build(deps): bump transformers from 4.52.1 to 5.17.0

[dependabot]

Bumps transformers from 4.52.1 to 5.17.0.

Release notes

Sourced from transformers's releases.

Release 5.17.0

Release v5.17.0

New Model additions

HYV4

Hy4-Preview is a 780B-parameter mixture-of-experts language model that activates 49B parameters per token. Each MoE layer holds 256 routed experts plus one always-active shared expert and routes every token to 8 of them. The context window is 1M tokens.

The architecture combines four features:

• Multi-head Latent Attention (MLA) compresses keys and values into a low-rank latent (kv_lora_rank) that kv_b_proj expands back to one key/value per query head.
• DeepSeek Sparse Attention (DSA) selects index_topk keys per query with a lightweight indexer. Following IndexShare, only the layers marked "full" in indexer_types run an indexer; "shared" layers reuse the previous full layer's selection.
• Gated MLA with learnable attention sinks, where each head owns a sink logit that participates in the softmax and contributes no value, as in GPT-OSS.
• Independent Hyper-Connections (iHC) replace the plain residual path with hc_mult parallel residual streams that are collapsed before, and redistributed after, every sublayer.

The implementation does not execute the multi-token prediction (MTP) layers. Released checkpoints keep those weights so that other runtimes can use them for speculative decoding; they are ignored at load time.

Links: Documentation

• Add h4 (#48473) by @​ArthurZucker in #48473

VibeVoice

VibeVoice is a novel framework for synthesizing high-fidelity, long-form speech with multiple speakers by employing a next-token diffusion approach within a Large Language Model (LLM) structure. It's designed to capture the authentic conversational "vibe" and is particularly suited for generating audio content like podcasts and multi-participant audiobooks.

Links: Documentation

• Implement VibeVoice (#40546) by @​pengzhiliang in #40546

NeoMME

NeoMME is a family of efficient 260M and 800M parameter multimodal-native multilingual foundation encoders from H Company. It processes multilingual text tokens and raw image patches in a single bidirectional Transformer encoder, without a separately pretrained vision tower or causal language model.

NeoMME-Retriever is a model fine-tuned from the NeoMME backbone for visual document retrieval with joint late-interaction and dense objectives. It takes text queries and documents (text or page screenshots) and produces multi-vector embeddings for MeanMaxSim scoring (late-interaction) and mean-pooled embeddings for cosine similarity (dense).

Links: Documentation

... (truncated)

Commits

• 856157a v5.17.0
• 5b7dcb0 MRoPE continued (#48594)
• 50bbcc6 [fix] Update stale expected strings in HunYuanVL integration tests (#48646)
• e8bcd79 [Quantizaiton]support 5/6/7 bits in AutoRound (#48481)
• 3283d5f [fix] Update stale golden values and fix expected_logits shape in FlavaForPre...
• 5f47b5a [tests] Fix integration test golden values broken by fast image processor def...
• fc50134 Add Fun-ASR-Nano model (#46180)
• d9fe823 Fix YOLOS device mismatch with device_map="auto" (#46886)
• cbc1651 [Generate] Avoid unconditionally downloading remote hub file (#48620)
• bd05a4b Honor shift_labels in decoder-only LLM/VLM losses (#48493)
• Additional commits viewable in compare view

[ReSerendipity]

先别合：这条单独不可能解析成功，但它其实是 #97 的唯一"前进"出路

按 PyPI requires_dist 实测（不含任何猜测）：

依赖	4.52.1 要求	5.17.0 要求	当前锁里
tokenizers	>=0.21,<0.22	>=0.23.1,<0.24.0	0.23.2
huggingface-hub	>=0.30,<1.0	>=1.5.0,<2.0	0.36.2
regex	无日期下限	>=2025.10.22	2026.9.10 ✔
safetensors	>=0.4.3	>=0.8.0	0.8.0 ✔
Python	>=3.9	>=3.10	我们 3.10+ ✔

两个直接结论：

1. 本 PR 单独合不进一个自洽的锁集：5.17.0 要求 hub>=1.5，而锁里是 0.36.2 → 必须与 build(deps): bump huggingface-hub from 0.36.2 to 1.32.0 #91（hub→1.32.0）同批。两者区间不冲突（1.32.0 ≥ 1.5.0 ✔）。
2. 但 0.23.2 这个 tokenizers 钉版只有 5.x 能吃：4.x 全线（实测 4.56.2 / 4.57.0 / 4.57.6）天花板都是 tokenizers<=0.23.0。所以 main 的便携锁集自相矛盾（#87 引入）：4 条可证明的约束违反，pip 解析不了 #97 的修法只有两条 —— 要么把 tokenizers 退回 0.21.x 保 4.52.1，要么整组进 5.x（= build(deps): bump transformers from 4.52.1 to 5.17.0 #88 + build(deps): bump huggingface-hub from 0.36.2 to 1.32.0 #91）。"升到 4.57.x 满足下界"救不了它，这点和 feat(ci)+fix(security): 钉版下界棘轮门禁 + CSRF 静默降级改硬失败 #81 债务卡里写的方向需要修正。

API 面（能确定的部分）

仓库自有代码只从 transformers 取 4 个顶层符号：AutoModel、AutoTokenizer、LlamaTokenizerFast、PreTrainedTokenizer。
不确定的部分：app/integrated_app/vendor/ 下上游建模代码是否用到 5.x 移除的 API，元数据看不出来 —— 必须真跑一次模型加载才算数（本机有 GPU 与权重，可以验）。

判据已就位

#98 的 scripts/check_pin_crossconflicts.py 就是为这类判断写的：改完锁跑它，0 冲突才有讨论意义。它当前在 main 上报出的正是 #97 那 4 条（mpmath/antlr4 那两条与 transformers 无关，无论如何都得回退）。

建议：把 #88 + #91 当一个批次，先解 #97 的 mpmath/antlr4 回退，再决定 tokenizers 走"退"还是"进"；走"进"的话合并后要跑一次便携包解析 + 真机加载。

[ReSerendipity]

关闭理由：这条 bump 被我们自己的门禁判死，不是主观取舍。

CI 的 Lint (ruff) 步骤里跑的 pin-crossconflict 检查（run 35565448506）给出 4 条硬冲突：

[pin-cross] 锁集内部自相矛盾：pip 解析必然失败（历史上表现为便携包 ResolutionImpossible）
  [FAIL] requirements-lock.txt:  transformers==5.17.0 要求 huggingface-hub>=1.5.0，锁里是 huggingface-hub==0.36.2
  [FAIL] requirements-lock.txt:  transformers==5.17.0 要求 tokenizers>=0.23.1，锁里是 tokenizers==0.21.0
  [FAIL] requirements-small.txt: 同上两条

而把 hub/tokenizers 一起抬上去也解决不了引擎侧：2026-09-21 在本机 RTX 5070 Ti 做过 A/B ——
只升到 transformers 4.57.6 + tokenizers 0.22.2（离 5.17 还差 4 个大版本），
indextts.infer_v2_5 与 indextts.infer_v2 就直接 ImportError，IndexTTS 2.5 / 2.0 双双起不来，
只有 VoxCPM2 正常。回 4.52.1 + 0.21.0 三引擎真推理全通（2.5：214,040 B / RMS 6176；
2.0：205,124 B / RMS 6926；VoxCPM2：230,148 B / RMS 4615）。indextts 2.0.0 的发行元数据本身
写的就是 transformers==4.52.1 且 tokenizers==0.21.0。

所以本仓库当前的口径是（#103 落地）：下界 transformers>=4.52.1,<4.53，配套 4.52.4 的三条 CVE
按"已接受风险"逐条豁免 + 带 expiration，理由与可达性判定在 docs/SECURITY_DEPENDABOT_TRIAGE.md §1/§2。

重新打开的条件（写在分诊文档 §4）：IndexTTS 侧适配 transformers ≥4.53 —— 上游放开精确 pin，
或我们改 vendored 拷贝并跑通三引擎真推理。到那时这条 bump 才有意义，届时请重开或直接开新的。

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.