Bump the development group with 3 updates

[dependabot]

Bumps the development group with 3 updates: huggingface-hub, prek and ty.

Updates huggingface-hub from 1.32.0 to 2.0.0

Release notes

Sourced from huggingface-hub's releases.

[v2.0.0] The httpx2 release

See MIGRATION GUIDE in docs.

💔 Breaking Change: HTTP stack moves to httpx2

See migration plan in huggingface/huggingface_hub#4802 .

huggingface_hub v2.0 replaces its HTTP dependency with httpx2: clients and transport exceptions now come from httpx2/httpcore2 instead of httpx/httpcore. Custom client factories (via set_client_factory / set_async_client_factory) and any except clauses catching transport errors must use httpx2 types. For code that must support both v1.x (starting with v1.30.0) and v2.x, import the HTTP module from huggingface_hub.utils:

from huggingface_hub.utils import get_session, httpx
try:
response = get_session().get("https://huggingface.co/api/models/gpt2")
response.raise_for_status()
except httpx.HTTPError:
...

Note that httpx2 uses the operating system's certificate trust store by default (custom CA bundles via SSL_CERT_FILE / SSL_CERT_DIR still work), logging configuration should target the httpx2 and httpcore2 loggers, and the oauth extra now requires authlib>=1.8.0.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4921

💔 Breaking Change: deprecated APIs are removed

This release also removes all APIs deprecated in 1.x:

• upload_large_folder / HfApi.upload_large_folder → use upload_folder
• duplicate_space → use duplicate_repo
• request_space_storage / delete_space_storage → use the volume APIs (set_space_volumes, delete_space_volumes)
• repo_type_and_id_from_hf_id → use parse_hf_uri
• InferenceEndpointType.PROTECTED → use AUTHENTICATED (create_inference_endpoint(type="protected") now raises ValueError)
• list_models(model_name=...) → use list_models(search=...)
• create_repo / duplicate_repo(space_storage=...) → use space_volumes
• text_generation(stop_sequences=...) → use stop
• Boolean InferenceClient(token=...) → pass a token string or None

On the CLI side, the following entry points and options are gone: huggingface-cli (use hf), hf repo and hf repo-files delete (use hf repos and hf repos delete-files), hf upload-large-folder (use hf upload), hf repos create/duplicate --storage (use --volume), hf jobs ps and hf jobs scheduled ps -f/--filter (use --status/--label), and hf skills add/update --claude (Claude Code installation is now automatic).

A migration guide covering all of this is available at https://github.com/huggingface/huggingface_hub/blob/main/docs/source/en/concepts/migration_v2.md.

• [Release] Prepare huggingface_hub 2.0 by @​Wauplin in #4994
• huggingface/huggingface_hub#4955
• huggingface/huggingface_hub#4971
• huggingface/huggingface_hub#4985

🏗️ Internal

• [CI] Support major (pre-)releases in release workflow by @​Wauplin in #4991

... (truncated)

Commits

• 97c5f5f Release: v2.0.0
• e2d609e Release: v2.0.0.rc0
• 89ae51f unbump
• 9f51867 [Release] Prepare huggingface_hub 2.0 (#4994)
• c2e6e0a Post-release: bump version to 1.34.0.dev0 (#4993)
• fa26f34 [CI] Support major (pre-)releases in release workflow (#4991)
• ac3ed2f [Xet] Show Validating progress during shard finalization (#4478)
• b904b94 Apply the repo_id length limit to the namespace as well (#4988)
• 1e0c305 Send PrivateLink config under privateService in create_inference_endpoint (#4...
• da5e244 Scope GITHUB_TOKEN permissions per job (#4982)
• Additional commits viewable in compare view

Updates prek from 0.5.3 to 0.5.4

Release notes

Sourced from prek's releases.

0.5.4

Release Notes

Released on 2026-09-28.

Highlights

Faster builtin hooks

In our end-to-end benchmark, prek is about 38% faster than 0.5.3, with some builtin hooks up to 273% faster (check-yaml: 273%, check-json: 80%, check-merge-conflict: 71%).

Enhancements

• Add include_deleted to allow hooks to include deleted files (#2733)
• Add --check and simplify end-of-file-fixer (#2764)
• Add --check to file-contents-sorter (#2765)
• Add --check to requirements-txt-fixer (#2766)
• Add --check to trailing-whitespace (#2763)
• Expose and document prek util generate-shell-completion (#2727)
• Support hide_status in project and user configuration (#2760)
• Support look-around regex in builtin pattern hooks (#2732)

Performance

• Cache the resolved Git executable on macOS (#2726)
• Combine and cache Git repository path queries (#2724)
• Optimize common builtin hook execution (#2768)
• Optimize scanning in mixed-line-ending and trailing-whitespace (#2769)
• Scan check-merge-conflict files in fixed-size blocks (#2781)
• Use SIMD UTF-8 validation in check-json, check-toml, and check-yaml (#2770)

Bug fixes

• Retry transient rename failures on Windows (#2756)
• Use PATH to resolve prek in completion scripts (#2719)

Documentation

• Clarify the flow and scope of usage guides (#2710)
• Reorganize usage guides and reference documentation (#2709)

Other changes

• Sync latest identify tags (#2762)

Contributors

• @​github-actions

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.4

Released on 2026-09-28.

Highlights

Faster builtin hooks

In our end-to-end benchmark, prek is about 38% faster than 0.5.3, with some builtin hooks up to 273% faster (check-yaml: 273%, check-json: 80%, check-merge-conflict: 71%).

Enhancements

• Add include_deleted to allow hooks to include deleted files (#2733)
• Add --check and simplify end-of-file-fixer (#2764)
• Add --check to file-contents-sorter (#2765)
• Add --check to requirements-txt-fixer (#2766)
• Add --check to trailing-whitespace (#2763)
• Expose and document prek util generate-shell-completion (#2727)
• Support hide_status in project and user configuration (#2760)
• Support look-around regex in builtin pattern hooks (#2732)

Performance

• Cache the resolved Git executable on macOS (#2726)
• Combine and cache Git repository path queries (#2724)
• Optimize common builtin hook execution (#2768)
• Optimize scanning in mixed-line-ending and trailing-whitespace (#2769)
• Scan check-merge-conflict files in fixed-size blocks (#2781)
• Use SIMD UTF-8 validation in check-json, check-toml, and check-yaml (#2770)

Bug fixes

• Retry transient rename failures on Windows (#2756)
• Use PATH to resolve prek in completion scripts (#2719)

Documentation

• Clarify the flow and scope of usage guides (#2710)
• Reorganize usage guides and reference documentation (#2709)

Other changes

• Sync latest identify tags (#2762)

Contributors

• @​github-actions
• @​j178

Commits

• 77c4056 Summarize builtin hook speedups
• 7a6b8d1 Bump version to 0.5.4
• c7ec693 Update ubuntu:26.04 Docker digest to da6fc2b (#2772)
• eee5822 Scan check-merge-conflict files in fixed-size blocks (#2781)
• 4c579dc Update dependency uv to v0.12.17 (#2773)
• 1f2a621 Update Rust crate clap to v4.6.7 (#2775)
• aeea7a5 Update GitHub Actions (#2778)
• 51ca2db Update Rust crate rustix to v1.1.5 (#2777)
• 80e8bcc Update Rust crate clap_complete to v4.6.11 (#2776)
• 0f23764 Update Rust crate async-compression to v0.4.48 (#2774)
• Additional commits viewable in compare view

Updates ty from 0.0.82 to 0.0.84

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

• Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

• Complete string keys from dictionary initializers (#28820)
• Support LSP requests against closed documents (#28595)
• Select projects for external files using import search paths (#28594)
• Use workspace editor settings for external files (#28639)

Performance

• Avoid repeated subtyping checks for materialized recursive protocols (#28774)
• Skip reading notebooks when discovering scripts (#28781)

Core type checking

• Avoid incorrect simplification of TypeIs materializations (#28817)
• Fix disjointness of generic class types (#28787)
• Fix staticmethod shadowing through generic receivers and unions (#28766)
• Infer callable signatures from bounded type variables (#28599)
• Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
• Infer through optional generic containers in the legacy solver (#28791)
• Preserve call narrowing during cyclic inference (#28708)
• Preserve intersections of type guard return types (#28796)
• Use subtyping for constraint-set implication (#28657)

Configuration

• Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

• Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

• @​ibraheemdev
• @​zsol
• @​charliermarsh
• @​lerebear
• @​MichaReiser
• @​ewdurbin

... (truncated)

Commits

• 8dd9a7f Bump version to 0.0.84 (#4585)
• d4e4bf9 publish to astral-sh/versions via OIDC (#4581)
• 94ce733 use oidc issued token for docs publication (#4579)
• 901eeaa Update prek dependencies (#4576)
• 09bf0b1 Update docker/setup-buildx-action action to v4.3.0 (#4575)
• 89d6ffe Update astral-sh/setup-uv action to v10.2.0 (#4574)
• 9c21479 Bump version to 0.0.83 (#4569)
• 04c6911 Sync the ty security mirror (#4549)
• 3fa57a2 Grant the versions workflow repository read access (#4550)
• a15b353 use scoped token for release workflow (#4506)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!