[dependabot]

Updates the requirements on huggingface-hub, openai, pyarrow and uvicorn to permit the latest version.
Updates huggingface-hub to 2.2.0

Release notes

Sourced from huggingface-hub's releases.

[v2.2.0] hf jobs stats snapshots, download and HfFileSystem fixes

A small release this week, mostly bug fixes and quality-of-life improvements. hf jobs stats now returns right away instead of streaming forever, concurrent downloads reliably use hf_xet, and HfFileSystem caching is more predictable. Two behavior changes are listed under Breaking changes.

📊 hf jobs stats prints a snapshot by default

hf jobs stats used to stream metrics until the job finished, so scripts and agents calling it on a running job hung until their own timeout. It now prints the latest sample of each job once and exits, like hf jobs logs and hf spaces logs. Use -f/--follow for the previous live view. Snapshot output also supports --format json|agent|quiet, which outputs the raw API metrics.

On the Python side, HfApi.fetch_job_metrics gets the same follow parameter as fetch_job_logs. It defaults to False and returns only the current sample. Pass follow=True to stream until the job completes.

>>> hf jobs stats 6ac3bd9afbc85ba6823a9ad4
JOB ID                CPU % NUM CPU MEM % MEM USAGE      NET I/O         GPU UTIL % GPU MEM % GPU MEM USAGE
--------------------- ----- ------- ----- -------------- --------------- ---------- --------- -------------
6ac3bd9afbc85ba682... 0%    2.0     0.01% 1.0MB / 16.0GB 0.0bps / 0.0bps N/A        N/A       N/A
Hint: Use `hf jobs stats -f celinah/6ac3bd9afbc85ba6823a9ad4` to follow live stats.
Stream live stats until the job completes
>>> hf jobs stats -f 6ac3bd9afbc85ba6823a9ad4

>>> from huggingface_hub import fetch_job_metrics
>>> for metrics in fetch_job_metrics(job_id=job.id, follow=True):
...     print(metrics)

Other Jobs fixes in this release: hf jobs logs and hf spaces logs without -f no longer hang while the job keeps printing, hf jobs stats no longer fails when one of the requested jobs has finished, and hf jobs stats --json prints [] when no job is running.

• [CLI] Snapshot by default in hf jobs stats, add -f/--follow by @​hanouticelina in #5090
• [CLI] Fix empty hf jobs stats --json output with no running jobs by @​hanouticelina in #5094
• [Jobs] Fix no-follow logs hanging while the job keeps printing by @​hanouticelina in #5092
• [Jobs] Ignore 406 from metrics endpoint for finished jobs by @​hanouticelina in #5091

📚 Documentation: Jobs guide

⚡ Concurrent downloads always use hf_xet

In a fresh process, the first concurrent hf_hub_download calls could read a placeholder version for hf_xet while another thread was still looking it up. Those calls treated hf_xet as missing and downloaded through the plain HTTP path. This mostly affected parallel downloads such as snapshot_download, where some of the files skipped Xet. The version lookup is now cached only once it is resolved, so every download sees the real value.

• Fix race in _get_version that makes concurrent downloads skip hf_xet by @​BramVanroy in #5102

📂 HfFileSystem cache fixes

Three fixes to how HfFileSystem caches listings and missing paths:

• ls() on a newly created empty bucket returns an empty list instead of raising FileNotFoundError.
• Directory listings are now replaced in the cache instead of appended to. Before, ls() after find() or ls(refresh=True) could return duplicate entries, refresh=True kept deleted files, and listing a single bucket file cached it as the whole folder's listing.
• exists(path, refresh=True) and invalidate_cache(path) now clear cached "not found" results. Before, a repo, branch or bucket created in the same process stayed missing until a full invalidate_cache().

</tr></table> 

... (truncated)

Commits

• acfdf30 Release: v2.2.0
• 193d9d9 Release: v2.2.0.rc0
• 5be3565 [Cache] Speed up delete_revisions with a set lookup (#5118)
• dab6a96 [CLI] Don't glob-expand arguments on Windows (#5117)
• cca4d3a [Download] Fix offline snapshot_download with a pinned revision (#5113)
• c6cc03e Fix argument name in raise_text_generation_error docstring (#5108)
• 8abbfe5 Fix race in _get_version that makes concurrent downloads skip hf_xet (#5102)
• bb3a875 [Docs] Fix from_pretrained integration example (#5105)
• cf992a9 [HfFileSystem] Make refresh=True clear cached not-found results (#5106)
• af74167 [Tests] Wait for bucket listings after writes (#5095)
• Additional commits viewable in compare view

Updates openai to 3.32.0

Release notes

Sourced from openai's releases.

v3.32.0

3.32.0 (2026-10-16)

Features

• api: add cache settings and key options [2/2] (#4087) (325da45)
• api: add prompt-based voice creation (#4091) (2e39db7)
• api: add regional processing residency options (#4081) (21ce0c2)
• api: add response error diagnostics and model notices (#4086) (e71d781)
• api: support audio fixture playback in Live sessions (#4085) (9998c1a)
• api: support Decisions in Live sessions (#4088) (230a923)

Bug Fixes

• api: declare Realtime response error messages (#4083) (95dbee9)

Chores

• api: clarify Decisions request and response fields (#4079) (d42accb)

Refactors

• share WebSocket connection handling (#4084) (70d4738)

Changelog

Sourced from openai's changelog.

3.32.0 (2026-10-16)

Features

• api: add cache settings and key options [2/2] (#4087) (325da45)
• api: add prompt-based voice creation (#4091) (2e39db7)
• api: add regional processing residency options (#4081) (21ce0c2)
• api: add response error diagnostics and model notices (#4086) (e71d781)
• api: support audio fixture playback in Live sessions (#4085) (9998c1a)
• api: support Decisions in Live sessions (#4088) (230a923)

Bug Fixes

• api: declare Realtime response error messages (#4083) (95dbee9)

Chores

• api: clarify Decisions request and response fields (#4079) (d42accb)

Refactors

• share WebSocket connection handling (#4084) (70d4738)

3.31.0 (2026-10-14)

Features

• add browser and computer toolsets (1/4) (#4073) (47b9e4e)

3.30.0 (2026-10-14)

Features

• api: add beta session spending limits (#4058) (b570279)
• api: add OCI external-storage provider support (#4060) (9eb83fe)
• api: add organization Decisions usage reporting (#4062) (5e7a23e)
• api: expose image tool error and moderation details (#4072) (c5452af)
• api: support image URLs and detailed safety alert explanations (#4061) (3c50399)
• api: support updating project API key expiry (#4066) (1f05e33)

Bug Fixes

• streaming: restore async HTTP/1.1 connection reuse (#4041) (1f6cfe1)

... (truncated)

Commits

• 6ea95a6 release: 3.32.0 (#4080)
• 2e39db7 feat(api): add prompt-based voice creation (#4091)
• 230a923 feat(api): support Decisions in Live sessions (#4088)
• 325da45 feat(api): add cache settings and key options [2/2] (#4087)
• 9998c1a feat(api): support audio fixture playback in Live sessions (#4085)
• e71d781 feat(api): add response error diagnostics and model notices (#4086)
• 70d4738 refactor: share WebSocket connection handling (#4084)
• 95dbee9 fix(api): declare Realtime response error messages (#4083)
• 21ce0c2 feat(api): add regional processing residency options (#4081)
• d42accb chore(api): clarify Decisions request and response fields (#4079)
• Additional commits viewable in compare view

Updates pyarrow to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Commits

• 4461671 MINOR: [Release] Update versions for 26.0.0
• 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
• 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
• 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
• 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
• 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
• cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
• 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
• f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
• 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
• Additional commits viewable in compare view

Updates uvicorn to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.