Who contributed to Hugging Face on July 22, 2026?

8 developers shipped this update, including Remy, XciD, lhoestq, Adithya S K, hf-security-analysis[bot], JakeStevens, github-actions[bot], and David Corvoysier.

What were the notable Hugging Face updates?

fix: upgrade nginx to 1.27.0 to address CVE-2026-42533 (#3379), fix: temporarily disable raw Arrow datasets, and equivalence_tests v0.8.7: pipeline hardening (leak fix, retry, purity + importability filters).

@huggingface

Transformers, Datasets, and the open AI-model layer

github ↗

Pick a date

Topics: Python AI / ML Full archive →

The Wire · Showcase

DATASET VIEWER LOCKS DOWN ARROW, FUNES SHIPS GROUNDED ASK

By RepoJournal · Filed 07:00 UTC on July 22, 2026 · About Hugging Face

8 people shipped this

Adithya S K @adithya-s-k 2 cited

JakeStevens @JakeStevens 2 cited

Remy @rtrompier 1 cited

XciD @XciD 1 cited

github-actions[bot] @github-actions[bot] 1 cited

David Corvoysier @dacorvo 1 cited

lhoestq @lhoestq

hf-security-analysis[bot] @hf-security-analysis[bot]

Hugging Face security teams moved overnight to contain a critical Arrow IPC parsing vulnerability in dataset-viewer while shipping three production hardening releases across Repo2RLEnv, optimum-executorch, and funes.

In brief

Dataset Viewer temporarily disables raw Arrow datasets. serving unprocessed columnar data to the public was always a risk vector. this one's a band-aid until they scope the real fix.
nginx 1.27.0 lands in Dataset Viewer to patch CVE-2026-42533. reverse proxy vulnerabilities don't grab headlines but they're how you lose infrastructure. upgrade now.
Funes 1.1.0 ships grounded ask and progressive indexing. retrieval-augmented generation that knows what it doesn't know. that's table stakes now.
equivalence_tests v0.8.7 hardens the RL pipeline. leak fixes, retry logic, purity and importability filters. less flake means faster iteration on model training.

The dataset-viewer team disabled raw Arrow dataset support entirely [2], returning HTTP 501 on all Arrow IPC reads as an immediate containment measure while the upstream datasets library review completes [2]. This guard routes all Arrow parsing through safe_load_dataset_builder, covering both streaming first-rows and Parquet conversion workers. In parallel, nginx upgraded to 1.27.0 to address CVE-2026-42533 [1]. The Repo2RLEnv team shipped two pipeline hardening releases: equivalence_tests v0.8.7 closed a full-source instruction leak where agents could copy oracle code verbatim [3], and code_instruct v0.8.6 fixed a critical prompt bug that explicitly told LLMs to avoid importing the target package [4]. funes v1.1.0 ships grounded Claude/Codex ask queries [7] that enforce forced-injection grounding for accuracy (codex already did this; Claude now matches it after latency testing showed agentic recall cost 2.5-7x more and missed relevance on first recall [8]). Three separate CLI breaking changes ship in funes: store becomes memory, list/REPL interfaces are renamed [7]. optimum-executorch hardened CI to handle large model OOM kills by adding swap and aggressive disk cleanup [5], while fixing XLM-Roberta sequence shapes and T5 cross-attention export [6].

Action items

→ Review Arrow dataset handling if you serve untrusted .arrow files huggingface/dataset-viewer [immediate]
→ Update funes CLI scripts for memory/--memory flag rename before next release huggingface/funes [plan]
→ Monitor optimum-executorch test_models.yml for phi4/large-model stability post-swap huggingface/optimum-executorch [monitor]
→ Audit code_instruct syntheses on your repos for actual package imports post-v0.8.6 huggingface/Repo2RLEnv [plan]

References

[1] fix: upgrade nginx to 1.27.0 to address CVE-2026-42533 (#3379) huggingface/dataset-viewer
[2] fix: temporarily disable raw Arrow datasets ↗ huggingface/dataset-viewer
[3] equivalence_tests v0.8.7: pipeline hardening (leak fix, retry, purity + importability filters) ↗ huggingface/Repo2RLEnv
[4] code_instruct v0.8.6: repo-anchoring, quality gates, delivery contract + 100-env reference dataset ↗ huggingface/Repo2RLEnv
[5] ci: mitigate OOM kills on large-model export tests ↗ huggingface/optimum-executorch
[6] fix: address stable model export failures ↗ huggingface/optimum-executorch
[7] v1.1.0: grounded ask and progressive indexing ↗ huggingface/funes
[8] feat(ask): unify both agents on forced-injection grounding huggingface/funes

Quick answers

What shipped in Hugging Face on July 22, 2026?: Hugging Face security teams moved overnight to contain a critical Arrow IPC parsing vulnerability in dataset-viewer while shipping three production hardening releases across Repo2RLEnv, optimum-executorch, and funes. In total, 64 commits, 23 pull requests, and 4 releases landed.
Who contributed to Hugging Face on July 22, 2026?: 8 developers shipped this update, including Remy, XciD, lhoestq, Adithya S K, hf-security-analysis[bot], JakeStevens, github-actions[bot], and David Corvoysier.
What were the notable Hugging Face updates?: fix: upgrade nginx to 1.27.0 to address CVE-2026-42533 (#3379), fix: temporarily disable raw Arrow datasets, and equivalence_tests v0.8.7: pipeline hardening (leak fix, retry, purity + importability filters).

TRANSFORMERS FIXES RECURRENT MASKING BUG; MOON-IDE KILLS PAIRING WINDOW

A critical padding mask bug in transformers is now fixed for chunked prefill and cache continuation, while moon-ide removes dead startup ceremony and hardens the remote bridge client.

python 97 shipped 2-min read

@huggingface 2 days ago

TAU FIXES SESSION CORRUPTION BUG, SERGE ADDS GPU VERIFICATION LOOP

Tau's Unicode line separator bug was silently bricking user sessions. The fix is retroactive and ships today.

python 36 shipped 2-min read

@huggingface 3 days ago

MLCLAW TIGHTENS AUTHENTICATION, TAU SHIPS REASONING PERSISTENCE

MLClaw fixed a critical authentication gap where private Space edge cookies weren't reaching approval requests, forcing a shift to protected Space defaults across all hosted gateways.

python 69 shipped 2-min read

@huggingface 4 days ago

DIFFUSERS SHIPS COSMOS3 FEW-STEP INFERENCE, LEROBOT STRIPS 3K LINES OF VENDORED CODE

Cosmos3 distilled checkpoints hit diffusers with 4-step T2I and I2V support, while lerobot kills its Qwen2.5-VL fork and rebases onto native transformers.

python 40 shipped 1-min read

Elsewhere on the wire

@cachyos about 4 hours ago

PROTON 11.0 SHIPS WITH LOW-LATENCY VKD3D, MIRROR NETWORK EXPANDS

Proton 11.0 lands experimental low-latency graphics support while CachyOS adds a Hungary mirror to its distribution tier.

infra 45 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TOOLING FIXES LAND AHEAD OF SYSTEM COMPATIBILITY PUSH

The compiler stops misinterpreting profile flags, string reversal handles invalid UTF8 correctly, and Ecto gains fragment column selection in a wave of fixes that shores up core library reliability.

elixir 11 shipped 1-min read

@dotnet about 4 hours ago

COMPLEX NUMBERS NOW IEEE 754 COMPLIANT, SKILLS EVALS GO VALLY-ONLY, UNSAFE EVOLVES

Complex<T> just shipped conformance to C23 Annex G special values, dotnet/skills completed its migration to the Vally eval harness, and the language is tightening unsafe semantics ahead of C# 13.

dotnet 141 shipped 2-min read

@spring-projects about 4 hours ago

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.