chore(deps): bump the python-deps group across 1 directory with 3 updates

[dependabot]

Updates the requirements on pyarrow, huggingface-hub and sentence-transformers to permit the latest version.
Updates pyarrow to 25.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 25.0.0

Release Notes URL: https://arrow.apache.org/release/25.0.0.html

Commits

• 59bea6e MINOR: [Release] Update versions for 25.0.0
• 381fab6 MINOR: [Release] Update .deb/.rpm changelogs for 25.0.0
• 7f72d5b MINOR: [Release] Update CHANGELOG.md for 25.0.0
• fe2f85c GH-50336: [Release][Archery] Fix archery GitHub integration for release scrip...
• c658548 GH-50293: [CI] Run check-labels for all triggers to avoid cancelling further ...
• f83c8ca GH-50330: [C++][R][Parquet] Add missing typename in RleBitPackedDecoderGetRun...
• 35e0f63 GH-50318: [R][CI] Install missing libpng-dev for test-r-linux-as-cran (#50328)
• 61ca7a9 GH-50295: [C++][R] #include <ranges> in vector_select_k.cc breaks macOS CRAN ...
• 1b6edb8 GH-50291: [Python][Packaging] Stop using nightly build dependencies for build...
• e183ea9 MINOR: [Docs] Add Timestamp With Offset to canonical extension types status (...
• Additional commits viewable in compare view

Updates huggingface-hub to 1.23.0

Release notes

Sourced from huggingface-hub's releases.

[v1.23.0] Space templates, CLI extension updates & smoother Xet downloads

🚀 Create Spaces from templates

You can now seed a new Space from one of the official Hub templates (JupyterLab, a Gradio chatbot, a Streamlit app, etc.) instead of starting from an empty repo. List what's available with the new list_space_templates() API or the hf spaces templates CLI command, then pass a template's repo_id (or its short name) to create_repo(..., space_template=...) or hf repos create --type space --template. The Space SDK is inferred from the template, and templates recommended as private (like JupyterLab) are created privately by default unless you explicitly choose a visibility.

# List available templates
$ hf spaces templates
NAME        REPO_ID                             SDK     PREFERRED_PRIVATE
----------- ----------------------------------- ------- -----------------
Streamlit   streamlit/streamlit-template-space  docker
JupyterLab  SpacesExamples/jupyterlab           docker  ✔
Create a Space from a template
$ hf repos create my-jupyterlab --type space --template jupyterlab
✓ Repo created
repo_id: Wauplin/my-jupyterlab
url: https://huggingface.co/spaces/Wauplin/my-jupyterlab

>>> from huggingface_hub import create_repo
>>> create_repo("my-jupyterlab", repo_type="space", space_template="jupyterlab")

• Support creating a Space from a template by @​moon-bot-app[bot] in #4504

🔌 Update installed CLI extensions

A new hf extensions update command brings your installed CLI extensions to their latest published version on GitHub. Pass a name to update a single extension, or run it with no argument to check every installed extension and update the ones that are behind. Updates are applied in place — Python extensions reuse their existing venv and binary extensions are overwritten — so a failed update no longer leaves the extension uninstalled, and extensions that are already up to date are simply skipped.

# Update a single extension (accepts <name>, hf-<name> or OWNER/hf-<name>)
hf extensions update hf-claude
Check every installed extension and update the outdated ones
hf extensions update

• [CLI] Add hf extensions update command by @​Wauplin in #4496

📶 Smoother Xet download progress with dual bars

Xet downloads now show two progress bars so you can tell a transfer is alive even on a slow connection. The transfer bar advances as bytes arrive over the network, while the reconstruction bar tracks real progress as buffered chunks are written to disk — previously the single bar could sit at 0% for a long time while data was actually arriving. The dual bars are wired into single-file downloads (hf_hub_download), snapshot_download (where parallel file downloads feed the repo-level transfer and reconstruction bars), the hf download CLI, and bucket downloads.

big.bin: downloading bytes:   |  52.4MB     1.2MB/s
big.bin: reconstructing file: |  52.4MB / 105MB     800kB/s
</tr></table> 

... (truncated)

Commits

• 0c92853 Release: v1.23.0
• 6bc5aa0 Release: v1.23.0.rc0
• 0815693 [CLI] Generate hf-cli skill locally instead of downloading from bucket (#4199)
• 923acb0 [Utils] Add get_cached_repo_tree utility (#4513)
• 7625ea3 Expose snapshot_path on IncompleteSnapshotError (#4500)
• c5a110d [CLI] Add --pipeline-tag, --gated, --apps filters to hf models ls (#4512)
• b63ed5b [Utils] Treat backslashes as path separators in filter_repo_objects (#4506)
• 6d40d9c docs: drop /new from Inference Endpoints web interface links (#4509)
• ed48426 [CI] Fix expand property type tests (#4510)
• 790120b Support creating a Space from a template (#4504)
• Additional commits viewable in compare view

Updates sentence-transformers to 5.6.0

Release notes

Sourced from sentence-transformers's releases.

v5.6.0 - Fixes for Causal LM Rerankers, Hard-Negative Mining, and More

This minor version is a correctness- and robustness-focused release. It fixes a silent scoring bug for causal-LM rerankers, corrects several hard-negative mining and GIST loss edge cases, restores TSDAE on transformers v5, and adds Apple Silicon (MPS) support for the cached losses.

The headline fix affects chat-template models that read the final token position, i.e. causal-LM rerankers (like Qwen3-Reranker) and last-token-pooling embedders: when an over-long input was truncated, the chat template's trailing suffix (e.g. the assistant prefill the model scores from) was silently dropped, producing wrong scores with no error. There's also a forward-looking deprecation: loading local custom code without trust_remote_code=True now warns, and will require it from v6.0.

Install this version with

# Training + Inference
pip install sentence-transformers[train]==5.6.0
Inference only, use one of:
pip install sentence-transformers==5.6.0
pip install sentence-transformers[onnx-gpu]==5.6.0
pip install sentence-transformers[onnx]==5.6.0
pip install sentence-transformers[openvino]==5.6.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==5.6.0
pip install sentence-transformers[audio]==5.6.0
pip install sentence-transformers[video]==5.6.0
Or combine as needed:
pip install sentence-transformers[train,onnx,image]==5.6.0

Fixed silently wrong scores when truncation drops chat-template suffixes (#3787)

Chat-template models render the full conversation to a flat string before tokenizing, so when the rendered input is longer than the tokenizer's model_max_length, the tokenizer truncates it from the right and drops the template's trailing suffix: the fixed tokens a template appends after the content, e.g. a prompt, instruction, [/INST], or a trailing EOS. For models that read the final token position, this silently corrupted the result:

• causal-LM rerankers (e.g. Qwen/Qwen3-Reranker-0.6B) score a pair from the last token's yes/no logits, and
• last-token-pooling embedders read the final hidden state.

When the suffix was truncated away, that final position landed mid-document instead of after the prefill, so the score or embedding came from the wrong place.

Transformer.preprocess now detects when truncation drops the suffix and splices it back onto the tail of each truncated row. Because the fix lives in the shared base Transformer, it applies across SentenceTransformer, CrossEncoder, and SparseEncoder. It's enabled by default and saved to the model configuration. Pass processing_kwargs={"chat_template": {"restore_suffix": False}} to opt back into raw truncation.

Hard-negative mining and GIST loss correctness (#3821, #3817, #3816)

A trio of correctness and scalability fixes for hard-negative mining and the GIST losses:

• Sign-independent relative margin: mine_hard_negatives(relative_margin=...) and the margin_strategy="relative" branch of GISTEmbedLoss / CachedGISTEmbedLoss used a multiplicative threshold (positive * (1 - margin)) that only behaves correctly when the positive-pair similarity is positive. When that similarity was negative, the threshold moved the wrong way and let through false negatives: candidates more similar to the anchor than the true positive. The threshold is now positive - |positive| * margin, identical to before for positive scores but correct for negative ones.
• Distributed positive masking in the GIST losses: with gather_across_devices=True and a non-zero margin, the false-negative suppression mask protected the wrong columns on ranks beyond the first (it ignored the per-rank offset into the gathered batch), which set the true positive's logit to -inf and produced a +inf loss. The mask now accounts for the cross-rank offset, so multi-GPU GIST training stays finite.
• Memory-bounded mining without FAISS: mine_hard_negatives(use_faiss=False) (the default) materialized the full (queries × corpus) similarity matrix at once, which could OOM on large corpora. It now batches over the query axis (controlled by faiss_batch_size, default 16384), bounding peak memory while producing identical results.

TSDAE weight tying restored on transformers v5 (#3781)

transformers v5 removed the private PreTrainedModel._tie_encoder_decoder_weights helper that DenoisingAutoEncoderLoss (TSDAE) used to tie its separate encoder and decoder. As a stopgap, v5.5 raised a RuntimeError for the default tie_encoder_decoder=True on transformers >= 5.0.0, effectively breaking TSDAE there unless you pinned an older transformers or disabled tying. TSDAE now ships its own tying routine that shares storage between encoder and decoder, so it works on both transformers <5 and >=5 with the default settings.

Deprecation: loading local custom code without trust_remote_code (#3807)

... (truncated)

Commits

• 9c73df3 Release v5.6.0
• 222b052 [fix] Don't override device_map placement with the device argument (#3823)
• a38a6bf Fix causal LM reranker scoring when max_length truncates chat-template suffix...
• 1812103 [fix] Make relative margin sign-independent in mining and GIST losses (#3821)
• ae1acc3 Warn when loading local custom code without trust_remote_code (#3807)
• 429cf5d [fix] Support MPS in the cached losses' RandContext (#3812)
• 77fdbff [fix] fix MPS errors (#3818)
• bfba988 [fix] Fix positive masking in GIST losses with multi-GPU + gather_across_devi...
• 29e382b [docs] Fix doc build problems (part 1) (#3811)
• d16e6bf [fix] Avoid materializing the full similarity matrix in mine_hard_negatives w...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions