chore(deps): update machine-learning - #29123
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/machine-learning
branch
11 times, most recently
from
June 21, 2026 22:27
ef10457 to
f7542f2
Compare
renovate
Bot
force-pushed
the
renovate/machine-learning
branch
12 times, most recently
from
July 7, 2026 07:48
f59745a to
99c9566
Compare
renovate
Bot
force-pushed
the
renovate/machine-learning
branch
2 times, most recently
from
July 7, 2026 20:03
2967f37 to
687d65a
Compare
renovate
Bot
force-pushed
the
renovate/machine-learning
branch
15 times, most recently
from
July 22, 2026 08:22
99223a4 to
174ff65
Compare
renovate
Bot
force-pushed
the
renovate/machine-learning
branch
14 times, most recently
from
July 28, 2026 20:42
d934308 to
445b150
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.19.0→1.27.02.44.1→2.46.32.1.0→2.3.02.4.6→2.5.12.5.21.26.0→1.28.01.26.0→1.28.01.25.0→1.27.14.13.0.92→4.14.0.949.0.3→9.1.1e2d3af7→d29f48a20ec607→a8f8fbe3.8.1→3.9.26.0.12.20260518→6.0.12.202607242.33.0.20260518→2.33.0.20260712Release Notes
huggingface/huggingface_hub (huggingface-hub)
v1.27.0: [v1.27.0] Automatichf-cliskill install, engine flags for Inference Endpoints & moreCompare Source
🤖 The
hf-cliskill installs itself and stays in syncThe
hf-cliskill teaches AI agents how to use thehfCLI, but until now you had to know it existed and install it by hand. The standalone installers (bashandPowerShell) now install it globally by default, pass--exclude-skill/-ExcludeSkillto skip — andhf updaterefreshes it afterwards, without ever bringing it back if you opted out or removed it. Anyhfcommand also hints, at most once a day, when the skill is missing or was generated by anotherhfversion. The hint is purely local, never installs anything on its own, and is silenced byHF_HUB_DISABLE_UPDATE_CHECK=1.⚙️ Engine flags for Inference Endpoints, at deploy time and after
--container-command/--container-argsno longer require--custom-image. That gate was conservative CLI scoping, not an API constraint:model.commandandmodel.argsare top-level fields of the endpoint payload and apply to managed engine images too, which is how the vLLM engine docs recommend passing engine flags. They can now also be changed after deploy —hf endpoints updategained both flags, andHfApi.update_inference_endpoint/InferenceEndpoint.updatethe matchingcontainer_command/container_argsparameters. Values replace rather than append: pass an empty string to reset to the image default, or omit the flag to leave it untouched.--health-routeand--portstill require--custom-image, since they only exist on the custom image payload.🚀 Baseten joins the inference providers
Baseten is now supported for the
conversationaltask. It serves an OpenAI-compatible chat completions API, so there are no provider-specific quirks: target it withprovider="baseten"and your own key, or let auto-routing pick it for any model already mapped on the Hub.🔧 Other QoL Improvements
regiontoExpandSpaceProperty_Tby @hanouticelina in #4641 — the Hub addedregionas an expandable property for Spaces; it is now accepted byspace_info/list_spacesand typed onSpaceInfoasLiteral["us", "eu"] | None— docsmodelfirst in conversational payloads by @moon-bot-app[bot] in #4618 — routers can now resolve the provider from a small prefix instead of buffering a whole payload of base64 images. The resulting dicts are equal, only the key order changes🐛 Bug and typo fixes
prefixlexically, so in a bucket holdinglogs_existing/but nologs/,exists(".../logs/new.txt")raisedKeyErrorandls(".../logs")could return the unrelated sibling. Listings are now filtered on path-component boundariesblobs/(Windows copies, or files created by the user inside a snapshot dir) were deleted a second time as blobs, logging aFileNotFoundErrortraceback each. Reported freed size is unchanged, and per-path delete lines moved todebuggc.collect(); vLLM had to monkey-patch this. Also fixes a v1.0 regression wherehttp_backoffretried on an httpx client already closed by a previousConnectError🏗️ Internal
23dc84bby @mishig25 in #4617v1.26.1Compare Source
v1.26.0: [v1.26.0] Resolve revisions only once, security hardening, and resource groups for Jobs & CollectionsCompare Source
📌 Pin a revision once with
resolve_revisionLibraries that download many files one by one (config, weights, tokenizer, processor, ...) had to resolve
revision="main"into a commit hash on every call — costing one HTTP request per file and risking two calls landing on two different commits if the repo is updated in between. The newHfApi.resolve_revisionresolves the revision once and returns aResolvedRevision: astrsubclass whose value stays the user-facing revision (so error messages keep saying"main") while its.resolvedattribute holds the commit hash. Download helpers (hf_hub_download,snapshot_download,get_cached_repo_tree) detect it and use the commit hash directly, guaranteeing every file comes from the same commit. The mapping is also written to therefs/folder of the cache, so later runs in offline mode transparently fall back to the cached value.📚 Documentation: Manage the cache — Pin a revision (advanced)
🔒 Security hardening for downloads and sandboxes
This release ships two security fixes. First, downloading or uploading to a
--local-dirnow rejects absolute, drive-relative, root-relative, UNC and..-traversal filenames on all platforms, interpreting each name under both POSIX and Windows rules (refs CVE-2026-15717). Previously only a Windows-only..\check existed, so a malicious repo could write files outside the target directory on Windows clients — and even leak a NetNTLMv2 hash via UNC paths. Legitimate repo filenames never contain such segments, so real downloads are unaffected; note that exotic names likefolder/..\..\..\file, previously tolerated on Linux, are now rejected everywhere. Second,Sandbox.createno longer injects your HF token into the job environment to download thesbx-serverbinary: the bucket is public, so the bootstrap now downloads it anonymously and no HF credential ever lands in the sandbox unless you explicitly opt in withforward_hf_token=True.🗂️ Resource groups for Jobs and Collections
Organization resource groups are now supported across the client. For collections,
create_collectionaccepts an optionalresource_group_id, and the newupdate_collection_resource_groupmethod wraps the dedicated Hub endpoint to assign a collection to a resource group afterwards (passingNoneremoves it). For Jobs,run_job,run_uv_jobandcreate_scheduled_jobaccept aresource_group_idparameter, mirrored by a--resource-group-idoption on thehf jobs run,hf jobs uv runandhf jobs scheduled runcommands. Beyond access control within an organization, resource groups are also used for cost attribution and per-group spending limits.📚 Documentation: Collections reference, CLI reference
📊 Job names, front and center in the CLI
Job names are now much easier to work with from the terminal.
hf jobs ls(andhf jobs scheduled ls) display a dedicatedNAMEcolumn, and a new--namefilter acts as a shortcut for--label name=NAME. The name is also surfaced as a top-level field inhf jobs inspectand in command results, instead of only living insidelabels— where it remains for compatibility.📚 Documentation: Run and manage Jobs
📖 Documentation
or) translation of the index, installation and quick-start pages by @indrajeetapache in #4454/tm/to/ta/(correct ISO 639-1 code)🐛 Bug and typo fixes
Unable to parse string as hex hash valueon gated repos without content accessheader is not json-encoded stringtoken=Falseincreate_inference_endpoint_from_cataloginstead of silently ignoring it by @ckarnell in #4605UnicodeEncodeErroron Windows when output is redirected or piped~/model.binno longer raiseFileNotFoundErroron upload🏗️ Internal
v1.25.1Compare Source
v1.25.0: [v1.25.0] Auto-named Jobs, smarter progress bars & cache diagnosticsCompare Source
🏷️ Auto-named Jobs on creation
Jobs now get an automatic
namewhen you don't provide one explicitly, derived from the Docker image (or UV script) plus a short hash of the command line. This means reruns of the same command share a consistent name, while different commands get distinct names — making it much easier to find and group related jobs in the UI or CLI. Names follow the server-side character rules::,/and.in image tags are replaced with-sopython:3.12 foo --trucbecomespython-3-12-7c6db949. Explicit--namestill takes precedence.📚 Documentation: Jobs guide, CLI guide
🔧 Other QoL Improvements
📖 Documentation
🐛 Bug and typo fixes
🏗️ Internal
v1.24.0: [v1.24.0] Name your Jobs! (and download fixes)Compare Source
📊 Name your Jobs!
Jobs on the Hub now support an optional
--nameflag on the CLI and anameparameter on the Python API (run_job,run_uv_job,create_scheduled_job,create_scheduled_uv_job). Names are stored as thenamelabel and make Jobs easier to find and identify in the UI. You can also name an existing Job usinghf jobs labels <job_id> --name my-job. Names are optional and do not need to be unique.📚 Documentation: CLI guide, Jobs guide
📖 Documentation
The README has been completely refreshed to put the
hfCLI first. The standalone installer (curl/PowerShell) and a terminal quick start — coveringauth login,models ls,download,upload, andjobs run— now appear before the Python library section. A new For AI agents section introduceshf skills addfor Codex, Cursor, OpenCode, Claude Code, and other AI tools. The Python content remains intact under the renamed Use the Python library heading, with refreshed example models and a corrected tagline ("The official CLI and Python client for the Hugging Face Hub").🐛 Bug and typo fixes
🏗️ Internal
v1.23.0: [v1.23.0] Space templates, CLI extension updates & smoother Xet downloadsCompare Source
🚀 Create Spaces from templates
You can now seed a new Space from one of the official Hub templates (JupyterLab, a Gradio chatbot, a Streamlit app, etc.) instead of starting from an empty repo. List what's available with the new
list_space_templates()API or thehf spaces templatesCLI command, then pass a template'srepo_id(or its short name) tocreate_repo(..., space_template=...)orhf repos create --type space --template. The Space SDK is inferred from the template, and templates recommended as private (like JupyterLab) are created privately by default unless you explicitly choose a visibility.🔌 Update installed CLI extensions
A new
hf extensions updatecommand brings your installed CLI extensions to their latest published version on GitHub. Pass a name to update a single extension, or run it with no argument to check every installed extension and update the ones that are behind. Updates are applied in place — Python extensions reuse their existing venv and binary extensions are overwritten — so a failed update no longer leaves the extension uninstalled, and extensions that are already up to date are simply skipped.hf extensions updatecommand by @Wauplin in #4496📶 Smoother Xet download progress with dual bars
Xet downloads now show two progress bars so you can tell a transfer is alive even on a slow connection. The transfer bar advances as bytes arrive over the network, while the reconstruction bar tracks real progress as buffered chunks are written to disk — previously the single bar could sit at 0% for a long time while data was actually arriving. The dual bars are wired into single-file downloads (
hf_hub_download),snapshot_download(where parallel file downloads feed the repo-level transfer and reconstruction bars), thehf downloadCLI, and bucket downloads.🤖 Always up-to-date, offline
hf-cliskillhf skills addandhf skills updatenow generate the built-inhf-cliskill locally from your installed CLI version instead of downloading it from the marketplace bucket. The installedSKILL.mdis therefore always in sync with the CLI you're running, and installing or updating thehf-cliskill works fully offline — the marketplace is only contacted when you install another managed skill. As defense-in-depth against path traversal, skill names coming from the marketplace payload are now validated before any filesystem work.🖥️ CLI
hf models lsby inference provider by @moon-bot-app[bot] in #4497 — docs🔧 Other QoL Improvements
get_cached_repo_treeutility by @Wauplin in #4513 — docs📖 Documentation
🐛 Bug and typo fixes
snapshot_downloadsilently skipped files on Windows🏗️ Internal
v1.22.0: [v1.22.0] Sandboxes, faster downloads, and a rebuilt CLICompare Source
🖥️ Sandboxes: isolated cloud machines on top of Jobs
Sandboxes are isolated cloud machines you can spin up in seconds, run commands in with live-streamed output, and move files in and out of — all from Python or the CLI. They are built entirely on top of Jobs: under the hood a sandbox is just a Job running a tiny static server, so any Docker image with
/bin/shworks and it inherits Jobs' billing, hardware flavors, and namespace permissions for free. Two flavors are available:Sandbox.createfor a dedicated VM (GPU workloads, untrusted code, full isolation) andSandboxPoolto pack many cheap CPU sandboxes into a few shared host VMs for fan-out workloads like RL rollouts. This release also adds background processes (sbx.run(..., background=True)/hf sandbox spawn) and a port proxy (Sandbox.proxy_url_for) so you can reach a server running inside a sandbox from the outside over HTTP or WebSocket.hf sandboxCLI on top of Jobs by @Wauplin in #4350📚 Documentation: Sandboxes guide, Sandbox reference
⚡ Faster snapshot downloads with a tree cache
snapshot_downloadnow caches a repository's file listing on disk under a newtrees/folder, so re-downloading a commit that's already cached costs a single network call — resolving the branch or tag to a commit hash — instead of one metadata request per file. The listing is immutable per commit and shared by bothsnapshot_downloadandhf_hub_download; for Xet-enabled files it also skips the per-file HEAD/resolverequest entirely, rebuilding the metadata from the cached listing. As a deliberate side effect of the completeness check, when the Hub can't be reached and the local snapshot is missing requested files,snapshot_downloadnow raisesIncompleteSnapshotErrorinstead of silently returning a partial folder.📚 Documentation: Manage your cache
🛠️ CLI rebuilt on Click (drops Typer)
The entire
hfCLI now runs on a small in-house layer over Click 8.x instead of Typer, which had vendored Click in a way that broke the CLI's custom help rendering, error enrichment, and shell completion — and forced cappingtyper<0.26. The migration preserves existing behavior:--helpoutput is byte-identical, the generatedcli.mdreference is unchanged apart from a header comment, and shell completion now uses Click's native completion. The publictyper_factoryhelper is kept so downstream libraries liketransformersthat register their own commands keep working.💔 Breaking Change
upload_large_folderandhf upload-large-folderare now deprecated in favor ofupload_folder/hf upload, which handle very large and resumable uploads out of the box.allow_patterns/ignore_patternsnow match case-sensitively on every OS (aligned with case-sensitive Hub paths). On Windows this is a behavior change: patterns like*.PDFno longer matchfile.pdf.black-forest-labs,clarifai,hyperbolic,nebius,nvidia,sambanova) — docs🖥️ CLI
hf discussions editby @Wauplin in #4415 — docshf cache lsnow flags leftover.incompletefiles andhf cache pruneremoves them automatically — docsoutsingleton publicly + addout.logmethod by @Wauplin in #4471🤖 Inference
📊 Jobs
jobs-artifactsbucket and mount it;-vaccepts local directories inhf jobs run/uv run(and scheduled variants) — docshf jobs scheduled trigger ...to trigger scheduled jobs on demand by @Wauplin in #4459 — docs🔧 Other QoL Improvements
http_backoffnow honors the standardRetry-Afterheader (delay-seconds form); HF rate-limit headers still take precedence when present.base_model=Falsetoget_dataset_leaderboardto include fine-tuned/derivative repos that declare a parent model.📖 Documentation
🐛 Bug and typo fixes
hf cache ls --filterthresholds likesize>1GBnow parse instead of raising.__init__.py).🏗️ Internal
v1.21.0: [v1.21.0] Jobs filtering & paginationCompare Source
📊 Jobs listing revamped: filter, paginate, and
lsinstead ofpsThe Jobs listing API and CLI have been overhauled with server-side filtering, proper pagination, and a CLI rename that aligns with the rest of
hf.list_jobs()now acceptsstatusandlabelsparameters that push filtering to the server, and returns a lazy iterator (matchinglist_models,list_datasets, etc.) so large result sets are fetched page by page. On the CLI side,hf jobs pshas been renamed tohf jobs lsfor consistency withhf repos ls,hf models ls, and friends —psandliststill work as aliases.list_jobs()now returns anIterable[JobInfo]instead oflist[JobInfo]. If you indexed the result (jobs[0]), wrap it withlist(...).-f/--filterinhf jobs lsis deprecated. Use--statusand--labelinstead. Glob patterns (data-*), negation (key!=value), and filtering byid/image/commandare no longer supported.hf jobs psby @Wauplin in #4403📚 Documentation: CLI guide, Jobs guide
🐛 Fix circular import on
from huggingface_hub import loginA regression introduced in v1.20.0 caused
from huggingface_hub import loginto raise anImportErroron a fresh interpreter, due to a circular dependency between_oauth_deviceandutils._http. The fix moves_oauth_device.pyinto theutilslayer so all imports resolve downward, eliminating the cycle. No lazy imports or workarounds required.from huggingface_hub import loginby @hanouticelina in #4385🔧 Other QoL Improvements
📖 Documentation
hf jobs uv runflags before the script for consistency by @davanstrien in #4396Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.