Bump huggingface-hub from 1.24.0 to 1.25.1 in /.github/actions/download-models

[dependabot]

Bumps huggingface-hub from 1.24.0 to 1.25.1.

Release notes

Sourced from huggingface-hub's releases.

[v1.25.0] Auto-named Jobs, smarter progress bars & cache diagnostics

🏷️ Auto-named Jobs on creation

Jobs now get an automatic name when you don't provide one explicitly, derived from the Docker image (or UV script) plus a short hash of the command line. This means reruns of the same command share a consistent name, while different commands get distinct names — making it much easier to find and group related jobs in the UI or CLI. Names follow the server-side character rules: :, / and . in image tags are replaced with - so python:3.12 foo --truc becomes python-3-12-7c6db949. Explicit --name still takes precedence.

>>> hf jobs run --detach python:3.12 foo --truc
  id: 6a60b85c13e6ef894d54b949
Hint: Job auto-named 'python-3-12-7c6db949'. Pass `--name` or run `hf jobs labels <id> --name` to rename.

📚 Documentation: Jobs guide, CLI guide

• [Jobs] Auto-name Jobs on creation by @​Wauplin in #4566

🔧 Other QoL Improvements

• Add timeout parameter to safetensors metadata methods by @​go-bai in #4378
• [Download] [Fix] Update file-count progress bar on completion by @​Wauplin in #4560
• [Cache] Warn on inconsistency in cache by @​Wauplin in #4551 — docs

📖 Documentation

• Document the 150-character limit on collection descriptions by @​davanstrien in #4553 — docs
• [Docs] Fix compromised DO_NOT_TRACK URL by @​Wauplin in #4545
• Add SECURITY.md file by @​Wauplin in #4541

🐛 Bug and typo fixes

• [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK by @​sohumt123 in #4526
• Fix Windows crash when downloading into a deep local_dir by @​askalf in #4546
• [Fix] Do not fail on create space if exists_ok=True and 402 Payment required error by @​Wauplin in #4539
• [Repocard] Preserve order of appended keys in CardData.to_yaml by @​rahulrshetty45 in #4561
• [HfFileSystem] Raise FileNotFoundError when streaming a missing file by @​rahulrshetty45 in #4562
• [Upload] Forward token in _final_commit_info repo_info lookup by @​Wauplin in #4572

🏗️ Internal

• Post-release: bump version to 1.25.0.dev0 by @​huggingface-hub-bot[bot] in #4538
• [CI] Remove test_list_private_datasets flaky test by @​Wauplin in #4565

Commits

• 9bf0595 Release: v1.25.1
• aace894 [Sandbox] Don't inject the HF token in sandbox jobs as SBX_DL_TOKEN (#4583)
• 16fffe4 Release: v1.25.0
• 61a0164 Release: v1.25.0.rc0
• 922b819 [Repocard] Fix catastrophic backtracking (ReDoS) in REGEX_YAML_BLOCK (#4526)
• e8bb319 [Upload] Forward token in _final_commit_info repo_info lookup (#4572)
• d5c4425 [HfFileSystem] Raise FileNotFoundError when streaming a missing file (#4562)
• 1ae04ff [Jobs] Auto-name Jobs on creation (#4566)
• 74213cb [Repocard] Preserve order of appended keys in CardData.to_yaml (#4561)
• 3a60f15 [Download] [Fix] Update file-count progress bar on completion (#4560)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)