Bump hydra-core from 1.1.1 to 1.3.4

[dependabot]

Bumps hydra-core from 1.1.1 to 1.3.4.

Release notes

Sourced from hydra-core's releases.

Hydra 1.3.4

Security patch release for the 1.3 line.

• Add a blocklist to hydra.utils.instantiate() for security-sensitive _target_ callables.

Users on Hydra 1.3 should upgrade from hydra-core<=1.3.3 to hydra-core==1.3.4.

Hydra 1.3.3 fixes source builds with modern setuptools by removing the setup.py dependency on pkg_resources. Fixes #3207.

Hydra 1.3.2

1.3.2 (2023-02-22)

Features

• Add a hydra.utils.get_object function that gives users access to Hydra's dotpath-lookup machinery. (#2139)
• Allow config_path to specify a non-relative module path, by starting with pkg:// (#2564)

Maintenance Changes

• Drop support for python3.6 (#2304)

Links:

• Hydra on pypi
• Hydra 1.3 docs

Hydra 1.3.1

1.3.1 (2022-12-20)

This bugfix release updates a version pin on the OmegaConf library, allowing Hydra to be installed alongside the latest version of OmegaConf.

Bug Fixes

• Relax OmegaConf pin allowing OmegaConf 2.3 to be installed (#2510)

Links:

• Hydra on pypi
• Hydra 1.3 docs

Hydra 1.3.0

1.3.0 (2022-12-08)

Features:

• Implement _convert_="object" option for instantiate, enabling conversion of non-_target_ structured configs to instances of the backing dataclass / attr class. (#1719)

... (truncated)

Changelog

Sourced from hydra-core's changelog.

1.3.4 (2026-07-05)

Bug Fixes

• Add an instantiate target blocklist for security-sensitive callables. (#3259) 1.3.3 (2026-06-11) ==================

Bug Fixes

• Remove the setup.py dependency on pkg_resources for source builds. (#3207)

1.3.2 (2023-02-22)

Features

• Add a hydra.utils.get_object function that gives users access to Hydra's dotpath-lookup machinery. (#2139)
• Allow config_path to specify a non-relative module path, by starting with pkg:// (#2564)

Maintenance Changes

• Drop support for python3.6 (#2304)

1.3.1 (2022-12-20)

Bug Fixes

• Relax OmegaConf pin allowing OmegaConf 2.3 to be installed (#2510)

1.3.0 (2022-12-08)

Features

• Implement _convert_="object" option for instantiate, enabling conversion of non-_target_ structured configs to instances of the backing dataclass / attr class. (#1719)
• Enable layering of the @hydra.main decorator on top of other decorators produced using functools.wraps. (#2303)
• Allow for non-leading dashes in override keys (#2363)
• support specifying an absolute path with --config-path (#2368)
• Support python3.11 (#2443)

Bug Fixes

• Fix an issue where Hydra's exception-handling logic could raise an AssertionError (#2342)

... (truncated)

Commits

• 81070c4 Release Hydra 1.3.4
• bc0b68c Pin pytest for 1.3 test compatibility
• 461538e updated news fragment
• 7faad0d Harden instantiate target blocklist (#3261)
• d69214b Add 1.3 branch PyPI publish workflow
• e67cae3 Prepare Hydra 1.3.3 release
• f8d6111 Fix source builds without pkg_resources
• 7ef3aca release v1.3.2
• 224d01a silence bandit security false positive (#2593)
• f66646f Allow specifying a non-relative module name in config_path (#2565)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.