* Bump the actions group with 17 updates (#12)
Bumps the actions group with 17 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.2.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.6.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.3.0` |
| [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) | `e60a538eea9817ab312196d0d233604b01697265` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` |
| [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `e60a538eea9817ab312196d0d233604b01697265` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.155` | `1.0.193` |
| [huggingface/security-workflows/.github/workflows/codeql-reusable.yml](https://github.com/huggingface/security-workflows) | `1.1.0` | `1.2.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [actions/labeler](https://github.com/actions/labeler) | `5.0.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.2` |
| [huggingface/tailscale-action](https://github.com/huggingface/tailscale-action) | `7d53c9737e53934c30290b5524d1c9b4a7c98c8a` | `07d36e4c3b68707bd3fe070dbb96f03f993a6efd` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.94.2` | `3.97.0` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.42.1` | `1.49.0` |
| [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `9ad2de8582b56c017cb530c1165116d40433f1c6` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |
Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)
Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...v7.0.1)
Updates `docker/setup-buildx-action` from 3.12.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](8d2750c68a...bb05f3f551)
Updates `docker/login-action` from 3.7.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](c94ce9fb46...dbcb813823)
Updates `docker/build-push-action` from 6.19.2 to 7.3.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](10e90e3645...53b7df96c9)
Updates `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` from e60a538eea9817ab312196d0d233604b01697265 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](e60a538eea...af49b8dc38)
Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.6.0...v7)
Updates `huggingface/doc-builder/.github/workflows/build_pr_documentation.yml` from e60a538eea9817ab312196d0d233604b01697265 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](e60a538eea...af49b8dc38)
Updates `anthropics/claude-code-action` from 1.0.155 to 1.0.193
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](80b3182633...9d7150bc8a)
Updates `huggingface/security-workflows/.github/workflows/codeql-reusable.yml` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/huggingface/security-workflows/releases)
- [Commits](dc6ca34688...e0d40aaf3c)
Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4.3.0...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)
Updates `actions/labeler` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](8558fd7429...bf12e9b00b)
Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](ed0c53931b...dc37677b2e)
Updates `huggingface/tailscale-action` from 7d53c9737e53934c30290b5524d1c9b4a7c98c8a to 07d36e4c3b68707bd3fe070dbb96f03f993a6efd
- [Release notes](https://github.com/huggingface/tailscale-action/releases)
- [Commits](7d53c9737e...07d36e4c3b)
Updates `trufflesecurity/trufflehog` from 3.94.2 to 3.97.0
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](6bd2d14f7a...bcfcf73aaf)
Updates `crate-ci/typos` from 1.42.1 to 1.49.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](65120634e7...8a48f81b6c)
Updates `huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml` from 9ad2de8582b56c017cb530c1165116d40433f1c6 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](9ad2de8582...af49b8dc38)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/setup-buildx-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/login-action
dependency-version: 4.6.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: docker/build-push-action
dependency-version: 7.3.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml
dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
dependency-type: direct:production
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml
dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
dependency-type: direct:production
dependency-group: actions
- dependency-name: anthropics/claude-code-action
dependency-version: 1.0.193
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: huggingface/security-workflows/.github/workflows/codeql-reusable.yml
dependency-version: 1.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: huggingface/tailscale-action
dependency-version: 07d36e4c3b68707bd3fe070dbb96f03f993a6efd
dependency-type: direct:production
dependency-group: actions
- dependency-name: trufflesecurity/trufflehog
dependency-version: 3.97.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: crate-ci/typos
dependency-version: 1.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml
dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
dependency-type: direct:production
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Scope GITHUB_TOKEN permissions per job (#16)
A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.
Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
* Pin GitHub Actions to commit SHAs (#17)
A tag is mutable: whoever controls the action's repository can move
`v4` to different code, and the next run picks it up with no diff to
review. Pinning to the commit SHA freezes the code that runs today.
Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
* Bump doc-builder workflow pin (#22)
* Bump doc-builder pin to 9fc8a41 in build_documentation.yml
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Bump doc-builder pin to 9fc8a41 in build_pr_documentation.yml
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Bump doc-builder pin to 9fc8a41 in upload_pr_documentation.yml
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add FLUX.3 image: Flux3Transformer2DModel and modular text-to-image / image-to-image pipeline
Adds the FLUX.3 image transformer, the modular pipeline (text-to-image and image-to-image with one
prompt per call and one or more reference images), Flux3ImageProcessor, the converter for BFL's
model package, tests and docs. Verified against BFL's reference on the real checkpoint
(integration-notes/parity_bf16.py, temporary folder).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* integration-notes: ship the knight example image with the doc examples
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* integration-notes: drop the tokenizer config workaround (not needed with transformers 5.x)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Address review: rename the mode channel dict and the final norm, name the reference workflow
image_conditioned, document the guidance scale
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Add the step-distilled FLUX.3 image model (flow map)
- transformer: `flow_map` config and `target_timestep_embedder`; forward takes
`target_timestep` (the timestep each step jumps to), added to the modulation
of every mode and the final layer
- convert script: map `ref_time_in.*` and read `flow_map` from the package config
- modular: dedicated `Flux3Distilled*` blocks (text encoder, text input, text
RoPE inputs, denoiser) with no guider and no negative prompt, 16 steps by
default; `Flux3DistilledAutoBlocks` and `Flux3DistilledModularPipeline`
- tests for the flow-map transformer path and the distilled modular pipeline
- docs: step-distilled section and autodoc entries
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Add the step-distilled examples script
Same four cases as flux3_examples.py, run against the distilled Hub repo.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat: add a single file support in Flux3 image. (#32)
* Warn about the denoiser input fields that are not passed to the transformer
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Document reproducible generation with user-provided latents
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Run the QK norm and RoPE in fp32 with a single cast back, matching the BFL implementation
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* parity script: run against the Hub repos and print the imported diffusers source
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Wrap a forward docstring line for the doc-builder style check
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* support lora loading (including ostris) in flux3 image pipeline. (#25)
* feat: support loading and performing inference with single-file formatted FP8 and NVFP4 checkpoints (#24)
* feat: support loading siungle file format checkpoints including quants.
* remove updates.patch
* remove fluff.
* feat: add a single file support in Flux3 image.
* bfl prefix
* version guard.
* prpoagate changes.
* add tests
* doc mods and remove integration notes
* remove script for quant
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* add LoRA training for Flux 3 image small
* tests: clarify FLUX3_TINY_REPO comment
The tiny repo is uploaded to hf-internal-testing and the env var is a
local-dev escape hatch, not a pre-PR TODO.
* examples/flux3: drop unused args and dead class
Remove the text-encoder weight-decay arg from both trainers (neither
trains the text encoder) and, from the img2img trainer, the
prior-preservation leftovers (--class_data_dir, --sample_batch_size,
PromptDataset) that it never uses.
* bump yarn example rank to 32 in flux3 small readme
* Document <ref_image_n> references and layout prompts for FLUX.3
Matches the prompt grammar in BFL's reference inference code (bfl-hf-flux3-confidential#3): references are addressed as <ref_image_n> in the order passed to image, and regions can be placed with a trailing JSON list of id / bbox / desc (from / src_bbox / tgt_bbox when editing).
* examples/flux3: set klein model id, document ref image prompts, clean leftover refs
* point flux3 image docs at the klein release model ids
* fix: TestFlux3DistilledModularPipelineWorkflow::test_workflow_defaults test (#35)
* fix checkpoint ids in the flux3 docs. (#38)
* [docs] update pipe loading with vae fp32 dtype (#39)
* update pipe loading with vae fp32 dtype
* updating `load_componenets`
* use actual ckpts. (#42)
* flux3 klein example: rename from "small" and fix caption dropout for long prompts (#41)
* examples/flux3: rename small trainer, tests and readme files to klein
* examples/flux3: fix caption dropout shape mismatch for prompts longer than the pad window
* examples/flux3: add caption dropout to the i2i trainer
* examples/flux3: complete the klein rename (test class names, example output dirs)
* examples/flux3: guard against train_batch_size>1 with variable-length captions
* update flux3.md (#43)
* examples/flux3: support train_batch_size>1 and prior preservation with variable-length captions (#44)
* doc
* autodocstrings.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Co-authored-by: Pauline Bailly-Masson <155966238+paulinebm@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: yiyixuxu <yixu310@gmail.com>
Co-authored-by: linoytsaban <linoy.tsaban@gmail.com>
Co-authored-by: apolinário <joaopaulo.passos@gmail.com>
Co-authored-by: Linoy Tsaban <57615435+linoytsaban@users.noreply.github.com>
Co-authored-by: Aritra Roy Gosthipaty <aritra.born2fly@gmail.com>
Co-authored-by: Yumeng Li <109459218+YumengLi007@users.noreply.github.com>
* fix(torchao): route root-level tensors around safetensors reconstruction
Models with parameters at the root of the module tree (e.g. Wan's
`scale_shift_table`) crashed torchao's `unflatten_tensor_state_dict`
when loading serialized checkpoints, since flattened tensor names are
assumed to carry a module prefix. Filter such tensors and their
metadata entries out of the reconstruction and merge them back
unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(bnb): defer 8-bit weights split from their SCB stats across shards
Sharded serialization can place an 8-bit weight and its `SCB`
statistics in different shard files, in which case the shard-by-shard
loader failed with "Missing quantization component `SCB`". Hold the
incomplete half of the pair back until its counterpart arrives with a
later shard, mirroring the torchao pending mechanism, and disable
parallel shard loading for prequantized 8-bit checkpoints.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [tests] extend model-level quantization tester mixins
Migrate remaining model-level coverage from tests/quantization into the
tester mixins so it runs for every wired model:
- base: buffer-placement assertions in the device-map test, and an
opt-in sharded-serialization test enabled by setting
`sharded_serialization_config`
- bnb: serialization across all configs (sharded included), dtype
assignment and adapter training for 8-bit, device moves preserving
the memory footprint, corrupted-state-dict loading error, and a fixed
modules-to-not-convert test (BitsAndBytesConfig only exposes
llm_int8_skip_modules; the old test passed an unsupported kwarg and
only survived by being skipped)
- torchao: custom device maps with cpu/disk offload, generalized from
the Flux-specific test
- gguf: the diffusers-format single-file loading path, wired into the
Flux model tests
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [tests] fix model-level quantization test wiring
- SD3.5: the quantized testers reused the random-init dummy inputs
(4 latent channels, fp32) while the tiny Hub checkpoint has
in_channels=8 and the quantizers load the model in half precision;
give them matching inputs and relax the 4-bit memory expectation for
the tiny checkpoint.
- QwenImage / Flux2: the quantized testers had no Hub checkpoint wired
at all, so every test errored; point them at
hf-internal-testing/tiny-qwenimage-pipe and tiny-flux2 with matching
inputs.
- NucleusMoE: no tiny checkpoint exists on the Hub yet; comment the
testers out like the LTX ones.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [tests] split tests/quantization into pipeline-level and backend-level tiers
Pipeline-level quantization tests (pipeline quality slices, cpu offload,
LoRA loading, compile, PipelineQuantizationConfig) move to
tests/pipelines/testing_utils/quantization.py, marked per backend so the
nightly CI can select them with `pytest -m`. tests/quantization keeps
only backend-level tests that fit neither tier: config validation,
utility warnings, and GGUF CUDA kernel correctness. Tests already
covered by the model-level mixins are dropped.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [ci] select nightly quantization tests by marker across test tiers
Each backend job now runs `pytest -m <marker>` over tests/models,
tests/quantization, and tests/pipelines/testing_utils/quantization.py,
giving the model-level mixin tests a nightly home with the backend
dependencies installed. The torchao job additionally installs mslk.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: sayak@huggingface.co <sayak@ip-10-53-90-45.ec2.internal>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* initial
* fix code quality
* dependency test fix
* apply review suggestions
* add extras and version check
* fix gating and prefer local cache for modular
* simplify transformers registration and make the version warning silenceable
* remove pipeline level test
* only model level testing
* layers to quantizze, change em dashes
* env flag for transformers
---------
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* Fix training gradient underflow in quantization tests
Change autocast dtype from float16 to bfloat16 in _test_quantization_training.
Float16's limited dynamic range causes gradients to underflow to zero when
passing through quantized tensor subclass operations.
* fix autocast dtype check
Signed-off-by: jiqing-feng <jiqing.feng@intel.com>
---------
Signed-off-by: jiqing-feng <jiqing.feng@intel.com>
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* remove str option for quantization config in torchao
* Apply style fixes
* minor fixes
* Added AOBaseConfig docs to torchao.md
* minor fixes for removing str option torchao
* minor change to add back int and uint check
* minor fixes
* minor fixes to tests
* Update tests/quantization/torchao/test_torchao.py
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* Update docs/source/en/quantization/torchao.md
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* Update tests/quantization/torchao/test_torchao.py
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* version=2 update to test_torchao.py
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Sayak Paul <spsayakpaul@gmail.com>
* support device type device_maps to work with offloading.
* add tests.
* fix tests
* skip tests where it's not supported.
* empty
* up
* up
* fix allegro.
