chore(deps): bump the python-deps group across 1 directory with 6 updates

[dependabot]

Updates the requirements on marker-pdf, pandas, pyarrow, pytz, huggingface-hub and sentence-transformers to permit the latest version.
Updates marker-pdf to 2.0.0

Release notes

Sourced from marker-pdf's releases.

Marker 2.0.0

Marker 2 is a rewrite focused on speed, full CPU support, and accuracy. It's built on three new pieces we shipped over the last few months: Surya OCR 2, a 20M-param fast layout model, and a rebuilt (3× faster) pdftext.

Against comparable pipeline OCR systems, Marker 2 is both faster and more accurate — on olmOCR-bench, balanced mode scores 76.0% overall (83.5% on born-digital) while running over 5× more pages/sec than MinerU's pipeline backend.

Highlights

• Conversion modes. Choose your speed/accuracy tradeoff:
  • balanced — surya VLM for layout + full-page OCR when text is bad. Highest quality; best on GPU. 76.0% olmOCR-bench.
  • fast — lightweight rf-detr/onnx layout + pdftext, with minimal, surgical VLM use. 66.6%, and far cheaper.
  • --disable_ocr — pure text-layer extraction, no VLM at all. Runs entirely on CPU. 43.6%, 23.7 pg/s.
• Device-aware default. Mode now defaults by device automatically — balanced on GPU, fast on CPU/MPS — so you get a sensible speed/accuracy tradeoff without a flag. Override any time with --mode.
• Full CPU support. fast --disable_ocr needs no GPU and no inference server; the 20M layout model runs on CPU and still reads structure (columns, tables, headers).
• Throughput by design. Many thin CPU workers share a single surya inference server; the parent process budgets VLM concurrency across them, so throughput scales with server capacity instead of per-process VRAM. Sustained on one B200: 2.9 pg/s balanced, 7.4 pg/s fast, 23.7 pg/s no-OCR.
• Selective OCR. Marker reads the PDF text layer with pdftext and only calls the VLM where it's needed — garbled/scanned pages, equations, low-confidence tables — instead of VLM-OCRing every page.
• Reproducible benchmarks. A new benchmarks/ harness reproduces every olmOCR-bench score and throughput number in the README, for marker and competitors (MinerU, docling, liteparse).

Breaking changes

• Python 3.10+ required.
• Packaging moved from Poetry to uv (build backend is now hatchling). pip install marker-pdf is unchanged.
• The unused structured-extraction converter/extractors were removed; use the Datalab API or a --use_llm workflow for structured extraction.
• Mode default is now device-dependent rather than always balanced (see above).

Install

pip install marker-pdf          # PDFs
pip install marker-pdf[full]    # + docx, pptx, xlsx, epub, html

Benchmarks (olmOCR-bench, macro-average over 8 categories)

Mode	Overall	Digital-only	Throughput (B200)
balanced (GPU)	76.0	83.5	2.9 pg/s
fast (GPU)	66.6	71.6	7.4 pg/s
fast, no OCR (CPU)	43.6	55.8	23.7 pg/s

Full per-category scores, the competitive comparison, and reproduction steps are in the README.

For the highest possible accuracy, the hosted Datalab API runs Chandra (our document VLM) with automatic correction - free $5 in credits to try.

Commits

• 947d768 Merge pull request #1062 from datalab-to/dev
• c6169f6 Update surya
• 0a7c02f Fix blocks
• ebf1f3d README fix
• 15a468f CI: run a CPU test subset on ubuntu alongside the GPU suite
• bbb6713 Default mode by device: fast on CPU/MPS, balanced on GPU
• d59e56c Add in olmocr bench tests
• 3742376 Disable ocr in app
• d3b8522 Error fixes
• 619377f Swap to uv
• Additional commits viewable in compare view

Updates pandas to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Updates pyarrow to 25.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 25.0.0

Release Notes URL: https://arrow.apache.org/release/25.0.0.html

Commits

• 59bea6e MINOR: [Release] Update versions for 25.0.0
• 381fab6 MINOR: [Release] Update .deb/.rpm changelogs for 25.0.0
• 7f72d5b MINOR: [Release] Update CHANGELOG.md for 25.0.0
• fe2f85c GH-50336: [Release][Archery] Fix archery GitHub integration for release scrip...
• c658548 GH-50293: [CI] Run check-labels for all triggers to avoid cancelling further ...
• f83c8ca GH-50330: [C++][R][Parquet] Add missing typename in RleBitPackedDecoderGetRun...
• 35e0f63 GH-50318: [R][CI] Install missing libpng-dev for test-r-linux-as-cran (#50328)
• 61ca7a9 GH-50295: [C++][R] #include <ranges> in vector_select_k.cc breaks macOS CRAN ...
• 1b6edb8 GH-50291: [Python][Packaging] Stop using nightly build dependencies for build...
• e183ea9 MINOR: [Docs] Add Timestamp With Offset to canonical extension types status (...
• Additional commits viewable in compare view

Updates pytz to 2026.3

Commits

• 2c139e8 Merge branch 'fix/localize-overflow-at-datetime-extremes' of https://github.c...
• c843864 Run zdump tests quietly
• 518500c Reduce noise when collecting zdump info dumps
• 081f935 Merge branch 'kytta-fix-dst' into 2026c
• 8c9d69b Merge branch 'master' into 2026c
• 4bf5dd4 Refactor DST validation logic in build_tzinfo
• 881b89f Clarify which stdlib to use and issue that may arise
• 29b85de Add GitHub Project URLs to Python package
• ec0e890 Add GitHub Project URLs to Python package
• 93e4be3 Bump version numbers to 2026.3 (IANA 2026c)
• Additional commits viewable in compare view

Updates huggingface-hub to 1.24.0

Release notes

Sourced from huggingface-hub's releases.

[v1.24.0] Name your Jobs! (and download fixes)

📊 Name your Jobs!

Jobs on the Hub now support an optional --name flag on the CLI and a name parameter on the Python API (run_job, run_uv_job, create_scheduled_job, create_scheduled_uv_job). Names are stored as the name label and make Jobs easier to find and identify in the UI. You can also name an existing Job using hf jobs labels <job_id> --name my-job. Names are optional and do not need to be unique.

# Create a named Job
hf jobs run --name training-v2 python:3.12 python train.py
Name an existing Job
hf jobs labels <job_id> --name training-v2
Named scheduled Job
hf jobs scheduled run @​hourly --name hourly-task python:3.12 python -c 'print("This runs every hour!")'

📚 Documentation: CLI guide, Jobs guide

• [Jobs] Add optional names to Jobs CLI and API by @​Wauplin in #4532

📖 Documentation

• [Docs] Fix HTTP client name in download docs by @​cupkk in #4523

The README has been completely refreshed to put the hf CLI first. The standalone installer (curl/PowerShell) and a terminal quick start — covering auth login, models ls, download, upload, and jobs run — now appear before the Python library section. A new For AI agents section introduces hf skills add for Codex, Cursor, OpenCode, Claude Code, and other AI tools. The Python content remains intact under the renamed Use the Python library heading, with refreshed example models and a corrected tagline ("The official CLI and Python client for the Hugging Face Hub").

• CLI-first README: standalone installer and terminal quick start up top by @​davanstrien in #4527
• Mention the hf CLI in the README quick start by @​davanstrien in #4514

🐛 Bug and typo fixes

• [Download] Fix xet download rate: show summed, not per-file speed by @​rajatarya in #4530

🏗️ Internal

• Bump the actions group with 4 updates by @​dependabot[bot] in #4503
• Post-release: bump version to 1.24.0.dev0 by @​huggingface-hub-bot[bot] in #4516

Commits

• 36fd32c Release: v1.24.0
• 240dcf4 Release: v1.24.0.rc3
• d43b771 Release: v1.24.0.rc2
• 16e19c2 Release: v1.24.0.rc1
• 2917e60 Release: v1.24.0.rc0
• b2ae5b6 [Jobs] Add optional names to Jobs CLI and API (#4532)
• dc5c540 CLI-first README: standalone installer and terminal quick start up top (#4527)
• 74082b7 [Download] Fix xet download rate showing per-file speed instead of summed tot...
• 91dc59a Bump the actions group with 4 updates (#4503)
• 8a3189e [Docs] Fix HTTP client name in download docs (#4523)
• Additional commits viewable in compare view

Updates sentence-transformers to 5.6.1

Release notes

Sourced from sentence-transformers's releases.

v5.6.1 - Flash Attention Fix for XLM-R and RoBERTa Models

This patch release fixes silently degraded embeddings for RoBERTa-family models when flash attention is requested with transformers v5, notably every XLM-R based multilingual embedding model (BAAI/bge-m3, intfloat/multilingual-e5-large, etc.). The bug affected v5.5.0, v5.5.1, and v5.6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.1
Inference only, use one of:
pip install sentence-transformers==5.6.1
pip install sentence-transformers[onnx-gpu]==5.6.1
pip install sentence-transformers[onnx]==5.6.1
pip install sentence-transformers[openvino]==5.6.1
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.1
pip install sentence-transformers[audio]==5.6.1
pip install sentence-transformers[video]==5.6.1
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.1

Fix position_ids offsetting for RoBERTa-family models when flattening inputs (#3879)

Since v5.5.0, the Transformer module flattens text-only batches into one packed sequence when flash attention is requested, skipping all padding overhead for a notable performance improvement. The position_ids of that packed sequence restart at 0 for every text, which is correct for the vast majority of models. RoBERTa-family architectures however compute positions as padding_idx + 1 + n for the n-th token, so every token read a position embedding shifted by padding_idx + 1 (usually 2). Nothing crashes, the embeddings are just silently worse.

from sentence_transformers import SentenceTransformer
An affected configuration: flash attention with an XLM-R based model
model = SentenceTransformer(
"BAAI/bge-m3",
model_kwargs={"attn_implementation": "flash_attention_2"},
)

Measured on BAAI/bge-m3:

Evaluation	padded	packed, 0-based positions	packed, with this fix
stsb test Spearman	0.8485	0.7239	0.8485
NanoBEIR mean nDCG@10	0.6041	0.5414	0.6050

The quality loss recovers exactly once the offset is applied. The fix scans the loaded model's modules once for an int padding_idx stored next to a learned position_embeddings table, and offsets the packed position_ids when that pair is found. An audit of transformers finds 16 architectures with that pair (roberta, xlm_roberta, xlm_roberta_xl, camembert, roberta_prelayernorm, xmod, data2vec_text, longformer, luke, ibert, mpnet, markuplm, lilt, layoutlmv3, esm, and pp_doclayout_v2), all offset by exactly padding_idx + 1, and no 0-based or rotary architecture matches.

You are only affected if you encoded text with flash attention requested on transformers v5 with a RoBERTa-family checkpoint. The default padded path (e.g. sdpa) was never affected, and neither were MPNet models like all-mpnet-base-v2 despite mpnet appearing in the audit: transformers does not support flash attention for MPNet at all. If you did index a corpus with such a configuration, re-encode it after upgrading: pre-fix embeddings score notably worse and do not mix with post-fix embeddings.

What's Changed

... (truncated)

Commits

• 7d3eb16 Release v5.6.1
• 286dcf3 [tests] Skip bf16 + Windows + CPU forwards, as they can WindowsError on tor...
• 30bad93 [ci] Exclude librosa/numba/llvmlite on Python 3.13 (#3835)
• 9ca6bbc 🚨 Fix position_ids offsetting for RoBERTa-family models when flattening input...
• 9c73df3 Release v5.6.0
• 222b052 [fix] Don't override device_map placement with the device argument (#3823)
• a38a6bf Fix causal LM reranker scoring when max_length truncates chat-template suffix...
• 1812103 [fix] Make relative margin sign-independent in mining and GIST losses (#3821)
• ae1acc3 Warn when loading local custom code without trust_remote_code (#3807)
• 429cf5d [fix] Support MPS in the cached losses' RandContext (#3812)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions