Update dependencies 2026ww07

.github/actions/compile-models/requirements.in

@@ -1,21 +1,22 @@
 --extra-index-url https://download.pytorch.org/whl/cpu
 
 # Core
-transformers>=4.57.3
+transformers==4.57.3
 torch==2.8.0+cpu
 torchvision==0.23.0+cpu
-onnx>=1.20.0
-onnxruntime>=1.23.1
+protobuf==6.33.5
+onnx==1.20.0
+onnxruntime==1.23.2
 onnxruntime-tools>=1.7.0
 
 # Hugging Face Hub
-huggingface_hub>=0.36.0
-hf-xet>=1.2.0
+huggingface_hub==0.36.0
+hf-xet==1.2.0
 
 # Utils
-pillow>=12.0.0
+pillow>=12.1.1
 requests>=2.32.5
-tqdm>=4.67.1
+tqdm>=4.67.3
 accelerate>=1.12.0
-urllib3>=2.6.0
-filelock>=3.20.1
+urllib3>=2.6.3
+filelock>=3.21.2

.github/actions/download-models/requirements.in

@@ -1,8 +1,8 @@
 # Hugging Face Hub
-huggingface_hub>=1.1.7
+huggingface_hub>=1.4.1
 hf-xet>=1.2.0
 
 # Utils
 requests>=2.32.5
-urllib3>=2.6.0
-filelock>=3.20.1
+urllib3>=2.6.3
+filelock>=3.21.2

.github/actions/download-models/requirements.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pip-compile --generate-hashes .github/actions/download-models/requirements.in
@@ -119,9 +119,9 @@ colorama==0.4.6 \
     # via
     #   click
     #   tqdm
-filelock==3.20.1 \
-    --hash=sha256:15d9e9a67306188a44baa72f569d2bfd803076269365fdea0934385da4dc361a \
-    --hash=sha256:b8360948b351b80f420878d8516519a2204b07aefcdcfd24912a5d33127f188c
+filelock==3.21.2 \
+    --hash=sha256:cfd218cfccf8b947fce7837da312ec3359d10ef2a47c8602edd59e0bacffb708 \
+    --hash=sha256:d6cd4dbef3e1bb63bc16500fc5aa100f16e405bbff3fb4231711851be50c1560
     # via
     #   -r .github/actions/download-models/requirements.in
     #   huggingface-hub
@@ -167,9 +167,9 @@ httpx==0.28.1 \
     --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \
     --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
     # via huggingface-hub
-huggingface-hub==1.2.3 \
-    --hash=sha256:4ba57f17004fd27bb176a6b7107df579865d4cde015112db59184c51f5602ba7 \
-    --hash=sha256:c9b7a91a9eedaa2149cdc12bdd8f5a11780e10de1f1024718becf9e41e5a4642
+huggingface-hub==1.4.1 \
+    --hash=sha256:9931d075fb7a79af5abc487106414ec5fba2c0ae86104c0c62fd6cae38873d18 \
+    --hash=sha256:b41131ec35e631e7383ab26d6146b8d8972abc8b6309b963b306fbcca87f5ed5
     # via -r .github/actions/download-models/requirements.in
 idna==3.10 \
     --hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \
@@ -263,9 +263,9 @@ typing-extensions==4.13.2 \
     # via
     #   huggingface-hub
     #   typer-slim
-urllib3==2.6.2 \
-    --hash=sha256:016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797 \
-    --hash=sha256:ec21cddfe7724fc7cb4ba4bea7aa8e2ef36f607a4bab81aa6ce42a13dc3f03dd
+urllib3==2.6.3 \
+    --hash=sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed \
+    --hash=sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4
     # via
     #   -r .github/actions/download-models/requirements.in
     #   requests

.github/requirements-dev.in

@@ -1,4 +1,4 @@
 setuptools==80.9.0
-wheel>=0.45.1
-build<1.4
-patchelf>=0.16.1.0,<=0.17.2.2; sys_platform == 'linux' and platform_machine == 'x86_64'
+wheel>=0.46.3
+build==1.4.0
+patchelf>=0.16.1.0,<=0.17.2.4; sys_platform == 'linux' and platform_machine == 'x86_64'

.github/requirements-dev.txt

@@ -1,12 +1,12 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pip-compile --allow-unsafe --generate-hashes .github/requirements-dev.in
 #
-build==1.3.0 \
-    --hash=sha256:698edd0ea270bde950f53aed21f3a0135672206f3911e0176261a31e0e07b397 \
-    --hash=sha256:7145f0b5061ba90a1500d60bd1b13ca0a8a4cebdd0cc16ed8adf1c0e739f43b4
+build==1.4.0 \
+    --hash=sha256:6a07c1b8eb6f2b311b96fcbdbce5dab5fe637ffda0fd83c9cac622e927501596 \
+    --hash=sha256:f1b91b925aa322be454f8330c6fb48b465da993d1e7e7e6fa35027ec49f3c936
     # via -r .github/requirements-dev.in
 colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
@@ -15,7 +15,9 @@ colorama==0.4.6 \
 packaging==24.2 \
     --hash=sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759 \
     --hash=sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f
-    # via build
+    # via
+    #   build
+    #   wheel
 patchelf==0.17.2.2 ; sys_platform == "linux" and platform_machine == "x86_64" \
     --hash=sha256:05f6bbdbe484439cb025e20c60abd37e432e6798dfa3f39a072e6b7499072a8c \
     --hash=sha256:080b2ac3074fd4ab257700088e82470425e56609aa0dd07abe548f04b7b3b007 \
@@ -30,9 +32,9 @@ pyproject-hooks==1.2.0 \
     --hash=sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8 \
     --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
     # via build
-wheel==0.45.1 \
-    --hash=sha256:661e1abd9198507b1409a20c02106d9670b2576e916d58f520316666abca6729 \
-    --hash=sha256:708e7481cc80179af0e556bbf0cc00b8444c7321e2700b8d8580231d13017248
+wheel==0.46.3 \
+    --hash=sha256:4b399d56c9d9338230118d705d9737a2a468ccca63d5e813e2a4fc7815d8bc4d \
+    --hash=sha256:e3e79874b07d776c40bd6033f8ddf76a7dad46a7b8aa1b2787a83083519a1803
     # via -r .github/requirements-dev.in
 
 # The following packages are considered to be unsafe in a requirements file:

.github/workflows/clang-format.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - develop
+      - 'releases/*'
 
 concurrency:
   group: clang-format-${{ github.event_name }}-${{ github.ref_name }}
@@ -21,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest-8-cores
     steps:
       - name: Checkout NPU Compiler
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
           lfs: true

.github/workflows/codeql.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - develop
+      - 'releases/*'
   schedule:
     - cron: '24 8 * * 6'
 
@@ -30,16 +31,16 @@ jobs:
           build-mode: none
     steps:
     - name: Checkout repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
       with:
         category: "/language:${{matrix.language}}"
 
@@ -52,10 +53,12 @@ jobs:
       packages: read
       statuses: read
       security-events: write
+      attestations: write
       id-token: write
     with:
       os: ubuntu_24_04
       build-runner: ubuntu-latest-32-cores
       build-plugin: true
       build-driver: false
+      build-cid: false
       with-codeql: true

.github/workflows/job_build_cid.yml

@@ -118,7 +118,7 @@ jobs:
           cmake -E make_directory "${CID_PACKAGE_ARTIFACTS_DIR}"
 
       - name: Checkout actions
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: ${{ env.NPU_ACTIONS_DIR }}
           sparse-checkout: |
@@ -177,14 +177,14 @@ jobs:
       - name: Restore CiD artifacts from cache
         if: ${{ inputs.build-cache }}
         id: cache-restore
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           key: ${{ steps.cache-key.outputs.cache-key }}
           path: ${{ env.CID_PACKAGE_ARTIFACTS_DIR }}
 
       - name: Clone OpenVINO
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         timeout-minutes: 15
         with:
           repository: ${{ steps.versions.outputs.openvino-repository }}
@@ -194,15 +194,15 @@ jobs:
 
       - name: Checkout NPU Compiler
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: ${{ env.NPU_COMPILER_REPO }}
           submodules: true
           lfs: true
 
       - name: System info
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: openvinotoolkit/openvino/.github/actions/system_info@7a975177ff432c687e5619e8fb22e4bf265e48b7 # 2025.4.0
+        uses: openvinotoolkit/openvino/.github/actions/system_info@82bbf0292c5bd490bc25a383e63d6461d3ee05c5 # 2025.4.1
 
       - name: Setup python version
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
@@ -315,13 +315,13 @@ jobs:
 
       - name: Cache CiD artifacts
         if: ${{ inputs.build-cache && !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: ${{ env.CID_PACKAGE_ARTIFACTS_DIR }}
           key: ${{ steps.cache-key.outputs.cache-key }}
 
       - name: Upload CiD package
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: ${{ steps.package-name.outputs.cid-package-full-name }}
           path: |

.github/workflows/job_build_drv_linux.yml

@@ -64,14 +64,14 @@ jobs:
       - name: Restore Driver package from cache
         if: ${{ inputs.build-cache }}
         id: cache-restore
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           key: ${{ steps.cache-key.outputs.cache-key }}
           path: ${{ env.NPU_DRIVER_INSTALL_DIR }}
 
       - name: Checkout versions action
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: ${{ env.NPU_ACTIONS_DIR }}
           sparse-checkout: |
@@ -85,7 +85,7 @@ jobs:
 
       - name: Clone Linux NPU Driver
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         timeout-minutes: 15
         with:
           repository: ${{ steps.versions.outputs.npu-linux-driver-repository }}
@@ -95,7 +95,7 @@ jobs:
 
       - name: System info
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
-        uses: openvinotoolkit/openvino/.github/actions/system_info@7a975177ff432c687e5619e8fb22e4bf265e48b7 # 2025.4.0
+        uses: openvinotoolkit/openvino/.github/actions/system_info@82bbf0292c5bd490bc25a383e63d6461d3ee05c5 # 2025.4.1
 
       - name: Install system packages
         if: ${{ !steps.cache-restore.outputs.cache-hit }}
@@ -145,13 +145,13 @@ jobs:
 
       - name: Cache artifacts
         if: ${{ inputs.build-cache && !steps.cache-restore.outputs.cache-hit }}
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: ${{ env.NPU_DRIVER_INSTALL_DIR }}
           key: ${{ steps.cache-key.outputs.cache-key }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           path: ${{ env.NPU_DRIVER_INSTALL_DIR }}
           name: ${{ env.NPU_DRIVER_BUILD_PACKAGE }}