fix(deps): update python: non-major updates - #339
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/python-non-major
branch
from
August 25, 2026 17:10
3124628 to
1ea7fff
Compare
renovate
Bot
force-pushed
the
renovate/python-non-major
branch
8 times, most recently
from
September 1, 2026 02:50
4f65f2f to
25993b6
Compare
renovate
Bot
force-pushed
the
renovate/python-non-major
branch
9 times, most recently
from
September 9, 2026 19:44
cfb53b8 to
aeb62ba
Compare
renovate
Bot
force-pushed
the
renovate/python-non-major
branch
from
September 10, 2026 01:42
aeb62ba to
9915f5b
Compare
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.2.28→==0.2.29==6.25.0→==6.26.0==1.28.0→==1.30.0==0.16.4→==0.16.6==2.13.0→==2.14.0+cpu==0.0.74→==0.0.80Release Notes
urchade/GLiNER (gliner)
v0.2.29Compare Source
GLiNER v0.2.29 — OpenVINO, label descriptions, and contextual embeddings
This release expands deployment options, adds richer inference outputs, and fixes issues across batching, fine-tuning, evaluation, and offline model loading.
New capabilities
GLiNER.from_pretrained, while retaining GLiNER’s familiar prediction API. [#385](#385){label: description}dictionary to inference or serving. Descriptions become model prompts, while predictions retain your label names. Separate label dictionaries per input text are also supported. [#386](#386)return_vectors=Trueandreturn_label_vectors=Truefor downstream processing. [#386](https://redirect.github.com/urchade/GLiNER/pull/386/files)Fixes and improvements
local_files_onlythrough model initialization and saving/loading auxiliary tokenizers locally. [#391](#391)warmup_ratiocompatibility with newer Transformers versions. [#388](#388)Upgrade notes
gliner[onnx]for CPU ONNX Runtime,gliner[gpu]for GPU ONNX Runtime, orgliner[openvino]for OpenVINO. Install the separateonnxpackage when exporting to ONNX.gradio-app/gradio (gradio)
v6.26.0Compare Source
Features
5824703- workflows: allow save as copy. Thanks @hannahblair!375335e- Keep workflow canvas layout per-viewer, and add undo/redo. Thanks @abidlabs!2cb02c0- Upgrade vulnerable frontend dependencies. Thanks @abidlabs!Fixes
d9acd25- Fix OAuth redirect loops caused by stale sessions. Thanks @dawoodkhan82!7831e62- Give the client's internal helper tasks their own thread pool. Thanks @hysts!a9ce60a- Load a saved run's outputs, not just its inputs, when SSR is on. Thanks @abidlabs!huggingface/huggingface_hub (huggingface-hub)
v1.30.0: [v1.30.0] Scheduled job filters, repo-aware revision pinning and moreCompare Source
🖥️
hf jobs scheduled lscan now filter by status, label and nameYou can now filter scheduled jobs with
--status(active/suspended), repeatable-l/--label key=valueand--name(a shortcut for--label name=NAME), matching the flagshf jobs lsalready had. On the Python side,HfApi.list_scheduled_jobsgains alabelsargument.-f name=daily-report--name daily-report-f env=prod--label env=prod-f suspend!=true--status active)-f suspend=true--status suspended📚 Documentation: Jobs guide
hf jobs scheduled lsfiltering withhf jobs ls(--status/--label/--name) by @moon-bot-app[bot] in #4773🔖
ResolvedRevisionnow pins the repo it was resolved forResolvedRevisiondidn't record which repo a commit hash was resolved against, so resolving"main"on two different repos returned the same commit oid. It now remembers itsrepo_idandrepo_type: passed back for the same repo it is returned as is, for a different repo the requested revision is resolved again.📚 Documentation: Manage cache — Pin a revision
ResolvedRevisiononly pins the repo it was resolved for by @Wauplin in #4767🤖 Inference
conversationaltag for chat-completion on hf-inference: any model with pipeline tagtext-generationorimage-text-to-textcan now be served, mirroring the updated provider-side rules by @hanouticelina in #4784🐛 Bug and typo fixes
Authorizationis never forwarded off-Hub) by @hanouticelina in #4739📖 Documentation
🏗️ Internal
opencode models --refresh) before validatingRELEASE_NOTES_MODEL, fixing release CI failures on cold runners by @Wauplin in #4761huggingface/skillsper release by @hanouticelina in #4765v1.29.0: [v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixesCompare Source
⚡ Xet downloads no longer make one API call per file
Since v1.19.0, downloading a repository with
hf_xeteagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leavingsnapshot_downloadappearing stalled for minutes before failing with a429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.🪣 Change bucket visibility after creation
Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new
HfApi.update_bucket_settings()method (also exported asupdate_bucket_settings) or from the CLI withhf buckets settings, which takes either--privateor--public.📚 Documentation: Buckets guide
🔒 Security fixes
Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to
hf buckets sync/sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil,../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second,load_state_dict_from_filecould fall back to pickle deserialization for a shard named exactly.safetensors:Path.suffixreturns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which usesstr.endswith) was still routed totorch.load(weights_only=False). A shared_is_safetensors()helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle._is_safetensors) by @moon-bot-app[bot] in #4737🤖 Inference
stream=Truewhen a non-streaming inference call fails with 504 by @moon-bot-app[bot] in #4744🖥️ CLI
🔧 Other QoL Improvements
huggingface_hub[mcp]by @Wauplin in #4735labels/tagsfrom docstrings and signature by @Wauplin in #4745🐛 Bug and typo fixes
📖 Documentation
🏗️ Internal
astral-sh/ruff (ruff)
v0.16.6Compare Source
Released on 2026-09-03.
Preview features
pytest-fixture-autouseto therestrictioncategory (#28219)flake8-pytest-style] Add an autofix forPT020(#27993)flake8-tidy-imports] Prevent fix loop betweenTID254andTID255(#28262)isort] Exclude pragma comments from line length calculation (I001) (#27313)Bug fixes
flake8-async,pylint] Recognizebuiltins.open(ASYNC230,PLW1514) (#28021)flake8-bugbear] Fix panic onmatchsubjects (B031) (#27781)flake8-datetimez] Rejecttzinfo=Nonefordatetimebounds (DTZ901) (#28022)flake8-pytest-style] Avoid duplicatePT017diagnostics (#27918)ruff] Removelint.externalhint for Ruff-specific suppressions (RUF102) (#27923)Rule changes
flake8-use-pathlib] Add display-only fix foros.listdir(PTH208) (#28027)Documentation
lint.per-file-ignores(#28106)flake8-async] Document thread offloading (ASYNC240) (#28008)pyupgrade] Clarify defaultencodingargument handling (UP012) (#27315)Other changes
Contributors
v0.16.5Compare Source
Released on 2026-08-27.
Preview features
Bug fixes
flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)flake8-datetimez] Allow timezone-safestrptimechains (DTZ007) (#28023)flake8-simplify] Respect side effects inlambdadefaults (SIM401) (#28000)Server
ClientOptionsdoc comment (#27978)Documentation
Contributors
astral-sh/ty (ty)
v0.0.80Compare Source
Released on 2026-09-09.
Bug fixes
--force-excludefor directories with an excluded ancestor (#28451)LSP server
Diagnostic improvements
Core type checking
functools.partialrelations (#28460)__set__itself (#28408)Performance
leninference over unions (#28470)Memory usage improvements
Contributors
v0.0.79Compare Source
Released on 2026-09-07.
Bug fixes
CLI
Diagnostic improvements
Literalfixes for diagnostics flagging invalid type annotations (#28185)awaitfixes for redundant conditions (#28169)assert_neverfixes for redundant finalelifbranches (#28178)eliffixes (#28179)reveal_typebackport fixes (#28177)Core type checking
TypeIsandisinstancenarrowing (#28193)Unknownwhen collecting type context constraints (#28297)f is identity(f)evaluates toLiteral[True](#28360)ParamSpec(#28085)ParamSpecinference (#28306)type[]aliases (#28267)Performance
Memory usage improvements
Other changes
Contributors
v0.0.78Compare Source
Released on 2026-09-02.
Bug fixes
Preview features
Diagnostics
disjoint-castrule (#28129)Core type checking
ParamSpecbindings inferred against type context (#28084)lambdafunctions are always truthy (#28254)Performance
Contributors
v0.0.77Compare Source
Released on 2026-08-31.
Bug fixes
Core type checking
__init_subclass__calls (#28138)TypedDictmethods (#28111)Performance
Contributors
v0.0.76Compare Source
Released on 2026-08-31.
Preview features
Bug fixes
LSP server
Core type checking
Selfthrough generic type aliases (#28117)==andmatch(#28103)Finalvariance in stubs (#28119)Performance
Contributors
v0.0.75Compare Source
Released on 2026-08-26.
Preview features
Bug fixes
Selfbounds of inherited methods (#27990)LSP server
Documentation
Library support
Diagnostics
Core type checking
ParamSpecsignatures inferred from bound receivers (#28020)Selfbinding inParamSpecprotocols (#28016)TypedDictvariance inference (#28052)yield fromsend/return types from the iterator returned by__iter__(#27987)TypeVarTuples in tuple annotations (#27950)TypeVarTuples (#27943)TypeVarTuple(#27957)typing.Unionas a class on Python 3.14+ (#28003)collections.abc.Callableis an instance oftype(#27991)Contributors
Configuration
📅 Schedule: (in timezone Europe/Berlin)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.