huggingface/huggingface_hub v1.29.0 on GitHub

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

[Xet] Cache connection info to avoid one token request per file by @hanouticelina in #4732

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings

# Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)

# Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True

# Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

[Buckets] Add support for updating bucket visibility by @hanouticelina in #4715

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

[Buckets] Validate remote paths in bucket sync to prevent path traversal by @hanouticelina in #4731
Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @moon-bot-app[bot] in #4737

🤖 Inference

[Inference Providers] Send LoRA weights for fal-ai text-to-video by @moon-bot-app[bot] in #4706
Hint at stream=True when a non-streaming inference call fails with 504 by @moon-bot-app[bot] in #4744

🖥️ CLI

[CLI] Installer: point at shadowed newer Python on macOS by @hanouticelina in #4758
[CLI] Fix hf-mount install instructions in hf-cli skill by @Wauplin in #4747

🔧 Other QoL Improvements

[MCP] Set upper bound mcp<2.0 for optional extra dependency huggingface_hub[mcp] by @Wauplin in #4735
Remove leftover deprecated labels/tags from docstrings and signature by @Wauplin in #4745

🐛 Bug and typo fixes

[CLI] Fix upload when local_path is a wildcard by @shoutoutuoadi325 in #4711
[CLI] Fix argument help rendering with click 8.5 by @Wauplin in #4759

📖 Documentation

Docs: mark Sandboxes as experimental and drop the "HF token never enters the sandbox" claim by @moon-bot-app[bot] in #4734

🏗️ Internal

[Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL by @Wauplin in #4761
[Tests] Fix expand property tests after server-side error message change by @Wauplin in #4746
[CI] Auto-close community PRs without a maintainer-scoped issue by @hanouticelina in #4695
Post-release: bump version to 1.29.0.dev0 by @huggingface-hub-bot[bot] in #4702
Bump the actions group with 4 updates by @dependabot[bot] in #4704

huggingface/huggingface_hub v1.29.0 [v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes on GitHub