chore: bump hf_xet and workspace versions to 1.7.0-dev1

[rajatarya]

What

Brings every in-tree version to 1.7.0-dev1 so a locally built wheel identifies itself correctly:

• hf_xet/Cargo.toml — 1.6.0 → 1.7.0-dev1 (the PyPI-facing version)
• [workspace.package] version — 1.6.0 → 1.7.0-dev1
• the 10 pinned xet-runtime / xet-core-structures / xet-client / xet-data dependency versions across xet_client, xet_core_structures, xet_data, xet_pkg
• both lockfiles (Cargo.lock, hf_xet/Cargo.lock)

Why

Two independent version sources feed the client's self-reporting, and neither is committed back to main by its release workflow:

Source	Bumped by	Feeds
hf_xet/Cargo.toml	release.yml (PyPI)	the user-agent string
[workspace.package]	bump-crates-version.yml (crates.io)	metrics.client_version

release.yml rewrites the version inside the release job only:

sed -i '/^version /s/=.*$/= "'"$VERSION"'"/' hf_xet/Cargo.toml

That edit never lands on main, so the committed version stayed at 1.6.0.

Separately, the telemetry payload reports:

// xet_data/src/telemetry/payload.rs:154
client_version: env!("CARGO_PKG_VERSION"),

CARGO_PKG_VERSION expands at compile time for the crate containing the macro — xet_data, which takes version.workspace = true. hf_xet sits in the workspace exclude list and is versioned independently, so the two drift apart: a 1.7.0-dev0 build emitted user-agent hf_xet/1.7.0-dev0 alongside client_version: "1.6.0".

Bumping both together keeps the user-agent and client_version consistent for this dev build.

Scope note

The dependency-pin rewrite mirrors exactly what bump-crates-version.yml does (same four crates, same hf_xet/ git_xet/ wasm/ exclusions). Those three excluded crates depend on the workspace crates by path with no version field, so they need no change.

This does not publish anything — crates-release is still a separate manual trigger.

Verification

• cargo +1.95.0 check -p xet-data -p xet-client -p xet-runtime -p xet-core-structures — clean, all resolving at 1.7.0-dev1
• cargo +1.95.0 test -p xet-data --features simulation --test test_transfer_telemetry — 12 passed, 0 failed
• no remaining 1.6.0 references in any manifest

Note for local builds: the repo needs rustc 1.95 (sysinfo@0.39.6 requires it); 1.94 fails to resolve before it ever reaches these crates.

---

Note

Low Risk
Version and lockfile-only changes with no logic, security, or protocol modifications.

Overview
Aligns all committed crate versions from 1.6.0 to 1.7.0-dev1 so local builds report a consistent version in telemetry and the Python user-agent.

Updates [workspace.package] version in the root Cargo.toml, the standalone hf_xet package version, and the pinned 1.7.0-dev1 path dependency versions on xet-runtime, xet-core-structures, xet-client, and xet-data in xet_client, xet_core_structures, xet_data, and xet_pkg. Lockfiles at the repo root, under hf_xet/, and in the WASM crates are refreshed to match.

There is no runtime or API behavior change—only manifest and lock metadata so CARGO_PKG_VERSION (e.g. in telemetry client_version) matches what release workflows temporarily set on hf_xet without committing to main.

^{Reviewed by Cursor Bugbot for commit 1bf4532. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit cf9912a. Configure here.}

[rajatarya]

Instead of merging this into main - I am going to build the Python hf-xet==1.7.0-dev1 directly off this branch. That way we aren't bumping the Rust crates to the -dev1 semver semantics that Python uses.

[rajatarya]

Not needed since never actually released this, closing.