Skip to content

chore(deps): update huggingface-hub requirement from <2.0.0,>=1.5.0 to >=1.5.0,<3.0.0 - #1007

Merged
cemililik merged 3 commits into
developmentfrom
dependabot/pip/huggingface-hub-gte-1.5.0-and-lt-3.0.0
Oct 18, 2026
Merged

cemililik merged 3 commits into
developmentfrom
dependabot/pip/huggingface-hub-gte-1.5.0-and-lt-3.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Updates the requirements on huggingface-hub to permit the latest version.

Release notes

Sourced from huggingface-hub's releases.

[v2.2.0] hf jobs stats snapshots, download and HfFileSystem fixes

A small release this week, mostly bug fixes and quality-of-life improvements. hf jobs stats now returns right away instead of streaming forever, concurrent downloads reliably use hf_xet, and HfFileSystem caching is more predictable. Two behavior changes are listed under Breaking changes.

📊 hf jobs stats prints a snapshot by default

hf jobs stats used to stream metrics until the job finished, so scripts and agents calling it on a running job hung until their own timeout. It now prints the latest sample of each job once and exits, like hf jobs logs and hf spaces logs. Use -f/--follow for the previous live view. Snapshot output also supports --format json|agent|quiet, which outputs the raw API metrics.

On the Python side, HfApi.fetch_job_metrics gets the same follow parameter as fetch_job_logs. It defaults to False and returns only the current sample. Pass follow=True to stream until the job completes.

>>> hf jobs stats 6ac3bd9afbc85ba6823a9ad4
JOB ID                CPU % NUM CPU MEM % MEM USAGE      NET I/O         GPU UTIL % GPU MEM % GPU MEM USAGE
--------------------- ----- ------- ----- -------------- --------------- ---------- --------- -------------
6ac3bd9afbc85ba682... 0%    2.0     0.01% 1.0MB / 16.0GB 0.0bps / 0.0bps N/A        N/A       N/A
Hint: Use `hf jobs stats -f celinah/6ac3bd9afbc85ba6823a9ad4` to follow live stats.
Stream live stats until the job completes
>>> hf jobs stats -f 6ac3bd9afbc85ba6823a9ad4

>>> from huggingface_hub import fetch_job_metrics
>>> for metrics in fetch_job_metrics(job_id=job.id, follow=True):
...     print(metrics)

Other Jobs fixes in this release: hf jobs logs and hf spaces logs without -f no longer hang while the job keeps printing, hf jobs stats no longer fails when one of the requested jobs has finished, and hf jobs stats --json prints [] when no job is running.

📚 Documentation: Jobs guide

⚡ Concurrent downloads always use hf_xet

In a fresh process, the first concurrent hf_hub_download calls could read a placeholder version for hf_xet while another thread was still looking it up. Those calls treated hf_xet as missing and downloaded through the plain HTTP path. This mostly affected parallel downloads such as snapshot_download, where some of the files skipped Xet. The version lookup is now cached only once it is resolved, so every download sees the real value.

  • Fix race in _get_version that makes concurrent downloads skip hf_xet by @​BramVanroy in #5102

📂 HfFileSystem cache fixes

Three fixes to how HfFileSystem caches listings and missing paths:

  • ls() on a newly created empty bucket returns an empty list instead of raising FileNotFoundError.
  • Directory listings are now replaced in the cache instead of appended to. Before, ls() after find() or ls(refresh=True) could return duplicate entries, refresh=True kept deleted files, and listing a single bucket file cached it as the whole folder's listing.
  • exists(path, refresh=True) and invalidate_cache(path) now clear cached "not found" results. Before, a repo, branch or bucket created in the same process stayed missing until a full invalidate_cache().
</tr></table> 

... (truncated)

Commits
  • acfdf30 Release: v2.2.0
  • 193d9d9 Release: v2.2.0.rc0
  • 5be3565 [Cache] Speed up delete_revisions with a set lookup (#5118)
  • dab6a96 [CLI] Don't glob-expand arguments on Windows (#5117)
  • cca4d3a [Download] Fix offline snapshot_download with a pinned revision (#5113)
  • c6cc03e Fix argument name in raise_text_generation_error docstring (#5108)
  • 8abbfe5 Fix race in _get_version that makes concurrent downloads skip hf_xet (#5102)
  • bb3a875 [Docs] Fix from_pretrained integration example (#5105)
  • cf992a9 [HfFileSystem] Make refresh=True clear cached not-found results (#5106)
  • af74167 [Tests] Wait for bucket listings after writes (#5095)
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from cemililik as a code owner October 18, 2026 09:42
@dependabot dependabot Bot added area: packaging-ci Code area: packaging-ci dependencies Dependency or ecosystem currency labels Oct 18, 2026
@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c7d5d436-3a6f-4b32-a066-426e47f308d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

cemililik added a commit that referenced this pull request Oct 18, 2026
…y 4-5 (#1014)

## Summary

Four Dependabot range bumps (#1003, #1008, #1010, #1011) combined into
one pull request so they cost one CI round instead of four (each merge
makes the others "behind" and the branch protection requires an
up-to-date branch). Dependabot closes its own pull requests when the
same change lands. The individual Dependabot commits are merged
unchanged.

## What each range change admits, and the evidence

| Dependency | Range | Where it is used | Evidence |
|---|---|---|---|
| `datasketch` | `<2` → `<3` | `ingestion-scale` extra (MinHash LSH) |
**CI installs 2.0.0** for the full suite (5868 passed, 22 skipped); the
data-audit modules also pass locally on 2.0.0 (283 passed) |
| `pytest-randomly` | `<4` → `<6` | `dev` extra | **CI installs 5.0.0**
for the full suite (5868 passed, 22 skipped) |
| `xxhash` | `<4` → `<5` | `ingestion` extra (simhash) | **Not exercised
by CI** (the extra is not installed there). Locally on 4.0.1 the
data-audit modules give the same result as on 3.8: 283 passed, 1 skipped
|
| `pypdf` | `<6` → `<7` | `ingestion` extra (PDF reading) | **Not
exercised by CI**: pypdf is not installed there, so the PDF tests skip
(224 passed, 19 skipped). Locally the same modules give 238 passed, 5
skipped on both 5.9.0 and 6.21.1 |

So for xxhash and pypdf the green CI proves nothing; the local runs
above are the evidence.

### Not included

**#1007 (`huggingface_hub` `<2` → `<3`)** is left open on purpose. CI
installs 1.33.0 either way, so the change is untested, and widening the
range lets pip install hub 2.x for users once their other dependencies
allow it. That is a claim ForgeLM has not checked, and the core stack
(`huggingface_hub`, transformers, torch, TRL, PEFT, accelerate,
datasets) is migrated deliberately, not by an automatic bump. I would
close it, and add a Dependabot `ignore` for semver-major bumps of that
stack; that is a separate change.

## Type

- [x] Dependency

## Testing

- CI (lint, validate, tests on Python 3.10–3.13) on this branch.
- Local runs against throwaway installs of datasketch 2.0.0, xxhash
4.0.1 and pypdf 5.9.0 / 6.21.1 as in the table.

## Checklist

- [x] CHANGELOG entry under `[Unreleased]`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Expand dependency compatibility ranges for ingestion extras and
development tooling while retaining the existing huggingface_hub
constraint.

Enhancements:
- Broaden supported version ranges for optional ingestion dependencies
and development tooling, admitting pypdf 6, xxhash 4, datasketch 2, and
pytest-randomly 4–5.

Documentation:
- Document the newly admitted dependency major versions and their
validation status in the unreleased changelog.

Tests:
- Validate compatibility with the newer dependency versions through CI
and targeted local test runs.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Expanded supported version ranges for optional ingestion and scaling
packages, plus the development testing package. Minimum supported
versions are unchanged.
* Verified ingestion tests with updated package versions and CI with the
newer scaling and testing package versions.
  * Updated the changelog to document these compatibility updates.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Updates the requirements on [huggingface-hub](https://github.com/huggingface/huggingface_hub) to permit the latest version.
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.5.0...v2.2.0)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 2.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/huggingface-hub-gte-1.5.0-and-lt-3.0.0 branch from 452c644 to d323ddb Compare October 18, 2026 11:24
cemililik and others added 2 commits October 18, 2026 15:52
…in CI

CI on this branch resolved huggingface_hub 2.2.0 with transformers 5.20.1 and passed the full suite on Python 3.10 to 3.13; every
huggingface_hub symbol ForgeLM imports exists in 2.2.0. transformers 5.10 to 5.17 pin the hub below 2, 5.18 and later allow 2.x. The
entry that said the hub stays below 2 is corrected.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@cemililik
cemililik merged commit 306c976 into development Oct 18, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/huggingface-hub-gte-1.5.0-and-lt-3.0.0 branch October 18, 2026 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: packaging-ci Code area: packaging-ci dependencies Dependency or ecosystem currency

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant