ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
unsloth/studio/backend
History
Daniel Han 6a7dad86d1 Merge branch 'main' into studio/hardening-followup 
Resolves the conflict in `studio/backend/main.py` `_csp_header()`. Both
sides widened the Content-Security-Policy for Hugging Face endpoints:

* This branch (9d693b35) extended `img-src` to cover
  `https://huggingface.co` and `https://cdn-avatars.huggingface.co`
  (so the model picker can render owner avatars) and broadened
  `connect-src` to cover `*.huggingface.co`, `cdn-lfs.huggingface.co`,
  `cdn-lfs.hf.co`, `hf.co`, and `*.hf.co` (so the picker can resolve
  LFS file metadata).
* `main` added `https://datasets-server.huggingface.co` to
  `connect-src` for the dataset picker.

Kept both: the new `img-src` and `connect-src` allowlist now includes
the union of every HF origin the frontend touches.

Verified post-merge:

- `pytest studio/backend/tests --deselect test_studio_api.py`:
  1119 passed, 46 skipped, 0 failed.
- CSP string in `main.py` parses cleanly and contains all three
  additions (`t3.gstatic.com https://huggingface.co`,
  `cdn-avatars.huggingface.co`, `datasets-server.huggingface.co`).
2026-05-16 07:01:58 +00:00
..
assets Add Qwen3.6 inference defaults for Studio (#5065) 2026-04-16 11:42:42 -07:00
auth studio: hardening follow-up (refresh-token race, sandbox alias bypass, /api/health launcher contract, Windows kill path) 2026-05-13 14:18:37 +00:00
core Merge branch 'main' into studio/hardening-followup 2026-05-16 07:01:58 +00:00
loggers Studio: stop truncating long log lines as suspected base64 (#5335) 2026-05-08 13:07:18 +04:00
models Merge branch 'main' into studio/hardening-followup 2026-05-16 07:01:58 +00:00
plugins fix(gh_client): fail fast on 401/403 auth errors instead of retrying forever (#5325) (#5329) 2026-05-08 21:57:41 +04:00
requirements studio: API external provider support for chat (OpenAI, Mistral, Gemini, Cohere, Anthropic, OpenRouter, DeepSeek, custom providers) (#4706) 2026-05-14 16:13:59 +04:00
routes Merge branch 'main' into studio/hardening-followup 2026-05-16 07:01:58 +00:00
state unsloth run: add --enable-tools/--disable-tools server-side tool policy (#5277) 2026-05-05 12:45:15 +04:00
storage studio: API external provider support for chat (OpenAI, Mistral, Gemini, Cohere, Anthropic, OpenRouter, DeepSeek, custom providers) (#4706) 2026-05-14 16:13:59 +04:00
tests Merge branch 'main' into studio/hardening-followup 2026-05-16 07:01:58 +00:00
utils studio/mmproj: skip unwanted GGUF values via seek instead of read (#5431) 2026-05-14 21:57:04 -07:00
__init__.py Final cleanup 2026-03-12 18:28:04 +00:00
_platform_compat.py Fix Studio crash on Anaconda/conda-forge Python (#4484) 2026-03-22 05:36:55 -07:00
colab.py Fix/studio colab button message: Add fallback message for Colab Studio button when proxy URL fails (#4866) 2026-04-05 21:57:45 -07:00
main.py Merge branch 'main' into studio/hardening-followup 2026-05-16 07:01:58 +00:00
run.py studio: security and hardening pass (auth rate-limit, sandbox, path containment, schema validation, headers) (#5375) 2026-05-13 06:12:18 -07:00
startup_banner.py studio: unify Windows installer/setup logging style, verbosity controls, and startup messaging (#4651) 2026-03-30 00:53:23 -07:00