Issue 102 langchain core security patch - #107
Closed
mounacheikho-cmd wants to merge 43 commits into
Closed
Conversation
…tility-security-patches Patched utility dependencies
…uthlib-security-patch Patched authlib dependency
…ytest-security-patch Patched pytest dependencies
…xml-security-patch Patched lxml dependency
…rypto-security-patch Patched crypto dependency alerts
…ency-security-patches
…ttp-dependency-security-patches Patched HTTP dependency security alerts
…ove-gradio Removed legacy Gradio interface
…tarlette-fastapi-security-patch Updated FastAPI and Starlette dependencies
…ltk-security-patch Deleted NLTK dependency
…gate-deleted-files Fixed deleted file linting
…g-security-patches
…remove-gradio-app-main Fix quality gate handling of deleted files
…ts. (climateandtech#48) * Add env-configurable LLM model lists with GPT-5.4 and Gemini 3 defaults. Streamlit and GET /models read OPENAI_MODELS, GEMINI_MODELS, and LLM_MODELS so deployments like actwyser can extend the dropdown without forking. Defaults now include gpt-5.4-mini, gpt-5.4, and current Gemini 3.x/2.5 ids. * Potential fix for pull request finding 'Unused import' * Remove unused LLM_MODELS and fix blank lines Drop get_llm_models import after merge; keep DEFAULT_LLM_MODEL for session default. * Fix ruff violations in streamlit_app for quality-gate lint-changed runs ruff on entire touched files; apply auto-fixes, formatting, and targeted noqa/import/except updates so QG passes.
…security-updates Promote reviewed security updates to main
…ile-parsing-security-patches File parsing security patches
…security-updates Promote file-parsing security patch to main
…climateandtech#4) * Add complete benchmarking system for information retrieval evaluation • Extended database schema with 4 new tables for benchmarking data • Created comprehensive data models with Pydantic validation • Implemented dataset loader with YAML/JSON support and validation • Built evaluation engine with precision, recall, F1, NDCG, MAP, MRR metrics • Added full Streamlit UI integration with 4 sub-tabs for benchmarking workflow • Included comprehensive test suite with 31 passing tests • Added plotly dependency for metrics visualization • Created sample TCFD benchmark dataset for testing • Updated .gitignore to exclude Cursor IDE files * Update pulsar-client version to 3.6.1 - Fix pulsar-client version from 3.6.0 to 3.6.1 (3.6.0 not available) - Add venv2/ to .gitignore * Add flexible benchmark dataset support and ClimRetrieve integration - Unify BenchmarkDataset and FlexibleBenchmarkDataset into single flexible class - Add DatasetType enum for IR and IE datasets - Add FlexibleDatasetRow with get_X() helper methods for variant column names - Create flexible CSV and SQLite loaders with automatic type detection - Update evaluation engine to compare flexible IR and IE datasets - Add comprehensive tests for flexible dataset loaders and evaluation - Create ClimRetrieve benchmark script with Excel support and content-based matching - Update benchmark_store to handle optional fields in unified model - Add documentation for flexible dataset flow - Update README with benchmark running instructions * Add flexible benchmark dataset support and ClimRetrieve integration - Unify BenchmarkDataset and FlexibleBenchmarkDataset into single flexible class - Add DatasetType enum for IR and IE datasets - Add FlexibleDatasetRow with get_X() helper methods for variant column names - Create flexible CSV and SQLite loaders with automatic type detection - Update evaluation engine to compare flexible IR and IE datasets - Add comprehensive tests for flexible dataset loaders and evaluation - Create ClimRetrieve benchmark script with Excel support and content-based matching - Update benchmark_store to handle optional fields in unified model - Add documentation for flexible dataset flow - Update README with benchmark running instructions * Format benchmark code and add merge assessment - Format all benchmark files with black and isort - Add assessment document for benchmark_zhenya merge requirements - Fix import formatting in test files * Add .devnotes/ to .gitignore for development assessments * Exclude report_analyst_enterprise from black and isort linting - Add report_analyst_enterprise to black exclude pattern - Add report_analyst_enterprise to isort skip list - Update test_linting.py to filter out report_analyst_enterprise errors - Fixes CI linting failure on node_modules files in report_analyst_enterprise * Format test_linting.py with black - Fix black formatting issues in test_linting.py - All linting checks now pass * Remove emojis from benchmarking feature - Remove emojis from benchmarking UI headers and tab labels - Remove emoji from benchmarking page header in streamlit app * Bugs identified, chunk dataset created, cliretrieve yaml created * Benchmarking tab added * added analysis against climretrieve question set, removed unnecessary logs * download error analysis dataset implementation, metrics evaluation bug fixed * creating a possibility for report analyst to be a package * fixing toml file * fixing toml file 2 * fixing toml file 3 * fixing toml file 4 * Remove accidental frontend artifacts from benchmark branch - Stop tracking committed node_modules and generated build outputs - Ignore artifact directories to prevent accidental recommits * Ignore coverage.xml artifact - Keep generated coverage report out of version control * Format files for latest Black CI - Apply Black-compatible formatting updates in benchmark storage and cache modules - Normalize formatting in affected benchmark and integration tests * implementing alignment option for the datasets of various structures * fixing missing climretrieve test * fixing black test * fixing flake8 bug * fixing warning issue * fixing warning issue * untracking data folder, modifying COLAB.md * Fix CI: benchmark_store fixture, black format, pytest-asyncio - Fix merge conflict in test_benchmark_store: use BenchmarkStore for schema only, single yield with try/finally - Apply black formatting to multi-line execute()/st.info() in 7 files - Fix pyproject.toml exclude typo and set asyncio_default_fixture_loop_scope * edited readme files, added a feature to download aligned datasets from UI * Resolve conflicts after syncing with remote * deleting merge conflict marker * Potential fix for pull request finding 'Unused import' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * Feature/benchmarking bugfixes (climateandtech#38) * flexible dataset alignment implementation * Add unit tests for flexible benchmark modules. Cover flexible_alignment, dataset_normalizer, and classification_calibration to address PR climateandtech#38 review feedback requesting tests for new classes. * Fix CI lint formatting on benchmark and integration tests. Apply black to new flexible benchmark test modules and isort fix for external service integration imports so the lint job passes. --------- Co-authored-by: suung <chris@devolute.org> * Fix duplicate Streamlit keys in classification panel * Format benchmark.py with Black * Fix CI ruff and raise benchmarking module coverage. - Clear quality-gate ruff failures on changed files after main merge - Add unit tests for error_analysis, UI, mapper/loader/engine edges - Fix error_analysis field access; drop dead upload UI and debug log - Fix cache_manager double-text() execute; use package-level --cov in QG * Remove unused BLE001 noqa flagged by CI ruff. * Use MockEmbedding when reloading vector store from cached vectors. VectorStoreIndex.from_documents no longer requires OPENAI_API_KEY when chunks already include embeddings, so CI cache tests pass without a real key. * Enforce E501 in streamlit_app and wrap long lines Drop file-level E501 noqa so quality-gate catches line length; split long f-strings/help/CSS/HTML for PR review. * Format streamlit_app with black after E501 wraps * Fix DocumentAnalyzer construction on Benchmarking page Add regression test that forbids DocumentAnalyzer(cache_manager=). Use ReportAnalyzer() like other nav pages; it already owns cache_manager. * Clear minor GitHub Code Quality notes on benchmarking Drop unused IGNORE_ACTION from conftest, document soft DB/OS excepts, use generate_chunk_id directly in apply, and satisfy mixed-return analysis after pytest.skip. --------- Co-authored-by: Huryn Yauheni <gurinevgeniy12@gmail.com> Co-authored-by: YauheniHuryn <126465715+YauheniHuryn@users.noreply.github.com> Co-authored-by: nicooxxx <nicox535@gmail.com> Co-authored-by: Nico <150376360+nicooxxx@users.noreply.github.com>
…-nltk-security-patch Pinned NLTK security dependency
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #102.
Updates
langchain-corefrom0.3.43to0.3.85, addressing Dependabot alerts #37, #44, #115, and #142.Also updates
langsmithfrom0.3.13to0.3.45, the minimum version required by the new LangChain Core version.Alerts requiring a coordinated LangChain
1.xmigration remain out of scope.Validation
pip checkpassed28 passed, 1 skipped369 passed, 10 skippedThe full installation used PR #104’s Chroma versions in the temporary test environment to bypass the existing Chroma build issue.