chore(deps): bump the python-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the python-minor-patch group with 4 updates in the / directory: typer, ruff, anthropic and huggingface-hub.

Updates typer from 0.27.0 to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

• ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

• 📝 Add Library Skills documentation. PR #1906 by @​tiangolo.
• 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation. PR #1904 by @​phalberg.
• 📝 Recommend uv projects by default in docs. PR #1903 by @​tiangolo.
• 📝 Update help docs. PR #1902 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #1909 by @​tiangolo.

Changelog

Sourced from typer's changelog.

0.27.1 (2026-08-03)

Features

• ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

• 📝 Add Library Skills documentation. PR #1906 by @​tiangolo.
• 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation. PR #1904 by @​phalberg.
• 📝 Recommend uv projects by default in docs. PR #1903 by @​tiangolo.
• 📝 Update help docs. PR #1902 by @​tiangolo.

Internal

• ⬆️ Upgrade latest-changes to 0.7.1. PR #1909 by @​tiangolo.

Commits

• fe2aa0e 🔖 Release version 0.27.1 (#1919)
• 680dc99 📝 Update release notes
• ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
• 32d80ef 📝 Update release notes
• 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
• ac329a0 📝 Update release notes
• c37ae2f 📝 Add Library Skills documentation (#1906)
• 0974a7e 📝 Update release notes
• 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
• 9051baa 📝 Update release notes
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Updates anthropic from 0.119.0 to 0.120.2

Release notes

Sourced from anthropic's releases.

v0.120.2

0.120.2 (2026-07-28)

Full Changelog: v0.120.1...v0.120.2

Bug Fixes

• mcp: support mcp sdk v2 alongside v1 (#300) (177f88c)

v0.120.1

0.120.1 (2026-07-28)

Full Changelog: v0.120.0...v0.120.1

Bug Fixes

• mcp: pin mcp extra to <2 (#1783) (fb66371)

v0.120.0

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

• api: add claude-opus-5 model (bf4e31c)
• api: add tool addition/removal blocks and tool_change events (bf4e31c)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)

Changelog

Sourced from anthropic's changelog.

0.120.2 (2026-07-28)

Full Changelog: v0.120.1...v0.120.2

Bug Fixes

• mcp: support mcp sdk v2 alongside v1 (#300) (177f88c)

0.120.1 (2026-07-28)

Full Changelog: v0.120.0...v0.120.1

Bug Fixes

• mcp: pin mcp extra to <2 (#1783) (fb66371)

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

• api: add claude-opus-5 model (bf4e31c)
• api: add tool addition/removal blocks and tool_change events (bf4e31c)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)

Commits

• f5c30d0 release: 0.120.2
• 8b327c3 fix(mcp): support mcp sdk v2 alongside v1 (#300)
• 3b65b23 release: 0.120.1
• 6c127ae fix(mcp): pin mcp extra to <2 (#1783)
• 36863a0 codegen metadata
• 60c64fb release: 0.120.0
• 70c0a64 feat(api): add claude-opus-5 model
• See full diff in compare view

Updates huggingface-hub from 1.24.0 to 1.26.0

Release notes

Sourced from huggingface-hub's releases.

[v1.26.0] Resolve revisions only once, security hardening, and resource groups for Jobs & Collections

📌 Pin a revision once with resolve_revision

Libraries that download many files one by one (config, weights, tokenizer, processor, ...) had to resolve revision="main" into a commit hash on every call — costing one HTTP request per file and risking two calls landing on two different commits if the repo is updated in between. The new HfApi.resolve_revision resolves the revision once and returns a ResolvedRevision: a str subclass whose value stays the user-facing revision (so error messages keep saying "main") while its .resolved attribute holds the commit hash. Download helpers (hf_hub_download, snapshot_download, get_cached_repo_tree) detect it and use the commit hash directly, guaranteeing every file comes from the same commit. The mapping is also written to the refs/ folder of the cache, so later runs in offline mode transparently fall back to the cached value.

>>> from huggingface_hub import resolve_revision, hf_hub_download
>>> revision = resolve_revision("openai-community/gpt2")
>>> revision
ResolvedRevision(initial=None, resolved='607a30d783dfa663caf39e06633721c8d4cfcd7e')
>>> revision == "main"  # readable error messages
True
>>> config = hf_hub_download("openai-community/gpt2", "config.json", revision=revision)
>>> weights = hf_hub_download("openai-community/gpt2", "model.safetensors", revision=revision)

📚 Documentation: Manage the cache — Pin a revision (advanced)

• [Download] Add HfApi.resolve_revision and ResolvedRevision by @​Wauplin in #4604

🔒 Security hardening for downloads and sandboxes

This release ships two security fixes. First, downloading or uploading to a --local-dir now rejects absolute, drive-relative, root-relative, UNC and ..-traversal filenames on all platforms, interpreting each name under both POSIX and Windows rules (refs CVE-2026-15717). Previously only a Windows-only ..\ check existed, so a malicious repo could write files outside the target directory on Windows clients — and even leak a NetNTLMv2 hash via UNC paths. Legitimate repo filenames never contain such segments, so real downloads are unaffected; note that exotic names like folder/..\..\..\file, previously tolerated on Linux, are now rejected everywhere. Second, Sandbox.create no longer injects your HF token into the job environment to download the sbx-server binary: the bucket is public, so the bootstrap now downloads it anonymously and no HF credential ever lands in the sandbox unless you explicitly opt in with forward_hf_token=True.

• [Download] Reject absolute/UNC/traversal filenames on local_dir & cache paths by @​Wauplin in #4540
• [Sandbox] Don't send the HF token to sandbox jobs by @​Wauplin in #4583

🗂️ Resource groups for Jobs and Collections

Organization resource groups are now supported across the client. For collections, create_collection accepts an optional resource_group_id, and the new update_collection_resource_group method wraps the dedicated Hub endpoint to assign a collection to a resource group afterwards (passing None removes it). For Jobs, run_job, run_uv_job and create_scheduled_job accept a resource_group_id parameter, mirrored by a --resource-group-id option on the hf jobs run, hf jobs uv run and hf jobs scheduled run commands. Beyond access control within an organization, resource groups are also used for cost attribution and per-group spending limits.

hf jobs run --resource-group-id <group-id> python:3.12 python train.py

📚 Documentation: Collections reference, CLI reference

• Support resource groups for collections by @​moon-bot-app[bot] in #4575
• feat(jobs): support resource group at Job creation by @​moon-bot-app[bot] in #4576

📊 Job names, front and center in the CLI

Job names are now much easier to work with from the terminal. hf jobs ls (and hf jobs scheduled ls) display a dedicated NAME column, and a new --name filter acts as a shortcut for --label name=NAME. The name is also surfaced as a top-level field in hf jobs inspect and in command results, instead of only living inside labels — where it remains for compatibility.

$ hf jobs ls -a --name training-v2
JOB_ID      NAME         IMAGE/SPACE COMMAND      CREATED      STATUS    RUNTIME
----------- ------------ ----------- ------------ ------------ --------- -------
6a60b190... training-v2  python:3.12 python -c... 2026-07-2... COMPLETED 0s

... (truncated)

Commits

• c998254 Release: v1.26.0
• 8a89097 Release: v1.26.0.rc2
• ac1c66b Release: v1.26.0.rc1
• 9c594e6 Release: v1.26.0.rc0
• 5af012a [Core] Fix tilde expansion in CommitOperationAdd (#4612)
• da90367 [CLI] Don't crash when stdout can't encode non-ASCII output (#4610)
• a782edf [Download] Add HfApi.resolve_revision and ResolvedRevision (#4604)
• 59df95f Reject token=False in create_inference_endpoint_from_catalog (#4605)
• a1028f8 [Safetensors] Fix truncated header on 100kb boundary (#4603)
• bbdef5b [Download] Reject redacted Xet hashes from tree cache (#4595)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	agentcairn	6276074	Commit Preview URL Branch Preview URL	Aug 06 2026, 09:53 PM