Skip to content

fix(deps): update python: non-major updates - #332

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major
Open

fix(deps): update python: non-major updates#332
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major

Conversation

@renovate

@renovate renovate Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF Age Confidence
fastapi (changelog) project.dependencies minor ==0.138.0 → ==0.141.1 OpenSSF Scorecard age confidence
gliner project.dependencies patch ==0.2.27 → ==0.2.28 OpenSSF Scorecard age confidence
gradio project.dependencies minor ==6.19.0 → ==6.22.0 OpenSSF Scorecard age confidence
huggingface-hub project.dependencies minor ==1.20.1 → ==1.26.0 OpenSSF Scorecard age confidence
onnxruntime project.dependencies minor ==1.27.0 → ==1.28.0 age confidence
pre-commit dependency-groups patch ==4.6.0 → ==4.6.1 OpenSSF Scorecard age confidence
prometheus-client project.dependencies minor ==0.25.0 → ==0.26.0 OpenSSF Scorecard age confidence
ruff (source, changelog) dependency-groups minor ==0.15.19 → ==0.16.1 OpenSSF Scorecard age confidence
ty (changelog) dependency-groups patch ==0.0.53 → ==0.0.65 OpenSSF Scorecard age confidence
uvicorn (changelog) project.dependencies minor ==0.49.0 → ==0.52.0 OpenSSF Scorecard age confidence

Release Notes

fastapi/fastapi (fastapi)

v0.141.1

Compare Source

Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #​16105 by @​tiangolo.
Docs

v0.141.0

Compare Source

Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #​16102 by @​tiangolo.

v0.140.13

Compare Source

Fixes
Docs

v0.140.12

Compare Source

Fixes

v0.140.11

Compare Source

v0.140.10

Compare Source

Fixes
Internal

v0.140.9

Compare Source

Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #​16043 by @​MBGrao.
Internal

v0.140.8

Compare Source

Fixes

v0.140.7

Compare Source

Refactors
Internal

v0.140.6

Compare Source

Refactors
  • ⚡️ Avoid flattening dependencies for request parameters, mainly for OpenAPI. PR #​16073 by @​tiangolo.

v0.140.5

Compare Source

Refactors

v0.140.4

Compare Source

v0.140.3

Compare Source

Refactors

v0.140.2

Compare Source

Refactors
Internal

v0.140.1

Compare Source

Refactors
  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #​16062 by @​tiangolo.

v0.140.0

Compare Source

Refactors
Docs
Internal

v0.139.2

Compare Source

Fixes
  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #​16013 by @​tiangolo.

v0.139.1

Compare Source

Fixes
Docs
  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #​15995 by @​YuriiMotov.
Translations
Internal

v0.139.0

Compare Source

Features
  • ✨ Support dependencies in app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #​15908 by @​tiangolo.
Translations
Internal

v0.138.2

Compare Source

Refactors
  • ♻️ Make app.frontend() return 404 for methods other than GET or HEAD with no static file matches. PR #​15863 by @​tiangolo.
Internal

v0.138.1

Compare Source

Refactors
Internal
urchade/GLiNER (gliner)

v0.2.28

Compare Source

gradio-app/gradio (gradio)

v6.22.0

Compare Source

Features
  • #​13685 6302098 - gr.Workflow: auto-create input/output nodes for model nodes (as already happens for Space nodes), replace the "Input"/"Output" buttons with a single "Component" button whose direction is derived from wiring, rename "Data" to "Dataset", let node error messages be copied, and document the oauth_token parameter in the View API panel. Thanks @​abidlabs!
  • #​13688 321361f - Workflow: resizable nodes, full-screen image view, and webcam/mic capture. Thanks @​abidlabs!
  • #​13697 3ac9d5d - Fix release CI regressions for assets and bundles. Thanks @​abidlabs!
Fixes

v6.21.0

Compare Source

Features
Fixes

v6.20.0

Compare Source

Features
Fixes
huggingface/huggingface_hub (huggingface-hub)

v1.26.0: [v1.26.0] Resolve revisions only once, security hardening, and resource groups for Jobs & Collections

Compare Source

📌 Pin a revision once with resolve_revision

Libraries that download many files one by one (config, weights, tokenizer, processor, ...) had to resolve revision="main" into a commit hash on every call — costing one HTTP request per file and risking two calls landing on two different commits if the repo is updated in between. The new HfApi.resolve_revision resolves the revision once and returns a ResolvedRevision: a str subclass whose value stays the user-facing revision (so error messages keep saying "main") while its .resolved attribute holds the commit hash. Download helpers (hf_hub_download, snapshot_download, get_cached_repo_tree) detect it and use the commit hash directly, guaranteeing every file comes from the same commit. The mapping is also written to the refs/ folder of the cache, so later runs in offline mode transparently fall back to the cached value.

>>> from huggingface_hub import resolve_revision, hf_hub_download
>>> revision = resolve_revision("openai-community/gpt2")
>>> revision
ResolvedRevision(initial=None, resolved='607a30d783dfa663caf39e06633721c8d4cfcd7e')
>>> revision == "main"  # readable error messages
True
>>> config = hf_hub_download("openai-community/gpt2", "config.json", revision=revision)
>>> weights = hf_hub_download("openai-community/gpt2", "model.safetensors", revision=revision)

📚 Documentation: Manage the cache — Pin a revision (advanced)

🔒 Security hardening for downloads and sandboxes

This release ships two security fixes. First, downloading or uploading to a --local-dir now rejects absolute, drive-relative, root-relative, UNC and ..-traversal filenames on all platforms, interpreting each name under both POSIX and Windows rules (refs CVE-2026-15717). Previously only a Windows-only ..\ check existed, so a malicious repo could write files outside the target directory on Windows clients — and even leak a NetNTLMv2 hash via UNC paths. Legitimate repo filenames never contain such segments, so real downloads are unaffected; note that exotic names like folder/..\..\..\file, previously tolerated on Linux, are now rejected everywhere. Second, Sandbox.create no longer injects your HF token into the job environment to download the sbx-server binary: the bucket is public, so the bootstrap now downloads it anonymously and no HF credential ever lands in the sandbox unless you explicitly opt in with forward_hf_token=True.

🗂️ Resource groups for Jobs and Collections

Organization resource groups are now supported across the client. For collections, create_collection accepts an optional resource_group_id, and the new update_collection_resource_group method wraps the dedicated Hub endpoint to assign a collection to a resource group afterwards (passing None removes it). For Jobs, run_job, run_uv_job and create_scheduled_job accept a resource_group_id parameter, mirrored by a --resource-group-id option on the hf jobs run, hf jobs uv run and hf jobs scheduled run commands. Beyond access control within an organization, resource groups are also used for cost attribution and per-group spending limits.

hf jobs run --resource-group-id <group-id> python:3.12 python train.py

📚 Documentation: Collections reference, CLI reference

  • Support resource groups for collections by @​moon-bot-app[bot] in [#​4575]

✂ Note

PR body was truncated to here.

@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Jul 12, 2026
@renovate
renovate Bot requested a review from freinold July 12, 2026 23:48
@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Jul 12, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 9 times, most recently from b25108e to fba0f64 Compare July 22, 2026 18:41
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 15 times, most recently from 76a17a0 to 6380f52 Compare July 29, 2026 21:10
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from 6380f52 to 356de3b Compare July 30, 2026 20:46
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from 356de3b to 588ee03 Compare July 31, 2026 05:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freinold freinold Awaiting requested review from freinold

Assignees

No one assigned

Labels

lifecycle Update or deprecate something renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants