Repository navigation
Conversation
Upgrade vulnerable packages in backend/uv.lock (fastapi/starlette, fastapi-users, python-multipart, litellm, dspy 3, ragas 0.4, deepeval, langchain 1.x, pypdf 6, pillow, nltk, aiohttp, cryptography, transformers removed, etc.) and adapt the code to the new versions: - fastapi-pagination >= 0.13 requires `apaginate` for async sessions. - ragas 0.4 names mode-based metric columns like "factual_correctness(mode=f1)". - cryptography moved the CFB mode to the `decrepit` module. - ragas 0.4.3 still imports langchain_community.chat_models.vertexai, so constrain langchain-community < 0.4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves GHSA-jhr6-gm9c-rqjv and switches to the non-deprecated CrossEncoder / encode() arguments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Upgrade litellm, llama-index-core 0.13, dspy 3, banks, deepdiff, pypdf, nltk, mistune, jupyter dev dependencies, etc. in core/uv.lock, and call dspy modules directly instead of `.forward()` as recommended by dspy 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pulls in a patched undici and drops @fastify/busboy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…erts - Upgrade next / @next/third-parties / eslint-config-next to 15.5.28, storybook to 8.6, @tanstack/react-form to 0.42, undici, postcss, js-cookie, vite, eslint. - Add scoped pnpm overrides for vulnerable transitive dependencies. - Replace the `ai` package (only `parseStreamPart` was used) with a small local parser for the data stream protocol, since newer `ai` majors dropped it. - Adapt to @tanstack/react-form 0.42 (`batch` from @tanstack/store). - Patch @storybook/nextjs's image loader for image-size 2 and the upgraded sharp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ruff-action installs the latest ruff by default, and ruff >= 0.16 enables a much larger default rule set (~1600 findings across the repo, also on main). Use the same version as backend/uv.lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…advisories - Require Python >= 3.11 (3.10 reached end of life in October 2026): the pillow fixes for the advisories published on 2026-10-20..22 are only available in pillow 13, which no longer supports Python 3.10. The backend Docker image already uses Python 3.11. - backend: certifi 2026.10.19, virtualenv 21.14.13. langfuse 2.x caps packaging < 25 although it only uses packaging.version, so override it to allow the patched virtualenv (pre-commit dependency). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shizn
marked this pull request as draft
November 2, 2026 21:58
shizn
changed the title
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This update retains the dependency upgrades from #717 and hardens Autoflow's authorization, credential handling and model configuration. It is a draft while the remaining repository security findings and deployment validation are completed.
Implemented:
Validation: 217 backend security tests, 51 frontend tests, frontend TypeScript check, changed Python Ruff checks, and diff checks passed locally. Database regression tests currently use real SQLite transactions; TiDB/container integration remains pending. The new Security Regression workflow runs the backend suite in CI. The sidecar container passed native-library, authentication and real inference checks for both pinned models. Real Chromium tests cover dynamic rendering, blocked internal HTTP/WebSocket/preconnect/WebRTC/service-worker access and timeout cleanup; HTTPS tests verify SNI/hostname checks on pinned connections. E2E now uses Playwright 1.64.1 (matching the validated crawler browser); all 24 tests collect. The previous E2E job stalled downloading Chromium 140 before executing tests. Browser installation has its own deadline, and integration/preview checks still require validation against the final branch.
Rollout requires coordinated API/worker downtime, private database/environment backups, schema migrations, provider-credential re-encryption, independent signing/encryption keys, new scoped API keys, and registration of custom provider origins. See
backend/SECURITY_MIGRATION.mdfor the current procedure.Still in progress: remaining provider-specific/DSPy deadline coverage and secret-safe diagnostic/Sentry logging, full CI/runtime deployment verification and Helix rescan. Do not deploy this draft independently of the documented migrations.