Repository navigation
chore(deps): update xxhash requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 - #1008
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [xxhash](https://github.com/ifduyue/python-xxhash) to permit the latest version. - [Release notes](https://github.com/ifduyue/python-xxhash/releases) - [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst) - [Commits](ifduyue/python-xxhash@v3.0.0...v4.0.1) --- updated-dependencies: - dependency-name: xxhash dependency-version: 4.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area: packaging-ci
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
2 tasks done
cemililik
added a commit
that referenced
this pull request
Oct 18, 2026
…y 4-5 (#1014) ## Summary Four Dependabot range bumps (#1003, #1008, #1010, #1011) combined into one pull request so they cost one CI round instead of four (each merge makes the others "behind" and the branch protection requires an up-to-date branch). Dependabot closes its own pull requests when the same change lands. The individual Dependabot commits are merged unchanged. ## What each range change admits, and the evidence | Dependency | Range | Where it is used | Evidence | |---|---|---|---| | `datasketch` | `<2` → `<3` | `ingestion-scale` extra (MinHash LSH) | **CI installs 2.0.0** for the full suite (5868 passed, 22 skipped); the data-audit modules also pass locally on 2.0.0 (283 passed) | | `pytest-randomly` | `<4` → `<6` | `dev` extra | **CI installs 5.0.0** for the full suite (5868 passed, 22 skipped) | | `xxhash` | `<4` → `<5` | `ingestion` extra (simhash) | **Not exercised by CI** (the extra is not installed there). Locally on 4.0.1 the data-audit modules give the same result as on 3.8: 283 passed, 1 skipped | | `pypdf` | `<6` → `<7` | `ingestion` extra (PDF reading) | **Not exercised by CI**: pypdf is not installed there, so the PDF tests skip (224 passed, 19 skipped). Locally the same modules give 238 passed, 5 skipped on both 5.9.0 and 6.21.1 | So for xxhash and pypdf the green CI proves nothing; the local runs above are the evidence. ### Not included **#1007 (`huggingface_hub` `<2` → `<3`)** is left open on purpose. CI installs 1.33.0 either way, so the change is untested, and widening the range lets pip install hub 2.x for users once their other dependencies allow it. That is a claim ForgeLM has not checked, and the core stack (`huggingface_hub`, transformers, torch, TRL, PEFT, accelerate, datasets) is migrated deliberately, not by an automatic bump. I would close it, and add a Dependabot `ignore` for semver-major bumps of that stack; that is a separate change. ## Type - [x] Dependency ## Testing - CI (lint, validate, tests on Python 3.10–3.13) on this branch. - Local runs against throwaway installs of datasketch 2.0.0, xxhash 4.0.1 and pypdf 5.9.0 / 6.21.1 as in the table. ## Checklist - [x] CHANGELOG entry under `[Unreleased]` 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Expand dependency compatibility ranges for ingestion extras and development tooling while retaining the existing huggingface_hub constraint. Enhancements: - Broaden supported version ranges for optional ingestion dependencies and development tooling, admitting pypdf 6, xxhash 4, datasketch 2, and pytest-randomly 4–5. Documentation: - Document the newly admitted dependency major versions and their validation status in the unreleased changelog. Tests: - Validate compatibility with the newer dependency versions through CI and targeted local test runs. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Expanded supported version ranges for optional ingestion and scaling packages, plus the development testing package. Minimum supported versions are unchanged. * Verified ingestion tests with updated package versions and CI with the newer scaling and testing package versions. * Updated the changelog to document these compatibility updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
Author
|
Looks like xxhash is no longer updatable, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/pip/xxhash-gte-3.0.0-and-lt-5.0.0
branch
October 18, 2026 11:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on xxhash to permit the latest version.
Release notes
Sourced from xxhash's releases.
Changelog
Sourced from xxhash's changelog.
... (truncated)
Commits
e2c1bcfRelease v4.0.1669a69cClean up _parse_init_args keyword handling4a6136dbuild(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1aa26ed6Bump version to 4.0.1.dev0d774e2aAdd _xxhash module docstringc8d9a0eClarify changelog: update() keyword and GIL release threshold80d42d2Mention exact str rejection error in changelogbefdf3bUpdate changelog: note str input rejection5c5e42fRelease v4.0.088fe191Bump version to 4.0.0.dev8Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)