Merge branch 'main' into zhenyuan_enable_studio

Bring the Intel XPU Studio enablement up to date with main (post unslothai#5819) and
resolve the four conflicts additively, keeping every non-XPU backend
(NVIDIA CUDA, AMD ROCm, CPU, Apple MLX) byte-for-byte unchanged.

- utils/hardware/hardware.py: re-apply the XPU points on top of main's
  refactor -- detect_hardware explicit-XPU hint, XPU as a supported
  selection backend (auto_select_gpu_ids, prepare_gpu_selection,
  get_device_map), ZE_AFFINITY_MASK visibility (_get_parent_visible_gpu_spec,
  get_visible_gpu_count, _backend_visible_devices_env, apply_gpu_ids),
  backend-aware clear_gpu_cache, package versions, per-device info, and the
  fork-after-Level-Zero-init guard. CUDA/ROCm/CPU/MLX paths are untouched.
- core/training/trainer.py: route the three codec cache clears through the
  backend-aware clear_gpu_cache(); keep codec device as CUDA-or-CPU because
  the SNAC/Spark-TTS/OuteTTS codecs are not yet validated on XPU.
- core/inference/llama_cpp.py: take main's Vulkan GGUF design verbatim;
  llama.cpp Intel inference (Vulkan) is decoupled from torch XPU training.
- tests/test_gpu_selection.py: XPU is now a supported selection backend.

Author: danielhanchen

.gitattributes

@@ -1,2 +1,13 @@
 # Normalize Python files to LF line endings
 *.py text eol=lf
+
+# Always check out shell scripts with LF endings. Without this rule a Windows
+# clone (core.autocrlf=true) rewrites them to CRLF, and the trailing \r breaks
+# them when run in WSL/Linux (e.g. `set -e` -> "set: Illegal option -").
+*.sh text eol=lf
+
+# Normalize Studio frontend sources to LF. Scoped to the frontend tree (rather
+# than repo-wide *.ts/*.tsx/... rules) so the policy can't force LF on files
+# elsewhere. text=auto lets Git detect and leave binary assets (logos, fonts)
+# untouched while text files (.ts/.tsx/.json/.html/.svg/...) are stored as LF.
+studio/frontend/** text=auto eol=lf

.github/CODEOWNERS

@@ -6,10 +6,10 @@
 /unsloth/models/rl_replacements.py @Datta0 @pluesclues @danielhanchen
 /unsloth/trainer.py @danielhanchen
 /unsloth/models/sentence_transformer.py @Etherll @danielhanchen
-/unsloth/save.py @rolandtannous @danielhanchen
+/unsloth/save.py @danielhanchen
 /unsloth/tokenizer_utils.py @mmathew23 @danielhanchen
-/unsloth/chat_templates.py @rolandtannous @danielhanchen
-/unsloth/ollama_template_mappers.py @rolandtannous @danielhanchen
+/unsloth/chat_templates.py @danielhanchen
+/unsloth/ollama_template_mappers.py @danielhanchen
 /unsloth/kernels/moe/*.py @Datta0
 /unsloth/import_fixes.py @danielhanchen
 /unsloth/device_type.py @danielhanchen
@@ -45,11 +45,18 @@
 /unsloth/utils/hf_hub.py @mmathew23
 /unsloth/utils/packing.py @mmathew23
 
-/cli/ @rolandtannous @Manan17
-/studio/frontend/ @Shine1i @rolandtannous @Manan17
+/cli/ @Manan17
+/studio/frontend/ @Shine1i @Manan17
 /studio/frontend/public/ @Shine1i
-/studio/backend/ @rolandtannous
-/studio/backend/core/data_recipe/ @rolandtannous
-/studio/backend/tests/ @rolandtannous @danielhanchen
-/tests/ @rolandtannous @danielhanchen
-/scripts/ @rolandtannous @danielhanchen
+/studio/backend/
+/studio/backend/core/data_recipe/
+/studio/backend/tests/ @danielhanchen
+/tests/ @danielhanchen
+/scripts/ @danielhanchen
+
+# Snapshot data for the notebook linter / Colab oracle. Drift in these
+# files changes the pin floor for every Unsloth notebook, so refreshes
+# must be reviewed by the notebook owners directly. CODEOWNERS later
+# wins, so this overrides the broader /scripts/ rule above.
+/scripts/data/colab_*.txt  @danielhanchen @shimmyshimmer
+/scripts/data/colab_*.json @danielhanchen @shimmyshimmer

.github/dependabot.yml

@@ -5,23 +5,96 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      # github-actions refs are git tags / SHAs, not semver -- the
+      # `semver-minor-days` / `semver-patch-days` knobs are rejected
+      # by Dependabot's validator for this ecosystem. Only the
+      # `default-days` floor applies.
+      default-days: 7
     groups:
       actions:
         patterns: ["*"]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
 
-  - package-ecosystem: "bun"
-    directory: "/studio/frontend"
+  # Removed a stray `package-ecosystem: "bun"` entry for
+  # /studio/frontend: that path has no bun.lock / bun.lockb, so
+  # Dependabot's bun ecosystem silently no-ops on it. The actual
+  # lockfile committed at /studio/frontend is package-lock.json
+  # (npm), and the npm entry further below already catches
+  # npm_and_yarn security advisories for that directory. Version
+  # updates for /studio/frontend stay suppressed (open-pull-
+  # requests-limit: 0 in that entry) -- security PRs flow through
+  # regardless. Add a real bun entry IF and WHEN bun.lock lands.
+
+  - package-ecosystem: "npm"
+    directory: "/studio/backend/core/data_recipe/oxc-validator"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
-      bun-frontend:
+      npm-oxc-validator:
+        patterns: ["*"]
+      npm-oxc-validator-security:
+        applies-to: security-updates
         patterns: ["*"]
 
+  # pip + cargo grouped weekly; the *-security siblings batch
+  # advisories that would otherwise each open their own PR.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      python:
+        patterns: ["*"]
+      python-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  - package-ecosystem: "cargo"
+    directory: "/studio/src-tauri"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 3
+    groups:
+      cargo-tauri:
+        patterns: ["*"]
+      cargo-tauri-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  # /studio/frontend npm dependencies. Version-update PRs are
+  # deliberately suppressed (open-pull-requests-limit: 0) -- the
+  # frontend dep tree is large, the lockfile is the authoritative
+  # pin, and `min-release-age=7` in studio/frontend/.npmrc already
+  # blocks fresh tarballs at install time. Security advisories
+  # arrive via GitHub's npm_and_yarn channel and are NOT capped by
+  # `open-pull-requests-limit` per Dependabot's documented
+  # behaviour; they flow through this entry, group together, and
+  # still respect the cooldown below so we never ingest a tarball
+  # that was hot-published less than 3 days ago.
   - package-ecosystem: "npm"
-    directory: "/studio/backend/core/data_recipe/oxc-validator"
+    directory: "/studio/frontend"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
-      npm-oxc-validator:
+      npm-frontend-security:
+        applies-to: security-updates
         patterns: ["*"]
 ...