Skip to content

chore(deps): update all non-major dependencies (minor) - #1892

Merged
shunkakinoki merged 1 commit into
mainfrom
renovate/all-minor-patch
Jun 13, 2026
Merged

chore(deps): update all non-major dependencies (minor)#1892
shunkakinoki merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@shunkakinoki

@shunkakinoki shunkakinoki commented Jun 5, 2026

Copy link
Copy Markdown
Owner

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
astral-sh/setup-uv action minor v8.1.0v8.2.0 age confidence
claude-swap dependency-groups minor >=0.10.2>=0.11.1 0.13.0 (+1) age confidence
huggingface-hub dependency-groups minor >=1.16.4>=1.18.0 1.19.0 age confidence
mistral-vibe dependency-groups minor >=2.11.1>=2.14.0 2.15.0 (+1) age confidence
transformers dependency-groups minor >=5.9.0>=5.10.2 5.12.0 (+1) age confidence
uvicorn (changelog) dependency-groups minor >=0.48.0>=0.49.0 age confidence
vllm dependency-groups minor >=0.21.0>=0.22.1 age confidence

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates
realiti4/claude-swap (claude-swap)

v0.11.1

Compare Source

What's Changed

Full Changelog: realiti4/claude-swap@v0.11.0...v0.11.1

v0.11.0

Compare Source

What's Changed

  • feat: display enterprise spend usage alongside 5h/7d rate limits by @​corysolovewicz in #​39
  • move to file based storage on Windows addressing Credentials Manager 2560-byte size limit by @​realiti4 in #​46

New Contributors

Full Changelog: realiti4/claude-swap@v0.10.2...v0.11.0

huggingface/huggingface_hub (huggingface-hub)

v1.18.0: [v1.18.0] Unified file copying, web URL support, and storage usage

Compare Source

🖥️ Unified hf cp command

A single hf cp command now handles all file-copy workflows (upload a local file, download from the Hub, or copy between two remote locations) with consistent hf:// URI syntax for both repositories and buckets. It is also available as hf repos cp and hf buckets cp; all three aliases are identical, so you can use whichever reads best for your workflow. You can stream from stdin (-) or to stdout (-), and a trailing / on the source path gives you rsync-style semantics (copy the folder contents, not the folder itself). Note that remote-to-remote copies only work within the same storage region, and bucket-to-repo is not yet supported.

# Upload a local file to a repo
hf cp ./model.safetensors hf://username/my-model/model.safetensors

# Download a file to stdout
hf cp hf://username/my-model/config.json - | jq .

# Copy between two Hub repos
hf cp hf://username/source-model/config.json hf://username/dest-model/config.json

📚 Documentation: CLI guide — Copy files

  • [CLI] Add unified hf cp command (aliased as hf repos cp and hf buckets cp) by @​Wauplin in #​4295

🥚 Easter egg:explore your storage usage

image

🔗 Paste web URLs directly

parse_hf_uri now accepts Hugging Face web URLs so you can paste a link straight into the CLI or the library and it "just works".

# Copy-paste a URL from the website
hf cp https://huggingface.co/nvidia/LocateAnything-3B/blob/main/config.json - | jq '.architectures'

📚 Documentation: HF URIs — Web URLs

🚨 Breaking change

On Lustre, GPFS, and some NFS mounts, flock(2) silently succeeds for every caller, which means filelock provides no mutual exclusion. When multiple hf_hub_download calls race for the same file, they can append to the same .incomplete file and silently corrupt the blob cache. This release fixes that by always downloading to a fresh temporary file instead of resuming an incomplete one, making the download path safe even when file locking is broken. filelock is still used as a "best-effort" hint to avoid unnecessary duplicate downloads, but correctness no longer depends on it. This is a breaking change: resuming a previously failed partial download is no longer possible. However, file resumability was already a niche use case only applicable when hf_xet is disabled.

  • [Fix] Make concurrent downloads safe even when file locking is broken by @​Wauplin in #​4306

🖥️ CLI

🐛 Bug and typo fixes

📖 Documentation

🏗️ Internal

v1.17.0: [v1.17.0] Cross-repo copies, ssh to Spaces, smarter CLI tables

Compare Source

📋 Copy files between repositories

You can now copy files or entire folders between different repositories on the Hub — model to model, model to dataset, any combination — without downloading or re-uploading data. CommitOperationCopy accepts src_repo_id and src_repo_type for cross-repo sources, and LFS blobs are deduplicated server-side via the /lfs-files/duplicate endpoint. Non-LFS files are fetched from the source repo and committed as regular payloads. copy_files and hf buckets cp now support repo-to-repo in addition to the existing bucket destinations.

>>> from huggingface_hub import copy_files

# Copy an entire folder
>>> copy_files(
...     "hf://datasets/username/source-dataset/data/",
...     "hf://datasets/username/target-dataset/data/",
... )

📚 Documentation: Upload guide — Copy files between repositories

🖥️ SSH into a Space with hf spaces ssh

A new hf spaces ssh command opens an SSH session directly into a Space's Dev Mode container. If Dev Mode is not enabled yet, the CLI prompts you to enable it. You can also use --dry-run to print the SSH command without running it, or -i to forward a specific key. Your SSH public key must be registered in your HF user settings.

# SSH into a Space
$ hf spaces ssh username/my-space

# Print the SSH command without running it
$ hf spaces ssh username/my-space --dry-run

📚 Documentation: CLI guide — SSH into a Space | Spaces guide — SSH into a Space

📂 List all your repos with hf repos ls

A new hf repos ls command lists all your repositories — models, datasets, spaces, and buckets — with storage size and percentage of namespace total, sorted by storage usage. It supports --type, --search, --namespace, and --limit (default 30, --limit 0 for all), plus the standard --format family.

# List all your repos
$ hf repos ls

# List all datasets under org with JSON output
$ hf repos ls --namespace my-org --type dataset --limit 0 --format json | jq '.[].id'

📚 Documentation: CLI guide — List repos | Repository guide — List your repositories

📊 CLI tables auto-fit terminal width and right-align numbers

Human-mode CLI tables now use a column-aware algorithm that computes per-column width caps from the actual terminal width, shrinking only the widest columns when needed. Non-TTY output keeps the legacy fixed cap, and --no-truncate bypasses truncation entirely. Numeric columns (all int/float values) are automatically right-aligned.

# Tables adapt to your terminal width
$ hf models ls --search qwen3

# Force full values regardless of width
$ hf models ls --no-truncate

📚 Documentation: CLI guide — Output formatting

🔧 Jobs hardware decoupled from Spaces, auto-synced with Hub API

Jobs now have their own JobHardware enum, independent of SpaceHardware, so the two catalogs can diverge as needed. The old JobHardware dataclass (return type of list_jobs_hardware()) has been renamed to JobHardwareInfo. CLI --flavor / --hardware flags use a new SoftChoice type that shows known values for autocomplete but accepts any string — older CLI versions won't reject new server-side flavors. A daily CI workflow (update-hardware-flavors.yaml) runs utils/check_hardware_flavors.py to sync both enums from the live Hub API and opens a bot PR when something changes.

# Unknown flavors pass through instead of raising a validation error
$ hf jobs run --flavor future-gpu-x99 python:3.12 echo "works with unknown flavors"
  • [Jobs] Decouple Job hardware from Spaces, auto-sync enums with Hub API by @​Wauplin in #​4266

📚 Documentation: Jobs guide

💔 Breaking Change

Note: The second item changes hf jobs ps and hf jobs scheduled ps to use --format auto|human|agent|json|quiet (removing --format table and -q). JSON output for hf jobs ps now flattens command to a string and status to a stage string.

🖥️ CLI

📊 Jobs

📚 Documentation: Jobs guide — Update labels | Jobs guide — Hardware

🔧 Other QoL Improvements

📖 Documentation

🐛 Bug and typo fixes

🏗️ Internal

mistralai/mistral-vibe (mistral-vibe)

v2.14.0

Compare Source

Added
  • Image attachments via @-mentions in the TUI for vision-capable models
  • Session deletion, exposed over ACP as the session/delete extension method
  • Browser sign-in now shows a copyable fallback URL when the browser does not open, so SSH and remote sessions can complete onboarding
  • Toast notification when a SKILL.md file fails to parse instead of silently dropping the skill
  • Trust prompt now proposes the git repository ancestor as a trust target
  • EnvironmentLayer in the layered configuration, populated from VIBE_-prefixed environment variables
Changed
  • New tool-call format for read and the file edit tool
  • write_file is now create-only and refuses to overwrite existing files
  • Bumped agent-client-protocol to 0.10.1
Fixed
  • LLM calls now retry on network errors and timeouts (connection, read, write, remote protocol, timeout)
  • Approval modal now sizes itself so the bottom of long tool-call payloads stays visible above the options block
  • Banner connector count and /mcp panel ordering now reflect which connectors are actually usable and the user's enable/disable choices
  • disabled_tools from runtime is merged with the TOML configuration instead of replacing it, and is enforced inside ToolManager.get()
  • shift+backspace and shift+delete now work in the chat input
  • Crash in the ACP todo plan-update handler when the model's tool call failed validation
Removed
  • Recursive search for nested harness files

v2.13.0

Compare Source

Added
  • enable_system_trust_store config flag to switch the shared SSL context to the OS trust store for corporate TLS / private CA setups
Changed
  • MCP HTTP transport now uses Vibe's shared SSL context so it honors SSL_CERT_FILE / SSL_CERT_DIR and the system trust store opt-in
  • API key onboarding and plan-upgrade CTAs now link to the new Mistral Vibe Code extensions page
  • Compaction summaries are now injected into the conversation instead of replacing it
Fixed
  • Crash during initialization
  • VS Code extension promo banner now sits at the top of the conversation instead of being pinned above the input

v2.12.1

Compare Source

Fixed
  • VS Code extension promo link in the CLI banner now points to the renamed mistralai.mistral-vibe-code extension
huggingface/transformers (transformers)

v5.10.2: Patch release v5.10.2

Compare Source

Patch release v5.10.2

There was a big bug in the model conversion of models related to clip, this affected models like sam3 and others. Please make sure to update 🙏

Full Changelog: huggingface/transformers@v5.10.1...v5.10.2

v5.10.1

Compare Source

Release v5.10.1

v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!

New Model additions

Gemma4 unified+ Gemma4 MTP
image

Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.

Key differences from standard Gemma 4:

  • No Vision Tower: Raw pixel patches are projected directly into LM space via a Dense + LayerNorm pipeline with factorized 2D positional embeddings, replacing the vision encoder.
  • No Audio Tower: Raw 16 kHz waveform samples are chunked into fixed-length frames and projected through a simple RMSNorm → Linear pipeline, replacing the mel spectrogram + Conformer encoder.
  • Shared Multimodal Pipeline: Both vision and audio use the same Gemma4UnifiedMultimodalEmbedder (RMSNorm → Linear) for the final projection to text hidden space.

You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.

Sapiens2

Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.

Links: Documentation | Paper

DeepSeek-OCR-2

DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.

Links: Documentation

Mellum

Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.

Links: Documentation

Breaking changes

The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.

Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.

Parallelization

This release includes numerous bug fixes for model parallelism across multiple models (Gemma4, AltCLIP, ChineseClip, Blip-2, Whisper, Ovis2, Moshi) and parallel execution strategies, including fixes for tensor parallelism (TP), expert parallelism (EP), beam search under model parallel settings, and loss over-counting under TP/EP configurations. The continuous batching manager was also reworked for clearer control flow and improved TP race condition handling, and FSDP initialization via from_pretrained was introduced.

Cache

Fixed a regression in encoder-decoder cache initialization where the decoder config was incorrectly applied to the cross-attention cache, and resolved a RuntimeError caused by buffer size limits when warming up the cache on MPS devices. Additional test infrastructure improvements were made to support read-only cache environments used in CI.

Quantization

Added support for DeepGEMM BF16, mixed FP8/FP4, and MegaMoE quantization via a grouped linear refactor, while fixing two bugs: an FP8 MoE reverse substring issue affecting DSv4 initialization, and a BitsAndBytes 4-bit/8-bit quantization bug that silently dropped chunked tensors from one-to-many weight converters.

Bugfixes and improvements

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@shunkakinoki
shunkakinoki enabled auto-merge (squash) June 5, 2026 04:28
@indent-zero

indent-zero Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor
PR Summary

Renovate rebased again and nudged three tools floors to newer patch/minor releases (claude-swap to 0.11.1, huggingface-hub[mcp] to 1.18.0, vllm to 0.22.1); other entries unchanged from the prior push. None of the bumped packages are imported by any Python code in this repo, so the effect is limited to uv tool install, the external Hermes-agent venv, and the Python CI workflow runner.

  • pyproject.toml tools group: claude-swap to >=0.11.1, huggingface-hub[mcp] to >=1.18.0, mistral-vibe to >=2.14.0, transformers to >=5.10.2, vllm to >=0.22.1.
  • pyproject.toml hermes group: uvicorn to >=0.49.0 (installed into the NousResearch/hermes-agent venv by home-manager/services/hermes/activate.sh).
  • .github/workflows/python.yml: astral-sh/setup-uv action to v8.2.0 for both the python-test and python-lint jobs.

Issues

No issues found.

CI Checks

All GitHub Actions code gates pass on 396dde9. The only non-success surface is the Mesa Description check (status: neutral), which is a description-generation bot \u2014 not a code gate.

@coderabbitai

coderabbitai Bot commented Jun 5, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

This PR updates the UV package manager's GitHub Action from v8.1.0 to v8.2.0 in CI workflows and bumps multiple project dependencies in pyproject.toml, including huggingface-hub, mistral-vibe, transformers, vllm, and uvicorn, across tools and runtime dependency groups.

Changes

Dependency and Tool Updates

Layer / File(s) Summary
GitHub Actions workflow setup-uv version bump
.github/workflows/python.yml
The astral-sh/setup-uv action is updated from v8.1.0 to v8.2.0 in both the python-test and python-lint jobs.
Project tool and runtime dependency version updates
pyproject.toml
Tool dependencies in dependency-groups.tools are bumped: huggingface-hub[mcp] (>=1.16.4 → >=1.17.0), mistral-vibe (>=2.11.1 → >=2.13.0), transformers (>=5.9.0 → >=5.10.1), and vllm (>=0.21.0 → >=0.22.0). Runtime dependency uvicorn in dependency-groups.hermes is updated (>=0.48.0 → >=0.49.0).

Estimated Code Review Effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly Related PRs

Poem

🐰 A hop, a skip, dependencies delight,
Version bumps bring tools to the right,
UV's updated in workflow flow,
Huggingface and vllm aglow,
Stronger builds in the growing light.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The PR title accurately describes the main change: updating multiple non-major dependencies to minor versions, which aligns with the changeset containing dependency bumps.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description check ✅ Passed The PR description clearly relates to the changeset, providing a Renovate-generated summary of dependency updates with detailed package version changes.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the version dependency of huggingface-hub[mcp] from >=1.16.4 to >=1.17.0 in pyproject.toml. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

@mesa-dot-dev mesa-dot-dev Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Performed full review of bd7cc99...702164f

Analysis

• Open-ended version constraint (>=1.17.0) creates unbounded risk by allowing automatic installation of future major/minor versions with unknown breaking changes; adopt a bounded range (e.g., >=1.17.0,<2.0) to maintain reproducibility and prevent surprise breakage.

• Breaking changes in huggingface-hub 1.17.0 (Together ASR removal and hf jobs CLI format changes) pose direct runtime risks if the codebase uses either feature—Together ASR will fail at runtime and parsed CLI output in scripts/CI will break; requires explicit verification of usage patterns before merging.

• Direct integration via [mcp] extra indicates this is not a transitive dependency but an active architectural component; MCP-related functionality compatibility across the version jump must be verified through targeted integration testing, not just baseline CI.

• Missing evidence of breaking change impact assessment—no verification that Together ASR isn't used elsewhere, no audit of operational scripts invoking hf jobs commands, and no validation that MCP APIs remain compatible; these gaps should be closed before automerge proceeds.

Tip

Help

Slash Commands:

  • /review - Request a full code review
  • /review latest - Review only changes since the last review
  • /describe - Generate PR description. This will update the PR body or issue comment depending on your configuration
  • /help - Get help with Mesa commands and configuration options

0 files reviewed | 0 comments | Edit Agent SettingsRead Docs

@mesa-dot-dev

mesa-dot-dev Bot commented Jun 5, 2026

Copy link
Copy Markdown

Mesa Description

TL;DR

Updated non-major dependencies (huggingface-hub, mistral-vibe, and vllm) to their latest minor versions in pyproject.toml.

What changed?

  • pyproject.toml:
    • Bumped huggingface-hub[mcp] from >=1.16.4 to >=1.17.0
    • Bumped mistral-vibe from >=2.11.0 to >=2.13.0
    • Bumped vllm from >=0.21.0 to >=0.22.0

Description generated by Mesa. Update settings

@shunkakinoki
shunkakinoki force-pushed the renovate/all-minor-patch branch from 702164f to 197ea1c Compare June 6, 2026 04:22
@shunkakinoki shunkakinoki changed the title chore(deps): update all non-major dependencies to >=1.17.0 chore(deps): update all non-major dependencies (minor) Jun 6, 2026
@shunkakinoki
shunkakinoki disabled auto-merge June 7, 2026 16:51
@shunkakinoki
shunkakinoki enabled auto-merge (squash) June 8, 2026 04:29
@shunkakinoki
shunkakinoki force-pushed the renovate/all-minor-patch branch 5 times, most recently from 900bb68 to cc7405c Compare June 12, 2026 04:29
@shunkakinoki
shunkakinoki force-pushed the renovate/all-minor-patch branch from cc7405c to 396dde9 Compare June 13, 2026 04:29
@shunkakinoki
shunkakinoki merged commit 1530f9a into main Jun 13, 2026
39 checks passed
@shunkakinoki
shunkakinoki deleted the renovate/all-minor-patch branch June 13, 2026 05:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants