deps(deps): update huggingface-hub requirement from >=0.30.0 to >=1.18.0

[dependabot]

Updates the requirements on huggingface-hub to permit the latest version.

Release notes

Sourced from huggingface-hub's releases.

[v1.18.0] Unified file copying, web URL support, and storage usage

🖥️ Unified hf cp command

A single hf cp command now handles all file-copy workflows (upload a local file, download from the Hub, or copy between two remote locations) with consistent hf:// URI syntax for both repositories and buckets. It is also available as hf repos cp and hf buckets cp; all three aliases are identical, so you can use whichever reads best for your workflow. You can stream from stdin (-) or to stdout (-), and a trailing / on the source path gives you rsync-style semantics (copy the folder contents, not the folder itself). Note that remote-to-remote copies only work within the same storage region, and bucket-to-repo is not yet supported.

# Upload a local file to a repo
hf cp ./model.safetensors hf://username/my-model/model.safetensors
Download a file to stdout
hf cp hf://username/my-model/config.json - | jq .
Copy between two Hub repos
hf cp hf://username/source-model/config.json hf://username/dest-model/config.json

📚 Documentation: CLI guide — Copy files

• [CLI] Add unified hf cp command (aliased as hf repos cp and hf buckets cp) by @​Wauplin in #4295

🥚 Easter egg:explore your storage usage

• [CLI] Easter egg: city skyline in hf repos ls by @​Wauplin in #4287

🔗 Paste web URLs directly

parse_hf_uri now accepts Hugging Face web URLs so you can paste a link straight into the CLI or the library and it "just works".

# Copy-paste a URL from the website
hf cp https://huggingface.co/nvidia/LocateAnything-3B/blob/main/config.json - | jq '.architectures'

📚 Documentation: HF URIs — Web URLs

• [URIs] Parse web URLs in parse_hf_uri + add HfUri.to_url by @​Wauplin in #4296

🚨 Breaking change

On Lustre, GPFS, and some NFS mounts, flock(2) silently succeeds for every caller, which means filelock provides no mutual exclusion. When multiple hf_hub_download calls race for the same file, they can append to the same .incomplete file and silently corrupt the blob cache. This release fixes that by always downloading to a fresh temporary file instead of resuming an incomplete one, making the download path safe even when file locking is broken. filelock is still used as a "best-effort" hint to avoid unnecessary duplicate downloads, but correctness no longer depends on it. This is a breaking change: resuming a previously failed partial download is no longer possible. However, file resumability was already a niche use case only applicable when hf_xet is disabled.

• [Fix] Make concurrent downloads safe even when file locking is broken by @​Wauplin in #4306

🖥️ CLI

• [CLI] inline enum choices in the generated CLI skill by @​hanouticelina in #4299

... (truncated)

Commits

• 64e5356 Release: v1.18.0
• b1c4c20 Release: v1.18.0.rc0
• c505f77 [Fix] Make concurrent downloads safe even when file locking is broken (#4306)
• d04c3b2 [URIs] Parse web URLs in parse_hf_uri + add HfUri.to_url (#4296)
• 0e57086 Bump the actions group with 2 updates (#4309)
• e628f15 [Download] Probe umask next to incomplete file instead of two levels above de...
• f4a91c2 [CLI] inline enum choices in the generated CLI skill (#4299)
• 1138933 [Docs] Mention storage region limitation for server-side copy (#4302)
• 26a6df1 [Docs] Document missing parameters in hf_hub_url and preupload_lfs_files (#4300)
• c6dfc6d [Docs] Document missing endpoint and template_str parameters (#4298)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vesper-review]

Vesper

Reviewed commits

Commit	Summary
685e0ad	deps(deps): update huggingface-hub requirement from >=0.30.0 to >=1.18.0

An analysis of the change in requirements.txt reveals a correctness issue:

Correctness & Compatibility

As of early 2025, the huggingface_hub library is in its 0.x version range (with recent versions being 0.28.x, 0.29.x, and 0.30.x). There is no version 1.18.0 available on PyPI.

Specifying >=1.18.0 will cause pip install -r requirements.txt to fail with a resolution error:

ERROR: Could not find a version that satisfies the requirement huggingface_hub>=1.18.0

If the intention was to use a version like 0.18.0 (which is quite old) or if this was a typo for another version, it is highly recommended to revert this to a valid version (such as >=0.30.0 as originally specified).

Here is the suggestion to revert this change to ensure successful installation:

requirements.txt
@@ -9,2 +9,2 @@
-huggingface_hub>=1.18.0
+huggingface_hub>=0.30.0

[vesper-review]

Vesper Analysis for 685e0ad

[vesper-review]

Here is the suggestion to revert this change to ensure successful installation:

Suggested change

	httpx==0.28.1
	huggingface_hub>=0.30.0