chore(deps): bump torch from 2.11.0 to 2.13.0 in /envs/openapp_env#993
chore(deps): bump torch from 2.11.0 to 2.13.0 in /envs/openapp_env#993dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [torch](https://github.com/pytorch/pytorch) from 2.11.0 to 2.13.0. - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.11.0...v2.13.0) --- updated-dependencies: - dependency-name: torch dependency-version: 2.13.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Dependabot lock-only bump: torch 2.11.0 → 2.13.0 in envs/openapp_env/uv.lock (the only changed file; +55/−52). torch is transitive here (pulled via browsergym; not pinned in pyproject.toml), so a lock-only change with no pyproject.toml edit is correct.
Automated Checks
- Lint: FAIL — not attributable to this PR.
bash .claude/hooks/lint.shexits non-zero, but every flagged file is pre-existingruff formatdrift in other envs'.pyfiles (agent_world_model_env,chat_env,coding_tools_env,jupyter_env,opencode_env,repl_env,terminus_env,textarena_env). This PR touches zero.pyfiles, and.lock/TOML are not linted. No lint issue originates from this change. - Debug code: CLEAN.
check-debug.shscans onlysrc/; itsconsole.print/TODO hits are pre-existing and none are in this PR's changed file.
Open RFCs Context
Open RFCs — 000/001/002/003/005 (In Review), 010 (Draft), 004 (no status) — cover core abstractions, env spec, MCP, agentic harnesses, world-modeling, and rewards. None governs Python packaging / dependency pins / the PyPI index, so none is relevant to a lockfile dependency bump.
Tier 1: Fixes Required
None. No source changed, and the PR's lockfile is internally consistent — uv lock --check passes on the PR revision. It actually repairs a pre-existing inconsistency (see the fastapi note below).
Tier 2: Alignment Discussion
Principle Conflicts
None identified. The reproducibility/provenance flag that often accompanies these uv-lock bumps does not apply: envs/openapp_env/uv.lock is already fully on pypi.org/simple (0 HF-mirror refs at base, revision = 3 unchanged) — i.e. "born clean" — so this bump introduces no index-source flip or provenance drift.
RFC Conflicts
None identified.
Process note (config, not a code defect) — cc @burtenshaw
This is a native dependabot/uv/envs/openapp_env/... PR, yet .github/dependabot.yml's uv updater declares exclude-paths: ["envs/**"]. The uv ecosystem isn't honoring that exclusion (a known recurring platform behavior; the codex/dependabot-envs-* aggregate roll-ups are the intended path for env locks). Not a defect in this PR — noted for maintainer awareness only. (dependabot.yml is unchanged here, hence in the body rather than inline.)
What I verified (all green)
- Security-positive:
torch2.11.0 carriesGHSA-rrmf-rvhw-rf47(fixed_in 2.13.0);torch2.13.0 has no known vulnerabilities. - Scope is exactly torch's transitive tree — 7 version bumps, 0 packages added/removed (162 → 162):
torch2.11.0→2.13.0,triton3.6.0→3.7.1,cuda-toolkit13.0.2→13.0.3.0,nvidia-cublas13.1.0.3→13.1.1.3,nvidia-cudnn-cu139.19.0.56→9.20.0.48,nvidia-cusparselt-cu130.8.0→0.8.1,nvidia-nccl-cu132.28.9→2.29.7. No unrelated package moved. This is a within-CUDA-13 update (not a cu12→cu13 transition). - Hashes real: new wheel
sha256/sizes verified against PyPI (torch24/24, plus the CUDA/nvidia deps spot-checked), none yanked, artifacts onfiles.pythonhosted.org. - Constraints satisfied:
torchrequires_python >=3.10⊆ env's>=3.11,<3.14. - fastapi re-sync (benign, net-positive): the
requires-distline moved>=0.115.0→>=0.116.0to matchpyproject.toml(which already declares>=0.116.0). Concretely: the base lock failsuv lock --check; the PR lock passes. Not a floor bump — the resolved fastapi version is unchanged. - Dropped
cp313t(free-threaded) wheels for torch/triton per upstream 2.13 release notes — no impact (env targets standard cp311/cp312/cp313;requires-python <3.14). This accounts for the −6 artifact lines. - macOS arm64 min OS raised 11.0 → 14.0 (upstream) — no practical impact (env runs in Docker/Linux).
Deploy heads-up (low-risk, not a blocker)
GPU hosts will pull new CUDA-13 point releases (cuDNN 9.20, NCCL 2.29) + a new torch runtime. The 2.13.0 tracked ROCm torch.compile-on-CPU regression does not apply (this env resolves standard CUDA/CPU wheels, not +rocm).
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review (1 process/config note for @burtenshaw)
- 0 RFC conflicts
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "torch" | ||
| version = "2.11.0" | ||
| version = "2.13.0" |
There was a problem hiding this comment.
torch 2.11.0 → 2.13.0 — the named bump. Verified against PyPI: all 24 wheels' sha256/size match, not yanked, requires_python >=3.10 (⊆ env's >=3.11,<3.14).
Security-positive: clears GHSA-rrmf-rvhw-rf47 (fixed_in 2.13.0); 2.13.0 has no known vulns.
Free-threaded cp313t wheels are dropped (upstream 2.13 note) and the macOS arm64 wheel min OS rose 11.0→14.0 — neither affects this env (runs in Docker/Linux; targets cp311–cp313).
| requires-dist = [ | ||
| { name = "browsergym", specifier = ">=0.13.3" }, | ||
| { name = "fastapi", specifier = ">=0.115.0" }, | ||
| { name = "fastapi", specifier = ">=0.116.0" }, |
There was a problem hiding this comment.
Benign requires-dist re-sync, not a floor bump: pyproject.toml already declares fastapi>=0.116.0, but the base lock's recorded constraint was stale at >=0.115.0. Dependabot's re-lock corrects it — the resolved fastapi version is unchanged.
Verified concretely: the base lock fails uv lock --check ("needs to be updated"), while this (head) lock passes. Net-positive side effect.
| [[package]] | ||
| name = "triton" | ||
| version = "3.6.0" | ||
| version = "3.7.1" |
There was a problem hiding this comment.
triton 3.6.0 → 3.7.1, part of torch's transitive CUDA-13 tree. In total 7 packages version-bump in this PR (torch, triton, cuda-toolkit, nvidia-cublas, nvidia-cudnn-cu13, nvidia-cusparselt-cu13, nvidia-nccl-cu13) with 0 added / 0 removed — a within-CUDA-13 update, not a cu12→cu13 transition. All new hashes verified on PyPI, none yanked.
Deploy heads-up (low-risk): GPU hosts pick up cuDNN 9.20 / NCCL 2.29.
1 participant
Bumps torch from 2.11.0 to 2.13.0.
Release notes
Sourced from torch's releases.
... (truncated)
Commits
cf30153[release/2.13] Strip +PTX from CUDA arch list on release/RC builds (#188914) ...3e3e24b[release/2.13] Restrict cuda-bindings to Python < 3.15 for CUDA 12.9 builds (...7986b06[release/2.13] Bump binary build timeout 280 -> 400 minutes (#188551)0bdbc26[release/2.13] Add CUDA 12.9 to TORCH_CUDA_ARCH_LIST tables (#188443)9cabb45[release/2.13] Update manywheel docker image pin to 78e737ad (#188409)78e737a[release/2.13] Revert "Tighten generalized scatter graph target (#184075)" (#...0bb9b5b[release/2.13] Revert "dynamo: round-trip torch.cuda.stream ctx mgr across gr...aaac2bf[release/2.13] Revert "[Reland] Port D104346887/PR 182675 for index_add fast ...9330813Fix build_with_debinfo.py broken by CONFIGURE_DEPENDS globbing (#188192)4e077a7Remove setuptools upper bound (#188190)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Major ML runtime upgrade can change GPU/CPU behavior, wheel availability (no cp313t), and binary compatibility; worth validating inference/training paths that use
browsergym-visualwebarena’storchdependency.Overview
Updates
envs/openapp_env/uv.lockso PyTorch moves from 2.11.0 → 2.13.0, with the resolver refreshing the Linux CUDA stack thattorchpulls in (e.g.cuda-toolkit,nvidia-cublas,nvidia-cudnn-cu13,nvidia-nccl-cu13,nvidia-cusparselt-cu13) and Triton 3.6.0 → 3.7.1.The lock also reflects tighter Linux optional-dependency markers on
cuda-toolkitextras (aarch64/x86_64) and extra transitive deps on some CUDA extras. Free-threaded (cp313t) torch/triton wheels are no longer present in the resolved set for 2.13.A separate resolver tweak in the same lock bumps the
fastapilower bound for the openapp env package from>=0.115.0to>=0.116.0(no application source changes in this diff).Reviewed by Cursor Bugbot for commit c8be017. Bugbot is set up for automated code reviews on this repo. Configure here.