Skip to content

chore(deps): update default python environment#133

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/default-python-environment
Open

chore(deps): update default python environment#133
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/default-python-environment

Conversation

@renovate

@renovate renovate Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
anyio (changelog) ==4.14.1 → ==4.14.2 age confidence
certifi ==2026.6.17 → ==2026.7.22 age confidence
filelock ==3.29.4 → ==3.32.0 age confidence
hf-xet ==1.5.1 → ==1.5.2 age confidence
huggingface-hub ==1.21.0 → ==1.24.0 age confidence
tqdm (changelog) ==4.68.3 → ==4.69.0 age confidence
typer (changelog) ==0.25.1 → ==0.27.0 age confidence
typing-extensions (changelog) ==4.15.0 → ==4.16.0 age confidence

Release Notes

agronholm/anyio (anyio)

v4.14.2

Compare Source

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#​1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#​1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#​1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#​1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#​1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#​1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#​1111)
certifi/python-certifi (certifi)

v2026.7.22

Compare Source

tox-dev/py-filelock (filelock)

v3.32.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

v3.31.2

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

v3.31.1

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

v3.31.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

v3.30.3

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.30.2...3.30.3

v3.30.2

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.1...3.30.2

v3.30.1

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.30.0...3.30.1

v3.30.0

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.7...3.30.0

v3.29.7

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.6...3.29.7

v3.29.6

Compare Source

What's Changed

Full Changelog: tox-dev/filelock@3.29.5...3.29.6

v3.29.5

Compare Source

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.29.4...3.29.5

huggingface/xet-core (hf-xet)

v1.5.2: [hf-xet v1.5.2] Fix HTTP Request Retry

Compare Source

Problems addressed

  • This release fixes a bug in HTTP request retry configuration that could cause apparent hangs under poor network conditions when a request was retried more than twice. Related PR: #​893

New Contributors

Full Changelog: huggingface/xet-core@v1.5.1...v1.5.2

huggingface/huggingface_hub (huggingface-hub)

v1.24.0: [v1.24.0] Name your Jobs! (and download fixes)

Compare Source

📊 Name your Jobs!

Jobs on the Hub now support an optional --name flag on the CLI and a name parameter on the Python API (run_job, run_uv_job, create_scheduled_job, create_scheduled_uv_job). Names are stored as the name label and make Jobs easier to find and identify in the UI. You can also name an existing Job using hf jobs labels <job_id> --name my-job. Names are optional and do not need to be unique.

# Create a named Job
hf jobs run --name training-v2 python:3.12 python train.py

# Name an existing Job
hf jobs labels <job_id> --name training-v2

# Named scheduled Job
hf jobs scheduled run @&#8203;hourly --name hourly-task python:3.12 python -c 'print("This runs every hour!")'

📚 Documentation: CLI guide, Jobs guide

📖 Documentation

The README has been completely refreshed to put the hf CLI first. The standalone installer (curl/PowerShell) and a terminal quick start — covering auth login, models ls, download, upload, and jobs run — now appear before the Python library section. A new For AI agents section introduces hf skills add for Codex, Cursor, OpenCode, Claude Code, and other AI tools. The Python content remains intact under the renamed Use the Python library heading, with refreshed example models and a corrected tagline ("The official CLI and Python client for the Hugging Face Hub").

🐛 Bug and typo fixes

🏗️ Internal

v1.23.0: [v1.23.0] Space templates, CLI extension updates & smoother Xet downloads

Compare Source

🚀 Create Spaces from templates

You can now seed a new Space from one of the official Hub templates (JupyterLab, a Gradio chatbot, a Streamlit app, etc.) instead of starting from an empty repo. List what's available with the new list_space_templates() API or the hf spaces templates CLI command, then pass a template's repo_id (or its short name) to create_repo(..., space_template=...) or hf repos create --type space --template. The Space SDK is inferred from the template, and templates recommended as private (like JupyterLab) are created privately by default unless you explicitly choose a visibility.

# List available templates
$ hf spaces templates
NAME        REPO_ID                             SDK     PREFERRED_PRIVATE
----------- ----------------------------------- ------- -----------------
Streamlit   streamlit/streamlit-template-space  docker
JupyterLab  SpacesExamples/jupyterlab           docker  ✔

# Create a Space from a template
$ hf repos create my-jupyterlab --type space --template jupyterlab
✓ Repo created
  repo_id: Wauplin/my-jupyterlab
  url: https://huggingface.co/spaces/Wauplin/my-jupyterlab
>>> from huggingface_hub import create_repo
>>> create_repo("my-jupyterlab", repo_type="space", space_template="jupyterlab")

🔌 Update installed CLI extensions

A new hf extensions update command brings your installed CLI extensions to their latest published version on GitHub. Pass a name to update a single extension, or run it with no argument to check every installed extension and update the ones that are behind. Updates are applied in place — Python extensions reuse their existing venv and binary extensions are overwritten — so a failed update no longer leaves the extension uninstalled, and extensions that are already up to date are simply skipped.

# Update a single extension (accepts <name>, hf-<name> or OWNER/hf-<name>)
hf extensions update hf-claude

# Check every installed extension and update the outdated ones
hf extensions update

📶 Smoother Xet download progress with dual bars

Xet downloads now show two progress bars so you can tell a transfer is alive even on a slow connection. The transfer bar advances as bytes arrive over the network, while the reconstruction bar tracks real progress as buffered chunks are written to disk — previously the single bar could sit at 0% for a long time while data was actually arriving. The dual bars are wired into single-file downloads (hf_hub_download), snapshot_download (where parallel file downloads feed the repo-level transfer and reconstruction bars), the hf download CLI, and bucket downloads.

big.bin: downloading bytes:   |  52.4MB     1.2MB/s
big.bin: reconstructing file: |  52.4MB / 105MB     800kB/s

🤖 Always up-to-date, offline hf-cli skill

hf skills add and hf skills update now generate the built-in hf-cli skill locally from your installed CLI version instead of downloading it from the marketplace bucket. The installed SKILL.md is therefore always in sync with the CLI you're running, and installing or updating the hf-cli skill works fully offline — the marketplace is only contacted when you install another managed skill. As defense-in-depth against path traversal, skill names coming from the marketplace payload are now validated before any filesystem work.

# Works fully offline, and always matches your installed CLI version
$ HF_HUB_OFFLINE=1 hf skills add --dest ./skills
Installed 'hf-cli' to ./skills/hf-cli

🖥️ CLI

🔧 Other QoL Improvements

📖 Documentation

🐛 Bug and typo fixes

  • [Utils] Treat backslashes as path separators in filter_repo_objects by @​Wauplin in #​4506 — fixes a v1.22 regression where snapshot_download silently skipped files on Windows
  • [CLI] Coerce enum member defaults to their value when building click params by @​dhruv7477 in #​4494 — fixes a v1.22 regression where commands using an enum option default failed at runtime
  • Update install.ps1 by @​ufocia in #​4501 — fixes false install verification failures on Windows

🏗️ Internal

v1.22.0: [v1.22.0] Sandboxes, faster downloads, and a rebuilt CLI

Compare Source

🖥️ Sandboxes: isolated cloud machines on top of Jobs

Sandboxes are isolated cloud machines you can spin up in seconds, run commands in with live-streamed output, and move files in and out of — all from Python or the CLI. They are built entirely on top of Jobs: under the hood a sandbox is just a Job running a tiny static server, so any Docker image with /bin/sh works and it inherits Jobs' billing, hardware flavors, and namespace permissions for free. Two flavors are available: Sandbox.create for a dedicated VM (GPU workloads, untrusted code, full isolation) and SandboxPool to pack many cheap CPU sandboxes into a few shared host VMs for fan-out workloads like RL rollouts. This release also adds background processes (sbx.run(..., background=True) / hf sandbox spawn) and a port proxy (Sandbox.proxy_url_for) so you can reach a server running inside a sandbox from the outside over HTTP or WebSocket.

from huggingface_hub import Sandbox

with Sandbox.create(image="python:3.12") as sbx:   # ready in ~6s
    sbx.files.write("/app/main.py", "print(40 + 2)")
    print(sbx.run("python /app/main.py").stdout)    # 42
# Create, run, copy files, and terminate from the terminal
hf sandbox create
hf sandbox exec <id> -- python -c "print('hi')"
hf sandbox cp data.csv <id>:/data/data.csv
hf sandbox kill <id>

📚 Documentation: Sandboxes guide, Sandbox reference

⚡ Faster snapshot downloads with a tree cache

snapshot_download now caches a repository's file listing on disk under a new trees/ folder, so re-downloading a commit that's already cached costs a single network call — resolving the branch or tag to a commit hash — instead of one metadata request per file. The listing is immutable per commit and shared by both snapshot_download and hf_hub_download; for Xet-enabled files it also skips the per-file HEAD /resolve request entirely, rebuilding the metadata from the cached listing. As a deliberate side effect of the completeness check, when the Hub can't be reached and the local snapshot is missing requested files, snapshot_download now raises IncompleteSnapshotError instead of silently returning a partial folder.

📚 Documentation: Manage your cache

🛠️ CLI rebuilt on Click (drops Typer)

The entire hf CLI now runs on a small in-house layer over Click 8.x instead of Typer, which had vendored Click in a way that broke the CLI's custom help rendering, error enrichment, and shell completion — and forced capping typer<0.26. The migration preserves existing behavior: --help output is byte-identical, the generated cli.md reference is unchanged apart from a header comment, and shell completion now uses Click's native completion. The public typer_factory helper is kept so downstream libraries like transformers that register their own commands keep working.

💔 Breaking Change

  • [Upload] Deprecate upload_large_folder (API + CLI) by @​Wauplin in #​4414 — upload_large_folder and hf upload-large-folder are now deprecated in favor of upload_folder / hf upload, which handle very large and resumable uploads out of the box.
  • Make filter_repo_objects pattern matching case-sensitive on all platforms by @​Sreekant13 in #​4435 — allow_patterns/ignore_patterns now match case-sensitively on every OS (aligned with case-sensitive Hub paths). On Windows this is a behavior change: patterns like *.PDF no longer match file.pdf.
  • [Inference Providers] Remove dead inference providers by @​hanouticelina in #​4447 — removes six providers no longer routed by the Hub (black-forest-labs, clarifai, hyperbolic, nebius, nvidia, sambanova) — docs

🖥️ CLI

🤖 Inference

  • [Inference Providers] deepinfra: add automatic-speech-recognition support by @​ovuruska in #​4382

📊 Jobs

  • [Jobs] Add sync_job_volume helper and local paths in hf jobs -v by @​Wauplin in #​4346 — sync a local directory to a jobs-artifacts bucket and mount it; -v accepts local directories in hf jobs run/uv run (and scheduled variants) — docs
  • [Jobs] Add hf jobs scheduled trigger ... to trigger scheduled jobs on demand by @​Wauplin in #​4459 — docs

🔧 Other QoL Improvements

  • [Http] Support standard Retry-After header in http_backoff by @​Wauplin in #​4460 — http_backoff now honors the standard Retry-After header (delay-seconds form); HF rate-limit headers still take precedence when present.
  • Expose base_model filter param on get_dataset_leaderboard by @​NathanHB in #​4474 — pass base_model=False to get_dataset_leaderboard to include fine-tuned/derivative repos that declare a parent model.

📖 Documentation

🐛 Bug and typo fixes

  • [CLI] Fix escaped backslash handling in .env value parsing by @​sarathfrancis90 in #​4413
  • [URIs] Percent-encode the revision in HfUri.to_url by @​sarathfrancis90 in #​4418
  • Accept two-letter byte units (KB/MB/GB/TB/PB) in parse_size by @​Sreekant13 in #​4468 — documented hf cache ls --filter thresholds like size>1GB now parse instead of raising.
  • Fix KeyError in get_dataset_leaderboard when entry has no source by @​NathanHB in #​4473
  • Do not suggest reporting if colab vault error by @​Wauplin in #​4437
  • [Build] Include huggingface_hub.templates via find_namespace_packages by @​Wauplin in #​4438 — model/dataset card templates are now shipped in wheels (previously skipped due to the missing __init__.py).

🏗️ Internal

tqdm/tqdm (tqdm)

v4.69.0: tqdm v4.69.0 stable

Compare Source

  • add tqdm.asyncio.gather(..., return_exceptions=False) (#​1776, #​1671 <- #​1286)
  • misc minor framework updates
    • bump workflow actions & pre-commit hooks

v4.68.4: tqdm v4.68.4 stable

Compare Source

fastapi/typer (typer)

v0.27.0

Compare Source

Breaking Changes
Internal

v0.26.8

Compare Source

Fixes
  • 🐛 Make second column of Rich help output reflect the type consistently, even when using metavar. PR #​1410 by @​svlandeg.
  • 🐛 Fix formatting in NoSuchOption.format_message(). PR #​1843 by @​foomunleong.
Docs
  • 📝 Update docs badges: remove Publish badge, it doesn't give extra information. PR #​1850 by @​tiangolo.
  • 📝 Fix formatting for help link to support GitHub-specific overview edge-case. PR #​1826 by @​phalberg.
Internal

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Between 12:00 AM and 02:59 AM (* 0-2 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedpypi/​certifi@​2026.7.2210010010010070
Updatedpypi/​tqdm@​4.68.3 ⏵ 4.69.0100 +110010010070
Updatedpypi/​huggingface-hub@​1.21.0 ⏵ 1.24.091100100100100
Addedpypi/​anyio@​4.14.297100100100100
Updatedpypi/​typer@​0.25.1 ⏵ 0.27.097 -2100100100100
Updatedpypi/​filelock@​3.29.4 ⏵ 3.32.0100100100100100
Addedpypi/​typing-extensions@​4.16.0100100100100100
Updatedpypi/​hf-xet@​1.5.1 ⏵ 1.5.2100100100100100

View full report

@renovate
renovate Bot force-pushed the renovate/default-python-environment branch from 14cf38b to 5e6c9ec Compare July 2, 2026 17:48
@renovate renovate Bot changed the title chore(deps): update dependency typer to v0.26.8 chore(deps): update default python environment Jul 2, 2026
@renovate
renovate Bot force-pushed the renovate/default-python-environment branch 6 times, most recently from bbc4987 to b83f019 Compare July 9, 2026 20:16
@renovate
renovate Bot force-pushed the renovate/default-python-environment branch 7 times, most recently from bd7124d to de16b5f Compare July 18, 2026 09:32
@renovate
renovate Bot force-pushed the renovate/default-python-environment branch 3 times, most recently from 4d7374f to d7ed876 Compare July 21, 2026 18:10
@renovate
renovate Bot force-pushed the renovate/default-python-environment branch from d7ed876 to e108225 Compare July 22, 2026 04:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants