Bump the pip group across 1 directory with 3 updates

[dependabot]

Bumps the pip group with 3 updates in the / directory: torch, jupyter-server and transformers.

Updates torch from 2.12.0 to 2.12.1

Release notes

Sourced from torch's releases.

PyTorch 2.12.1 Release, bug fix release

This release is meant to fix the following regressions and silent correctness issues:

Regression fixes

• Fix nondeterministic outputs in test_batch_invariance with FLASH_ATTN on NVIDIA B200 GPUs (#181248), fixed by updating Triton to 3.7.1 (#186814)
• Fix illegal memory access in the Triton convolution2d_bwd_weight kernel on B100/B200 (sm100) GPUs (#187081), fixed by updating Triton to 3.7.1 (#186814)
• Fix fill_ on byte-dtype views with misaligned storage offset (#186821)

Releng / Build

• Drop CPython 3.13t from the binary build matrix (#182951)

Commits

• 7269437 Update triton to 3.7.1 release (#186814)
• 88f16c2 [MPS] Fix fill_ on byte-dtype views with misaligned storage offset (#186821)
• ccf6e67 [release-only] Update version to 2.12.1 (#186813)
• 88a6dc7 Revive CUDA 12.9 nightly binary builds (#186015)
• ded5505 [CD] Drop CPython 3.13t from binary build matrix (#182951) (#186654)
• See full diff in compare view

Updates jupyter-server from 2.19.0 to 2.20.0

Release notes

Sourced from jupyter-server's releases.

v2.20.0

2.20.0

(Full Changelog)

Security fixes

• CVE-2026-44727 GHSA-fcw5-x6j4-ccmp

Enhancements made

• Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@​Yann-P, @​minrk)
• Add a toggle to enable curve encryption for all kernels that support it #1638 (@​krassowski, @​Carreau, @​ianthomas23, @​minrk)

Bugs fixed

• Grab the port from bind_sockets in case its different #1651 (@​choldgraf, @​krassowski)

Maintenance and upkeep improvements

• Fix test_authorizer having a spurious comma in params #1664 (@​krassowski)
• Add a reminder to merge GHSA before release #1659 (@​Yann-P, @​Carreau)
• Exclude problematic pywinpty 3.0.4 version #1658 (@​krassowski)
• ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@​Carreau, @​Copilot)

Documentation improvements

• Align docs for curve encryption with latest JEP version #1660 (@​krassowski, @​Carreau)
• Remove PGP key from docs #1653 (@​Yann-P, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​choldgraf (activity) | @​Copilot (activity) | @​ianthomas23 (activity) | @​krassowski (activity) | @​minrk (activity) | @​Yann-P (activity)

Changelog

Sourced from jupyter-server's changelog.

2.20.0

(Full Changelog)

Enhancements made

• Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@​Yann-P, @​minrk)
• Add a toggle to enable curve encryption for all kernels that support it #1638 (@​krassowski, @​Carreau, @​ianthomas23, @​minrk)

Bugs fixed

• Grab the port from bind_sockets in case its different #1651 (@​choldgraf, @​krassowski)

Maintenance and upkeep improvements

• Fix test_authorizer having a spurious comma in params #1664 (@​krassowski)
• Add a reminder to merge GHSA before release #1659 (@​Yann-P, @​Carreau)
• Exclude problematic pywinpty 3.0.4 version #1658 (@​krassowski)
• ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@​Carreau, @​Copilot)

Documentation improvements

• Align docs for curve encryption with latest JEP version #1660 (@​krassowski, @​Carreau)
• Remove PGP key from docs #1653 (@​Yann-P, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​choldgraf (activity) | @​Copilot (activity) | @​ianthomas23 (activity) | @​krassowski (activity) | @​minrk (activity) | @​Yann-P (activity)

Commits

• 05a78ad Publish 2.20.0
• 6cbee8d Merge commit from fork
• 333e700 Fix test_authorizer having a spurious comma in params (#1664)
• cccd543 Fix CI: explicitly pass base-setup inputs to avoid strict validation failures
• cd16d71 Align docs for curve encryption with latest JEP version (#1660)
• e458061 Add a toggle to enable curve encryption for all kernels that support it (#1638)
• 0ceeb4f Add note in RELEASE.md
• b13f8a2 Markdown does not work.
• e885b10 Add GHSA reminder in prep-release
• 0e28c90 Exclude problematic pywinpty 3.0.4 version (#1658)
• Additional commits viewable in compare view

Updates transformers from 4.57.6 to 5.0.0rc3

Commits

• cb5079f v5.0.0rc3
• d1808f2 [ci] Fixing some failing tests for important models (#43231)
• 3d27645 Add LightOnOCR model implementation (#41621)
• 77146cc fix crash in when running FSDP2+TP (#43226)
• 61317f5 [CB] Ensure parallel decoding test passes using FA (#43277)
• 1efe1a6 Fix failing PegasusX, Mvp & LED model integration tests (#43245)
• e8ae373 [consistency] Ensure models are added to the _toctree.yml (#43264)
• c85be98 [docs] tensorrt-llm (#43176)
• 38022fd [style] Fix init isort and align makefile and CI (#43260)
• e977446 Fix failing Hiera, SwiftFormer & LED Model integration tests (#43225)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Updates core ML and notebook dependencies to improve stability and security. Upgrades torch to 2.12.1, jupyter-server to 2.20.0, and transformers to 5.0.0rc3.

• Dependencies

  • torch 2.12.1: bug-fix release; updates triton to 3.7.1 for NVIDIA B100/B200 stability.
  • jupyter-server 2.20.0: includes security fix (GHSA-fcw5-x6j4-ccmp) and small UX improvements.
  • transformers 5.0.0rc3: major update; requires huggingface-hub 1.x and adds typer-slim (CLI); potential breaking changes.
  • Transitives updated accordingly (e.g., huggingface-hub 1.20.1, typer, rich).

• Migration

  • Run tests/notebooks to catch transformers v5 API breaks; consult v5 migration notes.
  • If issues arise, consider pinning transformers to 4.57.x temporarily.
  • Optionally enable Jupyter curve encryption if desired; no config changes required otherwise.

^{Written for commit 95f6f10. Summary will update on new commits.}