deps(deps): bump hf-xet from 1.2.0 to 1.5.2

[dependabot]

Bumps hf-xet from 1.2.0 to 1.5.2.

Release notes

Sourced from hf-xet's releases.

[hf-xet v1.5.2] Fix HTTP Request Retry

Problems addressed

• This release fixes a bug in HTTP request retry configuration that could cause apparent hangs under poor network conditions when a request was retried more than twice. Related PR: huggingface/xet-core#893

New Contributors

• @​kszucs made their first contribution in huggingface/xet-core#872

Full Changelog: huggingface/xet-core@v1.5.1...v1.5.2

[hf-xet v1.5.1] Progress Reporting Improvement

Problems addressed

• Missing final progress update — Progress was only emitted on a fixed poll interval, so the last snapshot could be skipped when upload/download finished between ticks (e.g. UI stuck below 100%).

• Panic on shutdown — The background progress thread used Python::attach while the interpreter was tearing down, which can panic when the GIL is no longer available.

Full Changelog: huggingface/xet-core@1.5.0...v1.5.1

[hf-xet v1.5.0] Session based API

Replaces the old upload_files / download_files / hash_files Python functions with a new object-oriented API that exposes XetSession and its child objects directly as PyO3 classes. This gives Python callers full control over session lifecycle, connection pooling, and progress reporting.

The previous module-level functions are kept under hf_xet/src/legacy/ and remain importable as from hf_xet import upload_files etc., but now emit DeprecationWarning.

New Python API

import hf_xet
Optional: create a custom config (immutable; use .with_config() to derive updates)
config = hf_xet.XetConfig().with_config("data.max_concurrent_file_ingestion", 8)
Create session; config is optional (defaults to XetConfig() with HF_XET_* env overrides)
session = hf_xet.XetSession(config=config)
Upload — multiple files, bytes, and streaming within one commit
with session.new_upload_commit(
endpoint="https://cas.xethub.hf.co",
token="jwt", token_expiry_unix_secs=9999999999,
token_refresh_url="https://…/xet-write-token/main",
token_refresh_headers={"Authorization": "Bearer hf_…"},
) as commit:
h1 = commit.start_upload_file("/path/to/model.bin")
h2 = commit.start_upload_file("/path/to/tokenizer.json", sha256="f2358d9a…")
h3 = commit.start_upload_bytes(b"...", name="config.json")
with commit.start_upload_stream(name="big.bin") as stream:
for chunk in produce_chunks():
    stream.write(chunk)

on normal exit: wait_to_finish() is called automatically
on exception:   abort() is called automatically
</tr></table>

... (truncated)

Commits

• cb96dfe Bump hf-xet to 1.5.2 (#902)
• fc6cbec Fix retry strategy configuration (#893)
• 553480b Update xtool to add GC simulation functionality (#759)
• f8598c2 chore: bump crate versions to 1.5.3 (#890)
• 0e47400 fix(client): call versioned /v1/shards endpoint for shard uploads (#879)
• 9d4e182 feat: add lifecycle-tag deletion mode to simulation clients (#882)
• bebdf4b feat: gate internal-only dependencies behind an internal-tools feature (#872)
• f408d7f Drop hf-xet Python release for Python 3.13t (#877)
• 8680670 feat(wasm): make hf-xet compile for wasm32-unknown-unknown (#841)
• a79cd63 build: bump pyo3 0.26 → 0.29 (fix RUSTSEC-2026-0176/0177) (#876)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)