chore(deps)(deps-dev): bump the python-dependencies group with 3 updates

[dependabot]

Updates the requirements on sentence-transformers, transformers and huggingface-hub to permit the latest version.
Updates sentence-transformers to 5.6.0

Release notes

Sourced from sentence-transformers's releases.

v5.6.0 - Fixes for Causal LM Rerankers, Hard-Negative Mining, and More

This minor version is a correctness- and robustness-focused release. It fixes a silent scoring bug for causal-LM rerankers, corrects several hard-negative mining and GIST loss edge cases, restores TSDAE on transformers v5, and adds Apple Silicon (MPS) support for the cached losses.

The headline fix affects chat-template models that read the final token position, i.e. causal-LM rerankers (like Qwen3-Reranker) and last-token-pooling embedders: when an over-long input was truncated, the chat template's trailing suffix (e.g. the assistant prefill the model scores from) was silently dropped, producing wrong scores with no error. There's also a forward-looking deprecation: loading local custom code without trust_remote_code=True now warns, and will require it from v6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.0
Inference only, use one of:
pip install sentence-transformers==5.6.0
pip install sentence-transformers[onnx-gpu]==5.6.0
pip install sentence-transformers[onnx]==5.6.0
pip install sentence-transformers[openvino]==5.6.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.0
pip install sentence-transformers[audio]==5.6.0
pip install sentence-transformers[video]==5.6.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.0

Fixed silently wrong scores when truncation drops chat-template suffixes (#3787)

Chat-template models render the full conversation to a flat string before tokenizing, so when the rendered input is longer than the tokenizer's model_max_length, the tokenizer truncates it from the right and drops the template's trailing suffix: the fixed tokens a template appends after the content, e.g. a prompt, instruction, [/INST], or a trailing EOS. For models that read the final token position, this silently corrupted the result:

• causal-LM rerankers (e.g. Qwen/Qwen3-Reranker-0.6B) score a pair from the last token's yes/no logits, and
• last-token-pooling embedders read the final hidden state.

When the suffix was truncated away, that final position landed mid-document instead of after the prefill, so the score or embedding came from the wrong place.

Transformer.preprocess now detects when truncation drops the suffix and splices it back onto the tail of each truncated row. Because the fix lives in the shared base Transformer, it applies across SentenceTransformer, CrossEncoder, and SparseEncoder. It's enabled by default and saved to the model configuration. Pass processing_kwargs={"chat_template": {"restore_suffix": False}} to opt back into raw truncation.

Hard-negative mining and GIST loss correctness (#3821, #3817, #3816)

A trio of correctness and scalability fixes for hard-negative mining and the GIST losses:

• Sign-independent relative margin: mine_hard_negatives(relative_margin=...) and the margin_strategy="relative" branch of GISTEmbedLoss / CachedGISTEmbedLoss used a multiplicative threshold (positive * (1 - margin)) that only behaves correctly when the positive-pair similarity is positive. When that similarity was negative, the threshold moved the wrong way and let through false negatives: candidates more similar to the anchor than the true positive. The threshold is now positive - |positive| * margin, identical to before for positive scores but correct for negative ones.
• Distributed positive masking in the GIST losses: with gather_across_devices=True and a non-zero margin, the false-negative suppression mask protected the wrong columns on ranks beyond the first (it ignored the per-rank offset into the gathered batch), which set the true positive's logit to -inf and produced a +inf loss. The mask now accounts for the cross-rank offset, so multi-GPU GIST training stays finite.
• Memory-bounded mining without FAISS: mine_hard_negatives(use_faiss=False) (the default) materialized the full (queries × corpus) similarity matrix at once, which could OOM on large corpora. It now batches over the query axis (controlled by faiss_batch_size, default 16384), bounding peak memory while producing identical results.

TSDAE weight tying restored on transformers v5 (#3781)

transformers v5 removed the private PreTrainedModel._tie_encoder_decoder_weights helper that DenoisingAutoEncoderLoss (TSDAE) used to tie its separate encoder and decoder. As a stopgap, v5.5 raised a RuntimeError for the default tie_encoder_decoder=True on transformers >= 5.0.0, effectively breaking TSDAE there unless you pinned an older transformers or disabled tying. TSDAE now ships its own tying routine that shares storage between encoder and decoder, so it works on both transformers <5 and >=5 with the default settings.

Deprecation: loading local custom code without trust_remote_code (#3807)

... (truncated)

Commits

• 9c73df3 Release v5.6.0
• 222b052 [fix] Don't override device_map placement with the device argument (#3823)
• a38a6bf Fix causal LM reranker scoring when max_length truncates chat-template suffix...
• 1812103 [fix] Make relative margin sign-independent in mining and GIST losses (#3821)
• ae1acc3 Warn when loading local custom code without trust_remote_code (#3807)
• 429cf5d [fix] Support MPS in the cached losses' RandContext (#3812)
• 77fdbff [fix] fix MPS errors (#3818)
• bfba988 [fix] Fix positive masking in GIST losses with multi-GPU + gather_across_devi...
• 29e382b [docs] Fix doc build problems (part 1) (#3811)
• d16e6bf [fix] Avoid materializing the full similarity matrix in mine_hard_negatives w...
• Additional commits viewable in compare view

Updates transformers to 5.12.1

Release notes

Sourced from transformers's releases.

Patch release v5.12.1

Updated the lower bound for PEFT and a fix for auto tokenizer to properly resolve the mistral tokenizer (when mistral-common is installed). This is similar to v.5.10.3 minus the fixes that were already included in the main release - vLLM will first target 5.10.3 🤗

• Fix peft lower bound #46605 by @​hmellor (#46605)
• mistral common backend fix #46667 by @​itazap (#46667)

Full Changelog: huggingface/transformers@v5.12.0...v5.12.1

Commits

• ddb849a v5.12.1
• d81db16 mistral common backend fix (#46667)
• 07c294c Fix peft lower bound (#46605)
• e0e7504 Revert "fix security issue with allow all kernels"
• 7904f30 fix security issue with allow all kernels
• d77d573 fix kernel path
• f7999c7 v5.12.0
• 4c5d4fd Add minimax m3vl (#46600)
• 5957e6f [CI] capture checkers output in OTEL (#46601)
• 2d68208 Lfm2: thread seq_idx through ShortConv for packed/varlen inputs (#46588)
• Additional commits viewable in compare view

Updates huggingface-hub to 1.21.0

Release notes

Sourced from huggingface-hub's releases.

[v1.21.0] Jobs filtering & pagination

📊 Jobs listing revamped: filter, paginate, and ls instead of ps

The Jobs listing API and CLI have been overhauled with server-side filtering, proper pagination, and a CLI rename that aligns with the rest of hf. list_jobs() now accepts status and labels parameters that push filtering to the server, and returns a lazy iterator (matching list_models, list_datasets, etc.) so large result sets are fetched page by page. On the CLI side, hf jobs ps has been renamed to hf jobs ls for consistency with hf repos ls, hf models ls, and friends — ps and list still work as aliases.

⚠️ Breaking changes:

• list_jobs() now returns an Iterable[JobInfo] instead of list[JobInfo]. If you indexed the result (jobs[0]), wrap it with list(...).
• -f/--filter in hf jobs ls is deprecated. Use --status and --label instead. Glob patterns (data-*), negation (key!=value), and filtering by id/image/command are no longer supported.

from huggingface_hub import list_jobs
Filter by status and labels
list_jobs(status=["RUNNING", "SCHEDULING"], labels={"env": "prod"})
Iterate lazily
for job in list_jobs():
print(job.id)
Materialize all results
all_jobs = list(list_jobs())

# Filter by status and labels
hf jobs ls --status running,scheduling --label env=prod --label team=ml
Paginate with --limit
hf jobs ls -a --limit 500
hf jobs ls -a --limit 0  # no limit

• [Jobs] Add stage/label filtering to list_jobs API and CLI by @​Wauplin in #4395
• [Jobs] Paginate list_jobs and add --limit to hf jobs ps by @​Wauplin in #4403
• [CLI] [Jobs] Rename job listing to 'hf jobs ls' (and keep 'hf jobs ps' alias) by @​Wauplin in #4409

📚 Documentation: CLI guide, Jobs guide

🐛 Fix circular import on from huggingface_hub import login

A regression introduced in v1.20.0 caused from huggingface_hub import login to raise an ImportError on a fresh interpreter, due to a circular dependency between _oauth_device and utils._http. The fix moves _oauth_device.py into the utils layer so all imports resolve downward, eliminating the cycle. No lazy imports or workarounds required.

• Fix circular import on from huggingface_hub import login by @​hanouticelina in #4385

🔧 Other QoL Improvements

• Retry requests on httpx.RemoteProtocolError by @​hanouticelina in #4398

📖 Documentation

... (truncated)

Commits

• aea9b9d Release: v1.21.0
• 2e2ed56 Release: v1.21.0.rc0
• 4bd4c90 [CLI] [Jobs] Rename job listing to 'hf jobs ls' (and keep 'hf jobs ps' alias)...
• fa3eb45 [Jobs] Paginate list_jobs and add --limit to hf jobs ps (#4403)
• ecfd4c5 [CLI] Fix ty/mypy errors with click 8.4.2 (#4408)
• 341469f Update hardware flavor enums (automated commit) (#4406)
• 2fbcdfe [i18n-HI] Add Hindi translation for guides overview (#4405)
• 5bc6bfa [Jobs] Add stage/label filtering to list_jobs API and CLI (#4395)
• d991f09 Fix IndexError in filter_repo_objects on an empty pattern (#4402)
• 0df783f Retry requests on httpx.RemoteProtocolError (#4398)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[opensource-SantanderAI]

Automated approval: green Dependabot update.