[dependabot]

Bumps torch from 2.8.0 to 2.9.1.

Release notes

Sourced from torch's releases.

PyTorch 2.9.1 Release, bug fix release

This release is meant to fix the following issues (regressions / silent correctness):

Tracked Regressions

Significant Memory Regression in F.conv3d with bfloat16 Inputs in PyTorch 2.9.0 (#166643) This release provides work around this issue. If you are impacted please install nvidia-cudnn package version 9.15+ from pypi. (#166480) (#167111)

Torch.compile

Fix Inductor bug when compiling Gemma (#165601) Fix InternalTorchDynamoError in bytecode_transformation (#166036) Fix silent correctness error_on_graph_break bug where non-empty checkpoint results in unwanted graph break resumption (#166586) Improve performance by avoiding recompilation with mark_static_address with cudagraphs (#162208) Improve performance by caching get_free_symbol_uses in torch inductor (#166338) Fix fix registration design for inductor graph partition for vLLM (#166458) (#165815) (#165514) Fix warning spamming in torch.compile (#166993) Fix exception related to uninitialized tracer_output variable (#163169) Fix crash in torch.bmm and torch.compile with PyTorch release 2.9.0 (#166457)

Other

Fix warning spamming on new APIs to control TF32 behavior (#166956) Fix distributed crash with non-contiguous gather inputs (#166181) Fix indexing on large tensor causes invalid configuration argument (#166974) Fix numeric issue in CUDNN_ATTENTION (#166912) (#166570) Fix symmetric memory issue with fused_scaled_matmul_reduce_scatter (#165086) Improve libtorch stable ABI documentation (#163899) Fix image display on pypi project description section (#166404)

2.9 Release Notes

PyTorch 2.9.0 Release Notes

• Highlights
• Backwards Incompatible Changes
• Deprecations
• New Features
• Improvements
• Bug fixes
• Performance
• Documentation
• Developers
• Security

Highlights

... (truncated)

Commits

• d38164a Enable Doc builds for: Minor Releases RCs. Minor and Patch Releases final RC ...
• b002562 Add doc for Symmetric Memory (#167477)
• 5811a8d [cuDNN][SDPA][Convolution] Expose cuDNN runtime version in CUDA hooks (#167327)
• f36c764 [dynamo][ez] Initialize tracer_output to None by default. (#167366)
• 6877288 Change forkserver test to only run below 3.13.8 (#167361)
• 9976b77 Cherry-pick LibTorch Stable ABI documentation (#167112 #166661 #163899) (#167...
• e6bcbbe [Inductor] No longer throw error in bmm out_dtype lowering due to tem… (#166922)
• 8f658d7 don't produce invalid grid configs (#166973) (#167158)
• 3d27d95 [GraphPartition] cache get_free_symbol_uses (#166338) (#166994)
• a06141f Delete deprecated fp32 precision warnings (#166956) (#166998)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

pyproject.toml

Package	Version	License	Issue Type
torch	2.9.1	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/torch	2.9.1	🟢 6.4	Details Check Score Reason Binary-Artifacts 🟢 9 binaries present in source code Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration CI-Tests ⚠️ -1 no pull request found CII-Best-Practices ⚠️ 0 no badge detected Code-Review 🟢 10 all last 30 commits are reviewed through Prow Contributors 🟢 10 35 different organizations found -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool ⚠️ 0 no update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) out of 30 and 15 issue activity out of 30 found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 no published package detected Pinned-Dependencies ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration SAST ⚠️ 0 no SAST tool detected Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ 0 0 out of 5 artifacts are signed -- score normalized to 0 Token-Permissions ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Vulnerabilities 🟢 10 no vulnerabilities detected Webhooks ⚠️ -1 check is not supported for this request: SCORECARD_V6 is not set, not running the Webhook check

Scanned Files

• pyproject.toml