chore(deps): bump timm from 0.6.13 to 1.0.27 in /DeQA-Score

[dependabot]

Bumps timm from 0.6.13 to 1.0.27.

Release notes

Sourced from timm's releases.

Release v1.0.27

April 23, 2026

• Add Gemma4 ViT encoders w/ NaFlex pipeline support (variable aspect/size per image). Thanks Yonghye Kwon
• Support DINOv3 weights in NaFlexVit. Thanks Yonghye Kwon
• Some improvements to Muon fallback (AdamW/NadamW) lr behavior

What's Changed

• 🔒 Pin GitHub Actions to commit SHAs by @​paulinebm in huggingface/pytorch-image-models#2689
• Improve fallback (adamw/nadamw) LR handling for Muon optimizer by @​rwightman in huggingface/pytorch-image-models#2688
• Fix NaFlexVit DINOv3 support: propagate rope_type and rotate_half by @​developer0hye in huggingface/pytorch-image-models#2692
• chore: bump doc-builder SHA for PR upload workflow by @​rtrompier in huggingface/pytorch-image-models#2694
• Gemma4 by @​rwightman in huggingface/pytorch-image-models#2697
• Add encoder_pool option to gemma4 classification model to toggle soft… by @​rwightman in huggingface/pytorch-image-models#2698
• Fix some performance regressions with torch.compile + Tasks. Fix #2693 by @​rwightman in huggingface/pytorch-image-models#2699

New Contributors

• @​paulinebm made their first contribution in huggingface/pytorch-image-models#2689

Full Changelog: huggingface/pytorch-image-models@v1.0.26...v1.0.27

Release v1.0.26

March 23, 2026

• Improve pickle checkpoint handling security. Default all loading to weights_only=True, add safe_global for ArgParse.
• Improve attention mask handling for core ViT/EVA models & layers. Resolve bool masks, pass is_causal through for SSL tasks.
• Fix class & register token uses with ViT and no pos embed enabled.
• Add Patch Representation Refinement (PRR) as a pooling option in ViT. Thanks Sina (https://github.com/sinahmr).
• Improve consistency of output projection / MLP dimensions for attention pooling layers.
• Hiera model F.SDPA optimization to allow Flash Attention kernel use.
• Caution added to SGDP optimizer.
• Release 1.0.26. First maintenance release since my departure from Hugging Face.

What's Changed

• fix: replace 5 bare except clauses with except Exception by @​haosenwang1018 in huggingface/pytorch-image-models#2672
• Add timmx model export tool to README by @​Boulaouaney in huggingface/pytorch-image-models#2673
• Enhance SGDP optimizer with caution parameter by @​Yuan-Jinghui in huggingface/pytorch-image-models#2675
• Fix CLS and Reg tokens usage when pos_embed is disabled by @​sinahmr in huggingface/pytorch-image-models#2676
• default weights_only=True for load fns by @​rwightman in huggingface/pytorch-image-models#2679
• Fix Hiera global attention to use 4D tensors for efficient SDPA dispatch by @​Raiden129 in huggingface/pytorch-image-models#2680
• Improve 2d and latent attention pool dimension handling. Fix #2682 by @​rwightman in huggingface/pytorch-image-models#2684
• Improve attention mask handling for vision_transformer and eva and related blocks by @​rwightman in huggingface/pytorch-image-models#2686
• Implement PRR as a pooling module. Alternative to #2678 by @​rwightman in huggingface/pytorch-image-models#2685

New Contributors

• @​haosenwang1018 made their first contribution in huggingface/pytorch-image-models#2672
• @​Raiden129 made their first contribution in huggingface/pytorch-image-models#2680

Full Changelog: huggingface/pytorch-image-models@v1.0.25...v1.0.26

Release v1.0.25

Feb 23, 2026

... (truncated)

Commits

• 0e968e1 Update README.md for release
• 6a49560 Version 1.0.27
• 6a928a1 Fix empty command line kwarg passing
• a60ce8b Avoid test triggering weights_only error for old PyTorch
• 7dff294 A few more tweaks to task setup for module access. Add back legacy_train.py a...
• 1953da3 Missed _helpers for task based resume/checkpoint
• 8bdb7ae More task fixups, made 'trainable_module' consistent, base optimization off t...
• 56e3981 Fix some performance regressions with torch.compile + Tasks. Fix #2693
• 6ce166b Add encoder_pool option to gemma4 classification model to toggle soft tokens ...
• eb11943 Update README.md
• Additional commits viewable in compare view

[dependabot]

Assignees

The following users could not be added as assignees: ByronWilliamsCPA. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

DeQA-Score/pyproject.toml

Package	Version	License	Issue Type
timm	1.0.27	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/timm	1.0.27	Unknown	Unknown

Scanned Files

• DeQA-Score/pyproject.toml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	torch@​2.0.1
	transformers@​4.36.1
	setuptools@​82.0.1
	scipy@​1.15.3
	scipy@​1.17.1
	wandb@​0.25.0
	sentencepiece@​0.1.99
	torchvision@​0.15.2
	scikit-learn@​1.2.2
	urllib3@​2.7.0
	uvicorn@​0.41.0
	timm@​0.6.13
	starlette@​0.50.0
	requests@​2.34.2
	ruff@​0.15.5
	tokenizers@​0.15.0
	ruff@​0.15.15
	shortuuid@​1.0.13

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: PyTorch: pypi torch`.load` with `weights_only=True` leads to remote code execution CVE: GHSA-53q9-r3pm-6pq6 PyTorch: torch.load with weights_only=True leads to remote code execution (CRITICAL) Affected versions: < 2.6.0 Patched version: 2.6.0 From: DeQA-Score/pyproject.toml → pypi/torch@2.0.1 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/torch@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report