fix(deps): update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
huggingface-hub	>=1.16.1,<2.0 → >=1.16.4,<2.0
ty (changelog)	>=0.0.39 → >=0.0.40

---

Release Notes

huggingface/huggingface_hub (huggingface-hub)

v1.16.4: [v1.16.4] hot fix: Fix typer>=0.26.0 compatibility

Compare Source

• [CI] Cap typer below 0.26.0 (CLI incompatibility) #​4272

• [CI] Add click as explicit dependency #​4270

Full Changelog: huggingface/huggingface_hub@v1.16.1...v1.16.4

v1.16.3

Compare Source

astral-sh/ty (ty)

v0.0.40

Compare Source

Released on 2026-05-27.

Bug fixes

• Accept complete enum-literal alias unions as enums (#​25341)
• Fix diagnostics in ignored folders after adding new files (#​25236)
• Show LiteralString when hovering over an inline of a literal string (#​25373)

LSP server

• Follow aliases when resolving stub mappings (#​25328)
• Treat Python notebook text documents as Python sources (#​25393)
• Recover incomplete list comprehension elements (#​25326)

Diagnostics

• Add help message to invalid-generic-class variance diagnostic (#​25385)

Core type checking

• Ignore and reject annotations on non-name targets (#​25324)
• Infer class attributes assigned by metaclass initialization (#​25342)
• Reject inconsistent generic bases in dynamic classes (#​25413)
• Resolve enum names for all unions arms in literal enum subsets (#​25379)
• Support typing.TypeForm (#​25334)
• Use constraint sets as pending state in SpecializationBuilder (#​24540)

Contributors

• @​anuraaga
• @​dcreager
• @​charliermarsh
• @​MichaReiser
• @​Dev-X25874

---

Configuration

📅 Schedule: (in timezone Asia/Ho_Chi_Minh)

• Branch creation
  • "before 5am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/huggingface-hub	1.16.4	🟢 6.3	Details Check Score Reason Code-Review 🟢 8 Found 23/26 approved changesets -- score normalized to 8 Maintained 🟢 10 30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST 🟢 7 SAST tool is not run on all commits -- score normalized to 7
pip/ty	0.0.40	Unknown	Unknown

Scanned Files

• uv.lock

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	huggingface-hub@​1.16.1 ⏵ 1.16.4
	ty@​0.0.39 ⏵ 0.0.40

View full report