build(deps): bump torch from 2.9.1 to 2.12.0 (#621)

Bumps [torch](https://github.com/pytorch/pytorch) from 2.9.1 to 2.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytorch/pytorch/releases">torch's
releases</a>.</em></p>
<blockquote>
<h1>PyTorch 2.12.0 Release Notes</h1>
<ul>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards
Incompatible Changes</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New
Features</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug
fixes</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li>
<li><a
href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li>
</ul>
<h1>Highlights</h1>
<!-- raw HTML omitted -->
<p>For more details about these highlighted features, you can look at
the release blogpost. Below are the full release notes for this
release.</p>
<h1>Backwards Incompatible Changes</h1>
<h2>Build Frontend</h2>
<ul>
<li>
<p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which
may reject previously accepted but incorrect SVE configurations (<a
href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p>
<p>Source builds that enable SVE now validate the compiler configuration
more strictly. If a build previously passed with an incomplete or
mismatched SVE setup, it may now fail during CMake configuration instead
of later in compilation. Update the compiler/toolchain flags so they
accurately describe the target SVE support, or disable SVE for that
build.</p>
</li>
<li>
<p>Updated the minimum CUDA version required to build PyTorch from
source to CUDA 12.6 (<a
href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p>
<p>Building PyTorch from source with CUDA versions older than 12.6 is no
longer supported. Users building custom binaries should install CUDA
12.6 or newer and make sure <code>CUDA_HOME</code> points to that
installation.</p>
<p>Version 2.11:</p>
<pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py
develop
</code></pre>
<p>Version 2.12:</p>
<pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py
develop
</code></pre>
</li>
<li>
<p>Enforced a C++20 minimum in CMake build files (<a
href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a>
[release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a
href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a>
[MPS] Fix SDPA wrong output for permuted q/k/v with B &gt; 1 (<a
href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a>
Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a
href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>)
(<a
href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a>
Avoid raw stream name collisions in Inductor (<a
href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a>
[MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a
href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>)
(<a
href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a>
Add enable_gqa parameter to SDPA MPS meta registration (<a
href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a>
[AOTI] Add BC-safe c_shim v2 for
_scaled_dot_product_attention_math_for_mps e...</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a>
[Inductor] Call latest c_shim version for versioned fallback ops (<a
href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a>
Revert &quot;[FSDP2] add fqn to communication ops&quot; (<a
href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>)
(<a
href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li>
<li><a
href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a>
Revert &quot;[Inductor] Improve materialization heuristic for a chain of
computaio...</li>
<li>Additional commits viewable in <a
href="https://github.com/pytorch/pytorch/compare/v2.9.1...v2.12.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=torch&package-manager=uv&previous-version=2.9.1&new-version=2.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/CDCgov/dibbs-text-to-code/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rob Mitchell <40571882+robertandremitchell@users.noreply.github.com>
Co-authored-by: Rob Mitchell <robert.a.mitchell@skylight.digital>

Author: dependabot[bot]

Dockerfile.ttc

@@ -10,13 +10,13 @@ LABEL org.opencontainers.image.licenses=Apache-2.0
 # off the runtime layer, which is where the HIGH-severity CVEs come from.
 # --releasever=latest is required: AL2023 base images pin to a snapshot release.
 RUN microdnf update -y --releasever=latest \
-    && microdnf clean all \
-    && rm -f /usr/local/bin/aws-lambda-rie
+  && microdnf clean all \
+  && rm -f /usr/local/bin/aws-lambda-rie
 
 # Heavy, rarely-changing layers first so they stay cached across source changes.
 # Install CPU-only PyTorch before any workspace package — a transitive pin
 # could otherwise pull the full CUDA wheel before our override lands.
-RUN pip install --no-cache-dir torch==2.9.1 --index-url https://download.pytorch.org/whl/cpu
+RUN pip install --no-cache-dir torch>=2.12.0 --index-url https://download.pytorch.org/whl/cpu
 RUN pip install --no-cache-dir huggingface_hub
 
 # Torch's build environment can leave behind an older setuptools that shadows
@@ -29,7 +29,7 @@ RUN --mount=type=secret,id=huggingface_token,env=HF_TOKEN \
 
 # Download reranker at build time (private repo, needs token)
 RUN --mount=type=secret,id=huggingface_token,env=HF_TOKEN \
-    python -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='NCHS/ttc-reranker-mvp', local_dir='/opt/reranker_model', ignore_patterns=['*.git*', '*.md', 'onnx/*', 'openvino/*', 'pytorch_model.bin', 'tf_model.h5', 'flax_model.msgpack', 'model.onnx'])" \
+  python -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='NCHS/ttc-reranker-mvp', local_dir='/opt/reranker_model', ignore_patterns=['*.git*', '*.md', 'onnx/*', 'openvino/*', 'pytorch_model.bin', 'tf_model.h5', 'flax_model.msgpack', 'model.onnx'])" \
   && rm -rf /root/.cache/huggingface
 
 # Workspace packages (change frequently) come after the heavy layers.
@@ -47,7 +47,7 @@ RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/text-to-code"
 
 COPY ./packages/text-to-code-lambda ${LAMBDA_TASK_ROOT}/text-to-code-lambda
 RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/text-to-code-lambda" \
-    && pip install --no-cache-dir --upgrade "urllib3>=2.7.0"
+  && pip install --no-cache-dir --upgrade "urllib3>=2.7.0"
 
 # Clean up package source copies
 RUN rm -rf ${LAMBDA_TASK_ROOT}/shared-models ${LAMBDA_TASK_ROOT}/utils ${LAMBDA_TASK_ROOT}/lambda-handler ${LAMBDA_TASK_ROOT}/text-to-code ${LAMBDA_TASK_ROOT}/text-to-code-lambda

packages/text-to-code/pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
   # to ensure compatibility across all hardware.
   # Once Intel Mac support is no longer needed, we can remove these pinned torch and numpy
   # versions and rely on spacy and sentence-transformers to manage their own dependencies.
-  "torch==2.9.1",
+  "torch>=2.12.0",
 ]
 
 [dependency-groups]