build(deps): bump huggingface-hub from 0.36.0 to 1.2.3

[dependabot]

Bumps huggingface-hub from 0.36.0 to 1.2.3.

Release notes

Sourced from huggingface-hub's releases.

[v1.2.3] Fix private default value in CLI

Patch release for #3618 by @​Wauplin.

When creating a new repo, we should default to private=None instead of private=False. This is already the case when using the API but not when using the CLI. This is a bug likely introduced when switching to Typer. When defaulting to None, the repo visibility will default to False except if the organization has configured repos to be "private by default" (the check happens server-side, so it shouldn't be hardcoded client-side).

Full Changelog: huggingface/huggingface_hub@v1.2.2...v1.2.3

[v1.2.2] Fix unbound local error in local folder metadata + fix hf auth list logs

• Fix unbound local error when reading corrupted metadata files by @​Wauplin in #3610
• Fix auth_list not showing HF_TOKEN message when no stored tokens exist by @​hanouticelina in #3608

Full Changelog: huggingface/huggingface_hub@v1.2.1...v1.2.2

v1.2.1: Smarter Rate Limit Handling, Daily Papers API and more QoL improvements!

🚦 Smarter Rate Limit Handling

We've improved how the huggingface_hub library handles rate limits from the Hub. When you hit a rate limit, you'll now see clear, actionable error messages telling you exactly how long to wait and how many requests you have left.

HfHubHTTPError: 429 Too Many Requests for url: https://huggingface.co/api/models/username/reponame.
Retry after 55 seconds (0/2500 requests remaining in current 300s window).

When a 429 error occurs, the SDK automatically parses the RateLimit header to extract the exact number of seconds until the rate limit resets, then waits precisely that duration before retrying. This applies to file downloads (i.e. Resolvers), uploads, and paginated Hub API calls (list_models, list_datasets, list_spaces, etc.).

More info about Hub rate limits in the docs 👉 here.

• Parse rate limit headers for better 429 error messages by @​hanouticelina in #3570
• Use rate limit headers for smarter retry in http backoff by @​hanouticelina in #3577
• Harmonize retry behavior for metadata fetch and HfFileSystem by @​hanouticelina in #3583
• Add retry for preupload endpoint by @​hanouticelina in #3588
• Use default retry values in pagination by @​hanouticelina in #3587

✨ HF API

Daily Papers endpoint: You can now programmatically access Hugging Face's daily papers feed. You can filter by week, month, or submitter, and sort by publication date or trending.

from huggingface_hub import list_daily_papers
for paper in list_daily_papers(date="2025-12-03"):
print(paper.title)
DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models
ToolOrchestra: Elevating Intelligence via Efficient Model and Tool Orchestration
MultiShotMaster: A Controllable Multi-Shot Video Generation Framework
Deep Research: A Systematic Survey
MG-Nav: Dual-Scale Visual Navigation via Sparse Spatial Memory
...
</tr></table>

... (truncated)

Commits

• 90faf8b Release: v1.2.3
• e333fed [CLI] Fix private should default to None, not False (#3618)
• 222bb9d Release: v1.2.2
• 877cec0 Fix unbound local error when reading corrupted metadata files (#3610)
• 8519f0d log a message when HF_TOKEN is set in auth list (#3608)
• d0bc914 Release: v1.2.1
• 59dd9f5 Merge branch 'main' into v1.2-release
• 5ad0254 Rename utility to is_offline_mode (#3598)
• 231c4cc Release: v1.2.0
• dc6e7be Release: v1.2.0.rc0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[lukehinds]

@dependabot rebase