RepoJournal
Hugging Face @huggingface
112 wires and counting

$ follow Hugging Face

Keep up with Hugging Face in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-24
stories 61
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

TRANSFORMERS SHIPS FSDP DISTRIBUTED TRAINING STACK, HUB LIBRARY PLUGS REDOS HOLE

By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology

evalstate Ferdinand Mom Kashif Rasul Harry Mellor Minsang Kim Kyle Sayers dacorvo
14 people shipped this
evalstate @evalstate 1 cited Ferdinand Mom @3outeille 1 cited Kashif Rasul @kashif 1 cited Harry Mellor @hmellor 1 cited Minsang Kim @kmswin1 1 cited Kyle Sayers @kylesayrs 1 cited dacorvo @dacorvo 1 cited github-actions[bot] @github-actions[bot] 1 cited moon-bot-app[bot] @moon-bot-app[bot] 1 cited Neroued @Neroued 1 cited Sohum Trivedi @sohumt123 1 cited Wauplin @Wauplin 1 cited moon-bot-app @moon-bot-app machineuser @machineuser

Hugging Face landed distributed training orchestration in transformers while plugging a regex vulnerability that could stall untrusted card parsing for minutes.

The transformers team merged full FSDP CI infrastructure and end-to-end distributed tests [1], introducing DistributedMixin and wiring DistributedConfig through from_pretrained and save_pretrained in the first two phases of the orchestration rollout. On the inference side, DiffusionGemma now supports gradient checkpointing [2] with exact loss/gradient reproduction, and Gemma 4 switched to explicit per_layer_config for heterogeneous attention patterns [3]. AXK1, a new Deepseek-derived MoE model, landed with TP bug fixes and modernized configuration [4], while a bugfix resolved fully offloaded model saving [5]. In the SDK layer, huggingface_hub patched catastrophic backtracking in REGEX_YAML_BLOCK [6], a ReDoS vulnerability that could pin CPU cores for seconds parsing untrusted README frontmatter. The hub_upload pipeline now forwards authentication tokens through _final_commit_info lookups [7], fixing 401 errors on private repos. Research-agent stripped deployment files and locked down configuration [8], and funes added a remove command [9] to undo fuses add operations. JavaScript tasks shipped v0.21.28 [10] with resourceGroupId support for organization-owned collections [11] and NInfer model library registration for the fastest documented Qwen35B inference engine [12].

Action items

References

  1. [1] Add FSDP CI and end-to-end FSDP tests + save fsdp (#47357) ↗ huggingface/transformers
  2. [2] [DiffusionGemma] Support gradient checkpointing (#46572) ↗ huggingface/transformers
  3. [3] Use new `per_layer_config` for Gemma 4 so that heterogeneous attention config is explicit (#47384) ↗ huggingface/transformers
  4. [4] add_axk1 (#46867) ↗ huggingface/transformers
  5. [5] [Offloading] [Bugfix] Fix fully offloaded model saving (#47336) ↗ huggingface/transformers
  6. [6] [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK (#4526) ↗ huggingface/huggingface_hub
  7. [7] [Upload] Forward token in _final_commit_info repo_info lookup ↗ huggingface/huggingface_hub
  8. [8] remove deploy files ↗ huggingface/research-agent
  9. [9] feat: add funes remove command ↗ huggingface/funes
  10. [10] tasks-v0.21.28 ↗ huggingface/huggingface.js
  11. [11] Support resourceGroupId when creating a collection (#2308) ↗ huggingface/huggingface.js
  12. [12] Register NInfer model library ↗ huggingface/huggingface.js

$ ls huggingface/reviews/ # the step-back reads

the week in review OpenEnv 0.5.0 ships as typed clients get fixed the month in review Cache-billing leak fixed, and everything from robots to diffusers gets harder to break
Topics: Python AI / ML Full archive → Weekly reviews →

Quick answers

What shipped in Hugging Face on July 24, 2026?
Hugging Face landed distributed training orchestration in transformers while plugging a regex vulnerability that could stall untrusted card parsing for minutes. In total, 34 commits, 26 pull requests, and 1 releases landed.
Who contributed to Hugging Face on July 24, 2026?
14 developers shipped this update, including evalstate, Ferdinand Mom, Kashif Rasul, Harry Mellor, Minsang Kim, Kyle Sayers, dacorvo, and github-actions[bot], and 6 more.
What were the notable Hugging Face updates?
Add FSDP CI and end-to-end FSDP tests + save fsdp (#47357), [DiffusionGemma] Support gradient checkpointing (#46572), and Use new `per_layer_config` for Gemma 4 so that heterogeneous attention config is explicit (#47384).
♥

$ log @huggingface --recent

Flash and sage varlen prep work under torch.compile dynamic shapes 6 shipped OpenEnv closes soupsieve CVEs in two more envs, TRL reshapes GRPO log-probs 63 shipped OpenEnv 0.5.0 ships new public surface, capture proxy gains an admin key 48 shipped pwc-cli exposes every read-only command as an MCP tool 47 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.