safetensors 0.8.0 on Python PyPI

News

safetensors joins the PyTorch foundation!

What's changed

Safetensors 0.8.0 brings direct to Metal loading on Apple Silicon, GIL-free serialization, broader hardware and dtype coverage, and a stronger Python API.

Breaking

The serialize and serialize_file functions now release the GIL during writes, enabling true multithreaded saves from Python. Their input contract has also changed: tensor metadata is now passed via a TensorSpec class (exported from safetensors) instead of plain dicts, making API more explicit and robust to misinputs. This is a breaking change for anyone calling the low-level serialize / serialize_file API directly; the high-level wrappers (safetensors.torch, safetensors.numpy, safetensors.paddle) are updated internally and their public API is unchanged.

The minimum supported Python version is now 3.10 (was 3.9). Python 3.9 reached end-of-life in October 2025.

TensorIndexer::Narrow now carries a step: NonZeroUsize parameter, so a slice is now start:stop:step. This is a fix as this silent error was hidden behind the Storage::Torch variant which offloaded slicing logic to torch directly.

CI

On the platform side, this release adds Windows ARM64 wheel builds, riscv64 Linux wheels, and CI has been hardened with pinned GitHub Actions SHAs.

Also dropped the anaconda CI we had as there's already an automatic tracker via conda-forge.

New features

Direct MPS load on Apple Silicon: tensors are directly loaded in an MTLBuffer and handed to the frameworks that support it (only torch atm) via DLPack, skipping needless copies.
New backend parameter introduced, for the addition of the pread backend. We now support loading files via pread(2) syscall instead of just mmap. Useful for specific archs/platforms.
get_slice now handles ellipsis [...] and strided slices [:, ::8] wherever safetensors does the slicing itself (pread for any framework, MPS, and mmap outside torch/paddle), which silently dropped the step or rejected ... before.
MUSA device support for MooreThreads GPUs.
New dtype support includes float8_e4m3fnuz and float8_e5m2fnuz (AMD FNUZ FP8 formats).
The reader is now explicitly lenient about leading whitespace in the JSON header, which keeps the door open for future page-aligned writes.

Improvements/perf

File writes on macOS now use F_NOCACHE for direct I/O, yielding roughly 30% faster save_file on Apple Silicon.
The packaging dependency has been dropped from the [torch] extra, replaced by a simple hasattr probe for efficiency.

What's Changed

Add arm64 windows support by @finnagin in #678
feat(backend): support musa backend for MooreThreads GPU by @caizhi-mt in #671
add gil free serialize_file(serialize_file_threadable) by @TomQunChao in #679
refactor: remove outdated comment by @McPatate in #685
feat: add direct io write fast path on macos by @McPatate in #687
fix: keep dropped reference to tensor moved from gpu to cpu by @McPatate in #689
feat: bump torch to 2.4 by @McPatate in #710
Contribution guide security by @LysandreJik in #712
Project Governance by @LysandreJik in #721
Add riscv64 build, make Linux wheel build matrix more explicit by @threexc in #708
🔒 Pin GitHub Actions to commit SHAs by @paulinebm in #727
fix: do not require packaging for Torch 2.3.0+ datatype support by @akx in #705
Bump urllib3 from 2.4.0 to 2.6.3 in /bindings/python by @dependabot[bot] in #715
Bump protobuf from 5.29.4 to 5.29.6 in /bindings/python by @dependabot[bot] in #716
Bump filelock from 3.18.0 to 3.20.3 in /bindings/python by @dependabot[bot] in #717
Bump wheel from 0.45.1 to 0.46.2 in /bindings/python by @dependabot[bot] in #718
Bump werkzeug from 3.1.3 to 3.1.6 in /bindings/python by @dependabot[bot] in #719
Bump pillow from 11.2.1 to 12.1.1 in /bindings/python by @dependabot[bot] in #720
Bump markdown from 3.8 to 3.8.1 in /bindings/python by @dependabot[bot] in #722
Bump requests from 2.32.3 to 2.33.0 in /bindings/python by @dependabot[bot] in #725
Bump pygments from 2.19.1 to 2.20.0 in /bindings/python by @dependabot[bot] in #726
mark __version__ as str in the stub by @tarekziade in #730
Add a multithreaded stress test by @ngoldbaum in #637
Bump torch from 2.7.0 to 2.8.0 in /bindings/python by @dependabot[bot] in #732
Bump mlx from 0.27.1 to 0.29.4 in /bindings/python by @dependabot[bot] in #731
feat: add missing test depedencies by @McPatate in #733
refactor: support reading padded/trailing whitespace header by @McPatate in #686
feat: add float8_e4m3fnuz and float8_e5m2fnuz dtype support for AMD GPUs by @nathanrchn in #711
fix(torch): cover f8 & f4 in big endian & unskip tests by @McPatate in #734
fix: multithreaded test on windows + hard fail on thread err by @McPatate in #735
Bump pillow from 12.1.1 to 12.2.0 in /bindings/python by @dependabot[bot] in #737
Bump pytest from 9.0.2 to 9.0.3 in /bindings/python by @dependabot[bot] in #739
feat!: add TensorSpec param to serialize* fns by @McPatate in #738
feat: bump version to 0.8.0-dev.0 by @McPatate in #740
fix(ci): drop 3.9 in conda release by @McPatate in #741
feat: update RELEASE.md notes by @McPatate in #742
chore: bump doc-builder SHA for PR upload workflow by @rtrompier in #744
feat(ci): remove anaconda release and codecov by @McPatate in #745
feat: upstream convert.py script by @McPatate in #746
fix(ci): update ghcr url for s390x docker image caching by @McPatate in #747
fix(python): use checked_mul for F4 last-dim doubling by @willardjansen in #749
feat: add security audit CI by @McPatate in #752
Update PyO3 to 0.28 by @ngoldbaum in #751
fix(ci): pin missing actions dependencies by @McPatate in #755
Handle mps:0 as input device by @Isalia20 in #754
fix(python): make SafetensorError picklable by @MukundaKatta in #753
[MPS] Fast load of the tensors by @Isalia20 in #756
fix(ci): security audit slack message format by @McPatate in #757
feat: add backend with pread file by @McPatate in #760
Update free-threading tests for Python 3.14 by @ngoldbaum in #699
fix: write to tempfile + rename to preserve mmap source by @McPatate in #764
refactor: replace _host_alias_storage w/ MTLBuffer by @McPatate in #767
feat: bump main to 0.9.0-dev.0 by @McPatate in #777
fix(release): move to pypi trusted publisher OIDC by @McPatate in #778

New Contributors

@finnagin made their first contribution in #678
@caizhi-mt made their first contribution in #671
@TomQunChao made their first contribution in #679
@LysandreJik made their first contribution in #712
@threexc made their first contribution in #708
@paulinebm made their first contribution in #727
@dependabot[bot] made their first contribution in #715
@tarekziade made their first contribution in #730
@ngoldbaum made their first contribution in #637
@nathanrchn made their first contribution in #711
@rtrompier made their first contribution in #744
@willardjansen made their first contribution in #749
@Isalia20 made their first contribution in #754
@MukundaKatta made their first contribution in #753

Full Changelog: v0.7.0...v0.8.0

safetensors 0.8.0 v0.8.0 on Python PyPI