yunlu.wen and Yunlu Wen
d60dbb146e
chore(deps): bump dep versions for CVE fixes
...
- starlette 1.0.1 -> 1.3.1 (CVE-2026-41947, CVE-2026-41948, CVE-2026-41949, CVE-2026-41950, CVE-2026-41951)
- aiohttp 3.13.4 -> 3.14.1 (CVE-2026-3245, CVE-2026-3246, CVE-2026-3247, CVE-2026-3248, CVE-2026-3249, CVE-2026-3250, CVE-2026-3251)
- pypdf 6.10.2 -> 6.14.2 (CVE-2026-3352, CVE-2026-3353, CVE-2026-3354, CVE-2026-3355, CVE-2026-3356, CVE-2026-3357, CVE-2026-3358, CVE-2026-3359)
- cryptography 46.0.7 -> 49.0.0 (CVE-2026-29497)
- bleach 6.3.0 -> 6.4.0 (CVE-2026-32786)
- ujson 5.12.1 -> 5.13.0 (CVE-2026-32787)
- langsmith 0.8.5 -> 0.8.18 (GHSA-f4xh-w4cj-qxq8)
- pydantic-settings 2.13.1 -> 2.14.2 (CVE-2026-32788)
- add cryptography>=48.0.1 to override-dependencies to force upgrade past 46.x
(cherry picked from commit ce6297bed2
2026-06-26 11:17:05 +08:00
yunlu.wen and Yunlu Wen
8be9c5f4d7
chore(deps): bump pyjwt to 2.13.0
...
(cherry picked from commit a247d625e5
2026-06-04 10:23:11 +08:00
yunlu.wen
c67c1090a2
chore(deps): bump sendgrid to v6.12.5
...
CVE-2024-23342 (ecdsa) fixed by upgrading sendgrid from 6.12.4 to 6.12.5,
which replaces ecdsa with cryptography. ecdsa dependency removed entirely.
2026-05-23 23:07:27 +08:00
yunlu.wen and Yunlu Wen
d8a465a746
chore: bump versions for litellm and langsmith ( #36385 )
...
(cherry picked from commit 718ab8433e
2026-05-20 14:25:32 +08:00
Yunlu Wen and GitHub
cb94877c18
chore: bump versions ( #35866 )
2026-05-07 13:53:39 +08:00
Yunlu Wen and GitHub
d666fb1b25
chore: lts bump litellm and langsmith versions ( #35592 )
2026-04-28 13:05:49 +08:00
Yunlu Wen and GitHub
3184ffd39b
chore: bump dependencies for lts ( #35231 )
2026-04-15 14:21:45 +08:00
Yunlu Wen and GitHub
57a4828dbf
chore: bump litellm to 1.83.0 ( #34842 )
2026-04-09 18:07:15 +08:00
59639ca9b2
chore: bump Dify to 1.13.3 and sandbox to 0.2.13 ( #34079 )
...
Signed-off-by: -LAN- <laipz8200@outlook.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-25 20:03:15 +08:00
9065d54f4a
chore: bump pyrefly from 0.55.0 to 0.57.0 ( #33755 )
...
Co-authored-by: yuchengpersonal <yuchengpersonal@users.noreply.github.com >
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-24 23:22:18 +09:00
edb261bc90
chore(deps-dev): bump the dev group across 1 directory with 12 updates ( #33919 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 17:26:47 +09:00
407f5f0cde
chore(deps-dev): bump alibabacloud-gpdb20160503 from 3.8.3 to 5.1.0 in /api in the vdb group ( #33879 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 17:25:44 +09:00
9336935295
chore(deps-dev): bump the storage group across 1 directory with 2 updates ( #33915 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 16:57:17 +09:00
a942d4c926
chore(deps): bump the python-packages group in /api with 4 updates ( #33873 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 16:33:31 +09:00
df69997d8e
chore(deps): bump google-cloud-aiplatform from 1.141.0 to 1.142.0 in /api in the google group across 1 directory ( #33917 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 16:32:05 +09:00
4ab7ba4f2e
chore(deps): bump the llm group across 1 directory with 2 updates ( #33916 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 16:31:23 +09:00
33000d1c60
chore(deps): bump pydantic-extra-types from 2.11.0 to 2.11.1 in /api in the pydantic group ( #33876 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 16:13:45 +09:00
2809e4cc40
chore(deps-dev): update pytest-cov requirement from ~=7.0.0 to ~=7.1.0 in /api in the dev group ( #33872 )d
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 16:12:23 +09:00
3f8f1fa003
chore(deps): bump google-api-python-client from 2.192.0 to 2.193.0 in /api in the google group ( #33868 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 16:11:32 +09:00
6604f8d506
chore(deps): bump litellm from 1.82.2 to 1.82.6 in /api in the llm group ( #33870 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 16:10:41 +09:00
368fc0bbe5
chore(deps): bump boto3 from 1.42.68 to 1.42.73 in /api in the storage group ( #33871 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 16:10:02 +09:00
wangxiaolei and GitHub
01d97fa2cf
fix: type object 'str' has no attribute 'LLM' ( #33899 )
2026-03-23 14:51:56 +09:00
9367020bfd
chore(deps): bump pypdf from 6.8.0 to 6.9.1 in /api ( #33698 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 04:12:54 +09:00
146f8fac45
chore(deps): bump ujson from 5.9.0 to 5.12.0 in /api ( #33683 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 03:55:49 +09:00
QuantumGhost and GitHub
49256770c9
chore: bump version to 1.13.2 ( #33681 )
2026-03-18 21:53:16 +08:00
6de605bc27
chore(deps): bump pyasn1 from 0.6.2 to 0.6.3 in /api ( #33611 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 07:54:44 +09:00
QuantumGhost and GitHub
d1961c261e
chore: bump version to 1.13.1 ( #33505 )
2026-03-17 18:30:11 +08:00
fa82a0f708
chore(deps): bump authlib from 1.6.7 to 1.6.9 in /api ( #33544 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-17 05:06:07 +09:00
c7f86dba09
chore(deps-dev): bump the dev group across 1 directory with 19 updates ( #33525 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 20:31:58 +09:00
57d476d4e2
feat: apply markdown rendering to HITL email, sanitize email subject and body ( #32305 )
...
This PR:
1. Fixes the bug that email body of `HumanInput` node are sent as-is, without markdown rendering or sanitization
2. Applies HTML sanitization to email subject and body
3. Removes `\r` and `\n` from email subject to prevent SMTP header injection
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: QuantumGhost <obelisk.reg+git@gmail.com >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 16:52:46 +08:00
df570df238
chore(deps-dev): bump the vdb group across 1 directory with 15 updates ( #33502 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 14:42:27 +09:00
29b724e23d
chore(deps): bump google-auth from 2.49.0 to 2.49.1 in /api in the google group ( #33483 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 13:55:34 +09:00
3c587097cd
chore(deps): bump the python-packages group in /api with 13 updates ( #33484 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 11:28:42 +09:00
6a3fcc0a7b
chore(deps): bump the llm group across 1 directory with 2 updates ( #33491 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 11:23:51 +09:00
c71ecd2fe0
chore(deps-dev): update faker requirement from ~=40.8.0 to ~=40.11.0 in /api in the dev group ( #33482 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 11:09:41 +09:00
808d186156
chore(deps): bump litellm from 1.82.1 to 1.82.2 in /api in the llm group ( #33480 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-16 11:08:28 +09:00
ac23a0409e
chore(deps): bump the storage group in /api with 2 updates ( #33488 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 11:07:11 +09:00
a6163f80d1
chore(deps): bump sqlalchemy from 2.0.44 to 2.0.48 in /api in the database group ( #33487 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 09:57:51 +08:00
f795d24151
feat: Add Hologres as a VDB & FullText DB choice ( #32830 )
...
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Crazywoola <100913391+crazywoola@users.noreply.github.com >
2026-03-15 20:55:02 +08:00
6043ec4423
chore(deps): bump fickling from 0.1.9 to 0.1.10 in /api ( #33436 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-14 13:33:24 +09:00
a600794370
chore(deps): bump pyjwt from 2.11.0 to 2.12.0 in /api ( #33437 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-14 13:32:55 +09:00
20e91990bf
chore(deps): bump orjson from 3.11.4 to 3.11.6 in /api ( #33380 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-13 17:33:33 +09:00
Asuka Minato and GitHub
31eba65fe0
ci: Revert "chore(deps): bump the python-packages group across 1 directory with 13 updates" ( #33331 )
2026-03-12 10:48:11 +09:00
72496a5847
chore(deps): bump the python-packages group across 1 directory with 13 updates ( #33319 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
2026-03-12 01:22:39 +09:00
8b16030d6b
chore(deps-dev): bump the dev group across 1 directory with 18 updates ( #33322 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-12 01:02:28 +09:00
a0f0c97133
chore(deps): bump opentelemetry-propagator-b3 from 1.28.0 to 1.40.0 in /api in the opentelemetry group ( #33308 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Asuka Minato <i@asukaminato.eu.org >
2026-03-12 00:37:48 +09:00
1505ec37ef
chore(deps): bump mlflow-skinny from 3.6.0 to 3.10.1 in /api in the llm group across 1 directory ( #33317 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-12 00:26:46 +09:00
7f09917b84
chore(deps): bump the storage group in /api with 7 updates ( #33315 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-12 00:26:21 +09:00
59367c6a1c
chore(deps): update redis[hiredis] requirement from ~=7.2.0 to ~=7.3.0 in /api in the database group ( #33306 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-12 00:11:53 +09:00
f95e2acb65
chore(deps): bump the llm group in /api with 6 updates ( #33305 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-12 00:11:20 +09:00
