chore(deps): update all non-major dependencies (minor) - #1892
Conversation
|
📝 WalkthroughWalkthroughThis PR updates the UV package manager's GitHub Action from v8.1.0 to v8.2.0 in CI workflows and bumps multiple project dependencies in pyproject.toml, including huggingface-hub, mistral-vibe, transformers, vllm, and uvicorn, across tools and runtime dependency groups. ChangesDependency and Tool Updates
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Code Review
This pull request updates the version dependency of huggingface-hub[mcp] from >=1.16.4 to >=1.17.0 in pyproject.toml. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Performed full review of bd7cc99...702164f
Analysis
• Open-ended version constraint (>=1.17.0) creates unbounded risk by allowing automatic installation of future major/minor versions with unknown breaking changes; adopt a bounded range (e.g., >=1.17.0,<2.0) to maintain reproducibility and prevent surprise breakage.
• Breaking changes in huggingface-hub 1.17.0 (Together ASR removal and hf jobs CLI format changes) pose direct runtime risks if the codebase uses either feature—Together ASR will fail at runtime and parsed CLI output in scripts/CI will break; requires explicit verification of usage patterns before merging.
• Direct integration via [mcp] extra indicates this is not a transitive dependency but an active architectural component; MCP-related functionality compatibility across the version jump must be verified through targeted integration testing, not just baseline CI.
• Missing evidence of breaking change impact assessment—no verification that Together ASR isn't used elsewhere, no audit of operational scripts invoking hf jobs commands, and no validation that MCP APIs remain compatible; these gaps should be closed before automerge proceeds.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 0 comments | Edit Agent Settings • Read Docs
Mesa DescriptionTL;DRUpdated non-major dependencies ( What changed?
Description generated by Mesa. Update settings |
702164f to
197ea1c
Compare
900bb68 to
cc7405c
Compare
Signed-off-by:
cc7405c to
396dde9
Compare
This PR contains the following updates:
v8.1.0→v8.2.0>=0.10.2→>=0.11.10.13.0(+1)>=1.16.4→>=1.18.01.19.0>=2.11.1→>=2.14.02.15.0(+1)>=5.9.0→>=5.10.25.12.0(+1)>=0.48.0→>=0.49.0>=0.21.0→>=0.22.1Release Notes
astral-sh/setup-uv (astral-sh/setup-uv)
v8.2.0: 🌈 New inputsquietanddownload-from-astral-mirrorCompare Source
Changes
This release brings two new inputs and a few bug fixes.
New inputs
Lets talk about the new inputs first.
quiet
Pretty simple. It turns of all
infologgings. Useful if you use this in a composite action and are not interested in all the details.In the upcoming releases we will add log groups to fully implement support for "less noise"
download-from-astral-mirror
In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting
download-from-astral-mirror: falseallows you to do that.Bugfixes
When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.
We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.
🐛 Bug fixes
🚀 Enhancements
download-from-astral-mirrorinput @eifinger (#897)🧰 Maintenance
⬆️ Dependency updates
realiti4/claude-swap (claude-swap)
v0.11.1Compare Source
What's Changed
Full Changelog: realiti4/claude-swap@v0.11.0...v0.11.1
v0.11.0Compare Source
What's Changed
New Contributors
Full Changelog: realiti4/claude-swap@v0.10.2...v0.11.0
huggingface/huggingface_hub (huggingface-hub)
v1.18.0: [v1.18.0] Unified file copying, web URL support, and storage usageCompare Source
🖥️ Unified
hf cpcommandA single
hf cpcommand now handles all file-copy workflows (upload a local file, download from the Hub, or copy between two remote locations) with consistenthf://URI syntax for both repositories and buckets. It is also available ashf repos cpandhf buckets cp; all three aliases are identical, so you can use whichever reads best for your workflow. You can stream from stdin (-) or to stdout (-), and a trailing/on the source path gives you rsync-style semantics (copy the folder contents, not the folder itself). Note that remote-to-remote copies only work within the same storage region, and bucket-to-repo is not yet supported.📚 Documentation: CLI guide — Copy files
hf cpcommand (aliased ashf repos cpandhf buckets cp) by @Wauplin in #4295🥚 Easter egg:explore your storage usage
hf repos lsby @Wauplin in #4287🔗 Paste web URLs directly
parse_hf_urinow accepts Hugging Face web URLs so you can paste a link straight into the CLI or the library and it "just works".📚 Documentation: HF URIs — Web URLs
parse_hf_uri+ addHfUri.to_urlby @Wauplin in #4296🚨 Breaking change
On Lustre, GPFS, and some NFS mounts,
flock(2)silently succeeds for every caller, which meansfilelockprovides no mutual exclusion. When multiplehf_hub_downloadcalls race for the same file, they can append to the same.incompletefile and silently corrupt the blob cache. This release fixes that by always downloading to a fresh temporary file instead of resuming an incomplete one, making the download path safe even when file locking is broken.filelockis still used as a "best-effort" hint to avoid unnecessary duplicate downloads, but correctness no longer depends on it. This is a breaking change: resuming a previously failed partial download is no longer possible. However, file resumability was already a niche use case only applicable whenhf_xetis disabled.🖥️ CLI
🐛 Bug and typo fixes
📖 Documentation
🏗️ Internal
v1.17.0: [v1.17.0] Cross-repo copies, ssh to Spaces, smarter CLI tablesCompare Source
📋 Copy files between repositories
You can now copy files or entire folders between different repositories on the Hub — model to model, model to dataset, any combination — without downloading or re-uploading data.
CommitOperationCopyacceptssrc_repo_idandsrc_repo_typefor cross-repo sources, and LFS blobs are deduplicated server-side via the/lfs-files/duplicateendpoint. Non-LFS files are fetched from the source repo and committed as regular payloads.copy_filesandhf buckets cpnow support repo-to-repo in addition to the existing bucket destinations.📚 Documentation: Upload guide — Copy files between repositories
🖥️ SSH into a Space with
hf spaces sshA new
hf spaces sshcommand opens an SSH session directly into a Space's Dev Mode container. If Dev Mode is not enabled yet, the CLI prompts you to enable it. You can also use--dry-runto print the SSH command without running it, or-ito forward a specific key. Your SSH public key must be registered in your HF user settings.hf spaces sshby @gary149 in #4241📚 Documentation: CLI guide — SSH into a Space | Spaces guide — SSH into a Space
📂 List all your repos with
hf repos lsA new
hf repos lscommand lists all your repositories — models, datasets, spaces, and buckets — with storage size and percentage of namespace total, sorted by storage usage. It supports--type,--search,--namespace, and--limit(default 30,--limit 0for all), plus the standard--formatfamily.hf repos lscommand by @Wauplin in #4283📚 Documentation: CLI guide — List repos | Repository guide — List your repositories
📊 CLI tables auto-fit terminal width and right-align numbers
Human-mode CLI tables now use a column-aware algorithm that computes per-column width caps from the actual terminal width, shrinking only the widest columns when needed. Non-TTY output keeps the legacy fixed cap, and
--no-truncatebypasses truncation entirely. Numeric columns (allint/floatvalues) are automatically right-aligned.📚 Documentation: CLI guide — Output formatting
🔧 Jobs hardware decoupled from Spaces, auto-synced with Hub API
Jobs now have their own
JobHardwareenum, independent ofSpaceHardware, so the two catalogs can diverge as needed. The oldJobHardwaredataclass (return type oflist_jobs_hardware()) has been renamed toJobHardwareInfo. CLI--flavor/--hardwareflags use a newSoftChoicetype that shows known values for autocomplete but accepts any string — older CLI versions won't reject new server-side flavors. A daily CI workflow (update-hardware-flavors.yaml) runsutils/check_hardware_flavors.pyto sync both enums from the live Hub API and opens a bot PR when something changes.📚 Documentation: Jobs guide
💔 Breaking Change
hf jobstooutsingleton by @hanouticelina in #4254🖥️ CLI
extensions,lfs-enable-largefiles,versiontooutsingleton by @hanouticelina in #4284📊 Jobs
📚 Documentation: Jobs guide — Update labels | Jobs guide — Hardware
🔧 Other QoL Improvements
clickas an explicit dependency (typer 0.26.0 fix) by @hanouticelina in #4270📖 Documentation
🐛 Bug and typo fixes
local_files_onlygrammar by @hunterhogan in #4255🏗️ Internal
_cli_utils.pyby @hanouticelina in #4285mistralai/mistral-vibe (mistral-vibe)
v2.14.0Compare Source
Added
@-mentions in the TUI for vision-capable modelssession/deleteextension methodSKILL.mdfile fails to parse instead of silently dropping the skillEnvironmentLayerin the layered configuration, populated fromVIBE_-prefixed environment variablesChanged
readand the fileedittoolwrite_fileis now create-only and refuses to overwrite existing filesagent-client-protocolto 0.10.1Fixed
/mcppanel ordering now reflect which connectors are actually usable and the user's enable/disable choicesdisabled_toolsfrom runtime is merged with the TOML configuration instead of replacing it, and is enforced insideToolManager.get()shift+backspaceandshift+deletenow work in the chat inputtodoplan-update handler when the model's tool call failed validationRemoved
v2.13.0Compare Source
Added
enable_system_trust_storeconfig flag to switch the shared SSL context to the OS trust store for corporate TLS / private CA setupsChanged
SSL_CERT_FILE/SSL_CERT_DIRand the system trust store opt-inFixed
v2.12.1Compare Source
Fixed
mistralai.mistral-vibe-codeextensionhuggingface/transformers (transformers)
v5.10.2: Patch release v5.10.2Compare Source
Patch release v5.10.2
There was a big bug in the model conversion of models related to clip, this affected models like sam3 and others. Please make sure to update 🙏
Full Changelog: huggingface/transformers@v5.10.1...v5.10.2
v5.10.1Compare Source
Release v5.10.1
v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!
New Model additions
Gemma4 unified+ Gemma4 MTP
Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.
Key differences from standard Gemma 4:
Dense + LayerNormpipeline with factorized 2D positional embeddings, replacing the vision encoder.RMSNorm → Linearpipeline, replacing the mel spectrogram + Conformer encoder.Gemma4UnifiedMultimodalEmbedder(RMSNorm → Linear) for the final projection to text hidden space.You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.
Sapiens2
Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.
Links: Documentation | Paper
DeepSeek-OCR-2
DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.
Links: Documentation
Mellum
Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.
Links: Documentation
Mellumv2 code generation model (#46112) by @shadeMe in #46112Breaking changes
The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.
Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.
Parallelization
This release includes numerous bug fixes for model parallelism across multiple models (Gemma4, AltCLIP, ChineseClip, Blip-2, Whisper, Ovis2, Moshi) and parallel execution strategies, including fixes for tensor parallelism (TP), expert parallelism (EP), beam search under model parallel settings, and loss over-counting under TP/EP configurations. The continuous batching manager was also reworked for clearer control flow and improved TP race condition handling, and FSDP initialization via
from_pretrainedwas introduced.Revert] FSDP+Dtensor refactor related changes (#46246) by @vasqu in [#46246]create_bidirectional_mask(#46221) by @kaixuanliu in [#46221]Cache
Fixed a regression in encoder-decoder cache initialization where the decoder config was incorrectly applied to the cross-attention cache, and resolved a
RuntimeErrorcaused by buffer size limits when warming up the cache on MPS devices. Additional test infrastructure improvements were made to support read-only cache environments used in CI.RuntimeErroron mps (#46239) by @McPatate in [#46239]Quantization
Added support for DeepGEMM BF16, mixed FP8/FP4, and MegaMoE quantization via a grouped linear refactor, while fixing two bugs: an FP8 MoE reverse substring issue affecting DSv4 initialization, and a BitsAndBytes 4-bit/8-bit quantization bug that silently dropped chunked tensors from one-to-many weight converters.
Bugfixes and improvements
contributing.md,modular_transformers.md,multimodal_processing.md,add_vision_processing_components.md,add_audio_processing_components.md,modeling_rules.md,model_output_tracing.md,auto_docstring.md,testing.md,pr_checks.mdandadd_new_model.md. (#46345) by @filipinescu in [#46345]weightconverter.md,models.md,custom_models.md,monkey_patching.md,fusion_mapping.md,how_to_hack_models.md,model_sharing.mdandserialization.md. (#46309) by @filipinescu in [#46309]Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.