deps(deps): bump hf-xet from 1.2.0 to 1.5.0

[dependabot]

Warning

Dependabot will stop supporting python v3.9!

Please upgrade to one of the following versions: v3.9, v3.10, v3.11, v3.12, v3.13, or v3.14.

Bumps hf-xet from 1.2.0 to 1.5.0.

Release notes

Sourced from hf-xet's releases.

[hf-xet v1.5.0] Session based API

Replaces the old upload_files / download_files / hash_files Python functions with a new object-oriented API that exposes XetSession and its child objects directly as PyO3 classes. This gives Python callers full control over session lifecycle, connection pooling, and progress reporting.

The previous module-level functions are kept under hf_xet/src/legacy/ and remain importable as from hf_xet import upload_files etc., but now emit DeprecationWarning.

New Python API

importhf_xetOptional: createacustomconfig (immutable; use .with_config() toderiveupdates)
config=hf_xet.XetConfig().with_config("data.max_concurrent_file_ingestion", 8)
Createsession; configisoptional (defaultstoXetConfig() withHF_XET_*envoverrides)
session=hf_xet.XetSession(config=config)
Upload — multiplefiles, bytes, andstreamingwithinonecommitwithsession.new_upload_commit(
endpoint="https://cas.xethub.hf.co",
token="jwt", token_expiry_unix_secs=9999999999,
token_refresh_url="https://…/xet-write-token/main",
token_refresh_headers={"Authorization": "Bearer hf_…"},
) ascommit:
h1=commit.start_upload_file("/path/to/model.bin")
h2=commit.start_upload_file("/path/to/tokenizer.json", sha256="f2358d9a…")
h3=commit.start_upload_bytes(b"...", name="config.json")
withcommit.start_upload_stream(name="big.bin") asstream:
forchunkinproduce_chunks():
stream.write(chunk)
onnormalexit: wait_to_finish() iscalledautomaticallyonexception: abort() iscalledautomaticallySHA-256sentinelscommit.start_upload_file("/path/to/model.bin", sha256=hf_xet.COMPUTE_SHA256) # defaultcommit.start_upload_file("/path/to/model.bin", sha256=hf_xet.SKIP_SHA256) # skipProgresscallback — receives (GroupProgressReport, dict[UniqueID, ItemProgressReport])
defon_progress(group, items):
bar.n=group.total_bytes_completedbar.refresh()
withsession.new_upload_commit(
token_refresh_url="https://…/xet-write-token/main",
token_refresh_headers={"Authorization": "Bearer hf_…"},
progress_callback=on_progress,
progress_interval_ms=100,
) ascommit:
commit.start_upload_file("/path/to/model.bin")
</tr></table>

... (truncated)

Commits

• 6ed5a00 Bump rustls-webpki from 0.103.10 to 0.103.13 (#823)
• 1629992 Add context manager for upload stream (#825)
• 9e804c2 Remove unnecessary UniqueId -> UniqueID type alias (#824)
• 23ec294 Expose XetSession APIs to Python (#792)
• d40f96b Fix spelling typos in comments and docs (#826)
• 18ebe48 Bump hf_xet rand to 0.10 (#811)
• 145b819 feat: expose CAS client factory and chunk cache re-exports (#730)
• 8df04e8 Potential fix for a couple of crates release issues (#806)
• b43c0ae Move XetRuntime model away from thread-local statics (#801)
• 7e91d1c Upgrade testing capability for GC simulations (#786)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[nuntius-review]

Vesper: Empty diff

😴 Vesper could not find a diff to analyze.

[dependabot]

Superseded by #131.