Merge branch 'main' into patch-2

Author: pcuenca

.github/workflows/trufflehog.yml

@@ -16,3 +16,5 @@ jobs:
         fetch-depth: 0
     - name: Secret Scanning
       uses: trufflesecurity/trufflehog@main
+      with:
+        extra_args: --results=verified,unknown

docs/hub/_toctree.yml

@@ -396,6 +396,8 @@
         title: How to configure OIDC with Azure in the Hub
       - local: security-sso-entra-id-scim
         title: How to configure SCIM with Microsoft Entra ID (Azure AD)
+      - local: security-sso-okta-scim
+        title: How to configure SCIM with Okta
     - local: security-resource-groups
       title: Advanced Access Control (Resource Groups)
     - local: security-malware

docs/hub/enterprise-hub-scim.md

@@ -30,4 +30,5 @@ Once SCIM is enabled in your IdP, users and groups provisioned will appear in th
 ## Supported Identity Providers
 
 We support SCIM with any IdP that implements the SCIM 2.0 protocol. We have specific guides for some of the most popular providers:
-- [How to configure SCIM with Microsoft Entra ID](./security-sso-entra-id-scim)
+- [How to configure SCIM with Microsoft Entra ID](./security-sso-entra-id-scim)
+- [How to configure SCIM with Okta](./security-sso-okta-scim)

docs/hub/security-sso-entra-id-scim.md

@@ -52,7 +52,20 @@ This feature is part of the <a href="https://huggingface.co/contact/sales?from=e
     | `name.formatted` | `Join(" ", [givenName], [surname])` | |
     | `externalId` | `objectId` | `1` |
 
-3.  After configuring the user mappings, go back to the Provisioning screen and click on **Provision Microsoft Entra ID Groups** to review group mappings. The default settings for groups are usually sufficient.
+3.  The Username needs to comply with the following rules.
+
+<Tip warning={true}>
+<ul>
+<li>Only regular characters and `-` are accepted in the Username.</li>
+<li>`--` (double dash) is forbidden.</li>
+<li>`-` cannot start or end the name.</li>
+<li>Digit-only names are not accepted.</li>
+<li>Minimum length is 2 and maximum length is 42.</li>
+<li>Username has to be unique within your org.</li>
+</ul>
+</Tip>
+
+4.  After configuring the user mappings, go back to the Provisioning screen and click on **Provision Microsoft Entra ID Groups** to review group mappings. The default settings for groups are usually sufficient.
 
 ### Step 5: Start Provisioning
 

docs/hub/security-sso-okta-scim.md

@@ -0,0 +1,70 @@
+# How to configure SCIM with Okta
+
+This guide explains how to set up SCIM user and group provisioning between Okta and your Hugging Face organization using SCIM.
+
+<Tip warning={true}>
+This feature is part of the <a href="https://huggingface.co/contact/sales?from=enterprise" target="_blank">Enterprise Plus</a> plan.
+</Tip>
+
+### Step 1: Get SCIM configuration from Hugging Face
+
+1.  Navigate to your organization's settings page on Hugging Face.
+2.  Go to the **SSO** tab, then click on the **SCIM** sub-tab.
+3.  Copy the **SCIM Tenant URL**. You will need this for the Okta configuration.
+4.  Click **Generate an access token**. A new SCIM token will be generated. Copy this token immediately and store it securely, as you will not be able to see it again.
+
+<div class="flex justify-center">
+    <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/scim-settings.png"/>
+    <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/scim-settings-dark.png"/>
+</div>
+
+### Step 2: Enter Admin Credentials
+
+1. In Okta, go to **Applications** and select your Hugging Face app.
+2. Go to the **General** tab and click **Edit** on App Settings
+3. For the Provisioning option select **SCIM**, click **Save**
+4. Go to the **Provisioning** tab and click **Edit**.
+5. Enter the **SCIM Tenant URL** as the SCIM connector base URL.
+6. Enter **userName** for Unique identifier field for users.
+7. Select all necessary actions for Supported provisioning actions.
+8. Select **HTTP Header** for Authentication Mode.
+9. Enter the **Access Token** you generated as the Authorization Bearer Token.
+10. Click **Test Connector Configuration** to verify the connection.
+11. Save your changes.
+
+### Step 3: Configure Provisioning
+
+1. In the **Provisioning** tab, click **To App** from the side nav.
+2. Click **Edit** and check to Enable all the features you need, i.e. Create, Update, Delete Users.
+3. Click **Save** at the bottom.
+
+### Step 4: Configure Attribute Mappings
+1.  While still in the **Provisioning** tab scroll down to Attribute Mappings section
+2.  The default attribute mappings often require adjustments for robust provisioning. We recommend using the following configuration. You can delete attributes that are not here:
+
+<div class="flex justify-center">
+    <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/scim-okta-mappings.png" alt="Okta SCIM mappings"/>
+    <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/sso/scim-okta-mappings-dark.png" alt="Okta SCIM mappings"/>
+</div>
+
+### Step 5: Assign Users or Groups
+
+1. Visit the **Assignments** tab, click **Assign**
+2. Click **Assign to People** or **Assign to Groups** 
+3. After finding the User or Group that needs to be assigned, click **Assign** next to their name
+4. In the mapping modal the Username needs to be edited to comply with the following rules.
+
+<Tip warning={true}>
+<ul>
+<li>Only regular characters and `-` are accepted in the Username.</li>
+<li>`--` (double dash) is forbidden.</li>
+<li>`-` cannot start or end the name.</li>
+<li>Digit-only names are not accepted.</li>
+<li>Minimum length is 2 and maximum length is 42.</li>
+<li>Username has to be unique within your org.</li>
+</ul>
+</Tip>
+
+5. Scroll down and click **Save and Go Back** 
+6. Click **Done**
+7. Confirm that users or groups are created, updated, or deactivated in your Hugging Face organization as expected.

docs/hub/spaces-custom-domain.md

@@ -0,0 +1,37 @@
+# Spaces Custom Domain  
+
+
+<Tip warning={true}>
+Spaces Custom Domain feature is part of PRO and Team or Enterprise subscriptions.
+</Tip>
+
+## Getting started with a Custom Domain
+
+Spaces Custom Domain is a feature that allows you to host your space in a custom domain of your choosing: `yourdomain.example.com` 🚀 The custom domain must be a valid DNS name.
+
+<div class="flex justify-center">
+    <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-feature_light.png"/>
+    <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-feature_dark.png"/>
+</div>
+
+## Using a Custom Domain
+
+You can submit a custom domain to host your space in the settings of your Space, under "Custom Domain". You'll need to add the CNAME Record Type: 
+
+<div class="flex justify-center">
+    <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-dns_light.png"/>
+    <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-dns_dark.png"/>
+</div>
+
+The request will move to 'pending' status after submission as seen below. 
+
+<div class="flex justify-center">
+    <img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-pending_light.png"/>
+    <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/custom-domain-pending_dark.png"/>
+</div>
+
+Please make sure to point the domain to `hf.space`. Once set up, you'll see a 'ready' status to know the custom domain is active for your Space 🔥
+
+## Removing a Custom Domain
+
+Simply remove a custom domain by using the delete button to the right of “Custom Domain” in the settings of your Space. You can delete while the custom domain is pending or in ready state.

docs/hub/storage-limits.md

@@ -2,6 +2,10 @@
 
 At Hugging Face our intent is to provide the AI community with **free storage space for public repositories**. We do bill for storage space for **private repositories**, above a free tier (see table below).
 
+<Tip>
+Storage limits and policies apply to both model and dataset repositories on the Hub.
+</Tip>
+
 We [optimize our infrastructure](https://huggingface.co/blog/xethub-joins-hf) continuously to [scale our storage](https://x.com/julien_c/status/1821540661973160339) for the coming years of growth in Machine learning.
 
 We do have mitigations in place to prevent abuse of free public storage, and in general we ask users and organizations to make sure any uploaded large model or dataset is **as useful to the community as possible** (as represented by numbers of likes or downloads, for instance).

docs/inference-providers/_toctree.yml

@@ -53,7 +53,7 @@
   - local: guides/function-calling
     title: Function Calling
   - local: guides/gpt-oss
-    title: How to use OpenAI's GPT OSS
+    title: How to use OpenAI gpt-oss
 
 
 - title: API Reference

docs/inference-providers/guides/gpt-oss.md

@@ -1,10 +1,10 @@
-# How to use OpenAI's GPT OSS
+# How to use OpenAI gpt-oss
 
 <div class="flex justify-center">
 <img src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/inference-providers-guides/gpt-oss-thumbnail-light.png"/>
 </div>
 
-This guide walks you through using OpenAI's latest GPT OSS models with Hugging Face Inference Providers. GPT OSS is an open-weights family built for strong reasoning, agentic workflows and versatile developer use cases, and it comes in two sizes: a one with 120B parameters ([gpt-oss-120b](https://hf.co/openai/gpt-oss-120b)), and a smaller one with 20B parameters ([gpt-oss-20b](https://hf.co/openai/gpt-oss-20b)). 
+This guide walks you through using OpenAI's latest gpt-oss models with Hugging Face Inference Providers, which is the same infra that powers the official OpenAI playground ([gpt-oss.com](https://gpt-oss.com)). OpenAI gpt-oss is an open-weights family built for strong reasoning, agentic workflows and versatile developer use cases, and it comes in two sizes: a version with 120B parameters [gpt-oss-120b](https://hf.co/openai/gpt-oss-120b), and a smaller one with 20B parameters ([gpt-oss-20b](https://hf.co/openai/gpt-oss-20b)).
 
 Both models are supported on Inference Providers and can be accessed through either the OpenAI-compatible [Chat Completions API](https://platform.openai.com/docs/api-reference/chat/completions), or the more advanced [Responses API](https://platform.openai.com/docs/api-reference/responses).
 
@@ -39,7 +39,7 @@ npm install openai
 </hfoptions>
 
 ## Chat Completion
-Getting started with GPT OSS models on Inference Providers is simple and straightforward. The OpenAI-compatible Chat Completions API supports features like tool calling, structured outputs, streaming, and reasoning effort controls.
+Getting started with gpt-oss models on Inference Providers is simple and straightforward. The OpenAI-compatible Chat Completions API supports features like tool calling, structured outputs, streaming, and reasoning effort controls.
 
 Here's a basic example using [gpt-oss-120b](https://hf.co/openai/gpt-oss-120b) through the fast Cerebras provider:
 
@@ -282,7 +282,7 @@ console.log(parsedOutput);
 </hfoption>
 </hfoptions>
 
-With just a few lines of code, you can start using GPT OSS models with Hugging Face Inference Providers, fully OpenAI API-compatible, easy to integrate, and ready out of the box!
+With just a few lines of code, you can start using gpt-oss models with Hugging Face Inference Providers, fully OpenAI API-compatible, easy to integrate, and ready out of the box!
 
 ## Responses API 
 
@@ -301,7 +301,7 @@ The implementation is based on the open-source [huggingface/responses.js](https:
 
 ### Stream responses
 
-Unlike traditional text streaming, the Responses API uses a system of semantic events for streaming. This means the stream is not just raw text, but a series of structured event objects. Each event has a type, so you can listen for the specific events you care about, such as content being added (`output_text.delta`) or the message being completed (`completed). The example below shows how to iterate through these events and print the content as it arrives.
+Unlike traditional text streaming, the Responses API uses a system of semantic events for streaming. This means the stream is not just raw text, but a series of structured event objects. Each event has a type, so you can listen for the specific events you care about, such as content being added (`output_text.delta`) or the message being completed (`completed`). The example below shows how to iterate through these events and print the content as it arrives.
 
 <hfoptions id="stream">
 <hfoption id="python">
@@ -566,5 +566,5 @@ response.output.forEach((item, index) => {
 </hfoption>
 </hfoptions>
 
-That's it! With the Responses API on Inference Providers, you get fine-grained control over powerful open-weight models like GPT OSS, including streaming, tool calling, and remote MCP, making it ideal for building reliable, agent-driven applications.
+That's it! With the Responses API on Inference Providers, you get fine-grained control over powerful open-weight models like gpt-oss, including streaming, tool calling, and remote MCP, making it ideal for building reliable, agent-driven applications.
 

docs/inference-providers/providers/cerebras.md

@@ -50,7 +50,7 @@ Find out more about Chat Completion (LLM) [here](../tasks/chat-completion).
 
 <InferenceSnippet
     pipeline=text-generation
-    providersMapping={ {"cerebras":{"modelId":"Qwen/Qwen3-Coder-480B-A35B-Instruct","providerModelId":"qwen-3-coder-480b"} } }
+    providersMapping={ {"cerebras":{"modelId":"openai/gpt-oss-120b","providerModelId":"gpt-oss-120b"} } }
 conversational />