upstream-archive/VoiceStudio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,244 Commits 24 Branches 39 Tags
c3d18412feb7d570865dfd7bf9a79baca5182af0
Commit Graph
1244 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
debpalash c3d18412fe fix(dub): bind cookie trust to the local UI origin 2026-08-10 03:21:02 +00:00
debpalash 74e6d4582b fix(dub): keep cookie credentials off remote plaintext HTTP 2026-08-10 03:16:35 +00:00
debpalash bfbf78a270 Merge remote-tracking branch 'origin/main' into fix/1429-youtube-cookie-file 
# Conflicts:
#	CHANGELOG.md
 2026-08-10 03:15:59 +00:00
Palash Debnath c3ad072a84 Merge pull request #1427 from debpalash/fix/classify-401-substring 
fix(errors): three digits in a path are not an authentication failure
 2026-08-10 02:58:16 +00:00
debpalash 270666fac8 Merge remote-tracking branch 'origin/main' into fix/classify-401-substring 2026-08-10 02:43:12 +00:00
Palash Debnath ee313ad892 Merge pull request #1465 from debpalash/dependabot/uv/yt-dlp-2026.7.4 
chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4
 2026-08-10 02:24:30 +00:00
debpalash 7e55468892 Merge remote-tracking branch 'origin/main' into fix/classify-401-substring 
# Conflicts:
#	CHANGELOG.md
 2026-08-10 02:10:37 +00:00
debpalash da31ef9aec Merge remote-tracking branch 'origin/main' into review/pr-1465 2026-08-10 02:09:35 +00:00
Palash Debnath 3c95d9c52d Merge pull request #1450 from debpalash/dependabot/uv/nltk-3.10.0 
chore(deps): bump nltk from 3.9.4 to 3.10.0
 2026-08-10 01:55:10 +00:00
debpalash c4e13fc07c Merge remote-tracking branch 'origin/main' into review/pr-1465 2026-08-10 01:48:07 +00:00
debpalash 3dde7b52db Merge remote-tracking branch 'origin/main' into codex/pr-1450 2026-08-10 01:39:04 +00:00
Palash Debnath 2b79d43e56 Merge pull request #1449 from debpalash/dependabot/uv/pypdf-6.15.0 
chore(deps): bump pypdf from 6.13.2 to 6.15.0
 2026-08-10 01:24:01 +00:00
debpalash c6f7167d06 Merge remote-tracking branch 'origin/main' into codex/pr-1449 2026-08-10 01:08:02 +00:00
dependabot[bot] 82a7039988 chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4 
Bumps [yt-dlp](https://github.com/yt-dlp/yt-dlp) from 2026.6.9 to 2026.7.4.
- [Release notes](https://github.com/yt-dlp/yt-dlp/releases)
- [Changelog](https://github.com/yt-dlp/yt-dlp/blob/master/Changelog.md)
- [Commits](https://github.com/yt-dlp/yt-dlp/compare/2026.06.09...2026.07.04)

---
updated-dependencies:
- dependency-name: yt-dlp
  dependency-version: 2026.7.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 00:54:03 +00:00
Palash Debnath 16cbf1db3a Merge pull request #1452 from debpalash/dependabot/uv/aiohttp-3.14.3 
chore(deps): bump aiohttp from 3.14.1 to 3.14.3
 2026-08-10 00:51:32 +00:00
debpalash b77e6b2030 Merge remote-tracking branch 'origin/main' into codex/pr-1452 2026-08-10 00:34:15 +00:00
Palash Debnath 28f40f1d59 Merge pull request #1446 from debpalash/fix/ghas-redos 
fix(security): make user-controlled validators linear-time
 2026-08-10 00:19:48 +00:00
debpalash cf59a508fe fix(security): align bounded model validation 2026-08-10 00:04:53 +00:00
debpalash c3209e3d32 Merge remote-tracking branch 'origin/main' into fix/ghas-redos 
# Conflicts:
#	CHANGELOG.md
 2026-08-10 00:03:45 +00:00
Palash Debnath 3634c3b9d6 Merge pull request #1462 from debpalash/fix/ghas-disclosure-streaming 
fix(security): stabilize streamed failure responses
 2026-08-09 23:49:59 +00:00
debpalash d35e8e881d fix(security): stabilize inner transcription failures 2026-08-09 23:35:28 +00:00
debpalash 544d345069 fix(security): keep stream failures out of logs 2026-08-09 23:18:16 +00:00
debpalash bebe462dc6 Merge remote-tracking branch 'origin/main' into fix/ghas-disclosure-streaming 
# Conflicts:
#	CHANGELOG.md
 2026-08-09 23:12:47 +00:00
Palash Debnath 7f67e1622b Merge pull request #1426 from debpalash/fix/1414-resolve-heartbeat 
fix(engines): a venv resolution that takes minutes is not a stalled generation (#1414)
 2026-08-09 22:59:26 +00:00
debpalash f122b84a7e test: always release parked heartbeat writer 2026-08-09 22:42:48 +00:00
debpalash 600a8dc936 Merge remote-tracking branch 'origin/main' into codex/pr-1426 2026-08-09 22:37:45 +00:00
Palash Debnath 9e9c9d031f Merge pull request #1461 from debpalash/test/ghas-fp-evidence 
test(security): lock reviewed GHAS invariants
 2026-08-09 22:23:35 +00:00
debpalash 3f706336f6 Merge remote-tracking branch 'origin/main' into test/ghas-fp-evidence 2026-08-09 22:08:40 +00:00
Palash Debnath ae46f187d0 fix(security): move host-path authority into the desktop shell (#1448) 
Close unauthenticated remote mutation paths and keep filesystem destinations behind one-shot Tauri capabilities. CodeRabbit and Greptile findings were fixed on-branch; all review threads are resolved. Full CI, Security, Rust, and cross-platform smoke checks are green.
 2026-08-09 21:55:43 +00:00
debpalash 96a6c7574a fix(security): stabilize streamed failure responses 2026-08-09 21:50:42 +00:00
debpalash 6e7f12f391 test(security): lock reviewed GHAS invariants 2026-08-09 21:48:54 +00:00
debpalash f6e01c142a Merge remote-tracking branch 'origin/main' into fix/ghas-redos 
# Conflicts:
#	CHANGELOG.md
 2026-08-09 21:24:31 +00:00
Palash Debnath 93143849d2 fix(security): constrain endpoint probes to trusted origins (#1447) 
Validate HTTPS probe destinations against the shipped origin allowlist and clean up the related CodeQL test findings. Reviewed by Greptile; CodeRabbit was harvested but rate-limited. CI, Security, and cross-platform smoke checks are green.
 2026-08-09 21:18:11 +00:00
debpalash 6f443ad387 fix(models): accept valid underscore repo IDs 2026-08-09 21:13:10 +00:00
dependabot[bot] b03b67ef00 chore(deps): bump aiohttp from 3.14.1 to 3.14.3 
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.1 to 3.14.3.
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/aiohttp/compare/v3.14.1...v3.14.3)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-09 21:01:51 +00:00
dependabot[bot] 70a5d69622 chore(deps): bump nltk from 3.9.4 to 3.10.0 
Bumps [nltk](https://github.com/nltk/nltk) from 3.9.4 to 3.10.0.
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](https://github.com/nltk/nltk/compare/3.9.4...v3.10.0)

---
updated-dependencies:
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-09 21:01:47 +00:00
dependabot[bot] f1aec13089 chore(deps): bump pypdf from 6.13.2 to 6.15.0 
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.13.2 to 6.15.0.
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](https://github.com/py-pdf/pypdf/compare/6.13.2...6.15.0)

---
updated-dependencies:
- dependency-name: pypdf
  dependency-version: 6.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-09 21:01:46 +00:00
debpalash ce2f2e9397 docs: note bounded input validation 2026-08-09 20:59:32 +00:00
debpalash 400fd97810 fix(security): bound model and voice validators 2026-08-09 20:59:12 +00:00
Gamble Tan 4945dec04e fix(asr): use the bundled ffmpeg for MLX transcription (#1436) 
Decode MLX Whisper audio once through VoiceStudio's validated bundled ffmpeg and reuse the waveform for forced alignment. This restores source-install transcription on Apple Silicon without requiring system ffmpeg.\n\nThanks @gambletan!
 2026-08-09 20:55:15 +00:00
debpalash b1b18dd1ba fix(dub): support explicit YouTube cookie exports (#1429) 2026-08-09 20:42:47 +00:00
debpalash 7c64a7270c fix: make resolve heartbeat shutdown race-free 2026-08-09 20:24:14 +00:00
debpalash 5c069feb50 Merge remote-tracking branch 'origin/main' into HEAD 
# Conflicts:
#	CHANGELOG.md
 2026-08-09 20:23:35 +00:00
debpalash 828ac1a2c8 test(errors): pin audio failure class with 401 path 2026-08-09 20:23:05 +00:00
debpalash 9f33129fee Merge remote-tracking branch 'origin/main' into HEAD 2026-08-09 20:22:16 +00:00
Palash Debnath c870f794ed fix(engines): give every sidecar a private fd for its frames (#1428) 
Protect all nine sidecar frame channels from library stdout noise and pin the complete sidecar manifest in regression coverage.\n\nCloses #1428. Thanks @1335-Group for the diagnosis and tested fix.
 2026-08-09 20:22:06 +00:00
debpalash 31c654a35a Merge main into fix/1414-resolve-heartbeat 
CHANGELOG only; both entries kept.
 2026-08-08 15:24:09 +05:30
Palash Debnath 1eb59c6f18 feat(diagnostics): say why a GPU host fell back to CPU (#1274) (#1425) 
The About page reported 'Compute device: cpu / GPU active: no / VRAM 0.00 GB' on a machine with a working GPU. Every line was true and none was usable — it is also exactly what a machine with no GPU at all reports, so the report could not distinguish a driver that isn't loaded from a container that cannot open the device from a ROCm older than the card.

The probe already knew all of it; torch.cuda.is_available() returning False simply produced no note. Each cause now reads differently: a missing device node names the --device flags, a permissions failure names --group-add and how to find the host's real render/video GIDs (copied numbers are the most common way this ends up on CPU in Docker), a card newer than the shipped ROCm points at rocminfo, an HSA_OVERRIDE_GFX_VERSION that is doing more harm than good is named first because it is both likelier and cheaper to test, and an unreachable NVIDIA driver gets its own advice.

The probe never diagnoses from a measurement it did not complete: when torch.cuda.is_available() itself raises, the exception is reported and no device findings are asserted beside it. Metadata access that raises is contained too — this runs on the path whose whole job is to explain a failure, so it cannot become one.
 2026-08-08 15:23:38 +05:30
debpalash 44f2cff6c1 Merge remote-tracking branch 'origin/main' into fix/classify-401-substring 
# Conflicts:
#	CHANGELOG.md
 2026-08-08 15:16:04 +05:30
debpalash 2df66e2628 Merge main into fix/1414-resolve-heartbeat 
CHANGELOG only; both entries kept.
 2026-08-08 15:08:13 +05:30