mirror of
https://github.com/unslothai/unsloth.git
synced 2026-07-21 05:33:47 +00:00
744b59f04a
The supply-chain scan gates on non-baselined CRITICAL/HIGH findings. A newer sentencepiece release reindented the stdout/stderr fd-redirect helper in sentencepiece/__init__.py (the os.dup2 pair the heuristic flags as a reverse/bind-shell pattern), moving it from L1221/L1226 to L772/L777 and changing its leading indentation. The baseline key is (package, package-relative file, check, evidence_hash), where evidence_hash is over the matched code with the L<NN>: markers stripped but the code's own indentation preserved. The reindent therefore changed the hash (bba233.. -> 65b5a11c..), so the existing entry no longer suppressed the finding and it resurfaced as a blocking CRITICAL in the hf-stack and studio scan legs. Add the new indentation variant to the allowlist. The calls are sentencepiece redirecting stdout/stderr file descriptors to capture its C++ logs, not a shell; no socket or networking is involved. The old L1221 entry is kept so both versions stay covered. |
||
|---|---|---|
| .. | ||
| data | ||
| check_frontend_dep_removal.py | ||
| check_new_install_scripts.py | ||
| enforce_kwargs_spacing.py | ||
| install_gemma4_mlx.sh | ||
| install_qwen3_6_mlx.sh | ||
| install_rocm_wsl_strixhalo.sh | ||
| lint_workflow_triggers.py | ||
| lockfile_supply_chain_audit.py | ||
| notebook_to_python.py | ||
| notebook_validator.py | ||
| run_ruff_format.py | ||
| scan_npm_packages.py | ||
| scan_npm_packages_baseline.json | ||
| scan_packages.py | ||
| scan_packages_baseline.json | ||
| stamp_studio_release.py | ||
| sync_allow_scripts_pins.py | ||
| uninstall.ps1 | ||
| uninstall.sh | ||
| verify_comment_only_diff.py | ||
| verify_import_hoist.py | ||