Daniel Han 6a7dad86d1 Merge branch 'main' into studio/hardening-followup ... Resolves the conflict in `studio/backend/main.py` `_csp_header()`. Both sides widened the Content-Security-Policy for Hugging Face endpoints: * This branch (9d693b35) extended `img-src` to cover `https://huggingface.co` and `https://cdn-avatars.huggingface.co` (so the model picker can render owner avatars) and broadened `connect-src` to cover `*.huggingface.co`, `cdn-lfs.huggingface.co`, `cdn-lfs.hf.co`, `hf.co`, and `*.hf.co` (so the picker can resolve LFS file metadata). * `main` added `https://datasets-server.huggingface.co` to `connect-src` for the dataset picker. Kept both: the new `img-src` and `connect-src` allowlist now includes the union of every HF origin the frontend touches. Verified post-merge: - `pytest studio/backend/tests --deselect test_studio_api.py`: 1119 passed, 46 skipped, 0 failed. - CSP string in `main.py` parses cleanly and contains all three additions (`t3.gstatic.com https://huggingface.co`, `cdn-avatars.huggingface.co`, `datasets-server.huggingface.co`).		2026-05-16 07:01:58 +00:00
..
__init__.py	Final cleanup	2026-03-12 18:28:04 +00:00
resume.py	Studio: Add checkpoint resume for stopped training runs (#5255)	2026-05-04 00:34:46 +04:00
trainer.py	Studio: Passing batch size for eval (#5168)	2026-05-14 17:48:28 +04:00
training.py	Merge branch 'main' into studio/hardening-followup	2026-05-16 07:01:58 +00:00
worker.py	Merge branch 'main' into studio/hardening-followup	2026-05-16 07:01:58 +00:00