Alpamys 7bee22052b v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection ... Security fixes across all HTTP surfaces: - Web UI: Bearer token auth on mutating endpoints, CORS restricted to served origin, path traversal protection on /api/data/inspect, config validated before training, removed user-controlled config_path from API - Serve/vLLM: max_tokens capped at 16384, generic error messages (no stack traces) - Generate: SSRF protection (--api-base blocks non-HTTPS for remote URLs), --api-key deprecated in favor of OPENAI_API_KEY env var - Export: llama.cpp pinned to tag b5270 (supply-chain safety) - Push: --token deprecated in favor of HF_TOKEN env var - Rewards: warning before executing custom .py reward files - Tests: all 40 UI tests updated with auth headers, 666 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-03-25 12:14:10 +05:00
..
__init__.py	Initial project setup: CLI skeleton + config + trainer + data pipeline	2026-02-20 16:14:56 +05:00
constants.py	Fix all ruff lint errors and failing test	2026-02-20 16:25:46 +05:00
deepspeed.py	Add Phase 3: serve, data generate, sweep, diff, DeepSpeed (v0.3.0)	2026-03-05 17:14:08 +05:00
errors.py	v0.10.3: Fix PPO trl >=0.28 API compat, improve GRPO CPU error message	2026-03-24 14:27:39 +05:00
gpu.py	v0.10.1: Fix 6 bugs from manual testing report	2026-03-24 12:31:37 +05:00
qat.py	Add Quantization-Aware Training support (Phase 7) — v0.6.0	2026-03-23 20:35:35 +05:00
unsloth.py	Add Unsloth backend for 2-5x faster training (Phase 5) — v0.4.3	2026-03-23 16:55:44 +05:00
vllm.py	v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection	2026-03-25 12:14:10 +05:00