RomanNum3ral
/
soup
mirror of https://github.com/razor-ai/soup.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

docs: credit @CODING-DARSH for judge-URL SSRF fix (#288) + SFT vocab expansion (#287)

This commit is contained in:
Alpamys 2026-07-03 18:51:05 +05:00
parent d8519c5f80
commit 1946e3fdde
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
CHANGELOG.md
View File

@ -12,6 +12,18 @@ reproducing 70+ versions of notes.
## [Unreleased]
### Fixed
- Harden judge-model URL validation against a hostname prefix bypass
(`http://localhost.attacker.com`) — `GateTask._valid_judge_url` /
`_parse_judge_url` now use `urllib.parse.urlparse` + hostname checks instead
of `startswith`. Closes #283
([#288](https://github.com/MakazhanAlpamys/Soup/pull/288) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
- `SFTTrainerWrapper` now applies configured vocabulary expansion
(`data.add_new_tokens` / `data.new_special_tokens`) and resizes the model
embeddings during initialization — previously these fields were accepted by
the schema but silently ignored. Closes #289
([#287](https://github.com/MakazhanAlpamys/Soup/pull/287) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
## [0.71.26] - 2026-07-01
### Added

3
CONTRIBUTORS.md
View File

@ -44,6 +44,9 @@ Listed by first contribution. PR numbers link the work.
- Unit tests for the `warmup.py` auto-warmup-steps helper ([#274](https://github.com/MakazhanAlpamys/Soup/pull/274))
- **Kondamwar Akshaya Shrikant** ([@Akshaya-reddy18](https://github.com/Akshaya-reddy18))
- Friendlier error messages — richer CUDA-OOM hint + Hugging Face gated-repo and `trust_remote_code` mappings + tests ([#282](https://github.com/MakazhanAlpamys/Soup/pull/282))
- **Darsh** ([@CODING-DARSH](https://github.com/CODING-DARSH))
- Harden judge-URL validation against hostname prefix bypass (`startswith` → `urlparse`) in `eval/gate.py` ([#288](https://github.com/MakazhanAlpamys/Soup/pull/288))
- Apply configured vocabulary expansion (`data.add_new_tokens` / `new_special_tokens`) during SFT trainer init ([#287](https://github.com/MakazhanAlpamys/Soup/pull/287))
---