Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 21 updates - #185

Open
dependabot[bot] wants to merge 556 commits into
mainfrom
dependabot/pip/minor-and-patch-cdce3cdbc5
Open

chore(deps): Bump the minor-and-patch group across 1 directory with 21 updates#185
dependabot[bot] wants to merge 556 commits into
mainfrom
dependabot/pip/minor-and-patch-cdce3cdbc5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 21 updates in the / directory:

Package From To
tokenizers 0.21.0 0.23.2
funasr 1.4.15 1.4.16
fastapi 0.141.1 0.142.2
uvicorn 0.53.0 0.54.0
cryptography 50.0.1 50.0.2
accelerate 1.8.1 1.15.0
antlr4-python3-runtime 4.9.3 4.13.2
charset-normalizer 3.5.1 3.5.2
filelock 4.0.1 4.0.10
fsspec 2026.7.0 2026.9.0
idna 3.19 3.20
lazy-loader 0.5 0.6
llvmlite 0.49.0 0.50.0
markupsafe 3.0.3 3.0.4
modelscope-hub 0.4.3 0.4.5
mpmath 1.3.0 1.4.1
msgpack 1.2.2 1.2.3
numba 0.67.0 0.68.0
platformdirs 4.11.9 4.12.3
regex 2026.9.10 2026.9.29
starlette 1.6.0 1.7.0

Updates tokenizers from 0.21.0 to 0.23.2

Release notes

Sourced from tokenizers's releases.

v0.23.2

This is the last v0 release, we are moving to v1!!

More details coming soon 👀

What's Changed

New Contributors

Full Changelog: huggingface/tokenizers@v0.23.1...v0.23.2

Release v0.23.1

TL;DR

tokenizers 0.23.1 is the first proper stable release in the 0.23 line — 0.23.0 only ever shipped as rc0 because the release pipeline itself was broken (Node side hadn't shipped multi-platform binaries since 2023, Python side was on pyo3 0.27 without free-threaded support). 0.23.1 is the version where everything actually goes out the door together: full Node multi-platform wheels for the first time in years, Python 3.14 (regular and free-threaded 3.14t), full type hints for every Python class, and a stack of measurable perf wins on the BPE / added-vocab hot paths.

There is no functional 0.23.0 published — we tag 0.23.1 directly so users don't accidentally pull a never-shipped version.

🚨 Breaking changes

  • Drop Python 3.9 (#1952) — requires-python = ">=3.10"; 3.9 users stay on 0.22.x.
  • add_tokens normalizes content at insertion (#1995) — re-saved tokenizer.json may differ in the added_tokens block. Existing files load unchanged.
  • Type stubs are precise (#1928, #1997) — methods that returned Any now return real types; mypy --strict may surface previously-hidden errors. Stub layout also moved from tokenizers/<sub>/__init__.pyi to tokenizers/<sub>.pyi. This breaks the surface of some of the processors like RobertaProcessign's __init__ .
  • 3.14t-only: setters/getters return PyResult<T> because of Arc<RwLock<Tokenizer>>; a poisoned lock surfaces as PyException instead of a panic.

... (truncated)

Commits
  • 88a4498 add lock
  • e4ea65f real release
  • 7c5964b add lock
  • bc405ad push rc0
  • d582781 Add a ParityBpeTrainer example and list it in the trainers API docs (#2217)
  • 447890f fix(python): pin the ruff rule set so a ruff release can't redden main (#2292)
  • 68b3ab7 chore(node): take node security alerts from 33 to 0 (#2287)
  • 74ef81f ci: pin every action to one SHA, drop stale audit suppressions (#2291)
  • b26727f chore(node): drop 8 unused devDependencies (#2286)
  • 7c7cfd8 chore: remove stale examples (kills 50% of dependabot traffic) (#2285)
  • Additional commits viewable in compare view

Updates funasr from 1.4.15 to 1.4.16

Commits
  • 904cd18 Release FunASR 1.4.16 (#3719)
  • 615ef05 Merge pull request #3714 from modelscope/codex/mixed-device-availability-2026...
  • b2d63f0 docs: clarify mixed-device source version requirement
  • 4d8e087 Merge pull request #3706 from damnwenxi/fix/submodel-device-placement
  • 1605ad2 test: isolate optional clustering dependency
  • 6444e20 Merge pull request #3713 from modelscope/codex/growth-target-strict-20260916
  • fc98a60 docs: correct strict ecosystem growth target
  • 66eb99a Merge pull request #3712 from modelscope/codex/roadmap-status-20260916
  • 8181a02 docs: align bilingual roadmap with delivered milestones
  • b07c5fa Merge pull request #3711 from modelscope/codex/sensevoice-punctuation-doc-202...
  • Additional commits viewable in compare view

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

  • 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

0.142.0

Features

Refactors

Docs

Translations

Internal

... (truncated)

Commits

Updates uvicorn from 0.53.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)
Commits

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates accelerate from 1.8.1 to 1.15.0

Release notes

Sourced from accelerate's releases.

v1.15.0: FSDP2 activation memory, dtensor improvements

FSDP2

A large batch of FSDP2 work this release: two fixes that cut activation memory at long sequence lengths, tied-embedding support on torch >= 2.13, and a round of checkpointing correctness and scale fixes.

Activation checkpointing was wrapping each child of the matched layer (self_attn, mlp, the norms) instead of the layer itself, so every inter-child activation stayed saved for backward. It now wraps the layer.

There's also a new FSDP2-only activation_checkpointing_offload, which moves the remaining per-layer checkpoint inputs to pinned CPU memory. Gradients are exactly those of plain activation checkpointing:

# fsdp2.yaml
fsdp_config:
  fsdp_version: 2
  fsdp_auto_wrap_policy: TRANSFORMER_BASED_WRAP
  fsdp_activation_checkpointing: true
  fsdp_activation_checkpointing_offload: true
accelerate launch --config_file fsdp2.yaml train.py
  • FSDP2 activation checkpointing: wrap the matched transformer layer itself, not each of its children by @​qgallouedec in #4172
  • Add FSDP2 activation_checkpointing_offload: offload checkpointed layer inputs to pinned CPU memory by @​qgallouedec in #4175
  • Fix FSDP2 tied-embedding models on torch >= 2.13: put the output embedding in the same fully_shard group by @​qgallouedec in #4171
  • Fix FSDP2/PEFT/FULL_STATE_DICT dropping every rank's adapter shard except rank 0 by @​AmineDiro in #4206
  • FSDP2: per-rank torch.save/load for SHARDED_STATE_DICT to fix 2800+ NPU checkpoint timeout by @​gygdh-001 in #4105
  • Fix FSDP sharded checkpoint path resolution by @​HaomingSong in #4119
  • Raise a clear error when FSDP is enabled on a mesh with no shard dimension by @​qgallouedec in #4180

DTensor

Two fixes for DTensor-sharded models, which you hit with FSDP2, tensor parallelism, or any N-D parallelism setup: gradient clipping no longer fails on the foreach op when plain tensors and DTensors are mixed, and prepare_model leaves an already-sharded model where it is:

Offloading & Quantization

An entire model can now be dispatched to disk, including tied weights — useful for tools like llm-compressor that compress large models on machines that can't hold them:

Trackers

Custom trackers can be registered by name and then selected from log_with= like any built-in one:

from accelerate import Accelerator
from accelerate.tracking import register_tracker_class
</tr></table>

... (truncated)

Commits
  • 6afc1e5 Release: v1.15.0
  • 636a934 Fix nightly CI: tensor parallel size detection and DeepSpeed warmup steps (#4...
  • 385d9fb docs: fix three dead links left by the docs restructure (#4230)
  • c424d0b docs: fix garbled sentence in CONTRIBUTING.md (#4231)
  • 0f7e35f Clip grad norm support for dtensors (#4219)
  • b2ac509 Fix FSDP2/ PEFT/FULL_STATE_DICT dropping every rank's adapter shard except ...
  • 33e8bc4 Fix load_accelerator_state only restoring one RNG backend (#4217)
  • 50de3ad Treat MPS out-of-memory errors as OOM in find_executable_batch_size (#4227)
  • ab5fe8e feat: add the neuron device branch in state (#4218)
  • 9baf95b Fix MLFLOW_NESTED_RUN never being able to turn nesting off (#4223)
  • Additional commits viewable in compare view

Updates antlr4-python3-runtime from 4.9.3 to 4.13.2

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Commits
  • 935c29a Release 3.5.2 (#805)
  • 9d3238a test: disable traefik in downstream niquests
  • b4c0368 docs: write changelog entry for 3.5.2
  • 717da31 chore: bump version to 3.5.2
  • 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
  • 41e28b6 chore: raise Cython upper bound to 3.3
  • b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
  • f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
  • See full diff in compare view

Updates filelock from 4.0.1 to 4.0.10

Release notes

Sourced from filelock's releases.

4.0.10

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.9...4.0.10

4.0.9

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.8...4.0.9

4.0.8

What's Changed

Full Changelog: tox-dev/filelock@4.0.7...4.0.8

4.0.7

What's Changed

Full Changelog: tox-dev/filelock@4.0.6...4.0.7

4.0.6

What's Changed

Full Changelog: tox-dev/filelock@4.0.5...4.0.6

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.12 (2026-10-05)

  • Fix read-lock acquisition on SQLite versions older than 3.33.0 by using sqlite_master for the schema probe. :pr:769

4.0.11 (2026-10-05)

  • ReadWriteLock and AsyncReadWriteLock use a validated private hard link when /dev/fd has no entry for the database descriptor, supporting NetBSD's static descriptor directory beyond descriptor 63. The temporary location must share a filesystem with the database. The symlink refusal test accepts NetBSD's error wording.

4.0.10 (2026-10-03)

  • Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

4.0.9 (2026-10-01)

  • ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
  • ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

4.0.8 (2026-10-01)

  • ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

4.0.7 (2026-09-29)

... (truncated)

Commits
  • 1f0632b Release 4.0.10
  • c9c65ab 🐛 fix(singleton): reject conflicting async and lease options (#765)
  • bc2405b ♻️ refactor(util): test helpers via public locks (#764)
  • 7b00bb8 Release 4.0.9
  • 4944624 🐛 fix(read-write): close db fd after connect (#763)
  • 162060e 📝 docs(util): correct write and break guarantees (#762)
  • 4d45e83 Merge commit from fork
  • 9376e9b Release 4.0.8
  • 34f4657 🐛 fix(read-write): refuse cross-thread write release (#761)
  • 9ed62ac Release 4.0.7
  • Additional commits viewable in compare view

Updates fsspec from 2026.7.0 to 2026.9.0

Commits
  • 0f76baa changelog (#2166)
  • 695f831 Add age-based cleanup for simplecache (#2118)
  • 42aa468 Mirror readinto from the pyarrow stream onto ArrowFile (#2111)
  • 4a4e6ae Make the SFTP host key policy configurable (#2126)
  • a0ce6db Normalize paths in AsyncFileSystemWrapper like the wrapped filesystem (#2159)
  • c5fea6d Fix cat_ranges on whole-file caches after #2154 (#2163)
  • 9efb18b Patch HAS_CPYTHON_API where _fast_slice reads it (#2164)
  • 27bcd35 feat(AdaptiveReadaheadCache): introducing a new cache-type adaptive (#2093)
  • a681aca Ignore a leading slash in TarFileSystem paths (#2148)
  • 57c55f8 Make names relative in DirFileSystem.walk(detail=True) (#2160)
  • Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates lazy-loader from 0.5 to 0.6

Release notes

Sourced from lazy-loader's releases.

v0.6

lazy-loader 0.6

We're happy to announce the release of lazy-loader 0.6!

Enhancements

  • improve perf, dogfood (#173).

Bug Fixes

  • Guard against import machinery masking out attributes (#171).

Maintenance

  • Support for Python 3.15 (#176).
  • Update release process (#177).

Contributors

3 authors added to this release (alphabetically):

4 reviewers added to this release (alphabetically):

These lists are automatically generated, and may not be complete or may contain duplicates.

v0.6rc0

lazy-loader 0.6rc0

We're happy to announce the release of lazy-loader 0.6rc0!

Enhancements

  • improve perf, dogfood (#173).

Bug Fixes

  • Guard against import machinery masking out attributes (#171).

Maintenance

... (truncated)

Changelog

Sourced from lazy-loader's changelog.

lazy-loader 0.6

We're happy to announce the release of lazy-loader 0.6!

Enhancements

  • improve perf, dogfood (#173).

Bug Fixes

  • Guard against import machinery masking out attributes (#171).

Maintenance

  • Support for Python 3.15 (#176).
  • Update release process (#177).

Contributors

3 authors added to this release (alphabetically):

4 reviewers added to this release (alphabetically):

These lists are automatically generated, and may not be complete or may contain duplicates.

lazy-loader 0.6rc0

We're happy to announce the release of lazy-loader 0.6rc0!

Enhancements

  • improve perf, dogfood (#173).

Bug Fixes

  • Guard against import machinery masking out attributes (#171).

Maintenance

  • Support for Python 3.15 (#176).

... (truncated)

Commits

Updates llvmlite from 0.49.0 to 0.50.0

Release notes

Sourced from llvmlite's releases.

0.50.0

Please find the detailed release notes here: https://llvmlite.readthedocs.io/en/v0.50.0/release-notes.html

Commits
  • de6d534 Merge pull request #1496 from swap357/changelog_0.50_final
  • c195535 add changelog update PR entry
  • d12d42b update date and PR list on CHANGE_LOG for 0.50.0 final release
  • ba6daa3 Merge pull request #1492 from swap357/cherry_pick_win-arm64_fix
  • b87d436 Merge pull request #1491 from swap357/ci/remove_bootstrap_channels_win-arm64
  • bb4a247 Merge pull request #1484 from swap357/changelog_0.50
  • 6af5f88 address review: update glibc compatibility highlight
  • 201997a add missing merge commit
  • 78181e3 update changelog for v0.50.0
  • a3d4140 Merge pull request #1454 from numba/renovate/actions-checkout-7.x
  • Additional commits viewable in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the ...

Description has been truncated

ReSerendipity and others added 30 commits September 13, 2026 11:39
@ReSerendipity
fix(config): 路由层改用类型化 AppConfig 访问，修复 mypy 棘轮回归
60e8dfe 
Voicebox convert 与 Step-Audio-EditX edit 路由原用 config.get("models")...get("voicebox") 字典式读取，迁移到类型化 AppConfig 后触发 AppConfig has no attribute get 回归，使 mypy 棘轮 +9 阻断推送。

- EngineSpecConfig 显式建模各引擎可选覆盖字段（base_se_path/repo_path/tokenizer_path/gpu_memory_utilization/max_model_len/dtype），避免被 extra=ignore 静默丢弃，保留原始可配置行为。

- 两路由改用 config.pydantic_config.models + get_engine_spec(name) 强类型读取，与 get_pretrained_dir() 一致；shared/portable 双模式路径解析语义不变。

- 守卫 os.path.basename 的 str | None 入参（source_path/target_path）。

mypy 棘轮 106 -> 103（回到基线），ruff 全绿。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(security): 接入 gitleaks 密钥扫描 CI（全历史，含误报 allowlist）
901c4a3 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(security): gitleaks 版本集中管理至 workflow env + README 徽章
68506f9 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(engines): EngineName 补齐 voicebox/step-audio-editx 并同步能力契约基线，重签完整性清单
ccb38ee 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
ci(docker): Trivy 镜像扫描超时 10m→20m，修复 25GB 镜像分析阶段超时假红
6272415 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@dependabot
build(deps): bump actions/setup-node from 4 to 7
523828f 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump docker/login-action from 3 to 4
240e749 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3 to 4.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3...v4)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump docker/metadata-action from 5 to 6
936e7dc 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5...v6)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump actions/cache from 4 to 6
cf72c5b 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump protobuf from 3.19.6 to 7.36.1 (#42)
aaacd29 
Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 3.19.6 to 7.36.1.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-version: 7.36.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ReSerendipity
chore(deps): transformers 4.52.1 → 5.10.1（修复 18 条安全告警；pytest 矩阵已在 #50 …
29cafff 
…全绿验证）

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
ci: add auto-merge workflow (Dependabot non-major + automerge label) (#…
28ad6ea 
…51)
@dependabot
build(deps): bump tokenizers from 0.21.0 to 0.23.2 (#44)
09de49a 
Bumps [tokenizers](https://github.com/huggingface/tokenizers) from 0.21.0 to 0.23.2.
- [Release notes](https://github.com/huggingface/tokenizers/releases)
- [Changelog](https://github.com/huggingface/tokenizers/blob/main/RELEASE.md)
- [Commits](huggingface/tokenizers@v0.21.0...v0.23.2)

---
updated-dependencies:
- dependency-name: tokenizers
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump platformdirs from 4.11.3 to 4.11.7 (#41)
ecb890f 
Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.3 to 4.11.7.
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.3...4.11.7)

---
updated-dependencies:
- dependency-name: platformdirs
  dependency-version: 4.11.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump modelscope-hub from 0.2.0 to 0.4.0 (#43)
dfc028f 
Bumps [modelscope-hub](https://github.com/modelscope/modelscope_hub) from 0.2.0 to 0.4.0.
- [Release notes](https://github.com/modelscope/modelscope_hub/releases)
- [Commits](modelscope/modelscope_hub@v0.2.0...v0.4.0)

---
updated-dependencies:
- dependency-name: modelscope-hub
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ReSerendipity
ci: add integrity manifest sync gate (#53)
3c64cc6 
* ci: add integrity manifest sync gate (GOTCHAS #77)

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* ci: add integrity manifest sync gate (GOTCHAS #77)

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity @web-flow
ci: 收敛 Dependabot 的 PR 数量与 Actions 算力开销 (#52)
1d02a40 
- dependabot.yml: minor/patch 合并为单个 PR，major 仍单独开；限制 open-pull-requests-limit；显式打 dependencies 标签

- codeql.yml: 跳过 dependabot PR 档，并补并发取消过期 run

- dco.yml: 豁免 dependabot[bot]

Co-authored-by: ReSerendipity <noreply@github.com>
@dependabot
build(deps): bump tqdm from 4.70.0 to 4.70.1 (#59)
f37874d 
Bumps [tqdm](https://github.com/tqdm/tqdm) from 4.70.0 to 4.70.1.
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.70.0...v4.70.1)

---
updated-dependencies:
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ReSerendipity @web-flow
chore(ci): mypy ratchet 与 pre-commit 收口 (#57)
17cd377 
* chore(ci): mypy ratchet 与 pre-commit 收口

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* fix: 修复 check_mypy_ratchet.py 的 ruff SIM105 违规

- 将 import sys 提前到文件顶部（此前在 import 之前就使用 sys，会 NameError）

- 用 contextlib.suppress 替代 try/except/pass（SIM105）

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
Co-authored-by: ReSerendipity <noreply@github.com>
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
f748d8a 
…2 updates (#58)

Bumps the minor-and-patch group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [torch](https://github.com/pytorch/pytorch) | `2.13.0+cu132` | `2.14.0` |
| [torchvision](https://github.com/pytorch/vision) | `0.28.0+cu132` | `0.29.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.10.1` | `5.17.0` |
| [funasr](https://github.com/modelscope/FunASR) | `1.4.2` | `1.4.15` |
| [modelscope](https://github.com/modelscope/modelscope) | `1.39.1` | `1.40.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [antlr4-python3-runtime](http://www.antlr.org) | `4.9.3` | `4.13.2` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.3` | `3.32.6` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.6.0` | `2026.7.0` |
| [hydra-core](https://github.com/facebookresearch/hydra) | `1.3.5` | `1.3.6` |
| [joblib](https://github.com/joblib/joblib) | `1.5.3` | `1.6.0` |
| [modelscope-hub](https://github.com/modelscope/modelscope_hub) | `0.4.0` | `0.4.2` |
| [mpmath](https://github.com/mpmath/mpmath) | `1.3.0` | `1.4.1` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.2` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.26.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.7` | `4.11.8` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.49.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.19` | `2026.9.10` |
| [typer](https://github.com/fastapi/typer) | `0.27.1` | `0.27.2` |



Updates `torch` from 2.13.0+cu132 to 2.14.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](https://github.com/pytorch/pytorch/commits/v2.14.0)

Updates `torchvision` from 0.28.0+cu132 to 0.29.0
- [Release notes](https://github.com/pytorch/vision/releases)
- [Commits](https://github.com/pytorch/vision/commits/v0.29.0)

Updates `transformers` from 5.10.1 to 5.17.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.10.1...v5.17.0)

Updates `funasr` from 1.4.2 to 1.4.15
- [Release notes](https://github.com/modelscope/FunASR/releases)
- [Commits](modelscope/FunASR@v1.4.2...v1.4.15)

Updates `modelscope` from 1.39.1 to 1.40.0
- [Release notes](https://github.com/modelscope/modelscope/releases)
- [Commits](modelscope/modelscope@v1.39.1...v1.40.0)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `antlr4-python3-runtime` from 4.9.3 to 4.13.2

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.15.1)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `filelock` from 3.32.3 to 3.32.6
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.3...3.32.6)

Updates `fsspec` from 2026.6.0 to 2026.7.0
- [Commits](fsspec/filesystem_spec@2026.6.0...2026.7.0)

Updates `hydra-core` from 1.3.5 to 1.3.6
- [Release notes](https://github.com/facebookresearch/hydra/releases)
- [Changelog](https://github.com/hydra-ecosystem/hydra/blob/v1.3.6/NEWS.md)
- [Commits](hydra-ecosystem/hydra@v1.3.5...v1.3.6)

Updates `joblib` from 1.5.3 to 1.6.0
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](joblib/joblib@1.5.3...1.6.0)

Updates `modelscope-hub` from 0.4.0 to 0.4.2
- [Release notes](https://github.com/modelscope/modelscope_hub/releases)
- [Commits](modelscope/modelscope_hub@v0.4.0...v0.4.2)

Updates `mpmath` from 1.3.0 to 1.4.1
- [Release notes](https://github.com/mpmath/mpmath/releases)
- [Changelog](https://github.com/mpmath/mpmath/blob/master/CHANGES)
- [Commits](mpmath/mpmath@1.3.0...1.4.1)

Updates `msgpack` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.2)

Updates `narwhals` from 2.24.0 to 2.26.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.24.0...v2.26.0)

Updates `platformdirs` from 4.11.7 to 4.11.8
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.7...4.11.8)

Updates `pydantic-core` from 2.46.4 to 2.49.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `regex` from 2026.7.19 to 2026.9.10
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.7.19...2026.9.10)

Updates `typer` from 0.27.1 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.1...0.27.2)

---
updated-dependencies:
- dependency-name: antlr4-python3-runtime
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: filelock
  dependency-version: 3.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fsspec
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: funasr
  dependency-version: 1.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: hydra-core
  dependency-version: 1.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: joblib
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: modelscope
  dependency-version: 1.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: modelscope-hub
  dependency-version: 0.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mpmath
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: msgpack
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: narwhals
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: platformdirs
  dependency-version: 4.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pydantic-core
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: torch
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: torchvision
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ReSerendipity
ci(automerge): fetch-metadata 跳过 commit 签名校验（本地变基分支无法携带 dependabot 签名…
5094309 
…，PR 作者已在 if 门禁校验） (#54)

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
feat(engines): 新增只读引擎发现/能力查询端点（/api/engines） (#55)
024572e 
* feat(engines): 新增只读引擎发现/能力查询端点并同步核心模块完整性清单

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* fix(security): 重新生成并重签完整性清单（engine_interface.py 哈希对齐）

* fix(security): 重新生成并重签完整性清单（engine_interface.py 哈希对齐）

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
feat(ui): 模型切换器/语音创建表单/健康监控与样式增强；后端路由支撑 (#62)
eafc4d6 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
feat(dist): 统一模型下载器 + 下载/许可文档 (#56)
7e1535e 
* feat(dist): 统一模型下载器（HF 镜像优先/魔搭回退/断点续传）+ 下载与许可文档

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* style: ruff format download_models.py

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(governance): 分支保护代码化 + 漂移检测 + fixer 锁 (#63)
a6482e7 
* chore(governance): 分支保护代码化（docs/ci）+ 漂移检测脚本 + 一仓一 fixer 锁

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* fix(governance): apply_branch_protection.py 满足 ruff（I001/E401/E702/SIM115/PLW1510）

* chore(governance): 移除 docs/agents 下的本地治理文档（自净化规则①）

* chore(governance): FIXER.lock 迁至 .github（doc/agents 为本地独享）

* chore(governance): applier 迁至 docs/ci（避开各仓 ruff 行宽分歧）

* chore(governance): applier 迁至 docs/ci（避开各仓 ruff 行宽分歧）

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
ci(gpu-smoke): 源码包解压改用 Python tarfile，规避 Windows bsdtar 中文文件名编码缺陷 (#64)
ea8b8c7 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(streaming): 统一 wireGenerationResult 接线入口并新增 /api/audio 音频路由 (#65)
4924ec8 
- 统一 window.wireGenerationResult(rootEl) 前端接线入口，修复 GET /output/streaming_*.wav 偶发 404
- 新增 /api/audio/{filename} 音频路由，前端改用稳定音频 URL
- 新增前端一致性冒烟测试 (tests/frontend) 与 OpenAPI 契约快照
- 新增 streaming 音频 URL 契约测试 (tests/test_streaming_audio_url_contract.py)
- CI: 新增 frontend.yml 前端测试工作流

recover: 本地 .git 对象库损坏后基于远程 main@ea8b8c7 重建提交

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
docs: 统一安全披露渠道并对齐 version.json 发布日期 (#66)
3be35aa 
- .github/SECURITY.md：中英双轨渠道合一（GitHub Security Advisory + 邮箱），响应时限统一 48h 确认 / 14d 修复
- version.json：release_date 对齐 CHANGELOG（2.2.1 = 2026-08-22），桌面分发内容标注属 Unreleased
- ci.yml：注释指向改名后的 mypy 迁移记录（mypy-ratchet-组织级门禁迁移_20260903.md）
- 新增 CONTRIBUTING.md（提交纪律 / 本地门禁 / release-please 发版易漏点）

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(pre-commit): gitleaks-system 补 pass_filenames: false 修复多文件提交 (#67)
5b1a716 
上游 gitleaks v8.30.1 的 gitleaks-system 定义（language: system）缺 pass_filenames，暂存 ≥2 个文件时文件名被当位置参数传给 gitleaks git（最多收 1 个）导致提交必炸；补齐后由 gitleaks 自扫 staged diff。家族六仓统一修复（TTS 参照/本仓/其余四仓）。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(consent): 克隆授权门禁 P0-1 + 完整性清单同步 + 移除 CONTRIBUTING.md（compliance 批…
a3d336c 
…次） (#68)

* fix(consent): 补齐 generic/clone 与 OpenAI 兼容端点的克隆授权门禁（P0-1）

- generic/clone 新增 has_consent 表单参数与 fail-safe 门禁（先于 pre_validate，防被引擎未就绪短路）
- /v1/audio/speech 与 batch 端点拒绝参考音频参数（400）；voxcpm2 下非预设 voice 必须是已登记且 granted/self 的音色（400/403），并记审计
- SecurityConfig 新增 clone_unverified_allow 开关（P2-7，默认 True 保持存量兼容）
- demo 页补「纯前端模拟」横幅声明（P2-3）
- 隐私政策披露上传音频默认留存 30 天（P2-4）
- README 模型许可表按实证回填（P1-6）：SenseVoiceSmall=model-license（可商用）、speech_zipenhancer=Apache-2.0（ModelScope API 实证）、OpenVoice=MIT（HF API 实证 V1/V2）、Step-Audio-EditX=Apache-2.0（GitHub API 实证）
- 新增 4 例验收测试（generic 门禁 ×2、OpenAI 防绕过 ×2），全套 9/9 通过

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* chore: 移除 CONTRIBUTING.md——由组织级仓库统一提供（自净化门禁要求）

org 自净化检查（ReSerendipity/.github）规定：CONTRIBUTING.md / CODE_OF_CONDUCT.md / SUPPORT.md 由组织级仓库统一提供，成员仓根目录不应自建；本文件系文档核查时误补，现移除。内容保留于 git 历史（PR #66）。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

* chore(security): 重生成完整性清单并重签——同步 PR #64 的 config_models.py 变更

PR #64（ea8b8c7）修改了核心模块 config_models.py 但未同步 security/integrity_manifest.json，导致后续 PR 的完整性清单同步门禁失败（期望 8b01636e / 实际 0416b85e）。按 docs/agents/GOTCHAS.md #77 SOP 重新生成并 Ed25519 重签。同分支上一提交移除 CONTRIBUTING.md（org 自净化门禁要求，健康文件由组织级仓库统一提供）。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>

---------

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
ReSerendipity and others added 25 commits October 2, 2026 09:32
@ReSerendipity
fix(ui): 引导卡片双向夹紧到视口 + 关于页版本改动态（tabs 上下文补 app_version）
9474279 
- onboarding.renderStep：旧实现先按目标定位、事后右移补救，窄视口/侧栏动画中
  卡片被推到负坐标（2026-10-01 实测 1280×720 下跳过按钮 x=-321，鼠标完全不可达）；
  改为先渲染内容取真实尺寸，left/top 双向夹紧到 [8, inner-尺寸-8]
- 关于页 v2.0 硬编码 → v{{ app_version }}；tabs.py 自建 Jinja2Templates 拿不到
  主实例全局，_common_context 补注入 app_version（与 ?v= 同源 config.yaml），
  否则渲染成空 'v'（2026-10-01 实测 /tab/help 输出）

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(deps): descript-audiotools 改 --no-deps 约定安装——撤销 protobuf 降级（Trivy…
f212700 
… 实证 3.19.6 带 4 个 HIGH CVE）

- 1bc627a 的'真解'（protobuf 3.19.6 + tensorboardX 2.6.0）被 Docker Trivy 闸否决：
  protobuf 3.19.x 有 CVE-2025-4565 等 4 个 HIGH（修复于 4.25.8+），不可为迁就
  descript 的过时元数据上界而把安全依赖钉回漏洞版本
- 终态架构：descript-audiotools 移出三份清单，改 --no-deps 约定安装
  （与 torch 家族'独立组件'同模式）；实测 --no-deps + 现有锁依赖即完整可用
  （tensorboard/ipython/matplotlib 均非 audiotools 导入路径所需，D 盘 runtime 实证）
- protobuf 回 7.36.2、tensorboardX 回 2.6.5；Pin 闸钻石注释更新为 --no-deps 教训
- 安装入口三处落约定：install.bat / build_portable_bundle.ps1 制备段 /
  prepare_runtime（D 盘脚本）；Docker 镜像不含 indextts 故无需改

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@github-actions
chore(main): release 2.4.0
4e0ff97
@ReSerendipity
chore(release): 补齐 2.4.0 的人工同步位（release-please 不碰这 6 处）
cc347cb 
- config.yaml version（驱动前端 ?v= 缓存）
- scripts/installer/setup.nsi 三处（OutFile/APP_VERSION/VIProductVersion）
- deploy/kubernetes/deployment.yaml 镜像 tag 两处（2.4.0 镜像待显式 dispatch 后为真值）
- desktop/src-tauri/Cargo.lock 的 tts-multimodel-desktop 条目
- version.json 的 release_date/changelog 散文位
- docs/release-governance.md 首行散文
- tests/test_version_consistency 9 项 + check_release_readiness 全过

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(release): version.json changelog 补全至最终九修复集（含引导夹紧与关于页动态版本）
1fa9187 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
security(deps): 登记 A17/PYSEC-2026-4174（transformers load_custom_gener…
7db3220 
…ate 远端写）为已接受风险

- 2026-10-02 pip-audit 新公告：影响 4.49.0–5.8.1，修复仅 5.8.2（被引擎 pin <4.53 挡住，
  与 A5–A8 同一 §2 约束；4.52.1→4.52.4 的 Dependabot bump 同样在受影响区间）
- 可达性判据：load_custom_generate/custom_generate/GenerativePreTrainedModel 全仓 0 命中；
  clean_launch 设 TRANSFORMERS_OFFLINE/HF_HUB_OFFLINE=1，离线模式远端模块拉取被禁
- 同步登记：分诊表 A17 行 + security.yml 豁免 +1（test_pip_audit_ignore_set_equals_the_triage_table 过）
- 摘要句 16→17

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
security(deps): 登记 A17/PYSEC-2026-4174（transformers load_custom_gener…
e5767c3 
…ate 远端写）为已接受风险

- 2026-10-02 pip-audit 新公告：影响 4.49.0–5.8.1，修复仅 5.8.2（被引擎 pin <4.53 挡住，
  与 A5–A8 同一 §2 约束；4.52.1→4.52.4 的 Dependabot bump 同样在受影响区间）
- 可达性判据：load_custom_generate/custom_generate/GenerativePreTrainedModel 全仓 0 命中；
  clean_launch 设 TRANSFORMERS_OFFLINE/HF_HUB_OFFLINE=1，离线模式远端模块拉取被禁
- 同步登记：分诊表 A17 行 + security.yml 豁免 +1（test_pip_audit_ignore_set_equals_the_triage_table 过）
- 摘要句 16→17

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
Merge pull request #173 from ReSerendipity/release-please--branches--…
a31e678 
…main

chore(main): release 2.4.0
@ReSerendipity
feat(mlops): 模型卡目录 + LoRA 训练产物 card.yaml schema（评估 P0-#2/#3）
36b8632 
- docs/model-cards/: 为 model/ 下 6 个权重目录补可追溯元数据卡，指向 configs/model_integrity_manifest.json 的 SHA；未核实的上游许可证/来源标未登记，不编造。
- app/integrated_app/training/lora_card.py: Pydantic v2 schema，钉死 git_commit(40)/manifest sha256(64)/persona 命名/产物相对路径防穿越；不 import torch/argbind，无 CUDA 可测。
- tests/test_lora_card.py: 7 用例（示例模板/往返/坏 SHA/绝对路径/../穿越/write_card 回读）。
- P0-#1 docker-smoke 引擎探针与 P1-#4 gpu_training_smoke 经核已在位，未重复实现。
- 注：本 shell 内 sh 钩子运行器静默失败，已手动逐项跑过 check_no_hardcoded_paths 与 check_layout 均通过，故 --no-verify。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
feat(ci): 新增 scripts/gpu_golden_baseline.py 固定10条文本真实合成基线（GPU补验 P1-#5）
8a160c7 
- 对已启动服务打 OpenAI 兼容 /v1/audio/speech，走 CSRF 双提交取票；
- 记录每条 wall_time、WAV 字节数、audio_sha256(前16)、时长、RTF；
- 本机 RTX 5070 Ti 实测：10/10 成功，mean RTF=1.626，首条冷启动 8.25s，显存峰值约 10.8GB；
- 为后续 quality.yml 周跑提供可重复基线脚本。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(ci): 训练层依赖安装显式约束 huggingface-hub<1.0
e81b98e 
datasets 新版解析把 hub 拉到 2.1.1，与钉死的 transformers 4.52.x（hub<1.0）冲突，
pip check 对全矩阵 exit 1（2026-10-06 起 main CI 红，与 36b8632 内容无关）。
同图显式约束让解析器回溯到兼容 datasets 版本。
注：pre-commit 因 .pre-commit-config.yaml 处于 WIP 未暂存状态环境性拦截，
本提交 --no-verify；YAML 已本地 safe_load 校验通过。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
style(ci): gpu_golden_baseline.py 过 ruff format（Lint 门禁）
3b4487b 
8a160c7 引入的脚本有一处多行 print 不符合 ruff format，Lint (ruff format check) 红。
注：--no-verify 原因同 e81b98e（pre-commit 被 WIP 未暂存配置环境性拦截），ruff check 本地已过。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
feat(db): history.db 反馈字段迁移 v008（P2-#8）
de89067 
- generation_history 新增 feedback_rating/feedback_liked/feedback_note/feedback_at 四列；
- 新增 scripts/migrate_history_feedback.py 幂等迁移脚本（含回滚说明）；
- history_db.py 注册 v008_feedback 并新增 set_feedback(id, rating, liked, note) 读写方法；
- tests/test_history_feedback.py 5 个 roundtrip 用例全绿（默认值/写入/部分更新/不存在/幂等）；
- 本地 data/history.db 已迁移：181 行零丢失，备份 history.db.bak-20261006。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
chore(security): 重签完整性清单——history_db.py 反馈字段迁移（v008）后同步 R10 哈希
0b06ae8 
de89067 改动核心模块 history_db.py，清单过期触发同步门禁（设计行为）。
generate_integrity_manifest.py 重生成 16 模块 + Ed25519 重签，
check_integrity_manifest_sync.py PASS。签名密钥未离机。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
fix(training): lora_card artifacts 路径校验改双风格（POSIX+Windows）
8b31fb1 
Path(item).is_absolute() 只认运行平台语义：CI 的 Linux runner 上
'C:/Windows/...' 不算绝对路径，test_absolute_artifact_rejected 全矩阵
DID NOT RAISE（本机 Windows 通过、CI 必红）。改用 PurePosixPath +
PureWindowsPath 双查 is_absolute 与 .. 穿越段，卡片是可移植 YAML，
两端语义都必须拒绝。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@github-actions
chore(main): release 2.5.0
28b2012
@ReSerendipity
chore(release): 补齐 2.5.0 的人工同步位（release-please 不碰这 6 处）
24a6aab 
- config.yaml version（驱动前端 ?v= 缓存）
- scripts/installer/setup.nsi 三处（OutFile/APP_VERSION/VIProductVersion）
- deploy/kubernetes/deployment.yaml 镜像 tag 两处（tag v2.5.0 推送自动触发 docker-publish）
- desktop/src-tauri/Cargo.lock 的 tts-multimodel-desktop 条目
- version.json 的 release_date/changelog 散文位（2.5.0 = 评估落地第一批：模型卡+LoRA card schema 双风格防穿越、history.db v008 反馈字段、CI hub<1.0 约束、golden baseline）
- docs/release-governance.md 首行散文
- check_release_readiness 全过（全部版本位 = 2.5.0）+ test_version_consistency 9 判据 9 passed
- 注：--no-verify 因本机全局环境缺 funasr（Engine Compat 环境性失败，CI 环境装齐）；其余实质门禁（integrity 同步/structure-guard/secrets）全过

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
Merge pull request #183 from ReSerendipity/release-please--branches--…
628fccd 
…main

chore(main): release 2.5.0
@ReSerendipity
docs(branch-protection): 镜像 live——repo 旧名改 TTS-MultiModel / contexts …
5d2f141 
…补 release-gate

① repo 字段仍是仓库改名前的 TTS_MultiModel。gh 的 GET 会跟随 307 重定向，所以只读漂移
   检测看起来一切正常；但 PUT 不跟随重定向——同族 Image-MultiModel 实测 --apply 因此
   一直返回 HTTP 307、静默写不进去（该字段不改，本仓的 --apply 也会同样空跑）。
② live 的必需检查实为 5 条，本文件缺 release-gate。按本文件口径「live 为准、本文件跟着
   live 更新」补入。补充取证：我原先怀疑 release-gate 是幻影（push 类提交的 check-run 名单
   里没有同名项），实测 gh pr checks 183/184 推翻——release-gate 与 DCO Check 在 PR 上都是
   pass（#183 已合并），必需检查可按 check-suite（workflow 的 name）匹配，不必等于 job 名。
   未对 live 做任何写入。
@ReSerendipity
chore(gitignore): 落地敏感信息防泄露块（指南 v1.1 第二章/第八章，含修 *.db 畸形行）
ec77486 
本仓 .gitignore 的凭据类规则都是按路径写的（data/*.db、app/cert.pem、desktop/tauri.key、
logs/*…），实测 git check-ignore 对「随手落在别处」的凭据一律不生效：20 个探针只覆盖
8/20（local.db / credentials.json / secrets.yaml / service-account.json / id_rsa / *.p12 /
.env.local / .aws/credentials 全漏）。这次补的是「任何目录」级兜底。

内容与本仓 index 里那份逐字节相同（blob 6e49f57），即此前已 staged 待提交的那一版，
不新造差异：该 blob 落地后，index/工作树与 main 完全一致，不会与任何在制品冲突。
沿用本仓既有取舍：跟踪 manifest_signing_public_key.pem（签名公钥须入库），
故不写 *.pem / *.key 通配，按私钥命名精确拦截（server.key/server.pem 显式列出）。
@ReSerendipity
test(mirror): LIVE_CTX 快照同步 live 第 5 条 release-gate
05165f9 
5d2f141 起 live contexts 补 release-gate（check-suite 匹配，PR #183 实测 pass），
测试夹具快照停在 4 条导致 9 例假红。同步快照并更新两个场景参数
（want 少最后一条 → 现在是 release-gate）。
注：--no-verify 因 .pre-commit-config.yaml 处于 WIP 未暂存状态环境性拦截。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
style(mirror): 补 ruff format（上一提交的格式遗漏）
e4b6302 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
ci(quality): 周度 golden-set 质量基线 workflow（self-hosted Windows GPU）
98a43c9 
- .github/workflows/quality.yml: runs-on [self-hosted,Windows,GPU], 周cron+手动;
- configs/golden_baseline.voxcpm2.ref.json: 10 条参考基线（实测 mean RTF=1.626）;
- scripts/gpu_golden_compare.py: 对比时长/RTF/sha, 内容漂移=红, sha软信号=黄, 出 junit;
- 失败边界: 内容漂移红 / sha漂移黄 / 环境问题(CUDA/OOM/服务未就绪)黄不阻断。

Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@ReSerendipity
style(quality): gpu_golden_compare.py 过 ruff format（pre-push 门禁）
bbaa50e 
Signed-off-by: ReSerendipity <zengyangc@outlook.com>
@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 2…
a49679d 
…1 updates

Bumps the minor-and-patch group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tokenizers](https://github.com/huggingface/tokenizers) | `0.21.0` | `0.23.2` |
| [funasr](https://github.com/modelscope/FunASR) | `1.4.15` | `1.4.16` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.53.0` | `0.54.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [accelerate](https://github.com/huggingface/accelerate) | `1.8.1` | `1.15.0` |
| [antlr4-python3-runtime](http://www.antlr.org) | `4.9.3` | `4.13.2` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.5.1` | `3.5.2` |
| [filelock](https://github.com/tox-dev/py-filelock) | `4.0.1` | `4.0.10` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.7.0` | `2026.9.0` |
| [idna](https://github.com/kjd/idna) | `3.19` | `3.20` |
| [lazy-loader](https://github.com/scientific-python/lazy-loader) | `0.5` | `0.6` |
| [llvmlite](https://github.com/numba/llvmlite) | `0.49.0` | `0.50.0` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` |
| [modelscope-hub](https://github.com/modelscope/modelscope_hub) | `0.4.3` | `0.4.5` |
| [mpmath](https://github.com/mpmath/mpmath) | `1.3.0` | `1.4.1` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.2` | `1.2.3` |
| [numba](https://numba.pydata.org) | `0.67.0` | `0.68.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.9` | `4.12.3` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.9.10` | `2026.9.29` |
| [starlette](https://github.com/Kludex/starlette) | `1.6.0` | `1.7.0` |



Updates `tokenizers` from 0.21.0 to 0.23.2
- [Release notes](https://github.com/huggingface/tokenizers/releases)
- [Commits](huggingface/tokenizers@v0.21.0...v0.23.2)

Updates `funasr` from 1.4.15 to 1.4.16
- [Release notes](https://github.com/modelscope/FunASR/releases)
- [Commits](modelscope/FunASR@v1.4.15...v1.4.16)

Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.142.2)

Updates `uvicorn` from 0.53.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.53.0...0.54.0)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `accelerate` from 1.8.1 to 1.15.0
- [Release notes](https://github.com/huggingface/accelerate/releases)
- [Commits](huggingface/accelerate@v1.8.1...v1.15.0)

Updates `antlr4-python3-runtime` from 4.9.3 to 4.13.2

Updates `charset-normalizer` from 3.5.1 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.5.1...3.5.2)

Updates `filelock` from 4.0.1 to 4.0.10
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.0.1...4.0.10)

Updates `fsspec` from 2026.7.0 to 2026.9.0
- [Commits](fsspec/filesystem_spec@2026.7.0...2026.9.0)

Updates `idna` from 3.19 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.19...v3.20)

Updates `lazy-loader` from 0.5 to 0.6
- [Release notes](https://github.com/scientific-python/lazy-loader/releases)
- [Changelog](https://github.com/scientific-python/lazy-loader/blob/main/CHANGELOG.md)
- [Commits](scientific-python/lazy-loader@v0.5...v0.6)

Updates `llvmlite` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/numba/llvmlite/releases)
- [Commits](numba/llvmlite@v0.49.0...v0.50.0)

Updates `markupsafe` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.3...3.0.4)

Updates `modelscope-hub` from 0.4.3 to 0.4.5
- [Release notes](https://github.com/modelscope/modelscope_hub/releases)
- [Commits](modelscope/modelscope_hub@v0.4.3...v0.4.5)

Updates `mpmath` from 1.3.0 to 1.4.1
- [Release notes](https://github.com/mpmath/mpmath/releases)
- [Changelog](https://github.com/mpmath/mpmath/blob/master/CHANGES)
- [Commits](mpmath/mpmath@1.3.0...1.4.1)

Updates `msgpack` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.2...v1.2.3)

Updates `numba` from 0.67.0 to 0.68.0

Updates `platformdirs` from 4.11.9 to 4.12.3
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.9...4.12.3)

Updates `regex` from 2026.9.10 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.9.10...2026.9.29)

Updates `starlette` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.6.0...1.7.0)

---
updated-dependencies:
- dependency-name: tokenizers
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: funasr
  dependency-version: 1.4.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: accelerate
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: antlr4-python3-runtime
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: filelock
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fsspec
  dependency-version: 2026.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lazy-loader
  dependency-version: '0.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: llvmlite
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: modelscope-hub
  dependency-version: 0.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mpmath
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: msgpack
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: numba
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: platformdirs
  dependency-version: 4.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026
@dependabot
dependabot Bot requested a review from ReSerendipity as a code owner October 7, 2026 16:47
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 7, 2026 17:16

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ReSerendipity ReSerendipity Awaiting requested review from ReSerendipity ReSerendipity is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ReSerendipity