Skip to content

Bump datasets from 4.1.1 to 5.0.1 - #472

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/datasets-5.0.1
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/datasets-5.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

Bumps datasets from 4.1.1 to 5.0.1.

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

Docs

New Contributors

... (truncated)

Commits
  • 921c2a7 release: 5.0.1 (#8370)
  • c6fc5cd Preserve nullable integer columns in to_json/to_csv/to_sql (#8366)
  • 6747b87 Fix DatasetDict.push_to_hub leaving removed splits in the dataset card (#8367)
  • b305031 fix buckets on windows (#8369)
  • 030a3e5 Decode Json() columns in Dataset.to_pandas() (#8344)
  • 0f207a0 Rebatch arrow source before formatting in IterableDataset.filter to fix resum...
  • adad35d Keep integers on the python read path for fixed-shape ArrayXD columns with nu...
  • 8966746 Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 (#8358)
  • b8e861a Fix bucket dataset card handling and push metadata accounting (#8354)
  • 521a590 Keep flat numeric columns with nulls numeric in numpy format (#8352)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Major-version bump of an optional examples dependency may change dataset loading/tokenization behavior in examples; core SDK install path is unaffected.

Overview
Bumps the optional examples dependency datasets from 4.1.1 to 5.0.1 by tightening pyproject.toml from >=2.18,<5.0 to >=5.0.1,<6.0, and regenerating poetry.lock (Poetry 2.5.1).

The lockfile picks up datasets 5’s new stack for the examples group—httpx, httpcore, h11, and anyio—along with minor constraint updates on transitive packages (e.g. fsspec, pydantic-core). Only examples/tokenize_data.py imports datasets; the main together package is unchanged.

Reviewed by Cursor Bugbot for commit cc1bd18. Bugbot is set up for automated code reviews on this repo. Configure here.

Bumps [datasets](https://github.com/huggingface/datasets) from 4.1.1 to 5.0.1.
- [Release notes](https://github.com/huggingface/datasets/releases)
- [Commits](huggingface/datasets@4.1.1...5.0.1)

---
updated-dependencies:
- dependency-name: datasets
  dependency-version: 5.0.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 10, 2026
@broly-code-security-scanner

Copy link
Copy Markdown

Broly Security Scan

Warning

Latest baseline snapshot is stale. Broly is running in PR-only fallback mode until the next scheduled baseline refreshes. This does not block the PR.

Note

Summary

13 actionable finding(s) in this PR

  • 🟡 13 medium

Main table: 5 shown, 8 omitted of 13 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity Scanner Issue Location Dismiss Verdict
🟡 MEDIUM SCA GHSA-27vj-qcqg-25rc:
fsspec@2025.3.0
→ >= 2026.6.0
poetry.lock:1 d4 🔺 TRUE_POSITIVE · Confidence: MEDIUM
🟡 MEDIUM SCA transformers@4.56.2 — 15 vulnerabilities (worst:
GHSA-29pf-2h5f-8g72)
poetry.lock:1 d11 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA aiohttp@3.12.15 — 64 vulnerabilities (worst:
GHSA-2fqr-mr3j-6wp8)
poetry.lock:1 d1 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA urllib3@2.4.0 — 16 vulnerabilities (worst:
GHSA-2xpw-w6gg-jr37)
poetry.lock:1 d12 🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM SCA black@25.9.0 — 3 vulnerabilities (worst:
GHSA-3936-cmfr-pm3m)
poetry.lock:1 d2 🔺 TRUE_POSITIVE · Confidence: MEDIUM

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

  • d1 · 🟡 MEDIUM   · poetry.lock:1 · aiohttp@3.12.15 — 64 vulnerabilities (worst: GHSA-2fqr-mr3j-6wp8)
  • d2 · 🟡 MEDIUM   · poetry.lock:1 · black@25.9.0 — 3 vulnerabilities (worst: GHSA-3936-cmfr-pm3m)
  • d3 · 🟡 MEDIUM   · poetry.lock:1 · filelock@3.19.1 — 4 vulnerabilities (worst: GHSA-qmgc-5h2g-mvrw)
  • d4 · 🟡 MEDIUM   · poetry.lock:1 · GHSA-27vj-qcqg-25rc: fsspec@2025.3.0
  • d5 · 🟡 MEDIUM   · poetry.lock:1 · idna@3.10 — 2 vulnerabilities (worst: GHSA-65pc-fj4g-8rjx)
  • d6 · 🟡 MEDIUM   · poetry.lock:1 · pillow@11.3.0 — 36 vulnerabilities (worst: GHSA-45hq-cxwh-f6vc)
  • d7 · 🟡 MEDIUM   · poetry.lock:1 · pyarrow@21.0.0 — 2 vulnerabilities (worst: GHSA-rgxp-2hwp-jwgg)
  • d8 · 🟡 MEDIUM   · poetry.lock:1 · pygments@2.19.1 — 2 vulnerabilities (worst: GHSA-5239-wwwm-4pmq)
  • d9 · 🟡 MEDIUM   · poetry.lock:1 · pytest@8.4.2 — 2 vulnerabilities (worst: GHSA-6w46-j5rx-g56g)
  • d10 · 🟡 MEDIUM   · poetry.lock:1 · requests@2.32.5 — 2 vulnerabilities (worst: GHSA-gc5v-m9x4-r6x2)
  • d11 · 🟡 MEDIUM   · poetry.lock:1 · transformers@4.56.2 — 15 vulnerabilities (worst: GHSA-29pf-2h5f-8g72)
  • d12 · 🟡 MEDIUM   · poetry.lock:1 · urllib3@2.4.0 — 16 vulnerabilities (worst: GHSA-2xpw-w6gg-jr37)
  • d13 · 🟡 MEDIUM   · poetry.lock:1 · virtualenv@20.34.0 — 10 vulnerabilities (worst: GHSA-597g-3phw-6986)

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

Ask in #security-engineering   Powered by Together AI

Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Comment thread poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant