[dependabot]

Bumps datasets from 4.8.5 to 5.0.1.

Release notes

Sourced from datasets's releases.

5.0.1

Bug fixes

• Fix version string in init.py by @​qgallouedec in huggingface/datasets#8244
• fix conda build by @​lhoestq in huggingface/datasets#8250
• Fix JSON loader schema inference for files starting with a UTF-8 BOM (#8241) by @​archievi in huggingface/datasets#8243
• Support hermes traces by @​lhoestq in huggingface/datasets#8255
• Fix batch(by_column=...) crashing after shard/shuffle/split by @​pkooij in huggingface/datasets#8259
• fix traces streaming by @​lhoestq in huggingface/datasets#8277
• support droid agent traces by @​cfahlgren1 in huggingface/datasets#8263
• Fix CI: commit operation equality (hfh 1.20.0) and pytest parametrize collection error by @​Wauplin in huggingface/datasets#8283
• Fix lance auth by @​lhoestq in huggingface/datasets#8301
• Fix symlink-following arbitrary file write in archive extraction by @​AAtomical in huggingface/datasets#8303
• Bug Fix: Resuming Twice Resets the Dataloader by @​francesco-bertolotti in huggingface/datasets#8295
• Bump fsspec and simpler wds compr by @​lhoestq in huggingface/datasets#8337
• fix: validate Arrow IPC record batches by @​XciD in huggingface/datasets#8350
• Make the dataset fingerprint independent of Arrow chunking by @​SuryanshSS1011 in huggingface/datasets#8339
• Fix casting a nullable LargeList to a different inner type by @​vineethsaivs in huggingface/datasets#8346
• docs: replace AutoFeatureExtractor with AutoImageProcessor in image preprocessing docs by @​gautamkishore in huggingface/datasets#8326
• Fix column drop in Arrow path of axis=1 concatenation by @​ebarkhordar in huggingface/datasets#8342
• Raise on length mismatch in batched IterableDataset.map by @​sohumt123 in huggingface/datasets#8332
• Fix require_storage_embed recursing into require_storage_cast by @​vineethsaivs in huggingface/datasets#8349
• Fix path traversal via metadata file_name in folder-based builders by @​Kaif10 in huggingface/datasets#8325
• Support batched=True in Dataset.to_dict by @​vineethsaivs in huggingface/datasets#8333
• Fix hdf5 external files by @​lhoestq in huggingface/datasets#8355
• remove bad require_storage test by @​lhoestq in huggingface/datasets#8357
• ensure fiels are in repo by @​lhoestq in huggingface/datasets#8356
• Keep flat numeric columns with nulls numeric in numpy format by @​ebarkhordar in huggingface/datasets#8352
• Fix bucket dataset card handling and push metadata accounting by @​pjh4993 in huggingface/datasets#8354
• Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 by @​ebarkhordar in huggingface/datasets#8358
• Keep integers on the python read path for fixed-shape ArrayXD columns with nulls by @​ebarkhordar in huggingface/datasets#8363
• Rebatch arrow source before formatting in IterableDataset.filter to fix resume data loss by @​ebarkhordar in huggingface/datasets#8360
• Decode Json() columns in Dataset.to_pandas() by @​ebarkhordar in huggingface/datasets#8344
• fix buckets on windows by @​lhoestq in huggingface/datasets#8369
• Fix DatasetDict.push_to_hub leaving removed splits in the dataset card by @​pjh4993 in huggingface/datasets#8367
• Preserve nullable integer columns in to_json/to_csv/to_sql by @​ebarkhordar in huggingface/datasets#8366

Docs

• docs: fix duplicate "to" in IterableDataset push-to-hub example by @​DaoyuanLi2816 in huggingface/datasets#8252
• Clarify dataset creation vs loading workflows in create_dataset tutorial by @​zanvari in huggingface/datasets#8235

New Contributors

• @​DaoyuanLi2816 made their first contribution in huggingface/datasets#8252
• @​zanvari made their first contribution in huggingface/datasets#8235
• @​archievi made their first contribution in huggingface/datasets#8243
• @​pkooij made their first contribution in huggingface/datasets#8259
• @​AAtomical made their first contribution in huggingface/datasets#8303
• @​francesco-bertolotti made their first contribution in huggingface/datasets#8295
• @​XciD made their first contribution in huggingface/datasets#8350
• @​SuryanshSS1011 made their first contribution in huggingface/datasets#8339
• @​vineethsaivs made their first contribution in huggingface/datasets#8346

... (truncated)

Commits

• 921c2a7 release: 5.0.1 (#8370)
• c6fc5cd Preserve nullable integer columns in to_json/to_csv/to_sql (#8366)
• 6747b87 Fix DatasetDict.push_to_hub leaving removed splits in the dataset card (#8367)
• b305031 fix buckets on windows (#8369)
• 030a3e5 Decode Json() columns in Dataset.to_pandas() (#8344)
• 0f207a0 Rebatch arrow source before formatting in IterableDataset.filter to fix resum...
• adad35d Keep integers on the python read path for fixed-shape ArrayXD columns with nu...
• 8966746 Fix CSV loader dropping on_bad_lines/encoding_errors on pandas 2.0-2.2 (#8358)
• b8e861a Fix bucket dataset card handling and push metadata accounting (#8354)
• 521a590 Keep flat numeric columns with nulls numeric in numpy format (#8352)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Major-version bump of a data-loading library with no code changes; regression risk is mainly in dataset/BrowserGym paths that depend on datasets APIs.

Overview
Updates the openapp_env lockfile to resolve Hugging Face datasets from 4.8.5 to 5.0.1 (sdist/wheel URLs and hashes only). No application or env source changes—this is a transitive dependency bump (e.g. via browsergym-assistantbench).

Reviewers should treat this as a major library upgrade: run openapp_env tests or any flows that load Hub datasets through BrowserGym, since 5.x may change behavior even though the diff is lockfile-only.

^{Reviewed by Cursor Bugbot for commit f2db6e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Automated Checks

• Lint: PASS (for this diff) — bash .claude/hooks/lint.sh reports 58 pre-existing files needing reformatting elsewhere in the repo, but none are touched by this PR (only envs/openapp_env/uv.lock changes). No lint regressions introduced.
• Debug code: CLEAN — bash .claude/hooks/check-debug.sh only flags pre-existing print()/TODO usages in unrelated src/ files; nothing in this diff.

Change Summary

This is a Dependabot lockfile-only bump of datasets from 4.8.5 → 5.0.1 in envs/openapp_env/uv.lock. datasets is not a direct dependency of openapp_env (not listed in pyproject.toml, not imported anywhere in envs/openapp_env/**/*.py); it's pulled in transitively by browsergym-assistantbench, evaluate, and weblinx-browsergym (part of the browsergym extras stack). No pyproject.toml changes, no application code changes.

Verification performed:

• uv lock --check in envs/openapp_env — lockfile is internally consistent and resolvable (164 packages).
• PYTHONPATH=src:envs uv run python3 envs/openapp_env/test_openapp_env.py — all structure/contract tests pass (these don't require BrowserGym/OpenApps to be installed, so they don't exercise datasets directly, but confirm no regression in importable surface).

Open RFCs Context

Scanned all RFCs in rfcs/ (statuses: 000, 001, 002, 003, 005, 006, 008, 012 = In Review; 010, 011 = Draft). None of them govern third-party dependency versions for openapp_env's BrowserGym stack. RFC 001 (abstractions) and RFC 006 (harness interception) mention "datasets" only in the generic TaskDataset/benchmark-dataset sense, not the datasets PyPI package — no overlap with this change.

Tier 1: Fixes Required

None. No mechanical issues introduced by this diff.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This touches no API surface, no client/server boundary, no reward logic, and no MCP/Gym interfaces — it's a transitive lockfile bump for a benchmark-dataset library consumed deep inside the BrowserGym dependency tree.

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

This looks like a safe, routine dependency bump. One minor non-blocking note for maintainers: datasets 4.x → 5.x is a major version bump upstream, so if anyone in the org exercises the full BrowserGym AssistantBench/WebLinx paths (which depend on datasets) in CI/integration tests, it would be worth a quick smoke test there, since this repo's own test suite doesn't exercise that code path (BrowserGym/OpenApps aren't installed in CI for openapp_env's basic tests).

  

_{Sent by Cursor Automation: Pre-review}