[davanstrien]

📋 Summary

Widens the huggingface-hub cap to <3 and upgrades the lock to 2.4.0, so Data Designer can be installed alongside packages that need hub 2.x. Data Designer's own Hub calls needed no changes. The only source change is one logger name.

🔗 Related Issue

Fixes #1110

🔄 Changes

• Widen the cap to huggingface-hub>=1.0.1,<3 in data-designer and data-designer-engine
• Upgrade the lock to hub 2.4.0. This also moves click to 8.4.2, hf-xet to 1.8.0, sqlfluff to 4.4.0 (4.2.1 caps click at <8.4) and datasets to 5.1.0 (5.0.1 caps hub at <2), and adds httpx2, httpcore2, httpx2-jsfetch and truststore
• Add httpx2 to _DEFAULT_NOISY_LOGGERS. Hub 2.x sends requests through httpx2, so without this every Hub request logs at INFO, including signed CDN URLs
• Fix test_app_rejects_unknown_options_before_script_separator for click 8.4

A correction to the issue: the test doesn't fail because of line wrapping. Click 8.4 changed the wording from No such option: --x to No such option '--x'., so normalising whitespace wouldn't fix it. The test now checks No such option and --num-recrods separately, which passes on click 8.3.3 and 8.4.2.

🧪 Testing

• make test passes (run as pytest per package in a locked environment on macOS, Python 3.12: config 830 passed, engine 2862 passed, interface 1309 passed and 11 skipped; the httpx2 line came after this run, and the 37 logging tests were re-run after it)
• Unit tests added/updated
• E2E tests added/updated (if applicable)

I ran two live smoke tests on hub 2.4.0 against temporary private dataset repos, deleted afterwards. The scripts aren't part of this PR.

Small run:

• push_to_hub_from_folder to a new repo, then again to the same repo
• Dataset card load
• An invalid token gives the expected authentication error

Larger run (242 MB: 3 parquet batches of 40,000 rows, 20 images, 1 processor output):

• push_to_hub_from_folder uploaded every file in 18 s, and a downloaded batch matched by SHA-256
• HuggingFaceSeedReader returned the expected columns and 120,000 rows
• A full DuckDB scan through HfFileSystem took 6 s, and the row count and checksums matched
• No HTTP Request lines appeared in the log after configure_logging()

Not tested: a live run on hub 1.x (44 mocked Hugging Face integration tests pass on 1.0.1), and custom CA certificates (SSL_CERT_FILE) under the new HTTP stack.

Notes for review

• hf-xet 1.8.0 was released on 2026-10-30, the day this lock was generated. Hub only needs >=1.6, so it's easy to hold back if you prefer.
• typer>=0.12 looks too low, separately from this PR: typer 0.15.2 --help raises TypeError on click 8.3.3 as well as 8.4.2, and 0.16.0 works on 8.4.2. I left it for a follow-up.
• Running the data-designer test suite rewrites the repo's uv.lock using the local user's uv config. This also looks separate from this PR, and I haven't traced it to a specific test (the plugin install tests are my first guess). It's worth knowing if you have a custom index or exclude-newer in your uv config.

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous finding is fixed and no new actionable issues remain.

Summary

Allows huggingface-hub 2.x alongside the existing 1.x range.

• Data Designer packages can use Hugging Face Hub versions below 3.
• Default logging keeps Hub 2.x request messages quiet.

_{Reviews (3) · Last reviewed commit: "test: annotate noisy logger test paramet..." · Reviewed by Greptile}

[andreatnvidia]

Thanks for this! Supporting Hub 2.x while keeping 1.x compatibility is useful. We’ll confirm which release to target shortly.

[andreatnvidia]

Could we extend test_configure_logging_silences_default_noisy_loggers to cover httpx2 too? Parametrizing it over httpx and httpx2, and resetting each logger’s level before configuring logging, would protect against regressions and test-order effects. Non-blocking suggestion.

[davanstrien]

Done in d363fa7, with type annotations added in 0c0cc2e.

[andreatnvidia]

Could we add a patched httpx2 minimum to the existing workspace/e2e security constraints and regenerate constraints.txt? The locked 2.16.0 is fine, but Hub’s dependency range also permits older releases with known advisories. This would follow the existing approach for transitive security floors. Non-blocking suggestion.

[davanstrien]

Thanks, both suggestions done in d363fa7, and I rebased on main.

• Added httpx2>=2.12.0 to the workspace and e2e constraints and regenerated constraints.txt. 2.12.0 is the lowest version that patches all five published advisories. The lock stays on 2.16.0.
• Parametrized the noisy logger test over httpx, httpx2 and matplotlib, with each level reset first. The httpx2 case fails if the logger is removed from the defaults.

make check-vulnerabilities is clean, and the logging, CLI and security constraint tests pass. I didn't re-run the full tests locally after the rebase.