Update rfdetr requirement from <2,>=1.8.0 to >=1.9.0,<2

[dependabot]

Updates the requirements on rfdetr to permit the latest version.

Release notes

Sourced from rfdetr's releases.

v1.9.0: Configurable Training, ExecuTorch & CoreML Export

📋 Summary

RF-DETR v1.9.0 makes training more configurable and deployment more portable. The training optimizer and LR scheduler are now pluggable (any torch.optim name, dotted import path, or callable), keypoint/pose models can train under multi-GPU and multi-node DDP, and models export to ExecuTorch (.pte) and native CoreML (.mlpackage) for on-device inference, alongside an improved TensorRT export path. Checkpoint loading is also hardened: RFDETR.from_checkpoint() now defaults to safe (weights_only=True) deserialization. The default augmentation backend changes in this release — see the migration guide before upgrading if you rely on the previous default.

✨ Spotlights / highlights

ExecuTorch export

model = RFDETRSmall()
model.export(format="executorch", backend="xnnpack")  # or "coreml", "qnn"

Native CoreML export

model = RFDETRSmall()
model.export(format="coreml", coreml_precision="float16")  # .mlpackage, no ONNX intermediary

Multi-GPU / multi-node keypoint training

RFDETRKeypointPreview().train(
    dataset_dir="...",
    strategy="ddp",
    devices=4,
    grad_accum_steps=1,
)

Configurable optimizer & LR scheduler

from rfdetr.config import TrainConfig
TrainConfig(
optimizer="pytorch_optimizer.Lion",
lr_scheduler="torch.optim.lr_scheduler.OneCycleLR",
lr_scheduler_kwargs={"max_lr": 1e-3, "total_steps": 10_000},
)

Safe checkpoint loading by default

model.from_checkpoint("checkpoint.pth")  # now weights_only=True by default
model.from_checkpoint("legacy_checkpoint.pth", trust_checkpoint=True)  # opt-in for trusted files

... (truncated)

Changelog

Sourced from rfdetr's changelog.

[1.9.0] — 2026-07-27

• Default dataset augmentations now use torchvision-native transforms unless Albumentations is installed, in which case augmentation_backend="auto"/"cpu" (the default) auto-selects Albumentations instead — identical user code can therefore resolve to a different resize backend (and slightly different pixel values / mAP) purely based on whether rfdetr[augment] is installed. Pass augmentation_backend="torchvision" to pin torchvision regardless of what is installed. Non-empty custom aug_config dictionaries use the optional Albumentations integration and Kornia GPU backend, both via pip install 'rfdetr[augment]'. The [train] extra no longer installs Albumentations or Kornia. See the migration guide's "Upgrade 1.8 → 1.9" section for remediation steps. (#1112)

Added

• Native CoreML export: format="coreml" on RFDETR.export() produces a .mlpackage (mlprogram, iOS 16+) directly from torch.export, with no ONNX intermediary — distinct from ExecuTorch's format="executorch", backend="coreml" .pte path. Install with pip install 'rfdetr[coreml]' (macOS only; coremltools>=8.0,<10.0). (#1235)
• Multi-GPU / multi-node keypoint (pose) training under DistributedDataParallel. Keypoint models (RFDETRKeypointPreview) previously raised NotImplementedError for any distributed strategy, num_nodes > 1, or devices > 1; they now train with strategy="ddp" / strategy="auto" on multiple GPUs and nodes, launched with torchrun exactly like detection models. Because keypoint models use manual optimization, gradients synchronize on every microbatch — keep grad_accum_steps=1 on multi-GPU for best throughput (grad_accum_steps > 1 is correct but performs redundant all-reduces). Sharded strategies (FSDP / DeepSpeed) remain unsupported for keypoint models and raise a clear error. See the "Keypoint / Pose models" note in docs/learn/train/advanced.md. (#1232)
• scale_jitter: bool = True on TrainConfig — independent control for the resize → crop → resize branch (Option B) in the training resize pipeline. Previously, disabling this branch required passing aug_config={}, which also disabled the entire Albumentations augmentation stack; aug_config now controls only that stack. Set scale_jitter=False to use direct resize only, with annotations near image borders never clipped.
• AugmentationBackend.TV (augmentation_backend="torchvision") — forces the torchvision-native default pipeline. Unlike "cpu"/"auto", which auto-select the best installed backend (Albumentations > Kornia > torchvision) and can therefore resolve differently across environments, "torchvision" always resolves to torchvision regardless of what optional packages happen to be installed. AugmentationBackend now only holds concrete, directly-usable backends (TV, ALBU, KORNIA); "cpu"/"auto" remain accepted augmentation_backend input strings (resolved lazily at dataset-build time, keeping saved configs portable across environments) but are no longer enum members. AugmentationBackend.TV/.ALBU values changed from "tv"/"albu" to "torchvision"/"albumentations"; the old "tv"/"albu"/"gpu" strings are still accepted as legacy input aliases.
• TrainConfig.optimizer (str | Callable) and optimizer_kwargs — configurable training optimizer. optimizer="adamw" (the default) keeps RF-DETR's built-in fused torch.optim.AdamW path unchanged. A bare short name selects a native torch.optim optimizer only (e.g. "sgd", "adam"); any other optimizer — including third-party ones such as pytorch-optimizer (install separately) — is selected by a full dotted import path ("pytorch_optimizer.Lion") or a callable / functools.partial called with the RF-DETR parameter groups. optimizer_kwargs forwards constructor arguments (ignored for callables, which bake their own arguments in). (#1006)
• TrainConfig.lr_scheduler (str | Callable) plus lr_scheduler_kwargs, lr_scheduler_interval, and lr_scheduler_monitor — configurable LR scheduler, mirroring optimizer. lr_scheduler="step"/"cosine" (the managed presets) keep RF-DETR's built-in warmup-aware schedules unchanged; any other scheduler is selected by a full dotted import path ("torch.optim.lr_scheduler.OneCycleLR") or a callable / functools.partial called with the optimizer. Explicit schedulers are built from lr_scheduler_kwargs only (no total_steps/T_max injected), are auto-wrapped in a SequentialLR linear warmup when warmup_epochs>0, and step at lr_scheduler_interval ("step"/"epoch"). ReduceLROnPlateau is supported end-to-end: it steps once per epoch on the metric named by lr_scheduler_monitor (default "val/loss"), in both the automatic and manual (keypoint) optimization paths.

Deprecated

• TrainConfig.lr_drop and lr_min_factor — pass them through lr_scheduler_kwargs instead ({"lr_drop": ...} / {"min_factor": ...}). Deprecated since v1.9.0, will be removed in v1.11.0. The fields still work in the meantime and are folded into lr_scheduler_kwargs for the managed presets with a FutureWarning; default values (e.g. on config reload) do not warn. Set with an explicit (non-managed) scheduler they are inert and emit a FutureWarning.

Fixed

• Keypoint L1-loss helper (compute_l1_keypoint_loss) now returns graph-connected zeros on its out-of-schema class-index guard instead of detached new_zeros. A detached zero left the keypoint-head parameters without a gradient path on that batch, which desyncs DistributedDataParallel's gradient reducer across ranks (hang or "parameter did not receive grad") when the guard fires on some ranks but not others. This is a prerequisite for the multi-GPU keypoint training above.
• Non-square Albumentations training resize (aug_config set, augmentation_backend resolving to "albumentations") no longer silently inflates every image's longest side to max_size (1333 by default). SmallestMaxSize → LongestMaxSize always forces an exact resize in Albumentations, not a conditional cap; a new CappedLongestMaxSize internal transform only shrinks, never upscales, matching torchvision's RandomResize semantics.
• Explicit augmentation_backend="albumentations" now raises a clear ImportError immediately if Albumentations is not installed, instead of resolving successfully and failing later, deep in dataset construction.
• RFDETR.from_checkpoint(..., trust_checkpoint=True) now actually works. It previously bypassed the safe-load check only for the checkpoint's own metadata read; model construction then silently reloaded the same file through load_pretrain_weights() with the unsafe-load default, so trust_checkpoint=True had no effect on checkpoints that genuinely needed it and raised the same RuntimeError it was supposed to bypass. (#1239)
• Segmentation evaluation resized ground-truth masks to each image's original resolution before comparison, a lossy round trip vs. the mask head's native grid; GT masks now resize directly to each prediction's own pixel grid, so segm mAP is computed on consistent pixel grids. (#1241)
• pip install 'rfdetr[onnx]' (and [tflite]) no longer hangs building onnxsim from source on CPython 3.11/3.13 and Linux aarch64. The previous onnxsim<0.6.0 pin resolved to 0.5.0, which ships no wheels for those targets, so pip compiled onnxsim's bundled onnxruntime/onnx from source. The constraint is now onnxsim>=0.7.0, which publishes prebuilt wheels across CPython 3.10–3.13 on Linux x86_64/aarch64, Windows x86_64, and macOS arm64. (#1242)

Deprecated

• RFDETR.optimize_for_inference() renamed to RFDETR.inference() (same signature). The old name is kept as a deprecated alias that forwards to inference() and emits a FutureWarning. Deprecated since v1.9.0, will be removed in v1.11.0.

Changed

• Matched-pair IoU targets in the classification/matching losses now compute via elementwise_box_iou/elementwise_generalized_box_iou (new public helpers in rfdetr.utilities.box_ops) instead of torch.diag(box_iou(...)). The old path built the full NxN pairwise IoU matrix just to read its diagonal; the new one computes only the N matched pairs directly, reducing peak GPU memory during loss calculation. Both new helpers raise ValueError on mismatched-length inputs instead of silently broadcasting. (#1245)
• The [tensorrt] extra no longer installs pycuda. It's only needed for TRTInference's async benchmarking mode, which now requires the separate [tensorrt-bench] extra (pip install 'rfdetr[tensorrt-bench]') — the standard export→engine path (polygraphy, no pycuda) is unaffected. (#1246)

Security

• RFDETR.from_checkpoint() now uses safe deserialization by default (weights_only=True) instead of always running full pickle deserialization. Checkpoints containing custom Python objects beyond argparse.Namespace or types.SimpleNamespace need the new keyword-only trust_checkpoint: bool = False parameter set to True to opt into the old (unsafe) behavior; resume-from-checkpoint during training honors the same trust_checkpoint flag. (#1179)
• TensorRT export no longer shells out to the trtexec CLI — engines are built in-process through the polygraphy Python API, removing the subprocess/shell-injection surface entirely. (#853)

Removed

• [kornia] extra removed — GPU-side augmentation now installs via [augment] (pip install 'rfdetr[augment]') instead. There is no [kornia] alias extra; pip install 'rfdetr[kornia]' will fail.
• rfdetr.util.* and rfdetr.deploy import paths, deprecated since v1.6.0 with remove_in="1.9.0". Use rfdetr.utilities.*, rfdetr.assets.coco_classes, rfdetr.training.drop_schedule, rfdetr.training.param_groups, rfdetr.visualize.data, rfdetr.models.heads.segmentation, and rfdetr.export instead.
• rfdetr._namespace.build_namespace(model_config, train_config), deprecated since v1.7.0 with remove_in="1.9.0". Use rfdetr.models.build_model_from_config and build_criterion_from_config instead.
• The train_config argument to load_pretrain_weights(nn_model, model_config, train_config), deprecated since v1.7.0 with remove_in="1.9.0". Call it with just (nn_model, model_config).
• The start_epoch, do_benchmark, and callbacks keyword arguments to .train()/.evaluate(), deprecated since v1.7.0 with remove_in="1.9.0". PTL resumes automatically via resume=; use the rfdetr.export.benchmark module for benchmarking; pass PTL Callback objects directly instead of a callbacks dict.
• TrainConfig.group_detr, TrainConfig.ia_bce_loss, TrainConfig.segmentation_head, TrainConfig.num_select, and ModelConfig.cls_loss_coef, deprecated since v1.7.0 with remove_in="1.9.0". group_detr, ia_bce_loss, segmentation_head, and num_select now live only on ModelConfig; cls_loss_coef now lives only on TrainConfig.
• RFDETRLarge's automatic silent fallback to RFDETRLargeDeprecatedConfig on checkpoint/config incompatibility errors. Loading legacy deprecated-Large weights through RFDETRLarge now raises the original error instead of retrying; use RFDETRLargeDeprecated directly to load those checkpoints.

... (truncated)

Commits

• a700efc releasing 1.9.0 (#1240)
• 899881f test(markers): drop dead marks, rename e2e marks to e2e_ prefix (#1246)
• 4c93cf0 Optimize GPU memory usage for box iou during loss calculation (#1245)
• 049dace docs(cookbooks): add native CoreML export notebook (#1244)
• 554575a feat: Add CoreML export support and enhance related documentation (#1235)
• 95d14ce fix(deps): require onnxsim>=0.7.0 so [onnx]/[tflite] install without hanging ...
• 2f6ae5d fix(models): preserve native mask evaluation targets (#1241)
• 3d27538 fix(security): propagate trust_checkpoint through model reconstruction (#1239)
• 80d9615 ci: add legacy-checkpoint backward-compat workflow and test suite (#994)
• 610ed6f executorch export docs: input contiguity (#1237)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.