$ cat huggingface/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
TRL 1.13.0 adds training beyond 1M tokens
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The release pairs a long-context guide and runnable example with breaking changes; Transformers.js adds dependency-free structured output across three packages.
v1.13.0 huggingface/trl
The release notes land a long-context guide plus a runnable example that trains beyond 1M tokens. It is marked breaking, so pin your current version until you have read the migration notes.
Add dependency-free response constraints huggingface/transformers.js
A small dependency-free package constrains generation with JSON Schema, JSON object, and regex, hooking token sampling into the generation loop with tests and docs. The API is imported as `ResponseConstraint` from `@huggingface/transformers-response-constraint`.
Create `@huggingface/transformers-structured-output` package (#1758) huggingface/transformers.js
The structured-output package shipped as `@huggingface/transformers-structured-output`, built on llguidance and using a `logits_processor` rather than the earlier `response_schema` plan. Regex examples and unit tests came with it.
Massive documentation overhaul huggingface/transformers.js
The docs build now uses a custom parser instead of the jsdoc-to-markdown dependency, with broken links fixed and an agents.md added. The docs previews are the point: this is a contributor-facing cleanup, not a runtime change.
fix: resilience to Hub rate limiting, stalled CAS uploads, and unclean shutdown huggingface/hf-mount
Three failure modes in hf-mount get hardened: EIO on `stat()` during Hub rate limiting, permanence of stalled CAS uploads, and unclean shutdown, using a cross-cloud checkpoint workload as the reference. If you mount a shared read-write bucket across clouds, this is the pass that matters.
fix: make the negative-lookup TTL configurable, default 1 s huggingface/hf-mount
The negative-lookup TTL becomes configurable with a 1-second default, down from a hardcoded 30 seconds. A producer-to-consumer handoff through a shared bucket previously took about 30 seconds because an early HEAD 404 poisoned the cache.
fix: scan blocks as individual files huggingface/funes
funes now stages each block (text, tool call, tool result) as its own file instead of scanning a session as one concatenated blob, so a detected secret is associated with its block directly rather than by trufflehog line number. Secret detection gets more precise attribution as a result.
refactor(scan): drop the line a secret was reported on huggingface/funes
Alongside: funes dropped the reported line number from scan results since nothing read it and it described trufflehog's decoded output, not the stored text; hf-mount grouped its GitHub Actions bumps; TRL grouped Dependabot updates into one PR per set of CI pins.
$ ls huggingface/week/ # the briefings behind this review
Keep up with Hugging Face in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.