Skip to content

fix(deps): update python: non-major updates - #339

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major
Open

fix(deps): update python: non-major updates#339
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/python-non-major

Conversation

@renovate

@renovate renovate Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
gitpython project.dependencies patch ==3.1.58 → ==3.1.61 OpenSSF Scorecard
gradio project.dependencies minor ==6.25.0 → ==6.26.0 OpenSSF Scorecard
huggingface-hub project.dependencies minor ==1.28.0 → ==1.29.0 OpenSSF Scorecard
ruff (source, changelog) dependency-groups patch ==0.16.4 → ==0.16.5 OpenSSF Scorecard
ty (changelog) dependency-groups patch ==0.0.74 → ==0.0.75 OpenSSF Scorecard

Release Notes

gitpython-developers/GitPython (gitpython)

v3.1.61

Compare Source

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed
New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

v3.1.60

Compare Source

v3.1.59: - Security

Compare Source

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

gradio-app/gradio (gradio)

v6.26.0

Compare Source

Features
Fixes
huggingface/huggingface_hub (huggingface-hub)

v1.29.0: [v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

Compare Source

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings

# Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)

# Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)
# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True

# Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

🤖 Inference

🖥️ CLI

🔧 Other QoL Improvements

  • [MCP] Set upper bound mcp<2.0 for optional extra dependency huggingface_hub[mcp] by @​Wauplin in #​4735
  • Remove leftover deprecated labels/tags from docstrings and signature by @​Wauplin in #​4745

🐛 Bug and typo fixes

📖 Documentation

  • Docs: mark Sandboxes as experimental and drop the "HF token never enters the sandbox" claim by @​moon-bot-app[bot] in #​4734

🏗️ Internal

astral-sh/ruff (ruff)

v0.16.5

Compare Source

Released on 2026-08-27.

Preview features
  • Allow rules without codes (#​28049)
  • Introduce category selectors (#​27666)
  • Update preview default rules and categories (#​27877)
Bug fixes
  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#​28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#​28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#​28000)
Server
  • Fix duplicated "of" in ClientOptions doc comment (#​27978)
Documentation
  • Document rule acceptance guidelines (#​27910)
  • Document the new category selectors (#​27906)
Contributors
astral-sh/ty (ty)

v0.0.75

Compare Source

Released on 2026-08-26.

Preview features
  • Initialize PEP 723 script environments in the CLI (#​27544)
  • Refresh PEP 723 script environments in watch mode (#​27617)
  • Run PEP 723 script synchronization on bounded workers (#​27615)
Bug fixes
  • Specialize Self bounds of inherited methods (#​27990)
LSP server
  • Add "Go to Definition" support for pytest fixtures (#​27444)
Documentation
  • Fix documented Python package build command (#​4384)
  • Link untyped-call tracking issue in migration guide (#​4382)
Library support
  • Resolve imported pytest fixture exposures (#​27539)
  • Resolve installed core pytest fixture providers (#​27770)
  • Resolve pytest fixtures through conftest (#​27540)
Diagnostics
  • Add more autofixes (#​28029)
  • Add a dedicated missing-slot diagnostic (#​28039)
  • Explain missing storage for declared slotted attributes (#​27969)
  • Improve diagnostic spans for unpacked variable assignments (#​28041)
Core type checking
  • Account for known subclasses in equality inference (#​28005)
  • Expand ParamSpec signatures inferred from bound receivers (#​28020)
  • Fix Self binding in ParamSpec protocols (#​28016)
  • Fix TypedDict variance inference (#​28052)
  • Fix unsound narrowing through branch-assigned conditions (#​28006)
  • Ignore inconsistent binding decorators on overloads (#​28036)
  • Infer yield from send/return types from the iterator returned by __iter__ (#​27987)
  • Infer tuple type parameters from union arguments (#​28062)
  • Infer variance through nonrecursive protocol references (#​28065)
  • Preserve bounds of non-literal metaclasses (#​28046)
  • Preserve correlated generic-call inference (#​28043)
  • Preserve invariant materialization constraints (#​28047)
  • Recover bare TypeVarTuples in tuple annotations (#​27950)
  • Reject fixed tuples for non-inferable TypeVarTuples (#​27943)
  • Reject incompatible constructor context for variadic packs (#​27966)
  • Support mixed gradual tuple assignability with TypeVarTuple (#​27957)
  • Support tagged union with multiple tags per type (#​27984)
  • Sync vendored typeshed stubs (#​28035). Typeshed diff
  • Treat typing.Union as a class on Python 3.14+ (#​28003)
  • Validate generic protocol variance (#​27531)
  • collections.abc.Callable is an instance of type (#​27991)
Contributors

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Aug 23, 2026
@renovate
renovate Bot requested a review from freinold August 23, 2026 22:50
@renovate renovate Bot added lifecycle Update or deprecate something renovate labels Aug 23, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from 3124628 to 1ea7fff Compare August 25, 2026 17:10
@renovate renovate Bot changed the title fix(deps): update dependency gitpython to v3.1.59 fix(deps): update python: non-major updates Aug 25, 2026
@renovate
renovate Bot force-pushed the renovate/python-non-major branch 5 times, most recently from 8a6ef95 to e0296fe Compare August 27, 2026 20:38
@renovate
renovate Bot force-pushed the renovate/python-non-major branch from e0296fe to 708cef6 Compare August 28, 2026 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freinold freinold Awaiting requested review from freinold

Assignees

No one assigned

Labels

lifecycle Update or deprecate something renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants