From 1946e3fdde54d5474bfb8a7595a5cc0299af84c6 Mon Sep 17 00:00:00 2001
From: Alpamys <vpn.alpamys@gmail.com>
Date: Fri, 3 Jul 2026 18:51:05 +0500
Subject: [PATCH] docs: credit @CODING-DARSH for judge-URL SSRF fix (#288) +
 SFT vocab expansion (#287)

---
 CHANGELOG.md    | 12 ++++++++++++
 CONTRIBUTORS.md |  3 +++
 2 files changed, 15 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4532f2..cd17b30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,18 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+### Fixed
+- Harden judge-model URL validation against a hostname prefix bypass
+  (`http://localhost.attacker.com`) — `GateTask._valid_judge_url` /
+  `_parse_judge_url` now use `urllib.parse.urlparse` + hostname checks instead
+  of `startswith`. Closes #283
+  ([#288](https://github.com/MakazhanAlpamys/Soup/pull/288) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
+- `SFTTrainerWrapper` now applies configured vocabulary expansion
+  (`data.add_new_tokens` / `data.new_special_tokens`) and resizes the model
+  embeddings during initialization — previously these fields were accepted by
+  the schema but silently ignored. Closes #289
+  ([#287](https://github.com/MakazhanAlpamys/Soup/pull/287) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
+
 ## [0.71.26] - 2026-07-01
 
 ### Added
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index ef9a07a..ed3cc5c 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -44,6 +44,9 @@ Listed by first contribution. PR numbers link the work.
   - Unit tests for the `warmup.py` auto-warmup-steps helper ([#274](https://github.com/MakazhanAlpamys/Soup/pull/274))
 - **Kondamwar Akshaya Shrikant** ([@Akshaya-reddy18](https://github.com/Akshaya-reddy18))
   - Friendlier error messages — richer CUDA-OOM hint + Hugging Face gated-repo and `trust_remote_code` mappings + tests ([#282](https://github.com/MakazhanAlpamys/Soup/pull/282))
+- **Darsh** ([@CODING-DARSH](https://github.com/CODING-DARSH))
+  - Harden judge-URL validation against hostname prefix bypass (`startswith` → `urlparse`) in `eval/gate.py` ([#288](https://github.com/MakazhanAlpamys/Soup/pull/288))
+  - Apply configured vocabulary expansion (`data.add_new_tokens` / `new_special_tokens`) during SFT trainer init ([#287](https://github.com/MakazhanAlpamys/Soup/pull/287))
 
 ---