Huggingface-hub

Latest version: v0.26.2

Safety actively analyzes 682416 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 9 of 16

0.13.4

Security patch to fix a vulnerability in `huggingface_hub`. In some cases, downloading a file with `hf_hub_download` or `snapshot_download` could lead to overwriting any file on a Windows machine. With this fix, only files in the cache directory (or a user-defined directory) can be updated/overwritten.

- Malicious repo can overwrite any file on disk 429 Wauplin

**Full Changelog**: https://github.com/huggingface/huggingface_hub/compare/v0.13.3...v0.13.4

0.13.3

Not secure
Patch to fix symlinks in the cache directory. Relative paths are used by default whenever possible. Absolute paths are used only on Windows when creating a symlink betweenh 2 paths that are not on the same volume. This hot-fix reverts the logic to what it was in `huggingface_hub<=0.12` given the issues that have being reported after the `0.13.2` release (https://github.com/huggingface/huggingface_hub/issues/1398, https://github.com/huggingface/diffusers/issues/2729 and https://github.com/huggingface/transformers/pull/22228)

Hotfix - use relative symlinks whenever possible https://github.com/huggingface/huggingface_hub/pull/1399 Wauplin

**Full Changelog**: https://github.com/huggingface/huggingface_hub/compare/v0.13.2...v0.13.3

0.13.2

Not secure
Patch to fix symlinks in the cache directory. All symlinks are now absolute paths.

* Fix relative symlinks in cache 1390 Wauplin

**Full Changelog**: https://github.com/huggingface/huggingface_hub/compare/v0.13.1...v0.13.2

0.13.1

Not secure
Patch to fix `upload_folder` when passing `path_in_repo="."`. That was a breaking change compared to `0.12.1`. Also added more validation around the `path_in_repo` attribute to improve UX.

* Fix `path_in_repo` validation when committing files by Wauplin in https://github.com/huggingface/huggingface_hub/pull/1382


**Full Changelog**: https://github.com/huggingface/huggingface_hub/compare/v0.13.0...v0.13.1

0.13.0

Not secure
Download files to a specific folder

It is now possible to download files from the Hub and move them to a specific folder!

Two behaviors are possible: either create symlinks or move the files from the cache. This can be controlled with the `local_dir_use_symlinks` input parameter. The default -and recommended- value is `"auto"` which will duplicate small files to ease user experience (no symlinks when editing a file) and create symlinks for big files (save disk usage).

py
from huggingface_hub import snapshot_download
or "from huggingface_hub import hf_hub_download"

Download and cache files + duplicate small files (<5MB) to "my-folder" + add symlinks for big files
snapshot_download(repo_id, local_dir="my-folder")

Download and cache files + add symlinks in "my-folder"
snapshot_download(repo_id, local_dir="my-folder", local_dir_use_symlinks=True)

Duplicate files already existing in cache and/or download missing files directly to "my-folder"
snapshot_download(repo_id, local_dir="my-folder", local_dir_use_symlinks=False)


* Download file to specific destination by Wauplin in 1360

Documentation

Efforts to improve documentation have continued. The [guides overview](https://huggingface.co/docs/huggingface_hub/main/en/guides/overview) has been refactored to display which topics are covered (repository, upload, download, search, inference, community tab, cache, model cards, space management and integration).

Upload / Download files

The [repository](https://huggingface.co/docs/huggingface_hub/main/en/guides/repository), [upload](https://huggingface.co/docs/huggingface_hub/main/en/guides/upload) and [download](https://huggingface.co/docs/huggingface_hub/main/en/guides/download) guides have been revisited to showcase the different possibilities to manage a repository and upload/download files to/from it. The focus has been explicitly put on the HTTP endpoints rather than the git cli.

* Refactor guides section + promote HTTP over GIT by Wauplin in 1338

Integrate a library

A new guide has been added on [how to integrate any ML framework](https://huggingface.co/docs/huggingface_hub/main/en/guides/integrations) with the Hub. It explains what is meant by that and how to do it. Here is the summary table to remember:

![2023-03-07_16-32](https://user-images.githubusercontent.com/11801849/223472691-f5d67882-13d7-48b4-8966-2bb25ef7063c.png)

* Write Mixins/Integration guide by Wauplin in 1362

Other

* Add repo_type to repo_info docstring by albertvillanova in 1347

New endpoints + QOL improvements

Duplicate a Space

It's now possible to [duplicate a Space](https://huggingface.co/docs/huggingface_hub/main/en/package_reference/hf_api#huggingface_hub.HfApi.duplicate_space) programmatically!

py
>>> from huggingface_hub import duplicate_space

Duplicate a Space to your account
>>> duplicate_space("multimodalart/dreambooth-training")
RepoUrl('https://huggingface.co/spaces/nateraw/dreambooth-training',...)


* :sparkles: add duplicate_space by nateraw in 1353

`delete_patterns` in `upload_folder`

New input parameter `delete_patterns` for the `upload_folder` method. It allows to delete some remote files before pushing a folder to the Hub, in a single commit. Useful when you don't exactly know which files have already been pushed. Here is an example to upload log files while deleting existing logs on the Hub:

py
api.upload_folder(
folder_path="/path/to/local/folder/logs",
repo_id="username/trained-model",
path_in_repo="experiment/logs/",
allow_patterns="*.txt", Upload all local text files
delete_patterns="*.txt", Delete all remote text files before
)


* Add delete_patterns option to upload_folder by Wauplin in 1370

List repo history

Get the repo history (i.e. all the commits) for a given revision.

py
Get initial commit on a repo
>>> from huggingface_hub import list_repo_commits
>>> initial_commit = list_repo_commits("gpt2")[-1]

Initial commit is always a system commit containing the `.gitattributes` file.
>>> initial_commit
GitCommitInfo(
commit_id='9b865efde13a30c13e0a33e536cf3e4a5a9d71d8',
authors=['system'],
created_at=datetime.datetime(2019, 2, 18, 10, 36, 15, tzinfo=datetime.timezone.utc),
title='initial commit',
message='',
formatted_title=None,
formatted_message=None
)


* Add list_repo_commits to list git history of a repo by Wauplin in 1331

Accept token in `huggingface-cli login`

`--token` and `--add-to-git-credential` option have been added to login directly from the CLI using an environment variable. Useful to login in a Github CI script for example.


huggingface-cli login --token $HUGGINGFACE_TOKEN --add-to-git-credential


* Add token and git credentials to login cli command by silvanocerza in 1372
* token in CLI login docs by Wauplin (direct commit on main)

Telemetry helper

Helper for external libraries to track usage of specific features of their package. Telemetry can be globally disabled by the user using `HF_HUB_DISABLE_TELEMETRY`.

py
from huggingface_hub.utils import send_telemetry

send_telemetry("gradio/local_link", library_name="gradio", library_version="3.22.1")


* Add utility to send telemetry by Wauplin in 1344

Breaking change

When loading a model card with an invalid `model_index` in the metadata, an error is explicitly raised. Previous behavior was to trigger a warning and ignore the model_index. This was problematic as it could lead to a loss of information. Fixing this is a breaking change but impact should be limited as the server is already rejecting invalid model cards. An optional `ignore_metadata_errors` argument (default to False) can be used to load the card with only a warning.

* Explicit raise on invalid model_index + add ignore_metadata_errors option by Wauplin in 1377

Bugfixes & small improvements

Model cards, datasets cards and space cards

A few improvements in repo cards: expose `RepoCard` as top-level, dict-like methods for `RepoCardData` object (1354), updated template and improved type annotation for metadata.

* Updating MC headings by EziOzoani in 1367
* Switch datasets type in ModelCard to a list of datasets by davanstrien in 1356
* Expose `RepoCard` at top level + few qol improvements by Wauplin in 1354
* Explicit raise on invalid model_index + add ignore_metadata_errors option by Wauplin in 1377

Misc

* Fix contrib CI for timm by Wauplin in 1346
* :ambulance: hotfix isHf test user permissions bug by nateraw in 1357
* Remove unused private methods by Wauplin in 1359
* Updates types for RepoCards fields by davanstrien in 1358
* some typos by Wauplin (direct commit on main)
* [WIP] make repr formatting narrower by davanstrien in 903
* Add ReprMixin to Repofile by Wauplin (direct commit on main)
* Fix ReprMixin for python3.7 + test by Wauplin in 1380
* fix create_commit on lowercased repo_id + add regression test by Wauplin in 1376
* FIX create_repo with exists_ok but no permission by Wauplin in 1364

0.12.1

Not secure
Hot-fix to remove authorization header when following redirection (using `cached_download`). Fix was already implemented for `hf_hub_download` but we forgot about this one. Has only a consequence when downloading LFS files from Spaces. Problem arose since a server-side change on how files are served. See https://github.com/huggingface/huggingface_hub/pull/1345.

**Full Changelog**: https://github.com/huggingface/huggingface_hub/compare/v0.12.0...v0.12.1

Page 9 of 16

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.