Skip to content

build(deps): bump the cargo group across 1 directory with 3 updates - #11

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-87d94c88e4
Closed

build(deps): bump the cargo group across 1 directory with 3 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-87d94c88e4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo group with 3 updates in the / directory: anyhow, candle-core and candle-nn.

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

  • Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)
Commits
  • 5bdb0e2 Release 1.0.103
  • e621bd3 Merge pull request #452 from dtolnay/downcast
  • 6e8c000 Eliminate pointer->reference->pointer during downcast
  • 67c4abd Add regression test for issue 451
  • 917a169 Update actions/upload-artifact@v6 -> v7
  • d9dc3fa Update actions/checkout@v6 -> v7
  • 841522b Raise minimum tested compiler to rust 1.85
  • See full diff in compare view

Updates candle-core from 0.10.2 to 0.11.0

Commits
  • 31f35b1 Bump candle version to 0.11.0 (#3658)
  • 9bcfd98 Add paged flash-attn kernels (#3655)
  • c63cb20 [CPU] Quantized perf improvements (#3643)
  • 5152ef6 Support embedding forward pass for ggml quants (#3644)
  • f53ed3b Parameter cache for CUDA kernel launch (#3598)
  • a9667ca Support cuda 13.3 (#3642)
  • 29a15c2 Remove flash attn specific rayon threadpool. Use device.with_context around e...
  • 0190c65 refactor: converge CPU flash attn kernels on shared primitives (#3513)
  • c4b0faf [CPU] Persistent barrier based threadpool and improved qgemm (#3627)
  • 7625889 [CPU] Add neon optimized path to BlockQ8K::from_float (#3629)
  • Additional commits viewable in compare view

Updates candle-nn from 0.10.2 to 0.11.0

Commits
  • 31f35b1 Bump candle version to 0.11.0 (#3658)
  • 9bcfd98 Add paged flash-attn kernels (#3655)
  • c63cb20 [CPU] Quantized perf improvements (#3643)
  • 5152ef6 Support embedding forward pass for ggml quants (#3644)
  • f53ed3b Parameter cache for CUDA kernel launch (#3598)
  • a9667ca Support cuda 13.3 (#3642)
  • 29a15c2 Remove flash attn specific rayon threadpool. Use device.with_context around e...
  • 0190c65 refactor: converge CPU flash attn kernels on shared primitives (#3513)
  • c4b0faf [CPU] Persistent barrier based threadpool and improved qgemm (#3627)
  • 7625889 [CPU] Add neon optimized path to BlockQ8K::from_float (#3629)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 1, 2026
@dependabot dependabot Bot changed the title build(deps): bump the cargo group with 3 updates build(deps): bump the cargo group across 1 directory with 3 updates Jul 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-87d94c88e4 branch from 6d5d861 to 83bf49b Compare July 6, 2026 13:29
@dependabot
build(deps): bump the cargo group across 1 directory with 3 updates
d1bd0eb 
Bumps the cargo group with 3 updates in the / directory: [anyhow](https://github.com/dtolnay/anyhow), [candle-core](https://github.com/huggingface/candle) and [candle-nn](https://github.com/huggingface/candle).


Updates `anyhow` from 1.0.102 to 1.0.103
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.102...1.0.103)

Updates `candle-core` from 0.10.2 to 0.11.0
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](huggingface/candle@0.10.2...0.11.0)

Updates `candle-nn` from 0.10.2 to 0.11.0
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](huggingface/candle@0.10.2...0.11.0)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: candle-core
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: candle-nn
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-87d94c88e4 branch from 83bf49b to d1bd0eb Compare July 7, 2026 01:08
@vbasky

vbasky commented Jul 7, 2026

Copy link
Copy Markdown
Owner

The two RUSTSEC advisories this PR would have cleared (anyhow 1.0.103 for RUSTSEC-2026-0190, and transitively crossbeam-epoch 0.9.20 for RUSTSEC-2026-0204) are now fixed directly on main (83a1a94). The remaining change here is candle-core/candle-nn 0.10 → 0.11, a minor bump behind the opt-in ml feature that needs revalidation on its own. Rebasing so CI reflects only that.

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 7, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-87d94c88e4 branch July 7, 2026 01:36
vbasky added a commit that referenced this pull request Jul 7, 2026
@vbasky
chore(deps): bump candle-core/candle-nn 0.10 → 0.11 (ml feature)
b788a79 
Supersedes dependabot PR #11. The ml module compiles unchanged against
candle 0.11; ml tests pass (17), clippy --features ml clean, cargo deny ok.
(anyhow/crossbeam advisory bumps from that PR already landed in 83a1a94.)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vbasky