deps(deps): bump transformers from 5.12.1 to 5.13.1

[dependabot]

Bumps transformers from 5.12.1 to 5.13.1.

Release notes

Sourced from transformers's releases.

Patch release v5.13.1

This patch is focused on enabling transformers for the latest release of vllm!

• Be more defensive with remap_legacy_layer_types for custom models (#47245) from @​hmellor
• Fix custom code which doesn't know about the new linear layer type names (#47174) from @​hmellor
• Fix case where _LazyAutoMapping.register is passed a str key (#47148) from @​hmellor

Release v5.13.0

New Model additions

KimiK 2.5, 2.6, and 2.7

This release includes the architecture for Kimi 2.5 which is used by 2.5-2.7:

Kimi K2.5 is an open-source, native multimodal agentic model that advances practical capabilities in long-horizon coding, coding-driven design, proactive autonomous execution, and swarm-based task orchestration. The model was proposed in Kimi K2.5: Visual Agentic Intelligence and further improved in [Kimi K2.6: Advancing Open-Source Coding](https://github.com/huggingface/transformers/blob/HEAD/Kimi K2.5: Visual Agentic Intelligence).

Kimi K2.5 achieves significant improvements on complex, end-to-end coding tasks, generalizing robustly across programming languages (Rust, Go, Python) and domains spanning front-end, DevOps, and performance optimization. The model is capable of transforming simple prompts and visual inputs into production-ready interfaces and lightweight full-stack workflows, generating structured layouts, interactive elements, and rich animations with deliberate aesthetic precision.

Links: Documentation

• Add new model: Kimi2-6 (#45630) by @​zucchini-nlp in #45630

MiMo-V2-Flash

MiMo-V2-Flash is a Mixture-of-Experts (MoE) language model developed by the Xiaomi MiMo team. Designed to establish a new balance between long-context modeling capabilities and inference efficiency, the model is built for strong performance in complex reasoning and agentic tasks. Trained on 27T tokens with native 32k sequence lengths, MiMo-V2-Flash seamlessly supports an extended 256K context window while significantly reducing KV-cache storage compared to standard global attention models.

Links: Documentation

• Add Xiaomi MiMo-V2 (#45144) by @​casinca in #45144

Nemotron 3.5 ASR

Nemotron 3.5 ASR is a 600M-parameter multilingual speech recognition model from NVIDIA, built for high-quality transcription in both low-latency streaming and high-throughput batch settings, with native punctuation and capitalization. For streaming, it offers configurable chunk sizes—80ms, 160ms, 560ms, and 1120ms, letting users trade off latency against accuracy to suit their application. Its cache-aware FastConformer-RNNT architecture is central to this capability: unlike traditional buffered streaming, which repeatedly reprocesses overlapping audio windows, the model processes only each new incoming chunk while reusing cached encoder context from prior chunks. This eliminates redundant computation, significantly improves efficiency, and minimizes end-to-end delay without sacrificing accuracy, making it well suited to real-time transcription workloads.

Links: Documentation

• Add Nemotron 3.5 ASR Streaming (#46565) by @​eustlb in #46565

NemotronAsrStreaming

Nemotron ASR Streaming is a 600M-parameter English speech recognition model from NVIDIA, built for high-quality transcription in both low-latency streaming and high-throughput batch settings, with native punctuation and capitalization. For streaming, it offers configurable chunk sizes—80ms, 160ms, 560ms, and 1120ms, letting users trade off latency against accuracy to suit their application. Its cache-aware FastConformer-RNNT architecture is central to this capability: unlike traditional buffered streaming, which repeatedly reprocesses overlapping audio windows, the model processes only each new incoming chunk while reusing cached encoder context from prior chunks. This eliminates redundant computation, significantly improves efficiency, and minimizes end-to-end delay without sacrificing accuracy, making it well suited to real-time transcription workloads.

Links: Documentation

• Add Nemotron ASR Streaming (#46332) by @​eustlb in #46332

... (truncated)

Commits

• 4626421 v5.13.1
• bef013c Be more defensive with remap_legacy_layer_types for custom models (#47245)
• 8bbbe24 Fix custom code which doesn't know about the new linear layer type names (#47...
• c782b84 Fix case where _LazyAutoMapping.register is passed a str key (#47148)
• 6af945f v5.13.0
• 0983570 Add new model: Kimi2-6 (#45630)
• 600c196 Update workflow callers to use transformers-ci (#47040)
• 259711a Fix/qwen3 variants tp plan (#47041)
• 5d06305 Add HunYuan VL model (#46417)
• 89917d0 Add tiny_model_id support to ProcessorTesterMixin for memory-sensitive tests ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[nuntius-review]

Nuntius

Reviewed commits

Commit	Summary
0bd5335	deps(deps): bump transformers from 5.12.1 to 5.13.1

An analysis of the change in requirements.txt reveals a potential correctness and security concern regarding the version numbers:

Correctness & Security Analysis

1. Non-existent Public Versions (Potential Dependency Confusion / Typo):
   The official Hugging Face transformers library is currently on version 4.x (e.g., 4.48.x). There are no official 5.x releases (such as 5.12.1 or 5.13.1) on the public PyPI registry.

   • If this is a typo (e.g., meaning 4.13.1), it should be corrected to prevent installation failures.
   • If this refers to a private fork or internal package hosted on a private package index, ensure that your pip configuration uses --index-url instead of --extra-index-url to mitigate Dependency Confusion attacks, where an attacker could register a malicious transformers==5.13.1 on the public PyPI to override your private package.

2. Other Version Anomalies:
   Similarly, fastapi==0.138.0, uvicorn==0.49.0, torch==2.9.1, and datasets==5.0.0 do not currently exist on public PyPI. This strongly suggests either a future-mocked environment, a custom internal versioning scheme, or a private repository.

If this is indeed an internal/private repository and the versioning is correct for your environment, the minor version bump from 5.12.1 to 5.13.1 is correct and follows standard dependency management practices. No changes are required in that case.

[dependabot]

Superseded by #93.