RepoJournal
Hugging Face @huggingface
112 wires and counting

$ follow Hugging Face

Keep up with Hugging Face in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-10
stories 93
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Tau 0.4.2 trims session files, chat-ui gates deep links, TRL ships v1.13.0

By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology

alejandro-ao gary149 qgallouedec albertvillanova danieldk cursor kashif
9 people shipped this
alejandro-ao @alejandro-ao 4 cited gary149 @gary149 2 cited qgallouedec @qgallouedec 2 cited albertvillanova @albertvillanova 2 cited danieldk @danieldk 2 cited cursor @cursor 2 cited kashif @kashif 1 cited TuhinKundu @TuhinKundu 1 cited thegovind @thegovind

Hugging Face's chat-ui now requires user confirmation before acting on deep-link prompts and untrusted attachments, closing a path where a crafted link chose the prompt, files, and model on the user's behalf.

chat-ui closed a real hole. A link into the home or model route could act with no user gesture: `?q=` created a conversation and sent the prompt on load, and `?attachments=` fetched arbitrary URLs through the proxy and attached them, with the linker choosing the prompt, the files, and on the model route the model [1]. A `?q=` link now opens a confirmation showing the prompt as plain text before anything runs [2].

On the Tau side, session files get smaller. Every state-changing write path used to persist a redundant `leaf` session entry; those are gone, and the active branch is now derived from the last non-`leaf` JSONL entry while historical `LeafEntry` deserialization is retained [3][4]. The broader change set adds Pi-compatible `firstKeptEntryId` boundaries for newly written compaction id sets, persists extension-injected context as first-class `custom_message` entries, and accounts for compaction and branch-summary request usage [5]. All of it lands in Tau 0.4.2, which bumps the package and lockfile from `0.4.1` and updates the versioned TUI branding assertion [6].

TRL released v1.13.0 with a long-context guide and a runnable single-node example: Qwen3-8B at 1,048,576 tokens measured 380 s/step and 56.2 GB per GPU in bf16 with `per_device_train_batch_size=1` and `loss_type="chunked_nll"` [7]. Two related fixes landed alongside it: trainers now keep `model.config` and `model.generation_config` in agreement with the tokenizer's pad token instead of letting `Trainer.train()` rewrite both configs and log it as a user change [8][9], and a trainer loading from a pinned revision now forwards that revision to its auto-created processing class so weights are not paired with a tokenizer from the default branch [10]. TRL also tracked vLLM 0.28.0, where static trainer-side weight transfer was removed: `NCCLWeightTransferEngine.trainer_init` / `trainer_send_weights` and `NCCLTrainerSendWeightsArgs` are gone, and `packed` moved from per-update info to init info [11].

Elsewhere: OpenEnv merged three focused environment lock updates (Tornado `6.5.7` to `6.5.8` in `wildfire_env`, NLTK `3.9.4` to `3.10.3` plus `defusedxml` in `textarena_env`, and a pypdf bump in `repl_env`) [12], fixed evaluator failures so provider parse errors stay in the submitted batch and canonical payload/write failures are quarantined and retried [13], and added Microsoft's ThinkingBox-Bench to the catalog [14]. The `kernels` project moved its `kernels-data` Python binding into `kernels` and renamed `kernels-data` to `kernels-common`, with the Rust-Python binding renamed from `_data` to `_rust` [15][16].

Action items

References

  1. [1] Confirm deep-link prompts and untrusted attachments before acting on them ↗ huggingface/chat-ui
  2. [2] Confirm deep-link prompts and untrusted attachments before acting on them (#2569) ↗ huggingface/chat-ui
  3. [3] Drop persisted leaf session entries ↗ huggingface/tau
  4. [4] Drop persisted leaf session entries (#702) ↗ huggingface/tau
  5. [5] Align Tau session storage with Pi entry semantics ↗ huggingface/tau
  6. [6] Prepare Tau 0.4.2 release ↗ huggingface/tau
  7. [7] v1.13.0 ↗ huggingface/trl
  8. [8] Sync the model config pad token id with the tokenizer in the trainers ↗ huggingface/trl
  9. [9] Sync the model config pad token id with the tokenizer in the experimental trainers ↗ huggingface/trl
  10. [10] Forward model revision to the auto-loaded processing_class ↗ huggingface/trl
  11. [11] Add support for vLLM 0.28.0 ↗ huggingface/trl
  12. [12] chore(deps): apply focused environment security updates ↗ huggingface/OpenEnv
  13. [13] fix(thinkingbox): isolate evaluator failures ↗ huggingface/OpenEnv
  14. [14] Adding ThinkingBox to OpenEnv ↗ huggingface/OpenEnv
  15. [15] Rename `kernels-data` to `kernels-common` ↗ huggingface/kernels
  16. [16] Move `kernels-data` Python binding into `kernels` ↗ huggingface/kernels

$ ls huggingface/reviews/ # the step-back reads

the week in review OpenEnv 0.5.0 ships as typed clients get fixed the month in review Cache-billing leak fixed, and everything from robots to diffusers gets harder to break
Topics: Python AI / ML Full archive → Weekly reviews →

Quick answers

What shipped in Hugging Face on September 10, 2026?
Hugging Face's chat-ui now requires user confirmation before acting on deep-link prompts and untrusted attachments, closing a path where a crafted link chose the prompt, files, and model on the user's behalf. In total, 46 commits, 44 pull requests, and 3 releases landed.
Who contributed to Hugging Face on September 10, 2026?
9 developers shipped this update, including alejandro-ao, gary149, qgallouedec, albertvillanova, kashif, danieldk, cursor, and TuhinKundu, and 1 more.
What were the notable Hugging Face updates?
Confirm deep-link prompts and untrusted attachments before acting on them, Confirm deep-link prompts and untrusted attachments before acting on them (#2569), and Drop persisted leaf session entries.
♥

$ log @huggingface --recent

Flash and sage varlen prep work under torch.compile dynamic shapes 6 shipped OpenEnv closes soupsieve CVEs in two more envs, TRL reshapes GRPO log-probs 63 shipped OpenEnv 0.5.0 ships new public surface, capture proxy gains an admin key 48 shipped pwc-cli exposes every read-only command as an MCP tool 47 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.