[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes
Latest
⚡ Xet downloads no longer make one API call per file
Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.
- [Xet] Cache connection info to avoid one token request per file by @hanouticelina in #4732
🪣 Change bucket visibility after creation
Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.
>>> from huggingface_hub import update_bucket_settings
# Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
# Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
bucket_id: username/my-bucket
private: True
# Make it public again
>>> hf buckets settings username/my-bucket --public📚 Documentation: Buckets guide
- [Buckets] Add support for updating bucket visibility by @hanouticelina in #4715
🔒 Security fixes
Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.
- [Buckets] Validate remote paths in bucket sync to prevent path traversal by @hanouticelina in #4731
- Fix extension-confusion fallback to pickle in load_state_dict_from_file (add
_is_safetensors) by @moon-bot-app[bot] in #4737
🤖 Inference
- [Inference Providers] Send LoRA weights for fal-ai text-to-video by @moon-bot-app[bot] in #4706
- Hint at
stream=Truewhen a non-streaming inference call fails with 504 by @moon-bot-app[bot] in #4744
🖥️ CLI
- [CLI] Installer: point at shadowed newer Python on macOS by @hanouticelina in #4758
- [CLI] Fix hf-mount install instructions in hf-cli skill by @Wauplin in #4747
🔧 Other QoL Improvements
- [MCP] Set upper bound mcp<2.0 for optional extra dependency
huggingface_hub[mcp]by @Wauplin in #4735 - Remove leftover deprecated
labels/tagsfrom docstrings and signature by @Wauplin in #4745
🐛 Bug and typo fixes
- [CLI] Fix upload when local_path is a wildcard by @shoutoutuoadi325 in #4711
- [CLI] Fix argument help rendering with click 8.5 by @Wauplin in #4759
📖 Documentation
- Docs: mark Sandboxes as experimental and drop the "HF token never enters the sandbox" claim by @moon-bot-app[bot] in #4734
🏗️ Internal
- [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL by @Wauplin in #4761
- [Tests] Fix expand property tests after server-side error message change by @Wauplin in #4746
- [CI] Auto-close community PRs without a maintainer-scoped issue by @hanouticelina in #4695
- Post-release: bump version to 1.29.0.dev0 by @huggingface-hub-bot[bot] in #4702
- Bump the actions group with 4 updates by @dependabot[bot] in #4704
