Model (#45919)595721cPass library_name/version to Hub calls via a shared HfApi (#46318)0f0036cdocs: update ACL Anthology URL in CITATION.cff (#46352)fa6c830DeepGEMM BF16 + mixed FP8/FP4 + MegaMoE + refactor (#45634)