release: v1.2.1 – dependency, toolchain, and CI/CD refresh - #9
Merged
Conversation
Maintenance release. Every production, ML, developer, and CI/CD dependency was audited against its upstream registry and moved to the latest final version the resolver accepts. No application behaviour changes; no public API changes. ## What changed ### ML / runtime - transformers ^5.15.1 -> ^5.16.1 - faster-whisper, sentencepiece, accelerate, audioread, pyyaml already current ### Developer toolchain - isort ^8.0.1 -> ^9.0.1 (major; profile="black" and the line_length=140 / py_version=312 config remain supported) - pylint ^4.0.7 -> ^4.0.8 - ruff ^0.16.4 -> ^0.16.5 - pytest, pytest-cov, radon, flake8, black, taplo, mypy, pyright, bandit, pip-audit, genbadge, types-pyyaml, mdformat, pymarkdownlnt already current ### Cross-platform & CI - POETRY_VERSION 2.4.1 -> 2.4.2 - actions/checkout v7.0.0 -> v7.0.1 (all three CI jobs) - actions/setup-python v6.3.0 -> v7.0.0 - actions/setup-node v5.0.0 -> v7.0.0 - The checkout and setup-python bumps also correct a real drift: ci.yml and release.yml had been pinning different versions of the same two actions. - upload-artifact (v7.0.1), download-artifact (v8.0.1), setup-go (v7.0.0) and softprops/action-gh-release (v3.0.3) were already latest; unchanged. - docker/Dockerfile.ubuntu: uv 0.6.14 -> 0.12.9 - docker/Dockerfile.ubuntu: hermetic CPython 3.12.13 -> 3.12.14 (verified in astral-sh/python-build-standalone release 20260901) ### Documentation - install_dependencies.ps1 header corrected from "CUDA 12.8 Stable" to "CUDA 13.2 Stable (PyTorch cu132 wheels)" — what has actually shipped since v1.1.3. - docs/instructions.md release-notes link repointed to v1.2.1. - Added docs/releases/v1.2.1.md and v1.2.1_github_description.md. ## Deferred: CUDA 13.3.1 NVIDIA released CUDA 13.3.1, but PyTorch never published a cu133 build and has skipped the version entirely. Probing the wheel indexes: cu132 stable=200 nightly=200; cu133 stable=403 nightly=403; cu134 stable=403 nightly=200. There is no cu133 artifact to upgrade to on either channel, so pinning it would break every GPU install. PyTorch's next CUDA target is 13.4, currently nightly-only. Reinforcing this, torch 2.13.0+cu132 hard-pins the CUDA 13.2.1 component stack: it depends on cuda-toolkit[cublas,...] (13.2.1) which pins nvidia-cublas ==13.4.0.1.*, and separately pins nvidia-cudnn-cu13 9.20.0.48. Raising either to its current PyPI release (13.6.1.10 / 9.25.1.1) fails version solving outright, so both pins are retained deliberately — dictated by torch, not chosen here. torch/torchvision stay at 2.13.0 / 0.28.0: 2.14.0+cu132 wheels are staged on the CUDA index but absent from PyPI with no upstream release, so they are pre-final and would desync the macOS branch. Revisit when cu134 reaches the stable channel. ## Deferred: audio-separator 0.47.0 Prepared, then reverted. 0.47.0 (with librosa ^1.0.0) makes Poetry's resolver blow up combinatorially — locks observed at 8, 30, and 150+ minutes of saturated CPU against a config that otherwise locks in ~11s. Bisected to 0.47.0 alone; librosa is not implicated. Verbose resolver output points at "Duplicate dependencies for nvidia-cublas": 0.47.0 adds torch<3,>=2.13 under a darwin/arm64 marker, pulling in PyPI torch 2.13.0, which depends on cuda-toolkit 13.0.3 rather than the cu132 wheel's 13.2.1 — two irreconcilable nvidia-cublas constraints. Pinning Darwin torch/torchvision exactly, and removing the project's own nvidia-* pins, were both tried; neither resolved it. audio-separator stays at ^0.44.5 and librosa keeps its >=0.10.2,<1.0 ceiling (0.44.5 calls librosa.get_duration(filename=...), removed in librosa 1.0). Note for the follow-up: 0.47.0 itself is librosa-1.0 compatible — it calls get_duration(path=...) — so both can move together once the conflict is solved. ## Quality gates - Tests: 310 passed, 13 deselected - Coverage: 90.48% (threshold >= 90%); all per-file gates >= 90% - Linters (isort/black/taplo/ruff/flake8/pylint/mdformat/pymarkdown): zero warnings - Type checkers (mypy, pyright): zero errors - Security (bandit -lll -iii, pip-audit): clean - Radon: A-grade cyclomatic complexity and maintainability index - poetry check --lock: All set! ## Breaking changes - None.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
🧰 Additional context used📓 Path-based instructions (1)Use markdown-quality when updating README/docs/.github markdown content.📄 CodeRabbit inference engine (AGENTS.md) Files:
🔇 Additional comments (7)
📝 SummarySummary by CodeRabbit
WalkthroughThis release updates project dependencies, development tools, CI actions, container tooling, Python, and documentation for version 1.2.1. It also records deferred CUDA and ChangesRelease maintenance
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This maintenance release updates dependencies, tooling, CI/CD actions, and documentation without reported application behavior or API changes; no actionable merge-blocking risk remains beyond normal checks and review. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maintenance release. Every production, ML, developer, and CI/CD dependency was audited against its upstream registry and moved to the latest final version the resolver accepts. No application behaviour changes; no public API changes.
What changed
ML / runtime
Developer toolchain
Cross-platform & CI
Documentation
Deferred: CUDA 13.3.1
NVIDIA released CUDA 13.3.1, but PyTorch never published a cu133 build and has skipped the version entirely. Probing the wheel indexes: cu132 stable=200 nightly=200; cu133 stable=403 nightly=403; cu134 stable=403 nightly=200. There is no cu133 artifact to upgrade to on either channel, so pinning it would break every GPU install. PyTorch's next CUDA target is 13.4, currently nightly-only.
Reinforcing this, torch 2.13.0+cu132 hard-pins the CUDA 13.2.1 component stack: it depends on cuda-toolkit[cublas,...] (13.2.1) which pins nvidia-cublas ==13.4.0.1.*, and separately pins nvidia-cudnn-cu13 9.20.0.48. Raising either to its current PyPI release (13.6.1.10 / 9.25.1.1) fails version solving outright, so both pins are retained deliberately — dictated by torch, not chosen here. torch/torchvision stay at 2.13.0 / 0.28.0: 2.14.0+cu132 wheels are staged on the CUDA index but absent from PyPI with no upstream release, so they are pre-final and would desync the macOS branch.
Revisit when cu134 reaches the stable channel.
Deferred: audio-separator 0.47.0
Prepared, then reverted. 0.47.0 (with librosa ^1.0.0) makes Poetry's resolver blow up combinatorially — locks observed at 8, 30, and 150+ minutes of saturated CPU against a config that otherwise locks in ~11s. Bisected to 0.47.0 alone; librosa is not implicated. Verbose resolver output points at "Duplicate dependencies for nvidia-cublas": 0.47.0 adds torch<3,>=2.13 under a darwin/arm64 marker, pulling in PyPI torch 2.13.0, which depends on cuda-toolkit 13.0.3 rather than the cu132 wheel's 13.2.1 — two irreconcilable nvidia-cublas constraints. Pinning Darwin torch/torchvision exactly, and removing the project's own nvidia-* pins, were both tried; neither resolved it.
audio-separator stays at ^0.44.5 and librosa keeps its >=0.10.2,<1.0 ceiling (0.44.5 calls librosa.get_duration(filename=...), removed in librosa 1.0). Note for the follow-up: 0.47.0 itself is librosa-1.0 compatible — it calls get_duration(path=...) — so both can move together once the conflict is solved.
Quality gates
Breaking changes