Bump the python-production group across 1 directory with 3 updates

[dependabot]

Bumps the python-production group with 3 updates in the /pydatalab directory: python-dotenv, tiktoken and transformers.

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates tiktoken from 0.13.0 to 0.14.0

Changelog

Sourced from tiktoken's changelog.

[v0.14.0]

• Build wheels for Python 3.15
• Support looking up more GPT-5 series models
• Upgrade dependencies

Commits

• 4e71bbe Release 0.14.0 (#597)
• 212b893 Fail open for GPT-5 model tokenisers (#596)
• 4187ba3 Upgrade dependencies (#595)
• 92a8255 Remove test-skip comment for macOS arm64 (#562)
• 674f5e6 Build Python 3.15 (#594)
• dbea866 Remove deprecated freethreading build
• f678224 Update cibuildwheel
• 08a5f3b ci: use static artifact name for sdist build job (#535)
• See full diff in compare view

Updates transformers from 5.14.1 to 5.16.1

Release notes

Sourced from transformers's releases.

Release v5.16.1

This is a special release as we include GLM! (and a few small fixes)

GLM-5.3-Flash

GLM-5.3-Flash, the first natively multimodal model in the GLM-5 series. With 320B total parameters and just 18B active parameters, it outperforms GLM-5.2 across benchmarks and real-world workloads at one-tenth the price, while approaching Claude Opus 4.8 on coding and agentic benchmarks.

GLM-5.3-Flash starts from a newly trained base model, with its architecture and training recipe redesigned around capability and efficiency. For the first time in the GLM series, we introduce a hybrid architecture combining sparse and linear attention, sharply reducing long-context serving costs while preserving precise long-context capabilities. The model also adopts Manifold-Constrained Hyper-Connections (mHC) to further improve scaling efficiency. Together with our latest 30T-token multimodal pre-training corpus, these changes enable GLM-5.3-Flash to deliver more intelligence with less compute.

Links: Documentation

• [Glm 5.3 Flash] GLM 5.3 Flash Support (#48342) by @​Dovis01 in #48342

Small patch fixes

Mainly BC behavior for TP and pinning a hf kernel for security reasons 🤗

• Restore BC for the tensor-parallel API (#48300) by @​ArthurZucker
• Fix kernel commit and repo paths for ESMFold2 (#48186) by @​Rocketknight1

Full Changelog: huggingface/transformers@v5.16.0...v5.16.1

Release: v5.16.0

Release v5.16.0

New Model additions

Qwen4-Exp

Qwen4-Exp builds on Qwen3.5's hybrid text and multimodal architecture with three key components: GatedResidual (GR), Qwen Sparse Attention (QSA), and Per-Layer Embedding (PLE).

GR is a Qwen-developed residual architecture that combines Hyper-Connection with GatedNorm. It mixes multiple residual streams with fine-grained elementwise gating before each attention and Mixture-of-Experts (MoE) block, then controls how much of the block output is injected back into each stream.

QSA uses multiple query heads to score compressed key blocks, selects the most relevant contiguous token blocks, and keeps the incomplete trailing block uncompressed. This block-level selection reduces indexing overhead and improves memory locality for long sequences. Combined with Gated DeltaNet, QSA makes Qwen4-Exp the first hybrid architecture to integrate linear and sparse attention, substantially improving inference efficiency for long-context workloads.

PLE enriches selected decoder layers with layer-specific lexical features derived from hashed token n-grams and a dilated depthwise convolution.

Links: Documentation

• Add Qwen4Exp model (#48337) by @​Cyrilvallez in #48337

GraniteSpeech5

... (truncated)

Commits

• 93c8b7b v5.16.1
• cdaca83 [Glm 5.3 Flash] GLM 5.3 Flash Support (#48342)
• b366ad3 Fix kernel commit and repo paths for ESMFold2 (#48186)
• f2f4327 Restore BC for the tensor-parallel API (#48300)
• 93d1bcf release: v5.16.0
• 276c5c4 Add Qwen4Exp model (#48337)
• d3cdaec Fix video-llama modular conversion (#48336)
• 949e301 CI: gate the hunyuan-moe slow test (#48330)
• 5fcf605 Add a regression test for force_accelerate_hooks signature preservation (#48...
• 27e7f6c Add an opt-in per-frame pixel cap (cap_pixels_per_frame) to the Qwen3-VL vide...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions