chore(deps): bump the dataviewer-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the dataviewer-dependencies group with 3 updates in the /data-management/viewer directory: python-multipart, huggingface-hub and ultralytics.

Updates python-multipart from 0.0.26 to 0.0.27

Release notes

Sourced from python-multipart's releases.

0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

Commits

• 6d1d689 Version 0.0.27 (#272)
• 0b10220 Run CI on main branch pull requests (#271)
• 3e64f5f Add multipart header limits (#267)
• eb109cc Pass parse offsets via constructors (#268)
• 78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
• b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
• See full diff in compare view

Updates huggingface-hub from 1.12.0 to 1.13.0

Release notes

Sourced from huggingface-hub's releases.

[v1.13.0] new CLI commands and formatting, and HF URI parsing

🖥️ New CLI commands: repo cards, file listings, and dataset leaderboards

This release adds three new CLI capabilities for exploring Hub content. hf models card, hf datasets card, and hf spaces card fetch the README of any repo and print it to stdout, with --metadata (YAML frontmatter as JSON) and --text (prose only) flags for splitting the card into its structured and unstructured parts. Calling hf models ls <repo_id>, hf datasets ls <repo_id>, or hf spaces ls <repo_id> now switches from listing repos to listing files inside that repo, with --tree, -R, -h, and --revision options mirroring the existing hf buckets ls behavior. And hf datasets leaderboard <dataset_id> surfaces model scores submitted to a benchmark dataset, making it easy to compare models by score from the terminal.

# Get model card metadata as JSON
hf models card google/gemma-4-31B-it --metadata --format json
List files in a model repo (tree view with sizes)
hf models ls meta-llama/Llama-3.2-1B-Instruct --tree -h
Show top 5 models on SWE-bench
hf datasets leaderboard SWE-bench/SWE-bench_Verified --limit 5

📚 Documentation: CLI guide

• [CLI] Add hf models card and hf datasets card commands by @​davanstrien in #4118
• [CLI] Add file listing to models/datasets/spaces ls by @​Wauplin in #4166
• [CLI] add hf datasets leaderboard by @​hanouticelina in #4154

🚀 Manage Spaces from the CLI

Three new hf spaces subcommands bring full lifecycle control to the terminal. hf spaces pause and hf spaces restart stop or rebuild a Space (with --factory-reboot for a clean rebuild), and hf spaces settings lets you configure sleep time and hardware in one call. A companion hf spaces hardware command lists all available hardware flavors with pricing, so you can discover options before changing settings. Pause and restart include a confirmation prompt (-y to skip) since they tear down the running container.

# Pause a Space when not in use (not billed while paused)
hf spaces pause username/my-space
Restart with a GPU
hf spaces settings username/my-space --hardware t4-medium --sleep-time 3600
List available hardware options
hf spaces hardware

📚 Documentation: CLI guide — Spaces

• [CLI] Add spaces lifecycle commands: pause, restart, sleep by @​davanstrien in #4155
• [CLI] Add hf spaces hardware command by @​Wauplin in #4169
• [CLI] Add --hardware flag to hf spaces settings by @​davanstrien in #4163

🔃 hf update replaces the auto-update prompt

The blocking interactive Y/n auto-update prompt at CLI startup is gone. It was catching too many non-interactive contexts (CI runners, Homebrew post-install hooks, Jupyter notebooks) and hanging automation. In its place, a single yellow stderr warning suggests running hf update — a new command that detects how hf was installed (Homebrew, standalone installer, or pip) and runs the right upgrade command. Set HF_HUB_DISABLE_UPDATE_CHECK=1 to silence the startup check entirely, for example in offline CI.

hf update

... (truncated)

Commits

• 3790483 Release: v1.13.0
• b648072 Release: v1.13.0.rc0
• 6e89ade [CLI] Make --format / --json / -q global (#4162)
• 6a57790 [CLI] Add hf spaces hardware command (#4169)
• 5fb553d Centralize hf:// URI parsing (#4158)
• bc4069b [CLI] Add file listing to models/datasets/spaces ls (#4166)
• 81e04b3 [CLI] Add --hardware flag to hf spaces settings (#4163)
• c1775a5 Avoid reuploading preuploaded LFS files (#4165)
• 1b2bce2 [Release] Mark minor releases as "latest" on GitHub (#4167)
• 47437a6 Add bucket+mount transport for Jobs script upload (#4025)
• Additional commits viewable in compare view

Updates ultralytics from 8.4.41 to 8.4.46

Commits

• 0ca0b6d ultralytics 8.4.46 Fix multiscale minimum train size (#24394)
• 1c68a1e Fix docs strict validation warnings (#24389)
• b4cf7c4 Improve export results path to point to actual artifact path (#24316)
• 670237c Improve data and fraction args across export formats (#24382)
• 4da693f Add https://youtu.be/FvWl00sD4rc to docs (#24370)
• 5840258 Fix: stop resume when training is already finished (#24386)
• 08edc82 Improve RKNN exports to highlight non-int8 supported chips (#24384)
• 79b2086 ultralytics 8.4.45 Fix pretrained checkpoint training regression (#24378)
• a8ff07a ultralytics 8.4.44 Apply pretrained arg across model trainers (#24374)
• 62bd0e0 Docs: Datasets Clustering (#24376)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 09de262.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

data-management/viewer/uv.lock

Package	Version	License	Issue Type
huggingface-hub	1.13.0	Null	Unknown License
python-multipart	0.0.27	Null	Unknown License
ultralytics	8.4.46	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/huggingface-hub	1.13.0	Unknown	Unknown
pip/python-multipart	0.0.27	Unknown	Unknown
pip/ultralytics	8.4.46	Unknown	Unknown

Scanned Files

• data-management/viewer/uv.lock

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.70%. Comparing base (c912668) to head (09de262).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #601      +/-   ##
==========================================
+ Coverage   65.16%   67.70%   +2.53%     
==========================================
  Files         251      263      +12     
  Lines       15597    16827    +1230     
  Branches     2193     2331     +138     
==========================================
+ Hits        10164    11392    +1228     
  Misses       5142     5142              
- Partials      291      293       +2     

Flag	Coverage Δ		*Carryforward flag
pester	83.13% <ø> (ø)		Carriedforward from c912668
pytest-data-pipeline	100.00% <ø> (ø)		Carriedforward from c912668
pytest-dataviewer	66.92% <ø> (ø)		Carriedforward from c912668
pytest-dm-tools	100.00% <ø> (ø)		Carriedforward from c912668
pytest-evaluation	99.83% <ø> (?)
pytest-fuzz	4.90% <ø> (ø)		Carriedforward from c912668
pytest-inference	0.00% <ø> (ø)		Carriedforward from c912668
pytest-training	82.14% <ø> (ø)		Carriedforward from c912668
vitest	53.02% <ø> (ø)		Carriedforward from c912668

*This pull request uses carry forward flags. Click here to find out more.
see 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Advisory Review Summary

Affected ecosystems and surfaces:

• pip / python-runtime — data-management/viewer/pyproject.toml + data-management/viewer/uv.lock (grouped dataviewer-dependencies update, 3 packages)

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	Unconfirmed (security-labeled)	python-runtime
huggingface-hub	1.12.0	1.13.0	None	python-runtime
ultralytics	8.4.41	8.4.46	None	python-runtime

---

python-multipart

Advisory: No explicit GHSA or CVE ID appears in the PR body. Dependabot designated this security(deps):, indicating a linked advisory. The 0.0.27 changelog adds multipart header limits (Kludex/python-multipart#267) — a standard DoS hardening measure for multipart parsers — and passes parse offsets via constructors (#268). Severity cannot be rated without a confirmed identifier.

Release notes highlights (compare view):

• Add multipart header limits #267
• Pass parse offsets via constructors #268

Repo-specific risk: Required base dependency of the FastAPI backend. Patch bump; no breaking changes; manifest and lockfile both updated (not lockfile-only).

Validation Signal

1. Deterministic CI: PR Validation: in_progress:queued
   ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
   Relevant check runs: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint — all pending.
2. Static impact reasoning: Manifest (pyproject.toml) and lockfile (uv.lock) both updated; not a lockfile-only pin. Patch bump; no ABI-sensitive packages touched.

---

huggingface-hub

Advisory: No security advisory. Minor version bump (1.12.0 → 1.13.0).

Release notes highlights (v1.13.0):

• New CLI commands: hf models card, hf datasets card, hf datasets leaderboard, file listings in ls subcommands
• New Spaces lifecycle commands: hf spaces pause, hf spaces restart, hf spaces settings
• Blocking interactive auto-update prompt removed; replaced with non-interactive hf update

Repo-specific risk: Used under the optional [huggingface] extra. Minor version bump; API backward-compatible per release notes.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:queued — relevant check runs not yet available.
2. Static impact reasoning: Minor version bump within an optional extra; no ABI or breaking-change signals in changelog.

---

ultralytics

Advisory: No security advisory. Patch bump across five consecutive releases (8.4.41 → 8.4.46).

Release notes highlights (compare view):

• 8.4.46: Fix multiscale minimum train size
• 8.4.45: Fix pretrained checkpoint training regression
• 8.4.44: Apply pretrained arg across model trainers
• Improve export results path and data/fraction args across export formats

Repo-specific risk: Used under the optional [yolo] extra for YOLO-based annotation inference. Patch level; no breaking changes noted.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:queued — relevant check runs not yet available.
2. Static impact reasoning: Patch bump; not an ABI-sensitive package in this surface context (not training/rl/).

---

Advisory verdict: COMMENT — PR Validation is still queued (in_progress:queued); advisory details for the security(deps): label could not be confirmed from the PR body (no explicit GHSA/CVE IDs present). All three bumps are patch or minor level with no high-risk surface triggers (no ABI-sensitive packages, no major version jumps). Re-evaluate once Dataviewer Backend Pytest and Python Lint check runs complete at PR Validation run.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #601 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #601 · ● 1M

[github-actions]

Advisory Review Summary

Grouped Dependabot PR bumping 3 packages in the dataviewer-dependencies group under data-management/viewer/.

Ecosystems and surfaces touched:

• uv / pip — data-management/viewer/pyproject.toml + uv.lock → python-runtime (dataviewer) surface

Package table:

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	None found	python-runtime (dataviewer)
huggingface-hub	1.12.0	1.13.0	None found	python-runtime (dataviewer)
ultralytics	8.4.41	8.4.46	None found	python-runtime (dataviewer)

Note — transitive-only lockfile detection: Both pyproject.toml (manifest) and uv.lock (lockfile) are updated for all three packages, confirming these are direct dependency bumps, not transitive-only pins.

---

python-multipart

Advisory: No GHSA or CVE identifiers found in the PR body. External advisory APIs (OSV, NVD) were unreachable from the review sandbox; no fabricated severities are reported.

Release notes (0.0.27, 2026-04-27):

• Add multipart header limits (#267)
• Pass parse offsets via constructors (#268)

Changelog: Kludex/python-multipart@0.0.26...0.0.27

Risk notes: Patch bump; no breaking changes identified. The python-multipart library is used by FastAPI for form data and file upload parsing in the dataviewer backend.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — the orchestrator has not yet completed at review time. Relevant check runs for this surface: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint. Results are not yet available.
2. Static impact reasoning: No ABI-sensitive packages (e.g., numpy, torch, onnxruntime-gpu) are touched. Bump is a patch release with no Isaac Sim or CUDA boundary implications.

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

---

huggingface-hub

Advisory: No GHSA or CVE identifiers found in the PR body. External advisory APIs were unreachable from the review sandbox.

Release notes highlights (v1.13.0, 2026-04-30):

• New CLI commands: hf models card, hf datasets card, hf spaces card, file listings, hf datasets leaderboard
• Space lifecycle management via CLI (hf spaces pause, hf spaces restart, hf spaces settings)
• Breaking behavior change for CLI automation: The blocking Y/n auto-update prompt at CLI startup is removed. Replaced with a non-blocking stderr warning and hf update command. Set HF_HUB_DISABLE_UPDATE_CHECK=1 to silence in offline CI.
• hf:// URI parsing centralised

Changelog: https://github.com/huggingface/huggingface_hub/releases/tag/v1.13.0

Risk notes: Minor bump (1.12.0 → 1.13.0). The auto-update prompt removal is a CLI behavioral change but does not affect the programmatic Python API used by the dataviewer backend. No ABI concerns. The [huggingface] optional dependency group is used by the dataviewer for Hub dataset integration.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress. Relevant check runs: Dataviewer Backend Pytest, Python Lint. Not yet available.
2. Static impact reasoning: Minor version bump; all changes are additive CLI features or behavioral improvements. No import API renames noted.

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

---

ultralytics

Advisory: No GHSA or CVE identifiers found in the PR body. External advisory APIs were unreachable from the review sandbox.

Commits (8.4.41 → 8.4.46):

• 8.4.46: Fix multiscale minimum train size (#24394)
• 8.4.45: Fix pretrained checkpoint training regression (#24378)
• 8.4.44: Apply pretrained arg across model trainers (#24374)
• Improve export results path, data/fraction args, RKNN export docs

Compare: ultralytics/ultralytics@v8.4.41...v8.4.46

Risk notes: Five patch releases since 8.4.41; all are bug fixes with no API removals noted. ultralytics depends on torch and torchvision transitively, but this patch bump does not cross any torch major-version boundary. Used in the [yolo] optional dependency group for YOLO inference in the dataviewer backend.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress. Relevant check runs: Dataviewer Backend Pytest, Python Lint. Not yet available.
2. Static impact reasoning: Patch bump across 5 releases. No Isaac Sim path touched (training/rl/ not in diff). No numpy ABI guard applies here — ultralytics is in the dataviewer [yolo] optional group, not the RL training stack.

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

---

Advisory verdict: COMMENT — CI is still in progress (in_progress:in_progress); no advisory identifiers found for any of the three bumps; all changes are patch or minor version bumps with no high-risk ABI, peer-dep, or breaking-change signals. Maintainers may merge once Dataviewer Backend Pytest, Pytest Data Management Tools, and Python Lint pass.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #601 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #601 · ● 405.6K

[katriendg]

@dependabot rebase

[github-actions]

Advisory Review Summary

Grouped Dependabot bump across 1 directory (data-management/viewer/) with 3 packages. All changes touch both the manifest (pyproject.toml) and the lockfile (uv.lock) — not transitive-only.

Affected ecosystems and surfaces:

• uv / pip under data-management/viewer/ → python-runtime (dataviewer)

Package	From	To	Severity	Surface
python-multipart	0.0.26	0.0.27	None	python-runtime (dataviewer)
huggingface-hub	1.12.0	1.13.0	None	python-runtime (dataviewer)
ultralytics	8.4.41	8.4.46	None	python-runtime (dataviewer)

---

python-multipart

No GHSA or CVE advisories found. Patch release (0.0.26 → 0.0.27) adds multipart header limits and passes parse offsets via constructors. This is a core dependency used by FastAPI for file/form uploads in the dataviewer backend. No breaking changes in the changelog.

Repo-specific risk: Low. Patch bump with security-hardening characteristics (header limits). No ABI sensitivity.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress
   ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
   • Relevant check runs: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint — conclusions pending.
2. Static impact reasoning: No training/rl/ paths in this diff; Isaac Sim ABI guard does not apply. No ABI-sensitive packages (numpy, torch, onnxruntime-gpu) are changed.

---

huggingface-hub

No GHSA or CVE advisories found. Minor release (1.12.0 → 1.13.0) adds new CLI capabilities and centralizes hf:// URI parsing. The blocking interactive auto-update prompt at CLI startup is removed (replaced with a passive stderr warning). Used only under the optional huggingface extra in the dataviewer. See v1.13.0 release notes.

Repo-specific risk: Low. Minor bump with additive CLI features only. No API-breaking changes relevant to hub download workflows used by the dataviewer.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — pending.
2. Static impact reasoning: Optional extra; only loaded when huggingface install target is selected. No ABI constraints.

---

ultralytics

No GHSA or CVE advisories found. Patch bump spanning 5 releases (8.4.41 → 8.4.46). Fixes include: pretrained-checkpoint training regression (8.4.45), pretrained arg propagation across model trainers (8.4.44), multiscale minimum train size fix (8.4.46), and improved export results path handling. Used only under the optional yolo extra. See compare view.

Repo-specific risk: Low. Optional extra; all changes are internal bug fixes to training/export pipelines. No YOLO inference API changes. Not in training/rl/ scope so no Isaac Sim ABI concern.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — pending.
2. Static impact reasoning: ultralytics is not in the Isaac Sim ABI-sensitive list. Patch bump only; no CUDA/driver compatibility concerns noted.

---

Advisory verdict: COMMENT — CI validation is still in progress (in_progress:in_progress); all three bumps are patch/minor with no advisory identifiers, no high-risk triggers, and no ABI-sensitive packages. Safe to approve once Dataviewer Backend Pytest, Pytest Data Management Tools, and Python Lint checks pass.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #601 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #601 · ● 404K