ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
unsloth/studio
History
Roland Tannous 6e8bf4d51b
 studio: fix training page regressions from the security hardening pass (#5409) 
* studio: allow huggingface.co and datasets-server.huggingface.co in CSP connect-src

The security hardening pass (0881a7a5) added connect-src 'self', which
blocked the Training page's direct browser calls to HuggingFace. Model
search (@huggingface/hub listModels/modelInfo/whoAmI -> huggingface.co)
and dataset subset/split discovery (datasets-server.huggingface.co/splits)
both returned nothing as a result.

Extend connect-src to permit the two HF hosts the SPA actually talks to.
No other directive changes; HF tokens still stay client-side.

* studio: format FastAPI 422 detail arrays in training error messages

readError in train-api.ts stringified payload.detail directly. On a 422
the detail is an array of {loc, msg} objects, which JS coerces to
'[object Object],[object Object]' -- the UI showed that instead of the
actual validator message.

Format the array into 'field.path: msg; ...' so the offending field and
the validator's message surface in the UI and toast.

* studio: allow num_epochs/max_steps = 0 sentinel through TrainingStartRequest

The hyperparameter validators added in the security pass rejected 0 for
both num_epochs and max_steps. But Studio's steps-vs-epochs toggle uses
0 as a sentinel: when training by max_steps the frontend sends
num_epochs=0, and when training by epochs it sends max_steps=0. The
trainer expects this and ignores the zeroed field.

Widen both validators to [0, MAX]. They still catch the actual
out-of-range and non-integer inputs they were added for.

* studio: reject TrainingStartRequest when num_epochs and max_steps are both 0

Each field's validator accepts 0 as a "use the other one" sentinel, but
on their own they don't catch the case where both are 0 (or max_steps
is None and num_epochs is 0). That payload would otherwise produce a
no-op training job. Add a model-level validator that rejects it with a
clear 422 message.

* studio: add Optional[int] type hints to _check_max_steps and _check_warmup_steps

Brings these two validators in line with the rest of the TrainingStartRequest
validators in the same file, which all carry explicit cls/v/return hints.
2026-05-13 19:40:54 +04:00
..
backend studio: fix training page regressions from the security hardening pass (#5409) 2026-05-13 19:40:54 +04:00
frontend studio: fix training page regressions from the security hardening pass (#5409) 2026-05-13 19:40:54 +04:00
src-tauri Harden Tauri release flow (#5341) 2026-05-12 20:30:20 -07:00
__init__.py Final cleanup 2026-03-12 18:28:04 +00:00
install_llama_prebuilt.py security: NOT affected by Mini Shai-Hulud (May-12 wave) -- forward-looking hardening only (#5397) 2026-05-13 04:58:12 -07:00
install_python_stack.py Add native GGUF intake to Studio (#5246) 2026-05-04 11:46:18 +02:00
LICENSE.AGPL-3.0 Add AGPL-3.0 license to studio folder 2026-03-09 19:36:25 +00:00
setup.bat Final cleanup 2026-03-12 18:28:04 +00:00
setup.ps1 CI: scope GITHUB_TOKEN permissions, add MLX CI, unblock ~60 skipped tests (#5312) 2026-05-11 03:19:13 -07:00
setup.sh Route CPU-only Linux x86_64 to ggml-org/llama.cpp prebuilts (#5302) 2026-05-05 23:22:22 -07:00
Unsloth_Studio_Colab.ipynb studio: add --local to setup.sh + overlay unsloth-zoo from git main (#5252) 2026-05-02 08:51:56 +04:00