Skip to content

fix(deps): update python: non-major updates - #339

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major
Open

fix(deps): update python: non-major updates#339
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major

Conversation

@renovate

@renovate renovate Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF Age Confidence
gitpython project.dependencies patch ==3.1.59 → ==3.1.62 OpenSSF Scorecard age confidence
gliner project.dependencies patch ==0.2.28 → ==0.2.29 OpenSSF Scorecard age confidence
gradio project.dependencies minor ==6.25.0 → ==6.27.0 OpenSSF Scorecard age confidence
huggingface-hub project.dependencies minor ==1.28.0 → ==1.31.0 OpenSSF Scorecard age confidence
onnxruntime project.dependencies minor ==1.29.0 → ==1.30.0 age confidence
ruff (source, changelog) dependency-groups patch ==0.16.4 → ==0.16.7 OpenSSF Scorecard age confidence
torch tool.uv.sources minor ==2.13.0 → ==2.14.0+cpu age confidence
ty (changelog) dependency-groups patch ==0.0.74 → ==0.0.80 OpenSSF Scorecard age confidence

Release Notes

gitpython-developers/GitPython (gitpython)

v3.1.62

Compare Source

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

v3.1.61

Compare Source

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed
New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

v3.1.60: Security

Compare Source

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

urchade/GLiNER (gliner)

v0.2.29

Compare Source

GLiNER v0.2.29 — OpenVINO, label descriptions, and contextual embeddings

This release expands deployment options, adds richer inference outputs, and fixes issues across batching, fine-tuning, evaluation, and offline model loading.

New capabilities

  • OpenVINO support: Export supported PyTorch models directly to OpenVINO IR and select OpenVINO or ONNX Runtime through GLiNER.from_pretrained, while retaining GLiNER’s familiar prediction API. [#​385](#​385)
  • Label descriptions: Pass a {label: description} dictionary to inference or serving. Descriptions become model prompts, while predictions retain your label names. Separate label dictionaries per input text are also supported. [#​386](#​386)
  • Contextual embeddings: Request entity, relation, and matched-label representations using return_vectors=True and return_label_vectors=True for downstream processing. [#​386](https://redirect.github.com/urchade/GLiNER/pull/386/files)
  • Additional training objectives: Add span-level Dice loss and optional weighting of positive spans by their width. [#​361](#​361)

Fixes and improvements

  • Fix crashes and incorrect label assignments when batching texts with different label sets. [#​384](#​384)
  • Fix training on negative examples with no annotated entities. [#​387](#​387)
  • Fix best-checkpoint restoration and resuming training from native GLiNER checkpoints. [#​389](#​389)
  • Fix relation-extraction evaluation by forwarding relation types and handling entity representations correctly. [#​380](#​380)
  • Improve offline loading by propagating local_files_only through model initialization and saving/loading auxiliary tokenizers locally. [#​391](#​391)
  • Separate optional runtime dependencies and preserve warmup_ratio compatibility with newer Transformers versions. [#​388](#​388)
  • Refresh fine-tuning and ONNX conversion notebooks. [#​390](#​390)

Upgrade notes

  • Install gliner[onnx] for CPU ONNX Runtime, gliner[gpu] for GPU ONNX Runtime, or gliner[openvino] for OpenVINO. Install the separate onnx package when exporting to ONNX.
  • Vector outputs require native PyTorch inference; ONNX, OpenVINO, and stateful streaming sessions do not currently return them.
  • OpenVINO and ONNX export support span/token uni-encoders, bi-encoders, and relation-extraction models. Generative-decoder and streaming-span architectures require PyTorch.
  • Descriptive prompts are intended for models trained to use descriptive labels.
gradio-app/gradio (gradio)

v6.27.0

Compare Source

Features
Fixes

v6.26.0

Compare Source

Features
Fixes
huggingface/huggingface_hub (huggingface-hub)

v1.31.0: [v1.31.0] Custom labels for Sandboxes, More resilient downloads and more

Compare Source

🏷️ Custom labels for Sandboxes

Dedicated sandboxes now accept custom labels, attached to the underlying Job. This is useful for cost attribution, bookkeeping, or finding and reconnecting to the sandboxes created by a given controller run. Labels use the same -l / --label KEY=VALUE syntax as hf jobs run. They are merged with the labels the SDK uses internally, and invalid or reserved labels are rejected before a billable Job is started. Pool-based sandboxes are unchanged: custom labels are only accepted for dedicated sandboxes.

>>> from huggingface_hub import Sandbox
>>> sandbox = Sandbox.create(image="python:3.12", labels={"controller-run": "run-42"})
hf sandbox create --label controller-run=run-42 --label team=data-infra
📥 More resilient downloads

A batch of fixes makes downloads more robust to unusual server responses, network hiccups and concurrent usage:

  • A timeout while waiting for the response headers of a streamed download is now retried and resumed like a body read failure, instead of escaping http_get() while retries remain.

  • Regular HTTP downloads no longer fail when the HEAD response has no Content-Length. The file size is validated against the GET response when available.

  • snapshot_download now writes the refs/ cache file atomically, reusing the logic already used by hf_hub_download. This fixes a long-standing race when many concurrent snapshot_download calls target the same repo (seen in vLLM / llm-compressor).

  • hf download --dry-run --local-dir ... no longer copies files from the Hub cache into the destination. On large files and slow disks this looked like a hang and could leave an incomplete file behind.

  • [Download] Share retry handling for stream entry and body failures by @​Wauplin in #​4826

  • [Download] Tolerate missing HEAD Content-Length by @​Wauplin in #​4805

  • [Download] Write cache ref file atomically in snapshot_download by @​Wauplin in #​4829

  • [Download] Prevent cached file copies during local-dir dry runs by @​wakamex in #​4817

🔌 httpx re-exported for library integrators

huggingface_hub now re-exports the HTTP library it uses as huggingface_hub.utils.httpx. Libraries built on top of huggingface_hub that need httpx types or exceptions (typically to catch errors) should import it from there rather than importing httpx directly. v1.x is built on httpx, and v2.x will move to its successor httpx2, so importing through huggingface_hub.utils keeps your code compatible with both. This is only for types and exceptions: to make requests to the Hub, keep using get_session().

from huggingface_hub.utils import httpx

try:
    ...
except httpx.HTTPError:
    ...

📚 Documentation: Utilities — The httpx module

🔒 Security

HfFileSystem.get() now validates remote filenames before writing anything locally. A server-side filename such as folder/..\..\outside.txt could previously escape the destination directory on Windows during a recursive download. The same check already protected hf_hub_download, snapshot_download and bucket sync. Unsafe filenames now raise ValueError on all platforms, including when downloading to an explicitly named file or a file object.

🖥️ CLI
  • [CLI] Fix hf buckets rm --recursive deleting lexical siblings of the prefix: removing logs/ no longer touches logs_root.txt by @​Wauplin in #​4804
  • [CLI] Don't let hf update self-upgrade a pip install on Windows: it now prints the pip install -U command to run instead of leaving a broken install by @​Wauplin in #​4823
  • [CLI] Raise explicit error for shell-script extensions on Windows by @​hanouticelina in #​4846
  • [CLI] Fix truncated command descriptions in the CLI reference by @​hanouticelina in #​4849
🐛 Bug and typo fixes
📖 Documentation
🏗️ Internal

v1.30.0: [v1.30.0] Scheduled job filters, repo-aware revision pinning and more

Compare Source

🖥️ hf jobs scheduled ls can now filter by status, label and name

You can now filter scheduled jobs with --status (active/suspended), repeatable -l/--label key=value and --name (a shortcut for --label name=NAME), matching the flags hf jobs ls already had. On the Python side, HfApi.list_scheduled_jobs gains a labels argument.

[!WARNING]
-f/--filter on hf jobs scheduled ls is deprecated and no longer applied: it is accepted but ignored, with a warning pointing to the new flags. Migrate as shown below. The option itself will be removed in a future release.

hf jobs scheduled ls --all
hf jobs scheduled ls --status suspended
hf jobs scheduled ls --name hourly-task --label env=prod
before after
-f name=daily-report --name daily-report
-f env=prod --label env=prod
-f suspend!=true (default, or --status active)
-f suspend=true --status suspended

📚 Documentation: Jobs guide

🔖 ResolvedRevision now pins the repo it was resolved for

ResolvedRevision didn't record which repo a commit hash was resolved against, so resolving "main" on two different repos returned the same commit oid. It now remembers its repo_id and repo_type: passed back for the same repo it is returned as is, for a different repo the requested revision is resolved again.

>>> from huggingface_hub import resolve_revision
>>> revision = resolve_revision("openai-community/gpt2")

# Same repo => returned as is
>>> resolve_revision("openai-community/gpt2", revision=revision) is revision
True

# Another repo => "main" is resolved again for that repo
>>> resolve_revision("openai-community/gpt2-medium", revision=revision).resolved
'6dcaa7a952f72f9298047fd5137cd6e4f05f41da'

📚 Documentation: Manage cache — Pin a revision

  • [Download] A ResolvedRevision only pins the repo it was resolved for by @​Wauplin in #​4767
🤖 Inference
  • Do not require the conversational tag for chat-completion on hf-inference: any model with pipeline tag text-generation or image-text-to-text can now be served, mirroring the updated provider-side rules by @​hanouticelina in #​4784
🐛 Bug and typo fixes
  • [Download] Follow redirects between Hub hosts when resolving files, instead of failing with a misleading connection error (redirects to CDNs are still not followed, so LFS metadata is preserved and Authorization is never forwarded off-Hub) by @​hanouticelina in #​4739
📖 Documentation
  • [Sandbox] Mark the Sandbox API as experimental across docstrings, guides, package reference and CLI help, and clarify that shared sandboxes are intended for workloads within the same trust boundary by @​Wauplin in #​4783
🏗️ Internal
  • [Release] Refresh OpenCode model cache (opencode models --refresh) before validating RELEASE_NOTES_MODEL, fixing release CI failures on cold runners by @​Wauplin in #​4761
  • [Release] Consolidate the HF CLI skill sync into the release workflow, removing the duplicate standalone sync workflow that opened two PRs on huggingface/skills per release by @​hanouticelina in #​4765
  • [CI] The close-unscoped-community-prs workflow stays available for manual runs only: enforcement was enabled and then disabled again within this release by @​hanouticelina and @​Wauplin in #​4766, #​4800
  • [CI] Fix torch_1.11 case-arm label to match the renamed matrix entry, restoring torch installation on that lane by @​MohammedAlkindi in #​4776
  • Post-release: bump version to 1.30.0.dev0 by @​huggingface-hub-bot[bot] in #​4763

v1.29.0: [v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

Compare Source

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings

# Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)

# Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)
# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True

# Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

🤖 Inference

🖥️ CLI

🔧 Other QoL Improvements

  • [MCP] Set upper bound mcp<2.0 for optional extra dependency huggingface_hub[mcp] by @​Wauplin in #​4735
  • Remove leftover deprecated labels/tags from docstrings and signature by @​Wauplin in #​4745

🐛 Bug and typo fixes

📖 Documentation

  • Docs: mark Sandboxes as experimental and drop the "HF token never enters the sandbox" claim by @​moon-bot-app[bot] in #​4734

🏗️ Internal

astral-sh/ruff (ruff)

v0.16.7

Compare Source

Released on 2026-09-10.

Preview features
  • [ruff] Add rule for default values on method receivers (RUF077) (#​26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#​28311)
Bug fixes
  • Alternate nested quotes inside format spec interpolations (#​28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#​27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#​26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#​28310)
Rule changes
  • Correct D211 and D203 rule conflict diagnostic (#​28444)
  • Recognize slice and frozendict generics (#​28477)
  • Stop defining __cached__ for Python 3.15 (#​28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#​28475)
Performance
  • Reuse parser name lookups when interning (#​28399)
  • Speed up inherited configuration resolution (#​28299)
Documentation
  • Fix line-length path in --config example (#​28392)
  • Remove the "Who’s Using Ruff?" list (#​28455)
Other changes
  • Embed archive checksums in the shell installer (#​28281)
Contributors

v0.16.6

Compare Source

Released on 2026-09-03.

Preview features
  • Move pytest-fixture-autouse to the restriction category (#​28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#​27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#​28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#​27313)
Bug fixes
  • Validate unary expressions when parsing (#​28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#​28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#​27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#​28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#​27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#​27923)
Rule changes
  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#​28027)
Documentation
  • Add another example and glob reference for lint.per-file-ignores (#​28106)
  • Add duplicate work guidance (#​28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#​28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#​27315)
Other changes
  • Allow unary plus in match patterns on Python 3.15 (#​28231)
Contributors

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features
  • Allow rules without codes (#​28049)
  • Introduce category selectors (#​27666)
  • Update preview default rules and categories (#​27877)
Bug fixes
  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)
Server
  • Fix duplicated "of" in ClientOptions doc comment (#​27978)
Documentation
  • Document rule acceptance guidelines (#​27910)
  • Document the new category selectors (#​27906)
Contributors
astral-sh/ty (ty)

v0.0.80

Compare Source

Released on 2026-09-09.

Bug fixes
  • Fix --force-exclude for directories with an excluded ancestor (#​28451)
  • Preserve metaclass candidates after conflicts (#​28461)
LSP server
  • Give existing autofixes descriptive titles (#​28456)
  • Prevent LSP hangs during inlay hint bursts (#​28390)
Diagnostic improvements
  • Preserve redundant-condition diagnostics with unreachable operands (#​28374)
Core type checking
  • Check captured receivers when calling wrapped classmethods (#​28467)
  • Fix cached classmethods on generic classes (#​28207)
  • Fix disjointness of type guards and boolean literals (#​28363)
  • Infer tuple variance from the full tuple spec (#​28446)
  • Infer tuple variance more precisely (#​28426)
  • Preserve callable identity across specialized types (#​28409)
  • Preserve callback type context through ParamSpec forwarding (#​28439)
  • Preserve wrapped functions in precise functools.partial relations (#​28460)
  • Respect descriptor protocol for __set__ itself (#​28408)
  • Respect type-variable bounds in argument context (#​28448)
  • Unwrap union alternatives in overload implementations (#​28468)
Performance
  • Distribute len inference over unions (#​28470)
  • Fast-path concrete literal intersections (#​28348)
Memory usage improvements
  • Avoid excess capacity in multi-binding tables (#​28412)
  • Share equivalent place tables within a file (#​28319)
  • Share names in synthesized constructor parameters (#​28398)
Contributors

v0.0.79

Compare Source

Released on 2026-09-07.

Bug fixes
  • Avoid dict keyword-call panics when typing is shadowed (#​28292)
  • Discover configs in models derived from legacy generic classes (#​28397)
  • Normalize recursive collection-use constraints (#​28332)
  • Recover cycles when constructing known class instances (#​28289)
CLI
  • Embed archive checksums in the shell installer (#​4458)
Diagnostic improvements
  • Add Literal fixes for diagnostics flagging invalid type annotations (#​28185)
  • Add await fixes for redundant conditions (#​28169)
  • Add assert_never fixes for redundant final elif branches (#​28178)
  • Add defensive assertion fallback for redundant elif fixes (#​28179)
  • Add rules to detect always-truthy and always-falsy conditions (#​28034)
  • Preserve deprecations on decorated callables (#​28256)
  • Require a direct dependency for reveal_type backport fixes (#​28177)
  • Suggest variable-length tuple annotations for redundant conditions (#​28168)
Core type checking
  • Align TypeIs and isinstance narrowing (#​28193)
  • Avoid falling back to Unknown when collecting type context constraints (#​28297)
  • Ensure f is identity(f) evaluates to Literal[True] (#​28360)
  • Fix callable specialization with union-valued ParamSpec (#​28085)
  • Infer variance through recursive protocols (#​28077)
  • Narrow types with ordered length comparisons (#​28264)
  • Preserve gradual type

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Aug 23, 2026
@renovate
renovate Bot requested a review from freinold August 23, 2026 22:50
@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Aug 23, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from 3124628 to 1ea7fff Compare August 25, 2026 17:10
@renovate renovate Bot changed the title fix(deps): update dependency gitpython to v3.1.59 fix(deps): update python: non-major updates Aug 25, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 8 times, most recently from 4f65f2f to 25993b6 Compare September 1, 2026 02:50
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 9 times, most recently from cfb53b8 to aeb62ba Compare September 9, 2026 19:44
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from aeb62ba to 9915f5b Compare September 10, 2026 01:42
@coderabbitai

coderabbitai Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 901f014a-3d45-41fc-a6ec-efb29d6ce3d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/python-non-major branch 2 times, most recently from 96702d0 to 5daef00 Compare September 10, 2026 18:28
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from 5daef00 to 9856072 Compare September 11, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freinold freinold Awaiting requested review from freinold

Assignees

No one assigned

Labels

lifecycle Update or deprecate something renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants