Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-transformers for
openSUSE:Factory checked in at 2026-08-11 17:14:02
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-transformers (Old)
and /work/SRC/openSUSE:Factory/.python-transformers.new.17972 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-transformers"
Tue Aug 11 17:14:02 2026 rev:3 rq:1370545 version:5.15.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-transformers/python-transformers.changes
2026-07-21 23:10:41.498894899 +0200
+++
/work/SRC/openSUSE:Factory/.python-transformers.new.17972/python-transformers.changes
2026-08-11 17:15:34.554080140 +0200
@@ -1,0 +2,39 @@
+Mon Aug 10 13:20:07 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Make the package importable again with the tokenizers we ship
+ (transformers-allow-tokenizers-0.23.1.patch): upstream caps
+ tokenizers at <=0.23.0, but 0.23.0 was never released as a
+ stable version, so the only 0.23.x on PyPI - and the one in
+ Factory - is 0.23.1. The cap is enforced at import time, so
+ "import transformers" raised ImportError and the build's own
+ import test failed. Widened to <0.24.0, keeping the intent of
+ the bound. Upstream is aware but has closed the community
+ fixes for it, so this stays downstream for now
+- Declare the tokenizers upper bound as a Requires too, so a
+ future 0.24 shows up as an unresolvable dependency rather than
+ installing cleanly and failing on import
+- Update to 5.15.0:
+ * Add Meta Muse Glimmer, a 30B dense multimodal model for
+ agentic use, plus Granite-swa, GraniteMoe-swa, A.X-K1,
+ A.X-K2 and Cosmos3 Edge
+ * Kernels are now opt-in for the linear attention models
+ (Mamba, GDN, convolution-only); enable them explicitly to
+ keep the previous automatic selection
+ * T5 and its family (MT5, LongT5, ...) gained SDPA and the
+ other attention backends, so the default attention
+ implementation changes - pass attn_implementation="eager"
+ for the old behaviour
+ * Cache cropping now takes only negative (relative) offsets
+ instead of absolute sizes
+ * Drop several private processor helpers such as _is_url and
+ _build_image_tokens
+ * Fix multi-head latent attention cache compression, and stop
+ keeping the static cache on the model across generate()
+ calls, which held memory needlessly
+ * Speed up image preprocessing for the vision-language models
+ by dropping redundant tensor copies
+- CVE-2025-6921 (boo#1250447): not affected, the ReDoS in
+ AdamWeightDecay._do_use_weight_decay was fixed upstream in
+ 4.53.0 and we are far above that floor
+
+-------------------------------------------------------------------
Old:
----
transformers-5.14.1.tar.gz
New:
----
transformers-5.15.0.tar.gz
transformers-allow-tokenizers-0.23.1.patch
----------(New B)----------
New:- Make the package importable again with the tokenizers we ship
(transformers-allow-tokenizers-0.23.1.patch): upstream caps
tokenizers at <=0.23.0, but 0.23.0 was never released as a
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-transformers.spec ++++++
--- /var/tmp/diff_new_pack.G6DDi5/_old 2026-08-11 17:15:35.978140486 +0200
+++ /var/tmp/diff_new_pack.G6DDi5/_new 2026-08-11 17:15:35.982140655 +0200
@@ -17,12 +17,15 @@
Name: python-transformers
-Version: 5.14.1
+Version: 5.15.0
Release: 0
Summary: State-of-the-art Machine Learning for JAX, PyTorch and
TensorFlow
License: Apache-2.0
URL: https://github.com/huggingface/transformers
Source:
https://files.pythonhosted.org/packages/source/t/transformers/transformers-%{version}.tar.gz
+# Upstream caps tokenizers at <=0.23.0, but the only stable 0.23.x release is
+# 0.23.1 - the cap makes "import transformers" fail outright.
+Patch0: transformers-allow-tokenizers-0.23.1.patch
BuildRequires: %{python_module base >= 3.10}
BuildRequires: %{python_module pip}
BuildRequires: %{python_module setuptools}
@@ -35,6 +38,9 @@
Requires: python-packaging >= 20.0
Requires: python-regex >= 2025.10.22
Requires: python-safetensors >= 0.8.0
+# dependency_versions_check.py enforces the upper bound at import time, so an
+# undeclared 0.24 would install fine and then fail on "import transformers".
+Requires: python-tokenizers < 0.24.0
Requires: python-tokenizers >= 0.22.0
Requires: python-tqdm >= 4.60
Requires: python-typer
++++++ transformers-5.14.1.tar.gz -> transformers-5.15.0.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-transformers/transformers-5.14.1.tar.gz
/work/SRC/openSUSE:Factory/.python-transformers.new.17972/transformers-5.15.0.tar.gz
differ: char 5, line 1
++++++ transformers-allow-tokenizers-0.23.1.patch ++++++
transformers pins tokenizers to >=0.22.0,<=0.23.0, but 0.23.0 was never
published as a stable release - the only 0.23.x on PyPI is 0.23.1, which is
what openSUSE ships. The pin is enforced at import time by
dependency_versions_check.py, so with tokenizers 0.23.1 installed a plain
"import transformers" raises
ImportError: tokenizers>=0.22.0,<=0.23.0 is required for a normal
functioning of this module, but found tokenizers==0.23.1.
which fails the build and would leave the package unusable at runtime.
Upstream is aware - see huggingface/transformers#47429 and #45736 - and has
closed the community pull requests that proposed exactly this change with
"We'll handle tokenizers version bumps internally! They need to be kept in
sync", so the fix has to be carried here until they act. Widening to <0.24.0
keeps the intent of the bound (the 0.23 series is supported, 0.24 is not) and
happens to also unblock the EncodingVisualizer XSS fix that 0.23.1 carries.
Both files need it: setup.py is the source of truth, and
dependency_versions_table.py is the generated copy that the runtime check
actually reads.
--- a/setup.py
+++ b/setup.py
@@ -146,7 +146,7 @@
"tomli",
"tiktoken",
"timm>=1.0.23",
- "tokenizers>=0.22.0,<=0.23.0",
+ "tokenizers>=0.22.0,<0.24.0",
"torch>=2.5",
"torchaudio",
"torchvision",
--- a/src/transformers/dependency_versions_table.py
+++ b/src/transformers/dependency_versions_table.py
@@ -73,7 +73,7 @@
"tomli": "tomli",
"tiktoken": "tiktoken",
"timm": "timm>=1.0.23",
- "tokenizers": "tokenizers>=0.22.0,<=0.23.0",
+ "tokenizers": "tokenizers>=0.22.0,<0.24.0",
"torch": "torch>=2.5",
"torchaudio": "torchaudio",
"torchvision": "torchvision",
