From 4925bf6a829735977bab5000b469c3edb19c75b1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 17:32:59 -0500
Subject: [PATCH] deps: bump hf-hub from 0.4.3 to 0.5.0 (#2285)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [hf-hub](https://github.com/huggingface/hf-hub) from 0.4.3 to
0.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/huggingface/hf-hub/releases">hf-hub's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Upgrade ureq by <a
href="https://github.com/Narsil"><code>@​Narsil</code></a> in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/114">huggingface/hf-hub#114</a></li>
<li>Update indicatif to current version in Cargo.toml by <a
href="https://github.com/gordonmessmer"><code>@​gordonmessmer</code></a>
in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/126">huggingface/hf-hub#126</a></li>
<li>Fix failing API tests due to outdated model metadata expectations by
<a href="https://github.com/bmqube"><code>@​bmqube</code></a> in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/124">huggingface/hf-hub#124</a></li>
<li>fix: fix typo by <a
href="https://github.com/AndyDai-nv"><code>@​AndyDai-nv</code></a> in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/121">huggingface/hf-hub#121</a></li>
<li>Updating tests and dependencies. by <a
href="https://github.com/Narsil"><code>@​Narsil</code></a> in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/127">huggingface/hf-hub#127</a></li>
<li>Remove markdown from Cargo.toml by <a
href="https://github.com/gordonmessmer"><code>@​gordonmessmer</code></a>
in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/128">huggingface/hf-hub#128</a></li>
<li>Fixup the docstrings for download function (which always downloads).
by <a href="https://github.com/Narsil"><code>@​Narsil</code></a> in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/130">huggingface/hf-hub#130</a></li>
<li>Expose <code>metadata</code> and <code>pointer_path</code> methods
by <a href="https://github.com/danieldk"><code>@​danieldk</code></a> in
<a
href="https://redirect.github.com/huggingface/hf-hub/pull/136">huggingface/hf-hub#136</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gordonmessmer"><code>@​gordonmessmer</code></a>
made their first contribution in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/126">huggingface/hf-hub#126</a></li>
<li><a href="https://github.com/bmqube"><code>@​bmqube</code></a> made
their first contribution in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/124">huggingface/hf-hub#124</a></li>
<li><a
href="https://github.com/AndyDai-nv"><code>@​AndyDai-nv</code></a> made
their first contribution in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/121">huggingface/hf-hub#121</a></li>
<li><a href="https://github.com/danieldk"><code>@​danieldk</code></a>
made their first contribution in <a
href="https://redirect.github.com/huggingface/hf-hub/pull/136">huggingface/hf-hub#136</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/huggingface/hf-hub/compare/v0.4.3...v0.5.0">https://github.com/huggingface/hf-hub/compare/v0.4.3...v0.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/huggingface/hf-hub/blob/main/RELEASE.md">hf-hub's
changelog</a>.</em></p>
<blockquote>
<h1>Releasing hf-hub</h1>
<p>This document covers the full release process for the
<code>hf-hub</code> crate. If anything here is unclear or out of date,
please open a PR.</p>
<h2>What gets released</h2>
<p>A single tag push releases one artifact:</p>
<ul>
<li><strong><code>hf-hub</code> Rust crate</strong> on <a
href="https://crates.io/crates/hf-hub">crates.io</a>, via
<code>.github/workflows/rust-release.yml</code>.</li>
</ul>
<p>The workflow triggers on tags matching <code>v*</code> (e.g.,
<code>v1.0.0</code>, <code>v1.0.0-rc.0</code>).</p>
<p>There are no Python components in this repo. The other workspace
members are not published:</p>
<ul>
<li><code>hfrs/</code> — CLI binary, distributed via <code>cargo install
--git</code>.</li>
<li><code>examples/</code>, <code>benches/</code>,
<code>integration-tests/</code> — internal-only, version
<code>0.0.0</code>, never published.</li>
</ul>
<h2>Pre-release checklist</h2>
<ol>
<li><strong>CI is green on <code>main</code>.</strong> The
<code>Rust</code> workflow must be passing on every platform in the
matrix (Ubuntu, Windows, macOS) with both feature configurations
(<code>&quot;&quot;</code> and <code>--all-features</code>).</li>
<li><strong>Review the diff since the last release.</strong>
<pre lang="bash"><code>git log --oneline v0.5.0..main
git diff v0.5.0..main --stat -- hf-hub/
</code></pre>
Pay particular attention to changes under <code>hf-hub/src/</code> —
those are the only changes that actually ship to crates.io.</li>
<li><strong>Identify breaking changes.</strong> Anything that changes
the public Rust API (types, function signatures, removed re-exports,
builder fields) needs to be reflected in the version bump per <a
href="https://semver.org">semver</a> and called out in the release
notes.</li>
<li><strong>Run the full pre-release test sweep</strong> (see next
section).</li>
</ol>
<h2>Pre-release test sweep</h2>
<p>Run all of these from the repo root before tagging. They mirror what
CI runs, plus a publish dry-run that CI does not currently do.</p>
<h3>Format and lint</h3>
<pre lang="bash"><code>cargo +nightly fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo clippy --workspace --all-targets --all-features -- -D warnings
</code></pre>
<h3>Unit tests (<code>hf-hub</code>)</h3>
<pre lang="bash"><code>cargo test -p hf-hub
cargo test -p hf-hub --features blocking
</code></pre>
<h3>Integration tests (<code>integration-tests</code>)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/huggingface/hf-hub/commit/b86d34cbddb4468eb50eb5d2977eddd0a28d2a44"><code>b86d34c</code></a>
release: <code>0.5.0</code></li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/5510260d5fd1d93238f8c43272a1a14e6848ec4b"><code>5510260</code></a>
Expose <code>metadata</code> and <code>pointer_path</code> methods (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/136">#136</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/94b83854e026775a779ec585860da2fdfd9243ea"><code>94b8385</code></a>
Fixup the docstrings for download function (which always downloads). (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/130">#130</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/c165283bf78a06ec2a227c7f40da092d59adbd87"><code>c165283</code></a>
Remove markdown from Cargo.toml (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/128">#128</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/2c1f231d85a03db24f5f5a989c592cb025788b19"><code>2c1f231</code></a>
Updating tests and dependencies. (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/127">#127</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/6fcb56d10296d66d4d035aa0d7365a2e814b54c2"><code>6fcb56d</code></a>
fix typo (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/121">#121</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/1d3037a3a9904933e393c765ed6bfc524d57f7e0"><code>1d3037a</code></a>
Fix failing API tests due to outdated model metadata expectations (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/124">#124</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/65fb0347d92c5569be93b334f547fc2f5c861ac6"><code>65fb034</code></a>
Update indicatif to current version in Cargo.toml (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/126">#126</a>)</li>
<li><a
href="https://github.com/huggingface/hf-hub/commit/3c9391bb77a08c977cf20fe96a30861538dc56bd"><code>3c9391b</code></a>
Upgrade ureq (<a
href="https://redirect.github.com/huggingface/hf-hub/issues/114">#114</a>)</li>
<li>See full diff in <a
href="https://github.com/huggingface/hf-hub/compare/v0.4.3...v0.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hf-hub&package-manager=cargo&previous-version=0.4.3&new-version=0.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                      | 92 +++------------------------------
 crates/headroom-core/Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 87 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6dd065fb6..88a1eccd1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1037,19 +1037,6 @@ dependencies = [
  "static_assertions",
 ]
 
-[[package]]
-name = "console"
-version = "0.15.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
-dependencies = [
- "encode_unicode",
- "libc",
- "once_cell",
- "unicode-width",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "console"
 version = "0.16.3"
@@ -1549,7 +1536,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3c8600c9ec79b51d60c19911fe14eac04fe9c2895e87d2a3e80e2213d645a32"
 dependencies = [
  "anyhow",
- "hf-hub 0.5.0",
+ "hf-hub",
  "image",
  "ndarray",
  "ort",
@@ -1876,7 +1863,7 @@ dependencies = [
  "dashmap",
  "fastembed",
  "flate2",
- "hf-hub 0.4.3",
+ "hf-hub",
  "http 1.4.2",
  "icu_segmenter",
  "magika",
@@ -2016,26 +2003,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hf-hub"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "629d8f3bbeda9d148036d6b0de0a3ab947abd08ce90626327fc3547a49d59d97"
-dependencies = [
- "dirs",
- "http 1.4.2",
- "indicatif 0.17.11",
- "libc",
- "log",
- "rand 0.9.4",
- "reqwest",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "ureq 2.12.1",
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "hf-hub"
 version = "0.5.0"
@@ -2044,7 +2011,7 @@ checksum = "aef3982638978efa195ff11b305f51f1f22f4f0a6cabee7af79b383ebee6a213"
 dependencies = [
  "dirs",
  "http 1.4.2",
- "indicatif 0.18.4",
+ "indicatif",
  "libc",
  "log",
  "rand 0.9.4",
@@ -2052,7 +2019,7 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror 2.0.18",
- "ureq 3.3.0",
+ "ureq",
  "windows-sys 0.61.2",
 ]
 
@@ -2438,26 +2405,13 @@ dependencies = [
  "hashbrown 0.17.1",
 ]
 
-[[package]]
-name = "indicatif"
-version = "0.17.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
-dependencies = [
- "console 0.15.11",
- "number_prefix",
- "portable-atomic",
- "unicode-width",
- "web-time",
-]
-
 [[package]]
 name = "indicatif"
 version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25470f23803092da7d239834776d653104d551bc4d7eacaf31e6837854b8e9eb"
 dependencies = [
- "console 0.16.3",
+ "console",
  "portable-atomic",
  "unicode-width",
  "unit-prefix",
@@ -2956,12 +2910,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "number_prefix"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -4362,7 +4310,7 @@ dependencies = [
  "derive_builder",
  "esaxx-rs",
  "getrandom 0.3.4",
- "indicatif 0.18.4",
+ "indicatif",
  "itertools 0.14.0",
  "log",
  "macro_rules_attribute",
@@ -4842,25 +4790,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
-[[package]]
-name = "ureq"
-version = "2.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
-dependencies = [
- "base64 0.22.1",
- "flate2",
- "log",
- "once_cell",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "socks",
- "url",
- "webpki-roots 0.26.11",
-]
-
 [[package]]
 name = "ureq"
 version = "3.3.0"
@@ -5236,15 +5165,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
diff --git a/crates/headroom-core/Cargo.toml b/crates/headroom-core/Cargo.toml
index 534a41b78..5fd25553c 100644
--- a/crates/headroom-core/Cargo.toml
+++ b/crates/headroom-core/Cargo.toml
@@ -22,7 +22,7 @@ tokenizers = "0.22"
 # with `rustls` (no system OpenSSL dep — keeps the binary static-linkable for
 # AWS deploys). `from_pretrained` is called once at startup, so blocking is
 # fine; if a tokio caller needs it later we can wrap in `spawn_blocking`.
-hf-hub = { version = "0.4", default-features = false, features = ["ureq", "rustls-tls"] }
+hf-hub = { version = "0.5", default-features = false, features = ["ureq", "rustls-tls"] }
 # `md5` for the CCR cache_key. Python's compression_store hashes the original
 # diff with MD5 truncated to 24 hex chars; we must match byte-for-byte.
 md-5 = "0.10"