$ the-wire · showcase
Security bumps in kernels, a torchao import fix, and Grounding DINO heads that stay untied
By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology
11 people shipped this
christopher5106
@christopher5106
1 cited
Muhammad Usman Mateen
@usmanmateen
1 cited
Daniël de Kok
@danieldk
1 cited
DltsumCtnori
@dltsum
1 cited
sayakpaul
@sayakpaul
Aayush D C Dangi
@dcaayushd
ariG23498
@ariG23498
tarekziade
@tarekziade
Athrael Soju
@athrael-soju
tritsystem
@tritsystem
Shree Yadav
@shreeyadav06
The day's real load-bearing changes are small: a defense-in-depth dependency bump in kernels, a diffusers fix that unbreaks model imports for anyone on torchao older than 0.15, and a transformers correction that stops MM Grounding DINO checkpoints from silently losing their per-layer decoder heads.
Security bumps (eMudhra compromise) (#918) huggingface/kernels
Daniël de Kok landed a set of dependency security bumps tied to the eMudhra compromise. Treat it as a supply-chain hygiene change and rebuild anything pinned to the kernels toolchain rather than waiting for a feature release.
Fix model imports when torchao is older than 0.15 (#15095) huggingface/diffusers
torchao_quantizer.py imported FqnToConfig whenever torchao was present, though the symbol only exists from torchao 0.15; with an older version, importing any model failed, including on Google Colab. The import is now gated on 0.15 or newer, so envs that pinned an earlier torchao compile again.
Only tie MM Grounding DINO decoder heads when the config shares them (#49552) huggingface/transformers
by 卢文彬
MMGroundingDinoForObjectDetection tied every decoder layer's bbox and class heads to layer 0 unconditionally, ignoring decoder_bbox_embed_share and decoder_cls_embed_share. Published checkpoints such as LLMDet tiny/base/large and the openmmlab mm_grounding_dino variants set both flags to False and store per-layer heads, so layers 1 and up were silently using the wrong ones.
Fix Windows path separators breaking relative imports of Hub custom-generate modules (#48951) huggingface/transformers
get_cached_module_file built child module paths with Path(...).parent / module_needed, which on Windows produced backslash paths like 'custom_generate\beam_search.py' that the Hub lookup could not resolve. Hub-relative imports for custom_generate and modeling modules now use forward slashes, so nested relative imports of remote custom code load on Windows.
[LTX-2] Add `motion_speed` to condition the positional time base apart from the playback frame rate huggingface/diffusers
LTX-2 tokenizes video on a seconds-based time axis derived from frame_rate, which conflated playback speed with positional timing; a new motion_speed lets the two diverge. That is what Lightricks' LTX-2.5-22b LoRA slow-motion control needs, since its reference driver conditions the diffusion stage on fps / speed while the video is still encoded at fps. Elsewhere: diffusers also gated .alpha app...
Action items
- → Rebuild kernels environments to pick up the eMudhra-related security bumps huggingface/kernels [plan]
