chore(deps): bump the training-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the training-dependencies group with 4 updates in the /training/rl directory: azure-ai-ml, pyjwt, rsl-rl-lib and tensordict.

Updates azure-ai-ml from 1.34.1 to 1.35.0

Release notes

Sourced from azure-ai-ml's releases.

azure-ai-ml_1.35.0

1.35.0 (2026-09-08)

Bugs Fixed

• Simplified schedule validation errors so invalid local job paths report the relevant file error instead of errors from every supported job schema.
• Fixed internal pipeline Command node dropping node-level interactive services (SSH, JupyterLab, TensorBoard, VS Code, etc.) during serialization, which prevented interactive endpoints from being created for Singularity jobs. The services are now serialized into the pipeline REST request and round-tripped on deserialization, matching the public Command node behavior.
• Fixed MLClient.jobs.create_or_update, archive, and restore failing for previously-fetched jobs across all job types by routing metadata-only edits through the RunHistory PATCH endpoint.
• Fixed DeploymentTemplate.creation_context always being None when retrieved via get() or list(). The created/modified timestamps and identity returned by the service (as createdTime / modifiedTime / createdBy) are now populated on creation_context, making DeploymentTemplate consistent with Model and Environment.
• Fixed DeploymentTemplate.creation_context.last_modified_by always being None even after the service began returning the modifying identity. The service sends it as a flattened modifiedBy field (top-level for get(), nested under properties for list()) alongside a present-but-null lastModifiedBy; last_modified_by is now populated from modifiedBy, matching how created_by is read.
• Fixed deployment_templates.list(name=...) raising AttributeError: 'str' object has no attribute 'request_timeout'. In the list response, requestSettings / livenessProbe / readinessProbe arrive as stringified dicts nested under properties; these are now parsed before conversion, giving list() parity with models.list() / environments.list().
• Fixed deployment_templates.get(name) failing with a 404 (DeploymentTemplate {name}:latest not found) when no version was supplied, because the literal string "latest" was sent as the version. The latest version is now resolved client-side (the service exposes no latest label and no server-side ordering), and get() accepts a label keyword (label="latest" resolves to the latest version) mirroring models.get(). delete(name) resolves the latest version the same way.
• Fixed models.get(name, label="latest") returning a Model whose default_deployment_template / allowed_deployment_templates references had asset_id=None. Label resolution goes through the version list endpoint (top=1), whose items omit the deployment-template references; for registry models the resolved version is now re-fetched through the get endpoint, so the label path hydrates these references identically to the explicit version= path.
• Added MLClient.jobs.begin_delete(name) to delete a job.
• Fixed loading a registered MLTable data asset via mltable.load("azureml://.../data/<name>/versions/<version>") failing with AttributeError: 'DataVersionEntity' object has no attribute 'additional_properties'. When the dataset_dataplane client was migrated to the TypeSpec (hybrid) model, DataVersionEntity stopped exposing the msrest additional_properties attribute that the mltable package reads (isV2 / legacyDataflow) on the local resolution path. The attribute is now restored as a compatibility shim returning the un-modeled wire keys, so the on-the-wire contract is unchanged.

Other Changes

• Migrated SDK entities and their consumers off the per-version msrest REST clients onto the shared arm_ml_service hybrid client. This is an internal change; the on-the-wire request/response contract is unchanged.

Commits

• 59fb7a9 Update CHANGELOG for version 1.35.0 release date (#48847)
• b95aa88 Update _version.py
• 8f90a15 Update _version.py
• 659c803 Configure Agent Server trace sampling and instrumentation defaults (#48753)
• 71ebbb4 [Search] Include Issue Cleanup starting 2026-08-01-preview release (#48767)
• fc72d1a [Storage Blob] Migrating to TypeSpec (#45133)
• 11200c9 Scope durable task IDs by hosted session GUID (#48776)
• aeeef3d Prepare azure-postgresql-auth 1.1.0 for release (#48762)
• ce9b039 Populate measurements on telemetry from the microsoft.custom_measurements a...
• eacd370 Increment package version after release of azure-ai-agentserver-responses (#4...
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Updates rsl-rl-lib from 5.5.0 to 5.5.1

Release notes

Sourced from rsl-rl-lib's releases.

v5.5.1

Overview

Full Changelog: leggedrobotics/rsl_rl@v5.5.0...v5.5.1

Fixed

• Fixes start_method=thread error with latest wandb by @​k1000dai in leggedrobotics/rsl_rl#232
• Avoids broadcast_object_list when broadcasting parameters to avoid CUDA context and adds the RND target to the broadcast by @​ClemensSchwarke and @​hujc7 in leggedrobotics/rsl_rl#233
• Reduces multi-GPU gradients in bounded buckets to avoid OOM by @​Strtus in leggedrobotics/rsl_rl#228

New Contributors

• @​k1000dai made their first contribution in leggedrobotics/rsl_rl#232
• @​hujc7 made their first contribution in leggedrobotics/rsl_rl#233
• @​Strtus made their first contribution in leggedrobotics/rsl_rl#228

Commits

• 857de61 Bump version to 5.5.1
• 00e13d1 Reduce multi-GPU gradients in bounded buckets (#228)
• a49e44e Avoid broadcast_object_list when broadcasting parameters (#233)
• fe28cb0 Remove start_method=thread causing errors in latest wandb (#232)
• See full diff in compare view

Updates tensordict from 0.14.1 to 0.14.2

Release notes

Sourced from tensordict's releases.

TensorDict v0.14.2

TensorDict 0.14.2 is a patch release correcting compiled shallow copies, non-tensor concatenation, and CUDA graph replay. No new public APIs, breaking changes, or deprecations are introduced.

• Preserve independent nested containers in compiled shallow copies while continuing to share tensor leaves (#1784).
• Preserve non-tensor values during concatenation, including mixed inputs and padded metadata, while retaining scalar metadata and weak-reference behavior (#1786).
• Ensure CUDA graph replay uses updated inputs when a module writes outputs under its input keys (#1788).

Install after publication: pip install tensordict==0.14.2

Thanks to @​vmoens.

Full changelog

Commits

• f2b44ec [Versioning] Prepare TensorDict 0.14.2
• 72b56ac [BugFix] Preserve uniform metadata during non-tensor concatenation
• 1bb5136 [BugFix] Keep CudaGraphModule inputs bound when a module rewrites its input k...
• 1f853a5 [BugFix] Preserve non-tensor values during concatenation (#1786)
• 03e16e0 [Compile] Preserve nested structure in shallow TensorDict copies (#1784)
• See full diff in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA bfd1b15.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

training/rl/uv.lock

Package	Version	License	Issue Type
tensordict	0.14.2	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/azure-ai-ml	1.35.0	Unknown	Unknown
pip/pyjwt	2.14.0	Unknown	Unknown
pip/rsl-rl-lib	5.5.1	Unknown	Unknown
pip/tensordict	0.14.2	Unknown	Unknown

Scanned Files

• training/rl/uv.lock

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.10%. Comparing base (ccd7603) to head (bfd1b15).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1580      +/-   ##
==========================================
- Coverage   88.13%   88.10%   -0.03%     
==========================================
  Files         279      279              
  Lines       23245    23203      -42     
  Branches     3153     3153              
==========================================
- Hits        20486    20444      -42     
  Misses       2071     2071              
  Partials      688      688              

Flag	Coverage Δ		*Carryforward flag
go	100.00% <ø> (ø)
pester	86.64% <ø> (-0.11%)	⬇️	Carriedforward from ccd7603
pytest-data-pipeline	100.00% <ø> (ø)		Carriedforward from ccd7603
pytest-dataviewer	89.66% <ø> (ø)		Carriedforward from ccd7603
pytest-dm-tools	100.00% <ø> (ø)		Carriedforward from ccd7603
pytest-evaluation	95.40% <ø> (ø)
pytest-fuzz	3.99% <ø> (ø)
pytest-inference	100.00% <ø> (ø)		Carriedforward from ccd7603
pytest-shared-ci	100.00% <ø> (ø)		Carriedforward from ccd7603
pytest-training	92.60% <ø> (ø)
vitest	85.66% <ø> (ø)		Carriedforward from ccd7603
vitest-app	85.66% <ø> (ø)		Carriedforward from ccd7603
vitest-components	85.66% <ø> (ø)		Carriedforward from ccd7603
vitest-features	85.66% <ø> (ø)		Carriedforward from ccd7603
vitest-lib	85.66% <ø> (ø)		Carriedforward from ccd7603
vitest-state	85.66% <ø> (ø)		Carriedforward from ccd7603

*This pull request uses carry forward flags. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.