build(deps): bump huggingface-hub from 0.36.2 to 1.32.0

[dependabot]

Bumps huggingface-hub from 0.36.2 to 1.32.0.

Release notes

Sourced from huggingface-hub's releases.

[v1.32.0] Shared blob store, sandbox security hardening and faster imports

📂 [Cache] Shared blob store: deduplicate Xet files across repos

The cache now deduplicates Xet files across repos. A Xet file downloaded through hf_xet is stored once at <CACHE_DIR>/blobs/<prefix>/<xet_hash> and every repo that needs it gets a relative symlink instead of a download: no bytes are transferred and no extra space is used, even across different repos — or after the repo that first downloaded the file was deleted. The per-repo snapshot layout is unchanged, older clients keep reading and downloading normally, and any failure to share silently falls back to regular repo-local storage. Set HF_HUB_DISABLE_SHARED_BLOBS=1 to opt out entirely. Shared files carry a <xet_hash>.refs manifest listing the repo blobs referencing them, which hf cache rm consults on deletion and hf cache prune sweeps to reclaim payloads that no cached repo uses anymore.

📚 Documentation: Manage your cache

• [Cache] Add cross-repo shared blob store by @​hanouticelina in #4498

💻 [Jobs] Ship config inside UV scripts

A UV script that only runs correctly on a specific runtime can now carry that runtime with it. An optional [tool.hf-jobs] table in the script's PEP 723 header accepts image, flavor, python, timeout, name, namespace, env, secrets, labels, volumes, network_group and network_aliases, and hf jobs uv run reads it at submit time. CLI flags always win, and env/secrets/labels/volumes merge entry by entry instead of being replaced, so -e/-v add to what the script declares. Typos and unknown keys are rejected with the list of valid options, secrets are passed by name only (values come from your environment), and every run prints a config summary with script-sourced values marked and secrets redacted. Note that the table is read by the CLI only: run_uv_job() and create_scheduled_uv_job() ignore it.

# /// script
# requires-python = ">=3.11"
# dependencies = ["vllm", "datasets"]
#
# [tool.hf-jobs]
# image   = "vllm/vllm-openai:unlimited-ocr"
# flavor  = "l4x1"
# python  = "/usr/bin/python3"
# secrets = ["HF_TOKEN"]
# ///

📚 Documentation: Run and manage Jobs

• [CLI] Read a UV script's [tool.hf-jobs] launch config (opus-generated) by @​Wauplin in #4598

🛡️ [Sandbox] security hardening

An internal security review of the Sandbox API resulted in a 9-PR hardening series. Pooled sandboxes now use their own per-sandbox capability token instead of the host-wide credential, pool hosts are fully validated (initiator, namespace, image, flavor, command, URL) before any credential is sent to them, the sbx-server binary is pinned by digest and verified before being run as PID 1, and the local pool cache is bound to the endpoint, credential and namespace that wrote it. Secret values no longer end up in argv when using hf sandbox exec --secrets, background processes are addressed by their server-assigned id (so kill() actually stops them and reports honestly), transfers and command output are bounded to avoid unbounded memory usage in the client, and pool ownership is decided per host so a with SandboxPool(...) block never again tears down a colleague's discovered host. The security documentation was also rewritten to state precisely what the sandbox contract is — and what it is not — including a new "Known limitations" section.

📚 Documentation: Sandboxes

• [sandbox audit] Make the sandbox security contract match the implementation by @​Wauplin in #4831
• [sandbox audit] Use each pooled sandbox's own capability token by @​Wauplin in #4832
• [sandbox audit] Validate a pool host before sending it a credential by @​Wauplin in #4834
• [sandbox audit] Bind the sandbox pool cache to the endpoint, credential and namespace that wrote it by @​Wauplin in #4838
• [sandbox audit] Bound what a transfer or a command's output costs the client by @​Wauplin in #4839
• [sandbox audit] Decide host teardown per host, and report it honestly by @​Wauplin in #4840
• [sandbox audit] Address background processes by their server-assigned id by @​Wauplin in #4836
• [sandbox audit] Pin the sandbox server binary by digest and verify it before running it by @​Wauplin in #4837
• [sandbox audit] Keep secret values out of argv in the CLI and fix the env/secrets docs by @​Wauplin in #4835

🔒 Security hardening for serialization and validation

Three changes make the library safer against malicious or malformed inputs, with a stricter behavior worth noting. Torch checkpoint deserialization was hardened across 11 reported vulnerabilities: load_state_dict_from_file now defaults to safe=True (always using the safetensors loader), the pickle path defaults to weights_only=True, and unsafe combinations raise explicit errors instead of silently falling through. Path validation now rejects .. segments anywhere in path_in_repo (previously only a leading one was caught), so uploads like "a/../../etc/passwd" are refused. Finally, repo_id validation is restricted to ASCII word characters as documented, so non-ASCII ids like café are rejected client-side instead of failing later on the Hub.

... (truncated)

Commits

• 8814aab Release: v1.32.0
• 4457706 Release: v1.32.0.rc0
• b064a14 [Download] Send X-HF-Download-Counter header on download calls (#4613)
• 79dd41e [Docs] Fix hf discussions info options that do not exist (#4886)
• d7b62c7 [CLI] Fix card data serialization (#4882)
• f94ea55 [Buckets] Send mtime when copying files (#4920)
• 6e3d21f [Cache] Add cross-repo shared blob store (#4498)
• 5a9cdda [Core] Speed up package imports (#4914)
• 2075fd6 [Cache] Support kernel repos in hf cache commands (#4905)
• af6b41e [Core] Reject path traversal via embedded ".." segments in path_in_repo (#4884)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ReSerendipity]

暂不合并（不关闭）：与本条同因 —— 提升幅度大（huggingface-hub 0.36.2 → 1.32.0，跨大版本）且 CI 的绿覆盖不到风险面。

huggingface-hub 也不在直接声明里（pyproject.toml / requirements.txt 无此项），是 transformers 的传递依赖；本仓实际用它的地方是下载与 from_pretrained 那条链（含 security/content_safety.py 里固定 revision 的 CLIP tokenizer）。hub 的大版本跨越会改 snapshot_download / hf_hub_download 的参数与缓存布局，而这些只在真取模型时才走得到 —— 无 GPU 的 CPU pytest 矩阵不会替你验这一层。

另外它和 #103 那批有耦合：transformers 4.52.1 的元数据要求 hub 的一个区间（check_pin_crossconflicts.py 的输出可以逐条给出：#88 那次就是它报出 transformers==5.17.0 要求 huggingface-hub>=1.5.0，锁里是 0.36.2 这类冲突）。hub 单独抬到 1.32.0 是否在 4.52.1 的区间内，需要复算而不是猜 —— 复算在同一次 relock 里做，做完连带的真机验收路径与 #90 那条注释里写的一致。