chore(deps): bump the dataviewer-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the dataviewer-dependencies group with 3 updates in the /data-management/viewer directory: pydantic, huggingface-hub and ultralytics.

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• See full diff in compare view

Updates huggingface-hub from 1.13.0 to 1.14.0

Release notes

Sourced from huggingface-hub's releases.

[v1.14.0] Handle Spaces secrets & variables from CLI and other improvements

🖥️ Manage Space secrets and variables from the CLI

You can now manage Space secrets and environment variables directly from the command line with two new hf spaces subgroups: secrets and variables. Use hf spaces secrets to add, list, and delete write-only secrets, and hf spaces variables to add, list, and delete readable environment variables. Both add commands support multiple -s/-e flags and --secrets-file/-env-file for loading from dotenv files. On the Python side, HfApi.get_space_secrets() returns secret metadata (key, description, updated timestamp) without ever revealing values.

# List secrets (values are write-only — only keys and timestamps are shown)
$ hf spaces secrets ls username/my-space
Add secrets
$ hf spaces secrets add username/my-space -s OPENAI_API_KEY=sk-...
$ hf spaces secrets add username/my-space --secrets-file .env.secrets
Delete a secret (confirmation prompt, use --yes to skip)
$ hf spaces secrets delete username/my-space OPENAI_API_KEY --yes
List, add, and delete variables (values are readable)
$ hf spaces variables ls username/my-space
$ hf spaces variables add username/my-space -e MODEL_ID=gpt2 -e MAX_TOKENS=512
$ hf spaces variables delete username/my-space MAX_TOKENS --yes

• [CLI] Add hf spaces secrets and variables subgroups by @​davanstrien in #4170
• [CLI] Add get_space_secrets + hf spaces secrets ls by @​Wauplin in #4182

📚 Documentation: CLI guide · Manage your Space

🪣 Rsync-style trailing slash for bucket folder copies

hf buckets cp now supports rsync-style trailing slash semantics when copying folders. A trailing / on the source path copies only the folder's contents to the destination, while omitting it nests the folder itself — matching the behavior you'd expect from rsync. This makes it possible to flatten directory structures during copies, which was not possible before. Additionally, copy_files now raises an explicit EntryNotFoundError when the source path resolves to no files, instead of silently succeeding with zero operations.

# Without trailing slash: "logs" dir is nested => dst/logs/...
$ hf buckets cp hf://buckets/username/src-bucket/logs hf://buckets/username/dst/
With trailing slash: only contents of "logs" are copied => dst/...
$ hf buckets cp hf://buckets/username/src-bucket/logs/ hf://buckets/username/dst/

• [Buckets] Support rsync-style trailing slash in copy_files by @​Wauplin in #4187
• [CLI] Raise error when copy_files source doesn't exist by @​Wauplin in #4186

📚 Documentation: Buckets guide · CLI guide

💔 Breaking Change

• [CLI] Rename hf skills upgrade -> hf skills update by @​hanouticelina in #4176 — hf skills upgrade no longer exists; use hf skills update instead.
• [CLI] Add out.status() by @​hanouticelina in #4171 — status updates (spinners/progress) on hf extensions install and hf spaces dev-mode are now suppressed when using --format json, --quiet, or --format agent.

🖥️ CLI

... (truncated)

Commits

• 2ea0c83 Release: v1.14.0
• f7cffc7 Release: v1.14.0.rc0
• ac0156b style
• 32476d9 Update typer dependency version in setup.py (#4193)
• fadab7a [CLI] Raise error when copy_files source doesn't exist (#4186)
• 7c0abeb [CLI] Add get_space_secrets + hf spaces secrets ls (#4182)
• 51adb8f [Buckets] Support rsync-style trailing slash in copy_files to copy folder con...
• 22eaf89 [internal] Untrack useless files (#4191)
• 2774771 Update unit test warnings check to ignore unrelated deprecation warnings (#4188)
• 3d19907 [CLI] Support hf -v to print version (#4185)
• Additional commits viewable in compare view

Updates ultralytics from 8.4.46 to 8.4.47

Commits

• ee66a76 ultralytics 8.4.47 Fix CLI parsing for solution colormap values (#24219)
• a32b648 Truncate results to 5 decimals (#23909)
• 3fedaaf Add top-k post-processing to RT-DETR decoder head (#24403)
• cc526db Return None in imread on read failure to match cv2.imread (#24406)
• bd89607 Add refer data and eval dataset class name consistency check for YOLOE valida...
• 9047b77 Resolve platform URIs for checkpoint loading (#24395)
• 4127e2f Fix latent bugs across loaders, hub session, and solutions (#24397)
• 540eaaa Bump slackapi/slack-github-action from v3.0.2 to v3.0.3 in /.github/workflows...
• f515c95 Fix Edge TPU INT8 calibration when data arg is not passed (#24383)
• See full diff in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a279b16.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

data-management/viewer/uv.lock

Package	Version	License	Issue Type
huggingface-hub	1.14.0	Null	Unknown License
pydantic	2.13.4	Null	Unknown License
pydantic-core	2.46.4	Null	Unknown License
ultralytics	8.4.47	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/huggingface-hub	1.14.0	Unknown	Unknown
pip/pydantic	2.13.4	Unknown	Unknown
pip/pydantic-core	2.46.4	Unknown	Unknown
pip/ultralytics	8.4.47	Unknown	Unknown

Scanned Files

• data-management/viewer/uv.lock

[github-actions]

Advisory Review Summary

Surfaces touched: python-runtime (dataviewer) — uv ecosystem under data-management/viewer/

Note: The PR title carries a security(deps): prefix, which means Dependabot detected at least one advisory for a package in this group. However, no explicit GHSA or CVE identifier appears in the PR body. Advisory enrichment via GHSA, OSV.dev, and NVD APIs was attempted but all external endpoints are inaccessible from the firewall sandbox. Manual advisory review via the Dependabot security alert linked to this PR is recommended before merging.

Package	From	To	Severity	Surface
pydantic	2.13.3	2.13.4	Unknown (no GHSA/CVE in body)	python-runtime (dataviewer)
huggingface-hub	1.13.0	1.14.0	Unknown (no GHSA/CVE in body)	python-runtime (dataviewer)
ultralytics	8.4.46	8.4.47	Unknown (no GHSA/CVE in body)	python-runtime (dataviewer)

pydantic

2.13.3 → 2.13.4 — patch release. Source: GitHub release v2.13.4

Release notes:

• Preserve RootModel core metadata
• Adapt pydantic-core linker flags on macOS
• Bump libc 0.2.155 → 0.2.185

No breaking changes. Same major version (v2). No ABI concerns for the dataviewer backend.

Validation Signal

1. Deterministic CI: PR Validation: in_progress:in_progress — orchestrator has not completed. All per-surface check runs (Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint) are in progress. CI run: PR Validation

   ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

2. Static impact reasoning: pydantic 2.13.4 remains within the >=2.0,<3.0 range expected by the dataviewer backend; no ABI-sensitive packages (numpy, torch, onnxruntime-gpu) are touched.

---

huggingface-hub

1.13.0 → 1.14.0 — minor release. Source: GitHub release v1.14.0

Release notes highlights:

• New hf spaces secrets / hf spaces variables CLI subgroups
• Rsync-style trailing slash for hf buckets cp
• copy_files now raises EntryNotFoundError when source resolves to no files (previously silent)
• typer dependency version updated

The error-behaviour change in copy_files only affects bucket CLI paths; the dataviewer uses huggingface-hub for dataset download/upload operations, which are unaffected. Minor bump, same major, no breaking API surface for this codebase.

Validation Signal

1. Deterministic CI: Same as above — in_progress:in_progress.
2. Static impact reasoning: No ABI-sensitive packages affected. huggingface-hub 1.14.0 is backward-compatible with the v1 API used by the dataviewer annotation and export flows.

---

ultralytics

8.4.46 → 8.4.47 — patch release. Source: GitHub compare v8.4.46...v8.4.47

Commit highlights:

• Fix CLI parsing for solution colormap values
• Return None in imread on read failure (matches cv2.imread contract)
• Resolve platform URIs for checkpoint loading
• Fix latent bugs across loaders, hub session, and solutions

The imread null-return alignment with cv2.imread may affect callers that previously relied on an exception rather than a None return on failure; review any imread call-sites in the dataviewer VLM judge code if they do not already guard against None.

Advisory note: security(deps): prefix indicates Dependabot linked an advisory to this group, most likely associated with ultralytics. The PR body does not include an explicit GHSA or CVE ID, and external enrichment APIs were inaccessible. Verify the linked Dependabot security alert before merging.

Validation Signal

1. Deterministic CI: in_progress:in_progress — Dataviewer Backend Pytest and Python Lint have not yet completed.
2. Static impact reasoning: ultralytics is not in the Isaac Sim ABI guard list (numpy, torch, onnxruntime-gpu). Patch bump within 8.4.x; no major-version ABI concerns.

---

Transitive-only pin note

data-management/viewer/uv.lock is updated alongside pyproject.toml. This is expected lockfile churn from the three direct dependency bumps — not a standalone transitive-only pin.

Advisory verdict: COMMENT — CI is still in progress (in_progress:in_progress); advisory enrichment was blocked by the firewall sandbox. Once Dataviewer Backend Pytest and Python Lint are green, and the linked Dependabot security advisory is manually verified, this PR is suitable for merge.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #632 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #632 · ● 1.2M

[katriendg]

@dependabot recreate

[github-actions]

Advisory Review Summary

Surfaces touched: python-runtime (dataviewer backend — data-management/viewer/)

Package	From	To	Severity	Surface
pydantic	2.13.3	2.13.4	None	python-runtime (dataviewer)
huggingface-hub	1.13.0	1.14.0	None	python-runtime (dataviewer)
ultralytics	8.4.46	8.4.47	None	python-runtime (dataviewer)

Both data-management/viewer/pyproject.toml (manifest) and uv.lock (lockfile) are updated.

---

pydantic

Advisory: No CVE or GHSA identifiers found. Source: GitHub Advisory Database

Release notes (v2.13.4, 2026-05-06):

• Packaging: bump libc 0.2.155 → 0.2.185; adapt pydantic-core linker flags on macOS.
• Fix: Preserve RootModel core metadata (#13129).
• Full changelog: pydantic/pydantic@v2.13.3...v2.13.4

Repo-specific risk: Patch bump; no breaking changes. No ABI concerns.

Validation Signal

• Deterministic CI: PR Validation: in_progress:in_progress — ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
  • Relevant check runs: Dataviewer Backend Pytest, Pytest Data Management Tools, Python Lint — conclusions pending.
• Static impact reasoning: Patch release; no breaking changes; no ABI-sensitive packages in this diff.

---

huggingface-hub

Advisory: No CVE or GHSA identifiers found. Source: GitHub Advisory Database

Release notes (v1.14.0):

• New: hf spaces secrets and hf spaces variables CLI subgroups.
• New: Rsync-style trailing-slash semantics for hf buckets cp.
• 💔 CLI-only breaking change: hf skills upgrade renamed to hf skills update (#4176).
• Full release notes: https://github.com/huggingface/huggingface_hub/releases/tag/v1.14.0

Repo-specific risk: The breaking rename affects the hf CLI tool only and is not used in this codebase. The dataviewer consumes huggingface-hub as a Python library; the Python API is unchanged and backward-compatible.

Validation Signal

• Deterministic CI: PR Validation: in_progress:in_progress — ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
  • Relevant check runs: Dataviewer Backend Pytest, Python Lint — conclusions pending.
• Static impact reasoning: Minor release; Python API is backward-compatible. CLI-only breaking change does not affect library consumers.

---

ultralytics

Advisory: No CVE or GHSA identifiers found. Source: GitHub Advisory Database

Release notes (v8.4.47):

• Fix CLI parsing for solution colormap values (#24219).
• Fix: imread returns None on read failure to match cv2.imread behaviour (#24406).
• Add top-k post-processing to RT-DETR decoder head (#24403).
• Full changelog: ultralytics/ultralytics@v8.4.46...v8.4.47

Repo-specific risk: Patch bump; no breaking changes. Used for YOLO-based detection in the dataviewer evaluation pipeline. No ABI concerns.

Validation Signal

• Deterministic CI: PR Validation: in_progress:in_progress — ⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.
  • Relevant check runs: Dataviewer Backend Pytest, Python Lint — conclusions pending.
• Static impact reasoning: Patch release with bug fixes only; no API changes.

---

Advisory verdict: COMMENT — CI validation is still in progress; no security advisories or ABI concerns identified across all three bumps. All are patch/minor releases targeting the dataviewer backend only. Safe to merge once Dataviewer Backend Pytest and Python Lint checks pass.

Note

🔒 Integrity filter blocked 1 item

The following item was blocked because it doesn't meet the GitHub integrity level.

• #632 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by AW Dependabot PR Review for issue #632 · ● 639.3K