RepoJournal
Hugging Face

@huggingface

Transformers, Datasets, and the open AI-model layer

Keep up with Hugging Face in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Wed 17 jun
  2. Thu 18 jun
  3. Sat 27 jun
  4. Sun 28 jun
  5. Mon 29 jun
  6. Tue 30 jun
  7. Wed 1 jul
  8. Thu 2 jul
  9. Fri 3 jul
  10. Sat 4 jul
  11. Sun 5 jul
  12. Mon 6 jul
  13. Tue 7 jul
  14. Wed 8 jul
  15. Thu 9 jul
  16. Fri 10 jul
  17. Sat 11 jul
  18. Sun 12 jul
  19. Mon 13 jul
  20. Tue 14 jul
  21. Wed 15 jul
  22. Thu 16 jul
  23. Fri 17 jul
  24. Sat 18 jul
  25. Sun 19 jul
  26. Mon 20 jul
  27. Tue 21 jul
  28. Wed 22 jul
  29. Thu 23 jul
  30. Today 24 jul
Topics: Python AI / ML Full archive →

The Wire · Showcase

TRANSFORMERS SHIPS FSDP DISTRIBUTED TRAINING STACK, HUB LIBRARY PLUGS REDOS HOLE

By RepoJournal · Filed · About Hugging Face

evalstate Ferdinand Mom Kashif Rasul Harry Mellor Minsang Kim Kyle Sayers dacorvo
14 people shipped this
evalstate @evalstate 1 cited Ferdinand Mom @3outeille 1 cited Kashif Rasul @kashif 1 cited Harry Mellor @hmellor 1 cited Minsang Kim @kmswin1 1 cited Kyle Sayers @kylesayrs 1 cited dacorvo @dacorvo 1 cited github-actions[bot] @github-actions[bot] 1 cited moon-bot-app[bot] @moon-bot-app[bot] 1 cited Neroued @Neroued 1 cited Sohum Trivedi @sohumt123 1 cited Wauplin @Wauplin 1 cited moon-bot-app @moon-bot-app machineuser @machineuser

Hugging Face landed distributed training orchestration in transformers while plugging a regex vulnerability that could stall untrusted card parsing for minutes.

The transformers team merged full FSDP CI infrastructure and end-to-end distributed tests [1], introducing DistributedMixin and wiring DistributedConfig through from_pretrained and save_pretrained in the first two phases of the orchestration rollout. On the inference side, DiffusionGemma now supports gradient checkpointing [2] with exact loss/gradient reproduction, and Gemma 4 switched to explicit per_layer_config for heterogeneous attention patterns [3]. AXK1, a new Deepseek-derived MoE model, landed with TP bug fixes and modernized configuration [4], while a bugfix resolved fully offloaded model saving [5]. In the SDK layer, huggingface_hub patched catastrophic backtracking in REGEX_YAML_BLOCK [6], a ReDoS vulnerability that could pin CPU cores for seconds parsing untrusted README frontmatter. The hub_upload pipeline now forwards authentication tokens through _final_commit_info lookups [7], fixing 401 errors on private repos. Research-agent stripped deployment files and locked down configuration [8], and funes added a remove command [9] to undo fuses add operations. JavaScript tasks shipped v0.21.28 [10] with resourceGroupId support for organization-owned collections [11] and NInfer model library registration for the fastest documented Qwen35B inference engine [12].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Add FSDP CI and end-to-end FSDP tests + save fsdp (#47357) huggingface/transformers
  2. [2] [DiffusionGemma] Support gradient checkpointing (#46572) huggingface/transformers
  3. [3] Use new `per_layer_config` for Gemma 4 so that heterogeneous attention config is explicit (#47384) huggingface/transformers
  4. [4] add_axk1 (#46867) huggingface/transformers
  5. [5] [Offloading] [Bugfix] Fix fully offloaded model saving (#47336) huggingface/transformers
  6. [6] [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK (#4526) huggingface/huggingface_hub
  7. [7] [Upload] Forward token in _final_commit_info repo_info lookup ↗ huggingface/huggingface_hub
  8. [8] remove deploy files huggingface/research-agent
  9. [9] feat: add funes remove command ↗ huggingface/funes
  10. [10] tasks-v0.21.28 ↗ huggingface/huggingface.js
  11. [11] Support resourceGroupId when creating a collection (#2308) huggingface/huggingface.js
  12. [12] Register NInfer model library ↗ huggingface/huggingface.js

Quick answers

What shipped in Hugging Face on July 24, 2026?
Hugging Face landed distributed training orchestration in transformers while plugging a regex vulnerability that could stall untrusted card parsing for minutes. In total, 34 commits, 26 pull requests, and 1 releases landed.
Who contributed to Hugging Face on July 24, 2026?
14 developers shipped this update, including evalstate, Ferdinand Mom, Kashif Rasul, Harry Mellor, Minsang Kim, Kyle Sayers, dacorvo, and github-actions[bot], and 6 more.
What were the notable Hugging Face updates?
Add FSDP CI and end-to-end FSDP tests + save fsdp (#47357), [DiffusionGemma] Support gradient checkpointing (#46572), and Use new `per_layer_config` for Gemma 4 so that heterogeneous attention config is explicit (#47384).

More from @huggingface

Hugging Face @huggingface

TRANSFORMERS HARDENS AGAINST PYTORCH FRAGMENTATION WHILE TRL SIMPLIFIES DISTILLATION

Transformers plugged a cascading import failure that breaks downstream CI on older PyTorch versions, while TRL rips out dead code to lock DistillationTrainer into prompt-only datasets.

dacorvo tarekziade vbayanag eustlb +5
python 70 shipped 2-min read
Hugging Face @huggingface

DATASET VIEWER LOCKS DOWN ARROW, FUNES SHIPS GROUNDED ASK

Hugging Face security teams moved overnight to contain a critical Arrow IPC parsing vulnerability in dataset-viewer while shipping three production hardening releases across Repo2RLEnv, optimum-executorch, and funes.

Remy XciD lhoestq Adithya S K +4
python 91 shipped 2-min read
Hugging Face @huggingface

TRANSFORMERS FIXES RECURRENT MASKING BUG; MOON-IDE KILLS PAIRING WINDOW

A critical padding mask bug in transformers is now fixed for chunked prefill and cache continuation, while moon-ide removes dead startup ceremony and hardens the remote bridge client.

coyotte508 Andrei Boldyrev Ferdinand Mom hmellor +6
python 97 shipped 2-min read
Hugging Face @huggingface

TAU FIXES SESSION CORRUPTION BUG, SERGE ADDS GPU VERIFICATION LOOP

Tau's Unicode line separator bug was silently bricking user sessions. The fix is retroactive and ships today.

alejandro-ao rian-dolphin sayakpaul tarekziade +2
python 36 shipped 2-min read

Daily updates, in your inbox

Follow Hugging Face

Keep up with Hugging Face in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

github-actions[bot] ccurme ak684 tofarr +2
ai-agents 62 shipped 1-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

Jesse Gross github-actions[bot] yuyue0225sc davidjpyu +8
llms 157 shipped 2-min read
CachyOS @CachyOS

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

github-actions Vladislav Nepogodin loathingKernel cantosun99 +2
infra 57 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

AlexGx Eurico Nicacio SteffenDE lukaszsamson +1
elixir 23 shipped 2-min read
Want every project, not just this one?