●Change8

v1.29.0

Breaking Changes
📦 huggingface-hubView on GitHub →
⚠ 2 breaking✨ 5 features🐛 6 fixes🔧 10 symbols

Summary

This release optimizes Xet downloads by caching connection info, introduces the ability to change bucket visibility after creation, and includes several security fixes for path traversal and deserialization vulnerabilities.

⚠️ Breaking Changes

  • The path-traversal guard for CVE-2026-15717 is now extended to `hf buckets sync` / `sync_bucket()`. Server-supplied file keys are now validated to prevent escaping the chosen directory and writing arbitrary files. This may break workflows that relied on downloading files with anchored or traversing keys.
  • The `load_state_dict_from_file` function now uses a shared `_is_safetensors()` helper to guarantee that pickle deserialization is not used for shards named `.safetensors`. Previously, a file passing sharded-checkpoint validation could still be loaded with pickle if its name was exactly `.safetensors`.

Migration Steps

  1. If you were relying on downloading files with anchored or traversing keys using `hf buckets sync` or `sync_bucket()`, you will need to update your workflow to use validated paths.
  2. If you encountered issues with `load_state_dict_from_file` and `.safetensors` files, ensure your files are correctly named and validated.

✨ New Features

  • Bucket visibility can now be changed after creation using `HfApi.update_bucket_settings()` or the CLI command `hf buckets settings`.
  • The `hf_xet` download process has been optimized to reduce API calls per file by caching connection info, leading to faster downloads and fewer rate-limiting issues on large repositories.
  • Inference providers now send LoRA weights for fal-ai text-to-video.
  • The CLI installer now points to a shadowed newer Python on macOS.
  • The CLI now provides a hint to use `stream=True` when a non-streaming inference call fails with a 504 error.

🐛 Bug Fixes

  • Fixed an issue where `hf_xet` downloads made excessive API calls per file, leading to rate limiting.
  • Fixed an issue with `hf buckets sync` / `sync_bucket()` where server-supplied file keys were not validated, allowing path traversal.
  • Fixed a fallback to pickle deserialization in `load_state_dict_from_file` for shards named `.safetensors`.
  • Fixed an issue with the CLI upload when `local_path` was a wildcard.
  • Fixed argument help rendering in the CLI with click 8.5.
  • Fixed `hf-mount` install instructions in `hf-cli` skill.

Affected Symbols

hf_xetHfApi.update_bucket_settingsupdate_bucket_settingshf buckets settingshf buckets syncsync_bucket()load_state_dict_from_filetorch.loadPath.suffix_is_safetensors()