Skip to content

fix(deps): update python: non-major updates#332

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major
Open

fix(deps): update python: non-major updates#332
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major

Conversation

@renovate

@renovate renovate Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
fastapi (changelog) project.dependencies minor ==0.138.0 → ==0.139.0 OpenSSF Scorecard
gitpython project.dependencies patch ==3.1.50 → ==3.1.51 OpenSSF Scorecard
gradio project.dependencies minor ==6.19.0 → ==6.20.0 OpenSSF Scorecard
huggingface-hub project.dependencies minor ==1.20.1 → ==1.23.0 OpenSSF Scorecard
ruff (source, changelog) dependency-groups patch ==0.15.19 → ==0.15.21 OpenSSF Scorecard
torch project.dependencies minor ==2.12.1 → ==2.13.0 OpenSSF Scorecard
ty (changelog) dependency-groups patch ==0.0.53 → ==0.0.59 OpenSSF Scorecard
uvicorn (changelog) project.dependencies minor ==0.49.0 → ==0.51.0 OpenSSF Scorecard

Release Notes

fastapi/fastapi (fastapi)

v0.139.0

Compare Source

Features
  • ✨ Support dependencies in app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #​15908 by @​tiangolo.
Translations
Internal

v0.138.2

Compare Source

Refactors
  • ♻️ Make app.frontend() return 404 for methods other than GET or HEAD with no static file matches. PR #​15863 by @​tiangolo.
Internal

v0.138.1

Compare Source

Refactors
Internal
gitpython-developers/GitPython (gitpython)

v3.1.51

Compare Source

gradio-app/gradio (gradio)

v6.20.0

Compare Source

Features
Fixes
huggingface/huggingface_hub (huggingface-hub)

v1.23.0: [v1.23.0] Space templates, CLI extension updates & smoother Xet downloads

Compare Source

🚀 Create Spaces from templates

You can now seed a new Space from one of the official Hub templates (JupyterLab, a Gradio chatbot, a Streamlit app, etc.) instead of starting from an empty repo. List what's available with the new list_space_templates() API or the hf spaces templates CLI command, then pass a template's repo_id (or its short name) to create_repo(..., space_template=...) or hf repos create --type space --template. The Space SDK is inferred from the template, and templates recommended as private (like JupyterLab) are created privately by default unless you explicitly choose a visibility.

# List available templates
$ hf spaces templates
NAME        REPO_ID                             SDK     PREFERRED_PRIVATE
----------- ----------------------------------- ------- -----------------
Streamlit   streamlit/streamlit-template-space  docker
JupyterLab  SpacesExamples/jupyterlab           docker  ✔

# Create a Space from a template
$ hf repos create my-jupyterlab --type space --template jupyterlab
✓ Repo created
  repo_id: Wauplin/my-jupyterlab
  url: https://huggingface.co/spaces/Wauplin/my-jupyterlab
>>> from huggingface_hub import create_repo
>>> create_repo("my-jupyterlab", repo_type="space", space_template="jupyterlab")

🔌 Update installed CLI extensions

A new hf extensions update command brings your installed CLI extensions to their latest published version on GitHub. Pass a name to update a single extension, or run it with no argument to check every installed extension and update the ones that are behind. Updates are applied in place — Python extensions reuse their existing venv and binary extensions are overwritten — so a failed update no longer leaves the extension uninstalled, and extensions that are already up to date are simply skipped.

# Update a single extension (accepts <name>, hf-<name> or OWNER/hf-<name>)
hf extensions update hf-claude

# Check every installed extension and update the outdated ones
hf extensions update

📶 Smoother Xet download progress with dual bars

Xet downloads now show two progress bars so you can tell a transfer is alive even on a slow connection. The transfer bar advances as bytes arrive over the network, while the reconstruction bar tracks real progress as buffered chunks are written to disk — previously the single bar could sit at 0% for a long time while data was actually arriving. The dual bars are wired into single-file downloads (hf_hub_download), snapshot_download (where parallel file downloads feed the repo-level transfer and reconstruction bars), the hf download CLI, and bucket downloads.

big.bin: downloading bytes:   |  52.4MB     1.2MB/s
big.bin: reconstructing file: |  52.4MB / 105MB     800kB/s

🤖 Always up-to-date, offline hf-cli skill

hf skills add and hf skills update now generate the built-in hf-cli skill locally from your installed CLI version instead of downloading it from the marketplace bucket. The installed SKILL.md is therefore always in sync with the CLI you're running, and installing or updating the hf-cli skill works fully offline — the marketplace is only contacted when you install another managed skill. As defense-in-depth against path traversal, skill names coming from the marketplace payload are now validated before any filesystem work.

# Works fully offline, and always matches your installed CLI version
$ HF_HUB_OFFLINE=1 hf skills add --dest ./skills
Installed 'hf-cli' to ./skills/hf-cli

🖥️ CLI

🔧 Other QoL Improvements

📖 Documentation

🐛 Bug and typo fixes

  • [Utils] Treat backslashes as path separators in filter_repo_objects by @​Wauplin in #​4506 — fixes a v1.22 regression where snapshot_download silently skipped files on Windows
  • [CLI] Coerce enum member defaults to their value when building click params by @​dhruv7477 in #​4494 — fixes a v1.22 regression where commands using an enum option default failed at runtime
  • Update install.ps1 by @​ufocia in #​4501 — fixes false install verification failures on Windows

🏗️ Internal

v1.22.0: [v1.22.0] Sandboxes, faster downloads, and a rebuilt CLI

Compare Source

🖥️ Sandboxes: isolated cloud machines on top of Jobs

Sandboxes are isolated cloud machines you can spin up in seconds, run commands in with live-streamed output, and move files in and out of — all from Python or the CLI. They are built entirely on top of Jobs: under the hood a sandbox is just a Job running a tiny static server, so any Docker image with /bin/sh works and it inherits Jobs' billing, hardware flavors, and namespace permissions for free. Two flavors are available: Sandbox.create for a dedicated VM (GPU workloads, untrusted code, full isolation) and SandboxPool to pack many cheap CPU sandboxes into a few shared host VMs for fan-out workloads like RL rollouts. This release also adds background processes (sbx.run(..., background=True) / hf sandbox spawn) and a port proxy (Sandbox.proxy_url_for) so you can reach a server running inside a sandbox from the outside over HTTP or WebSocket.

from huggingface_hub import Sandbox

with Sandbox.create(image="python:3.12") as sbx:   # ready in ~6s
    sbx.files.write("/app/main.py", "print(40 + 2)")
    print(sbx.run("python /app/main.py").stdout)    # 42
# Create, run, copy files, and terminate from the terminal
hf sandbox create
hf sandbox exec <id> -- python -c "print('hi')"
hf sandbox cp data.csv <id>:/data/data.csv
hf sandbox kill <id>

📚 Documentation: Sandboxes guide, Sandbox reference

⚡ Faster snapshot downloads with a tree cache

snapshot_download now caches a repository's file listing on disk under a new trees/ folder, so re-downloading a commit that's already cached costs a single network call — resolving the branch or tag to a commit hash — instead of one metadata request per file. The listing is immutable per commit and shared by both snapshot_download and hf_hub_download; for Xet-enabled files it also skips the per-file HEAD /resolve request entirely, rebuilding the metadata from the cached listing. As a deliberate side effect of the completeness check, when the Hub can't be reached and the local snapshot is missing requested files, snapshot_download now raises IncompleteSnapshotError instead of silently returning a partial folder.

📚 Documentation: Manage your cache

🛠️ CLI rebuilt on Click (drops Typer)

The entire hf CLI now runs on a small in-house layer over Click 8.x instead of Typer, which had vendored Click in a way that broke the CLI's custom help rendering, error enrichment, and shell completion — and forced capping typer<0.26. The migration preserves existing behavior: --help output is byte-identical, the generated cli.md reference is unchanged apart from a header comment, and shell completion now uses Click's native completion. The public typer_factory helper is kept so downstream libraries like transformers that register their own commands keep working.

💔 Breaking Change

  • [Upload] Deprecate upload_large_folder (API + CLI) by @​Wauplin in #​4414 — upload_large_folder and hf upload-large-folder are now deprecated in favor of upload_folder / hf upload, which handle very large and resumable uploads out of the box.
  • Make filter_repo_objects pattern matching case-sensitive on all platforms by @​Sreekant13 in #​4435 — allow_patterns/ignore_patterns now match case-sensitively on every OS (aligned with case-sensitive Hub paths). On Windows this is a behavior change: patterns like *.PDF no longer match file.pdf.
  • [Inference Providers] Remove dead inference providers by @​hanouticelina in #​4447 — removes six providers no longer routed by the Hub (black-forest-labs, clarifai, hyperbolic, nebius, nvidia, sambanova) — docs

🖥️ CLI

🤖 Inference

  • [Inference Providers] deepinfra: add automatic-speech-recognition support by @​ovuruska in #​4382

📊 Jobs

  • [Jobs] Add sync_job_volume helper and local paths in hf jobs -v by @​Wauplin in #​4346 — sync a local directory to a jobs-artifacts bucket and mount it; -v accepts local directories in hf jobs run/uv run (and scheduled variants) — docs
  • [Jobs] Add hf jobs scheduled trigger ... to trigger scheduled jobs on demand by @​Wauplin in #​4459 — docs

🔧 Other QoL Improvements

  • [Http] Support standard Retry-After header in http_backoff by @​Wauplin in #​4460 — http_backoff now honors the standard Retry-After header (delay-seconds form); HF rate-limit headers still take precedence when present.
  • Expose base_model filter param on get_dataset_leaderboard by @​NathanHB in #​4474 — pass base_model=False to get_dataset_leaderboard to include fine-tuned/derivative repos that declare a parent model.

📖 Documentation

🐛 Bug and typo fixes

  • [CLI] Fix escaped backslash handling in .env value parsing by @​sarathfrancis90 in #​4413
  • [URIs] Percent-encode the revision in HfUri.to_url by @​sarathfrancis90 in #​4418
  • Accept two-letter byte units (KB/MB/GB/TB/PB) in parse_size by @​Sreekant13 in #​4468 — documented hf cache ls --filter thresholds like size>1GB now parse instead of raising.
  • Fix KeyError in get_dataset_leaderboard when entry has no source by @​NathanHB in #​4473
  • Do not suggest reporting if colab vault error by @​Wauplin in #​4437
  • [Build] Include huggingface_hub.templates via find_namespace_packages by @​Wauplin in #​4438 — model/dataset card templates are now shipped in wheels (previously skipped due to the missing __init__.py).

🏗️ Internal

v1.21.0: [v1.21.0] Jobs filtering & pagination

Compare Source

📊 Jobs listing revamped: filter, paginate, and ls instead of ps

The Jobs listing API and CLI have been overhauled with server-side filtering, proper pagination, and a CLI rename that aligns with the rest of hf. list_jobs() now accepts status and labels parameters that push filtering to the server, and returns a lazy iterator (matching list_models, list_datasets, etc.) so large result sets are fetched page by page. On the CLI side, hf jobs ps has been renamed to hf jobs ls for consistency with hf repos ls, hf models ls, and friends — ps and list still work as aliases.

⚠️ Breaking changes:

  • list_jobs() now returns an Iterable[JobInfo] instead of list[JobInfo]. If you indexed the result (jobs[0]), wrap it with list(...).
  • -f/--filter in hf jobs ls is deprecated. Use --status and --label instead. Glob patterns (data-*), negation (key!=value), and filtering by id/image/command are no longer supported.
from huggingface_hub import list_jobs

# Filter by status and labels
list_jobs(status=["RUNNING", "SCHEDULING"], labels={"env": "prod"})

# Iterate lazily
for job in list_jobs():
    print(job.id)

# Materialize all results
all_jobs = list(list_jobs())
# Filter by status and labels
hf jobs ls --status running,scheduling --label env=prod --label team=ml

# Paginate with --limit
hf jobs ls -a --limit 500
hf jobs ls -a --limit 0  # no limit

📚 Documentation: CLI guide, Jobs guide

🐛 Fix circular import on from huggingface_hub import login

A regression introduced in v1.20.0 caused from huggingface_hub import login to raise an ImportError on a fresh interpreter, due to a circular dependency between _oauth_device and utils._http. The fix moves _oauth_device.py into the utils layer so all imports resolve downward, eliminating the cycle. No lazy imports or workarounds required.

🔧 Other QoL Improvements

📖 Documentation

🐛 Bug and typo fixes

🏗️ Internal

astral-sh/ruff (ruff)

v0.15.21

Compare Source

Released on 2026-07-09.

Preview features
  • Add --add-ignore for adding ruff:ignore comments (#​26346)
  • [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#​25707)
  • Avoid whitespace normalization when formatting comments (#​26455)
  • [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#​26417)
Bug fixes
  • Refine non-empty f-string detection (#​26526)
  • Detect syntax errors in individual notebook cells (#​26419)
  • [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#​26554)
Rule changes
  • [flake8-executable] Mark EXE004 fix as unsafe (#​26033)
  • [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#​26533)
  • [pydocstyle] Skip overload-with-docstring in stub files (D418) (#​26318)
Performance
  • Avoid per-token source index visitor calls (#​26506)
  • Cache parenthesized expression boundaries in the formatter (#​26344)
  • Improve performance of rendering edits in preview mode (#​26565)
  • Inline fits_element in formatter (#​26429)
  • Inline formatter printing hot paths (#​26504)
  • Lazily create builtin bindings (#​26510)
  • Skip empty trivia scans in the source indexer (#​26507)
  • Use ICF for macOS release builds (#​25780)
Formatter
  • Add --extend-exclude to ruff format (#​26372)
Documentation
  • Add "How does Ruff's import sorting compare to isort?" link to README (#​26530)
  • Fix Mozilla Firefox repository link in README (#​26537)
  • [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#​26432)
  • [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#​26433)
Contributors

v0.15.20

Compare Source

Released on 2026-06-25.

Preview features
  • Allow human-readable names in rule selectors (#​25887)
  • Emit a warning instead of an error for unknown rule selectors (#​26113)
  • Match noqa shebang handling in ruff:ignore comments (#​26286)
  • [ruff] Remove pytest-fixture-autouse (RUF076) (#​26240, #​26371)
Documentation
  • Add versioning sections to custom crate READMEs (#​26317)
  • Update ruff_python_parser README for crates.io (#​26315)
  • [perflint] Clarify that PERF402 applies to any iterable (#​26242)
Contributors
pytorch/pytorch (torch)

v2.13.0: PyTorch 2.13.0 Release

Compare Source

PyTorch 2.13.0 Release Notes

Highlights

FlexAttention lands on Apple Silicon (MPS), with up to ~12x speedup over SDPA on sparse patterns, and gains a deterministic backward path on CUDA for reproducible gradient computation.
CuTeDSL "Native DSL" backend gives Inductor a second high-performance code path (alongside Triton) for key GPU operations, with faster compilation. [Prototype]
nn.LinearCrossEntropyLoss combines the final prediction and loss computation to cut peak GPU memory by up to 4x for large-vocabulary language model training.
torchcomms, a new communications backend for PyTorch Distributed, improves fault tolerance, scalability, and debuggability for large-cluster training.
FSDP2 now overlaps reduce-scatter and all-gather communications via a dedicated process group (opt-in), increasing distributed training throughput.
Python 3.15 wheel support for PyTorch on Linux via the pytorch repository index, including builds compatible with free-threaded 3.15t.
Broader platform support: ROCm gains AOTriton 0.12b with native HIP CMake, Arm adds Armv9-A torch.compile targeting, and Intel XPU exposes new device telemetry APIs.

For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.

Tracked Regressions

ROCm wheels break torch.compile on CPU in environments without a GPU

Running a torch==2.13.0+rocm7.2 wheel in an environment where no GPU is available (torch.cuda.is_available() is False) breaks torch.compile on the CPU path: the first compile raises RuntimeError: Can't detect vectorized ISA for CPU (#​189194). This is a regression from torch==2.12.1+rocm7.2, which compiles CPU code fine (detecting e.g. VecAVX2) in the same setup. The 2.13 ROCm wheel appears to rely on something present in the ROCm builder image to detect the CPU vectorized ISA, so it works when run on a ROCm image but fails on a plain CPU-only image.

Workaround: run the +rocm wheel on a ROCm image, or install a standard CPU/CUDA build for GPU-less environments.

Backwards Incompatible Changes

  • Stop building CPython 3.13t (free-threaded) binaries (#​182951)

    Upstream pypa/manylinux removed CPython 3.13t (free-threaded) on 2026-05-07, because 3.13t
    was experimental and has been superseded by the now-non-experimental CPython 3.14t. As a result,
    PyTorch 2.13 no longer ships cp313t wheels (Linux, Triton, and related artifacts). Users on the
    free-threaded interpreter should move to Python 3.14t.

    PyTorch 2.12:

    # cp313t (free-threaded 3.13) wheels w

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Jul 12, 2026
@renovate renovate Bot requested a review from freinold July 12, 2026 23:48
@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Jul 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freinold freinold Awaiting requested review from freinold

Assignees

No one assigned

Labels

lifecycle Update or deprecate something renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants