huggingface/huggingface_hub v1.32.0 on GitHub

📂 [Cache] Shared blob store: deduplicate Xet files across repos

The cache now deduplicates Xet files across repos. A Xet file downloaded through hf_xet is stored once at <CACHE_DIR>/blobs/<prefix>/<xet_hash> and every repo that needs it gets a relative symlink instead of a download: no bytes are transferred and no extra space is used, even across different repos — or after the repo that first downloaded the file was deleted. The per-repo snapshot layout is unchanged, older clients keep reading and downloading normally, and any failure to share silently falls back to regular repo-local storage. Set HF_HUB_DISABLE_SHARED_BLOBS=1 to opt out entirely. Shared files carry a <xet_hash>.refs manifest listing the repo blobs referencing them, which hf cache rm consults on deletion and hf cache prune sweeps to reclaim payloads that no cached repo uses anymore.

📚 Documentation: Manage your cache

[Cache] Add cross-repo shared blob store by @hanouticelina in #4498

💻 [Jobs] Ship config inside UV scripts

A UV script that only runs correctly on a specific runtime can now carry that runtime with it. An optional [tool.hf-jobs] table in the script's PEP 723 header accepts image, flavor, python, timeout, name, namespace, env, secrets, labels, volumes, network_group and network_aliases, and hf jobs uv run reads it at submit time. CLI flags always win, and env/secrets/labels/volumes merge entry by entry instead of being replaced, so -e/-v add to what the script declares. Typos and unknown keys are rejected with the list of valid options, secrets are passed by name only (values come from your environment), and every run prints a config summary with script-sourced values marked and secrets redacted. Note that the table is read by the CLI only: run_uv_job() and create_scheduled_uv_job() ignore it.

# /// script
# requires-python = ">=3.11"
# dependencies = ["vllm", "datasets"]
#
# [tool.hf-jobs]
# image   = "vllm/vllm-openai:unlimited-ocr"
# flavor  = "l4x1"
# python  = "/usr/bin/python3"
# secrets = ["HF_TOKEN"]
# ///

📚 Documentation: Run and manage Jobs

[CLI] Read a UV script's [tool.hf-jobs] launch config (opus-generated) by @Wauplin in #4598

🛡️ [Sandbox] security hardening

An internal security review of the Sandbox API resulted in a 9-PR hardening series. Pooled sandboxes now use their own per-sandbox capability token instead of the host-wide credential, pool hosts are fully validated (initiator, namespace, image, flavor, command, URL) before any credential is sent to them, the sbx-server binary is pinned by digest and verified before being run as PID 1, and the local pool cache is bound to the endpoint, credential and namespace that wrote it. Secret values no longer end up in argv when using hf sandbox exec --secrets, background processes are addressed by their server-assigned id (so kill() actually stops them and reports honestly), transfers and command output are bounded to avoid unbounded memory usage in the client, and pool ownership is decided per host so a with SandboxPool(...) block never again tears down a colleague's discovered host. The security documentation was also rewritten to state precisely what the sandbox contract is — and what it is not — including a new "Known limitations" section.

📚 Documentation: Sandboxes

[sandbox audit] Make the sandbox security contract match the implementation by @Wauplin in #4831
[sandbox audit] Use each pooled sandbox's own capability token by @Wauplin in #4832
[sandbox audit] Validate a pool host before sending it a credential by @Wauplin in #4834
[sandbox audit] Bind the sandbox pool cache to the endpoint, credential and namespace that wrote it by @Wauplin in #4838
[sandbox audit] Bound what a transfer or a command's output costs the client by @Wauplin in #4839
[sandbox audit] Decide host teardown per host, and report it honestly by @Wauplin in #4840
[sandbox audit] Address background processes by their server-assigned id by @Wauplin in #4836
[sandbox audit] Pin the sandbox server binary by digest and verify it before running it by @Wauplin in #4837
[sandbox audit] Keep secret values out of argv in the CLI and fix the env/secrets docs by @Wauplin in #4835

🔒 Security hardening for serialization and validation

Three changes make the library safer against malicious or malformed inputs, with a stricter behavior worth noting. Torch checkpoint deserialization was hardened across 11 reported vulnerabilities: load_state_dict_from_file now defaults to safe=True (always using the safetensors loader), the pickle path defaults to weights_only=True, and unsafe combinations raise explicit errors instead of silently falling through. Path validation now rejects .. segments anywhere in path_in_repo (previously only a leading one was caught), so uploads like "a/../../etc/passwd" are refused. Finally, repo_id validation is restricted to ASCII word characters as documented, so non-ASCII ids like café are rejected client-side instead of failing later on the Hub.

[Serialization] Harden torch checkpoint deserialization by @Wauplin in #4877
[Core] Reject path traversal via embedded ".." segments in path_in_repo by @bodapatisaikrishna in #4884
[Core] Restrict repo_id validation regex to ASCII word characters by @bodapatisaikrishna in #4892

🧰 Smarter cache management

hf cache rm accepts hf:// file URIs, so you can remove a single cached file — typically one GGUF quantization — without deleting the whole repo. The file is removed from every cached revision, and its blob is deleted only if no other cached file still references it. hf cache commands also support kernel repos: scan_cache_dir() used to treat kernels--* folders as corrupted and skip them, but kernel repos now show up in hf cache ls, rm and prune, and --repo-type kernel works for hf download and hf cache verify.

hf cache rm hf://models/unsloth/gemma-3-27b-it-GGUF/gemma-3-27b-it-Q4_K_M.gguf --dry-run
hf download kernels-community/activation README.md --repo-type kernel

📚 Documentation: Manage your cache

[CLI] Support file URIs in hf cache rm by @hanouticelina in #4847
[Cache] Support kernel repos in hf cache commands by @hanouticelina in #4905

🚀 Faster imports

huggingface_hub now imports much faster: huggingface_hub.utils is lazy like the root package, heavy HfApi implementation imports and optional Torch/TensorBoard/NumPy/FastAPI/Starlette dependencies are deferred until used, and CLI commands are registered lazily while hf --help still renders the same complete output. Benchmark medians on Python 3.10: from huggingface_hub import * drops from 2.36s to 0.39s (626.8 → 49.6 MiB peak RSS), hf version from 0.37s to 0.17s, and hf env from 0.40s to 0.24s.

[Core] Speed up package imports by @Wauplin in #4914

🖥️ CLI

[CLI] Make --format human override agent auto-detection by @hanouticelina in #4878
[CLI] Add hf --skills as an alias for hf skills preview by @Wauplin in #4906

🤖 Inference

Add --container-registry-{username,password} by @alvarobartt in #4854 — docs

📊 Jobs

[Jobs] Scope network groups to the namespace and resource group by @co42 in #4855
[Jobs] Expose the network group on JobInfo by @co42 in #4862

🔧 Other QoL Improvements

[Download] Send X-HF-Download-Counter header on download calls by @Wauplin in #4613
[Buckets] Send mtime when copying files by @Wauplin in #4920

🐛 Bug and typo fixes

fix(serialization): save_torch_state_dict cleanup regex silently matches/deletes unrelated files by @g0rdonL in #4857
[Sandbox] Preserve terminal command results by @evalstate in #4851
[Http] Fix race in get_session() creating multiple clients by @hanouticelina in #4868
[RepoCard] Fix AttributeError when model-index has source: null by @Saniyagupte in #4870
[Spaces] Fix AttributeError in SpaceRuntime when hardware is null by @Saniyagupte in #4873
[Buckets] Fix file metadata size on redirects by @davanstrien in #4874
[CLI] Fix card data serialization by @davanstrien in #4882
Fix doubled colon in snapshot download transfer bar description by @sandeepb2013 in #4890
[Download] Fix silently disabled tree cache on long Windows paths by @askalf in #4896
[Safetensors] Recognize proposed U3 metadata by @7dsolv in #4898
[Serialization] Sync _get_dtype_size with safetensors by @Wauplin in #4902

📖 Documentation

[Community] Fix docstring for DiscussionComment.last_edited_by by @Saniyagupte in #4864
[Docs] Fix hf discussions info options that do not exist by @rishabhsai in #4886

🏗️ Internal

[CI] Make CI less flaky and stop 6h hung jobs by @Wauplin in #4830
Bump the actions group with 4 updates by @dependabot[bot] in #4848
Post-release: bump version to 1.32.0.dev0 by @huggingface-hub-bot[bot] in #4856
Key the doc build concurrency group on the pull request number by @albertvillanova in #4876

huggingface/huggingface_hub v1.32.0 [v1.32.0] Shared blob store, sandbox security hardening and faster imports on GitHub