mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
8b1bfb87f7af568b0df22d1d4ed4db42e16c884c
17
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
05eb74022a |
chore(ci): migrate Python tooling to uv and standardize workflow execution (#7386)
# Description of Changes This PR modernizes the project's Python tooling across GitHub Actions by migrating CI workflows from pip-based dependency management to `uv` and aligning Python execution with the engine project's managed environment. ### What was changed - Replaced `actions/setup-python` and ad-hoc `pip install` steps with `astral-sh/setup-uv` across CI workflows. - Configured shared `uv` dependency caching using `engine/pyproject.toml` and `engine/uv.lock`. - Updated Python script execution to use `uv run --project engine --locked` for a consistent runtime environment. - Replaced package installation steps with `uv sync` for the required dependency groups (e.g. `tools` and `cucumber`). - Added Docker image build validation for both production and development AI engine images. - Updated workflow cache configuration and Docker build context where required. - Removed obsolete Python requirements files that are no longer needed after the migration. - Applied minor Python code modernizations, including import cleanup, modern built-in generic type annotations (`list[...]`, `tuple[...]`, `float | None`), and small style improvements. - Removed unnecessary Python formatter/linter extensions from the development container configuration. ### Why the change was made - Standardize Python dependency management across the repository. - Reduce duplicated dependency installation logic in CI. - Improve workflow performance through shared dependency caching. - Ensure all Python utilities execute against the same locked dependency set managed by the engine project. - Simplify long-term maintenance by eliminating legacy requirements files and pip-specific workflow steps. --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details. --------- Signed-off-by: Carsten Drewes <c.drewes@stud.uni-hannover.de> Co-authored-by: albanobattistella <34811668+albanobattistella@users.noreply.github.com> Co-authored-by: kastenherri <116314318+kastenherri@users.noreply.github.com> Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: James Brunton <jbrunton96@gmail.com> |
||
|
dependabot[bot]
|
94fbc74271 |
build(deps): bump the uv group across 1 directory with 3 updates (#7287)
Bumps the uv group with 3 updates in the /engine directory: [cryptography](https://github.com/pyca/cryptography), [aiohttp](https://github.com/aio-libs/aiohttp) and [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator). Updates `cryptography` from 49.0.0 to 50.0.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>50.0.0 - 2026-07-31</p> <pre><code> * **SECURITY ISSUE**: :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:`3218`. Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247** * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added ``xof()`` class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>`_ for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's ``InvalidityDate`` extension now rejects a ``GeneralizedTime`` that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose ``version`` field is not ``v1``, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc"><code>dcb7050</code></a> Prepare for 50.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/15372">#15372</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"><code>53fccd9</code></a> Don't leak how PKCS#7 encryptedKey decryption failed (<a href="https://redirect.github.com/pyca/cryptography/issues/15369">#15369</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8"><code>d472f97</code></a> Add <code>from __future__ import annotations</code> to all src/ Python files (<a href="https://redirect.github.com/pyca/cryptography/issues/15371">#15371</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a"><code>908773d</code></a> Bump downstream dependencies in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15368">#15368</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812"><code>2cc07cc</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15367">#15367</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66"><code>c94ede9</code></a> chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15366">#15366</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35"><code>67a8308</code></a> chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15365">#15365</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596"><code>95018ff</code></a> Release the GIL in one-shot AEAD encrypt/decrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/15361">#15361</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02"><code>6954733</code></a> Release the GIL during DH and DSA parameter generation (<a href="https://redirect.github.com/pyca/cryptography/issues/15364">#15364</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6"><code>6893b94</code></a> Import _serialization instead of serialization in x509/extensions (<a href="https://redirect.github.com/pyca/cryptography/issues/15363">#15363</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/49.0.0...50.0.0">compare view</a></li> </ul> </details> <br /> Updates `aiohttp` from 3.14.1 to 3.14.3 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's changelog</a>.</em></p> <blockquote> <h1>3.14.3 (2026-07-22)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed the client dropping only the first <code>Authorization</code>, <code>Cookie</code> and <code>Proxy-Authorization</code> header when a redirect crossed an origin -- by :user:<code>arshsmith1</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>13180</code>.</p> </li> <li> <p>Fixed error message construction in the C HTTP parser -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>13222</code>.</p> </li> </ul> <hr /> <h1>3.14.2 (2026-07-20)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed :py:attr:<code>~aiohttp.web.StreamResponse.last_modified</code> rounding a :class:<code>datetime.datetime</code> with a fractional second down.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>5303</code>.</p> </li> <li> <p>Fixed resolving <code>localhost</code> on Windows to fall back without <code>AI_ADDRCONFIG</code> when the first lookup fails, so <code>localhost</code> still works without an active network.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>5357</code>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aio-libs/aiohttp/commit/5e392ce0456f5235a4ee6ad46f0e806df2f15873"><code>5e392ce</code></a> Release v3.14.3 (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13225">#13225</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"><code>49f65d5</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13222">#13222</a>/f4866933 backport][3.14] Build C parser error message from bounded...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/240099e5216a01b32919dcd8dd5c6c0b1bf83671"><code>240099e</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13180">#13180</a>/ee53d655 backport][3.14] drop every copy of credential headers on ...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/d93f30a302f8b930074fe14a2be7b2088ba28111"><code>d93f30a</code></a> Bump version (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13202">#13202</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/c1b9212ad3d93c24b5fc66ad0849597166bc816e"><code>c1b9212</code></a> Release v3.14.2 (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13201">#13201</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/380d4b55e8df48dfd62f1addfb530426f6bc4106"><code>380d4b5</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13054">#13054</a>/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/e1e1bee363dfba04a9a75c8801717da2ed5bdcb9"><code>e1e1bee</code></a> Make llhttp method array size dynamic (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13174">#13174</a>) (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13196">#13196</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/aa4cf29b6a5ad6f4d21fa1dd3f69193dc2f5d505"><code>aa4cf29</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13170">#13170</a>/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/71b57b40d85a0723c92b0a5a37ebdf518210d2ea"><code>71b57b4</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13172">#13172</a>/a57747ed backport][3.14] Fix C parser folding fragment into query_...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/64a03fb620b623e5a5a1b7103c07ae3e536a0d40"><code>64a03fb</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13169">#13169</a>/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...</li> <li>Additional commits viewable in <a href="https://github.com/aio-libs/aiohttp/compare/v3.14.1...v3.14.3">compare view</a></li> </ul> </details> <br /> Updates `datamodel-code-generator` from 0.56.0 to 0.64.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/koxudaxi/datamodel-code-generator/releases">datamodel-code-generator's releases</a>.</em></p> <blockquote> <h2>0.64.0</h2> <h2>Breaking Changes</h2> <h3>Code Generation Changes</h3> <ul> <li>Self-referencing fields are now quoted with <code>--disable-future-imports</code> - When <code>--disable-future-imports</code> is set (no <code>from __future__ import annotations</code> and no native PEP 649 deferred evaluation on Python < 3.14), self-referencing and forward-referencing field annotations in regular <code>BaseModel</code> classes are now emitted as quoted forward references instead of bare names. Previously such annotations were left unquoted, producing invalid code that raised <code>NameError</code> (Ruff F821) at class-evaluation time. Output for the common case (with <code>from __future__ import annotations</code> or Python 3.14 native deferred annotations) is unchanged. Users who snapshot/golden-file generated output for the <code>--disable-future-imports</code> configuration with self-referencing models will see the annotation change from unquoted to quoted, e.g. <code>children: Optional[List[Node]]</code> → <code>children: Optional[List["Node"]]</code>. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3387">#3387</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Update CHANGELOG for 0.63.0 by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3345">koxudaxi/datamodel-code-generator#3345</a></li> <li>Deduplicate module content builder by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3346">koxudaxi/datamodel-code-generator#3346</a></li> <li>Deduplicate import reference helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3348">koxudaxi/datamodel-code-generator#3348</a></li> <li>Refactor jsonschema root model registration by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3352">koxudaxi/datamodel-code-generator#3352</a></li> <li>Refactor XML Schema literal helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3349">koxudaxi/datamodel-code-generator#3349</a></li> <li>Move builtin formatter helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3351">koxudaxi/datamodel-code-generator#3351</a></li> <li>Deduplicate Pydantic v2 config helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3350">koxudaxi/datamodel-code-generator#3350</a></li> <li>Deduplicate DataType type hint rendering by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3354">koxudaxi/datamodel-code-generator#3354</a></li> <li>Fix <code>constr()</code> for string fields carrying minItems/maxItems by <a href="https://github.com/DarkaMaul"><code>@DarkaMaul</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3353">koxudaxi/datamodel-code-generator#3353</a></li> <li>Cover non-finite import idempotence by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3367">koxudaxi/datamodel-code-generator#3367</a></li> <li>Deduplicate input text detection by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3357">koxudaxi/datamodel-code-generator#3357</a></li> <li>Remove stale protobuf coverage pragma by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3358">koxudaxi/datamodel-code-generator#3358</a></li> <li>Cover explicit null OpenAPI media schemas by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3360">koxudaxi/datamodel-code-generator#3360</a></li> <li>Simplify Python version feature checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3361">koxudaxi/datamodel-code-generator#3361</a></li> <li>Speed up CI checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3378">koxudaxi/datamodel-code-generator#3378</a></li> <li>Add maintainer link to docs footer and README by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3379">koxudaxi/datamodel-code-generator#3379</a></li> <li>Use builtin formatter in CI by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3380">koxudaxi/datamodel-code-generator#3380</a></li> <li>Split coverage by OS by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3381">koxudaxi/datamodel-code-generator#3381</a></li> <li>Simplify import removal cleanup by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3362">koxudaxi/datamodel-code-generator#3362</a></li> <li>Pin deprecation warning stacklevel by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3363">koxudaxi/datamodel-code-generator#3363</a></li> <li>Pin public module exports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3364">koxudaxi/datamodel-code-generator#3364</a></li> <li>Cover to_hashable branch cases by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3366">koxudaxi/datamodel-code-generator#3366</a></li> <li>Cover stable toposort behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3369">koxudaxi/datamodel-code-generator#3369</a></li> <li>Extract registry render helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3371">koxudaxi/datamodel-code-generator#3371</a></li> <li>Fix minItems for arrays of URI strings by <a href="https://github.com/sjh9714"><code>@sjh9714</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3377">koxudaxi/datamodel-code-generator#3377</a></li> <li>Deduplicate config value validators by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3372">koxudaxi/datamodel-code-generator#3372</a></li> <li>Cover CLI option metadata helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3374">koxudaxi/datamodel-code-generator#3374</a></li> <li>Cover Pydantic v2 version fallback by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3368">koxudaxi/datamodel-code-generator#3368</a></li> <li>Fix nullable JSON Schema const enums by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3355">koxudaxi/datamodel-code-generator#3355</a></li> <li>Pin patchable generation seams by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3365">koxudaxi/datamodel-code-generator#3365</a></li> <li>Cover utility helper behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3375">koxudaxi/datamodel-code-generator#3375</a></li> <li>Cover DefaultPutDict behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3376">koxudaxi/datamodel-code-generator#3376</a></li> <li>Cover validator config normalization by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3373">koxudaxi/datamodel-code-generator#3373</a></li> <li>Avoid expensive runtime type checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3382">koxudaxi/datamodel-code-generator#3382</a></li> <li>Avoid eager builtin formatter import by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3383">koxudaxi/datamodel-code-generator#3383</a></li> <li>Avoid eager TOML parser import by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3384">koxudaxi/datamodel-code-generator#3384</a></li> <li>Stabilize msgspec payload tests by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3385">koxudaxi/datamodel-code-generator#3385</a></li> <li>Avoid eager input parser imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3386">koxudaxi/datamodel-code-generator#3386</a></li> <li>Avoid eager parser model imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3388">koxudaxi/datamodel-code-generator#3388</a></li> <li>Avoid eager AsyncAPI converter imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3389">koxudaxi/datamodel-code-generator#3389</a></li> <li>Dispose parser on parse errors by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3390">koxudaxi/datamodel-code-generator#3390</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/koxudaxi/datamodel-code-generator/blob/main/CHANGELOG.md">datamodel-code-generator's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.64.0">0.64.0</a> - 2026-06-14</h2> <h2>Breaking Changes</h2> <h3>Code Generation Changes</h3> <ul> <li>Self-referencing fields are now quoted with <code>--disable-future-imports</code> - When <code>--disable-future-imports</code> is set (no <code>from __future__ import annotations</code> and no native PEP 649 deferred evaluation on Python < 3.14), self-referencing and forward-referencing field annotations in regular <code>BaseModel</code> classes are now emitted as quoted forward references instead of bare names. Previously such annotations were left unquoted, producing invalid code that raised <code>NameError</code> (Ruff F821) at class-evaluation time. Output for the common case (with <code>from __future__ import annotations</code> or Python 3.14 native deferred annotations) is unchanged. Users who snapshot/golden-file generated output for the <code>--disable-future-imports</code> configuration with self-referencing models will see the annotation change from unquoted to quoted, e.g. <code>children: Optional[List[Node]]</code> → <code>children: Optional[List["Node"]]</code>. (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3387">#3387</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Update CHANGELOG for 0.63.0 by <a href="https://github.com/dcg-generated-docs"><code>@dcg-generated-docs</code></a>[bot] in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3345">koxudaxi/datamodel-code-generator#3345</a></li> <li>Deduplicate module content builder by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3346">koxudaxi/datamodel-code-generator#3346</a></li> <li>Deduplicate import reference helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3348">koxudaxi/datamodel-code-generator#3348</a></li> <li>Refactor jsonschema root model registration by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3352">koxudaxi/datamodel-code-generator#3352</a></li> <li>Refactor XML Schema literal helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3349">koxudaxi/datamodel-code-generator#3349</a></li> <li>Move builtin formatter helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3351">koxudaxi/datamodel-code-generator#3351</a></li> <li>Deduplicate Pydantic v2 config helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3350">koxudaxi/datamodel-code-generator#3350</a></li> <li>Deduplicate DataType type hint rendering by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3354">koxudaxi/datamodel-code-generator#3354</a></li> <li>Fix <code>constr()</code> for string fields carrying minItems/maxItems by <a href="https://github.com/DarkaMaul"><code>@DarkaMaul</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3353">koxudaxi/datamodel-code-generator#3353</a></li> <li>Cover non-finite import idempotence by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3367">koxudaxi/datamodel-code-generator#3367</a></li> <li>Deduplicate input text detection by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3357">koxudaxi/datamodel-code-generator#3357</a></li> <li>Remove stale protobuf coverage pragma by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3358">koxudaxi/datamodel-code-generator#3358</a></li> <li>Cover explicit null OpenAPI media schemas by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3360">koxudaxi/datamodel-code-generator#3360</a></li> <li>Simplify Python version feature checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3361">koxudaxi/datamodel-code-generator#3361</a></li> <li>Speed up CI checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3378">koxudaxi/datamodel-code-generator#3378</a></li> <li>Add maintainer link to docs footer and README by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3379">koxudaxi/datamodel-code-generator#3379</a></li> <li>Use builtin formatter in CI by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3380">koxudaxi/datamodel-code-generator#3380</a></li> <li>Split coverage by OS by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3381">koxudaxi/datamodel-code-generator#3381</a></li> <li>Simplify import removal cleanup by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3362">koxudaxi/datamodel-code-generator#3362</a></li> <li>Pin deprecation warning stacklevel by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3363">koxudaxi/datamodel-code-generator#3363</a></li> <li>Pin public module exports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3364">koxudaxi/datamodel-code-generator#3364</a></li> <li>Cover to_hashable branch cases by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3366">koxudaxi/datamodel-code-generator#3366</a></li> <li>Cover stable toposort behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3369">koxudaxi/datamodel-code-generator#3369</a></li> <li>Extract registry render helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3371">koxudaxi/datamodel-code-generator#3371</a></li> <li>Fix minItems for arrays of URI strings by <a href="https://github.com/sjh9714"><code>@sjh9714</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3377">koxudaxi/datamodel-code-generator#3377</a></li> <li>Deduplicate config value validators by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3372">koxudaxi/datamodel-code-generator#3372</a></li> <li>Cover CLI option metadata helpers by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3374">koxudaxi/datamodel-code-generator#3374</a></li> <li>Cover Pydantic v2 version fallback by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3368">koxudaxi/datamodel-code-generator#3368</a></li> <li>Fix nullable JSON Schema const enums by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3355">koxudaxi/datamodel-code-generator#3355</a></li> <li>Pin patchable generation seams by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3365">koxudaxi/datamodel-code-generator#3365</a></li> <li>Cover utility helper behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3375">koxudaxi/datamodel-code-generator#3375</a></li> <li>Cover DefaultPutDict behavior by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3376">koxudaxi/datamodel-code-generator#3376</a></li> <li>Cover validator config normalization by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3373">koxudaxi/datamodel-code-generator#3373</a></li> <li>Avoid expensive runtime type checks by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3382">koxudaxi/datamodel-code-generator#3382</a></li> <li>Avoid eager builtin formatter import by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3383">koxudaxi/datamodel-code-generator#3383</a></li> <li>Avoid eager TOML parser import by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3384">koxudaxi/datamodel-code-generator#3384</a></li> <li>Stabilize msgspec payload tests by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3385">koxudaxi/datamodel-code-generator#3385</a></li> <li>Avoid eager input parser imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3386">koxudaxi/datamodel-code-generator#3386</a></li> <li>Avoid eager parser model imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3388">koxudaxi/datamodel-code-generator#3388</a></li> <li>Avoid eager AsyncAPI converter imports by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3389">koxudaxi/datamodel-code-generator#3389</a></li> <li>Dispose parser on parse errors by <a href="https://github.com/koxudaxi"><code>@koxudaxi</code></a> in <a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/pull/3390">koxudaxi/datamodel-code-generator#3390</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/53a25ab8ddb132ac68a2795247fc855b8f445d84"><code>53a25ab</code></a> Fast path schema output (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3410">#3410</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/ee2087f32e6100f5c3642e7ea8506aa38e9df26c"><code>ee2087f</code></a> Skip discriminator import scan (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3411">#3411</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/bdf5ddfc27f94a06ba8d289759193bb09daadd34"><code>bdf5ddf</code></a> fix: quote self-referencing fields when --disable-future-imports is set (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3387">#3387</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/ad4ec877fa6708baebdaaf820171d24bfe5bf0cb"><code>ad4ec87</code></a> Cache payload validation strategies (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3409">#3409</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/b191d52a0a1d83edeac9553119f70b2f5c131126"><code>b191d52</code></a> Shard Python tests (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3408">#3408</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/29dd6d74c95dd7799d51f2c707db24862809eb23"><code>29dd6d7</code></a> Cache parsed sources (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3407">#3407</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/93e2fe3cf5774d5e4d2083fac365e5bcbf0a647a"><code>93e2fe3</code></a> Defer generation refresh (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3406">#3406</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/bb01d9c628f9077cc5dd72320ae60a18abd5b790"><code>bb01d9c</code></a> Lazy root format exports (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3405">#3405</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/48237ed8c3af3bb58b5e6b274925ebb646412d3a"><code>48237ed</code></a> Fast path JSON schemas (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3404">#3404</a>)</li> <li><a href="https://github.com/koxudaxi/datamodel-code-generator/commit/b21d106c88ac22f137cd4562389ad95a50c2e912"><code>b21d106</code></a> Slot generation facts (<a href="https://redirect.github.com/koxudaxi/datamodel-code-generator/issues/3403">#3403</a>)</li> <li>Additional commits viewable in <a href="https://github.com/koxudaxi/datamodel-code-generator/compare/0.56.0...0.64.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
47c68af068 |
build(deps): bump pyasn1 from 0.6.3 to 0.6.4 in /engine in the uv group across 1 directory (#7190)
Bumps the uv group with 1 update in the /engine directory: [pyasn1](https://github.com/pyasn1/pyasn1). Updates `pyasn1` from 0.6.3 to 0.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pyasn1/pyasn1/releases">pyasn1's releases</a>.</em></p> <blockquote> <h2>Release 0.6.4</h2> <p>This is a security release.</p> <ul> <li>CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.</li> <li>CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.</li> <li>CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in <code>Real.__float__()</code> for values with large base-10 exponents.</li> <li>Pinned PyPI publish GitHub Action to an immutable commit.</li> </ul> <p>All changes are noted in the <a href="https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst">CHANGELOG</a>.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst">pyasn1's changelog</a>.</em></p> <blockquote> <h2>Revision 0.6.4, released 08-07-2026</h2> <ul> <li>CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)</li> <li>CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)</li> <li>CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.<strong>float</strong>() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '<!-- raw HTML omitted -->' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)</li> <li>Pinned PyPI publish GitHub Action to an immutable commit [pr <a href="https://redirect.github.com/pyasn1/pyasn1/issues/113">#113</a>](<a href="https://redirect.github.com/pyasn1/pyasn1/pull/113">pyasn1/pyasn1#113</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyasn1/pyasn1/commit/72e4803405816c371ed3b2cb4be181c47f038406"><code>72e4803</code></a> Prepare release 0.6.4</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/0c19eeb853731db1c717ff125ea001a1e558332d"><code>0c19eeb</code></a> Pin PyPI publish action to immutable commit (<a href="https://redirect.github.com/pyasn1/pyasn1/issues/113">#113</a>)</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"><code>45bdb19</code></a> Merge commit from fork</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"><code>628e36e</code></a> Merge commit from fork</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"><code>e60c691</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/pyasn1/pyasn1/compare/v0.6.3...v0.6.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
dff3101ca7 |
build(deps): bump pillow from 12.2.0 to 12.3.0 in /engine in the uv group across 1 directory (#7119)
Bumps the uv group with 1 update in the /engine directory: [pillow](https://github.com/python-pillow/Pillow). Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Anthony Stirling
|
8de94ff152 |
Ai customization settings (#7069)
# Description of Changes AI settings customisation in settings menu, as part of this also tested and fixed ollama and other 3rd party AI integrations - Adds an admin AI settings UI for customizing AI behaviour, including per-provider model and API-key configuration - Backend pushes AI config changes to the Python engine at runtime via a config-push bridge, so changes apply without a restart - Config-push is gated off in SaaS; engine now drains background tasks on shutdown instead of cancelling them --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details. |
||
|
dependabot[bot]
|
43a6ff3066 |
build(deps): bump mcp from 1.26.0 to 1.28.1 in /engine in the uv group across 1 directory (#7114)
Bumps the uv group with 1 update in the /engine directory: [mcp](https://github.com/modelcontextprotocol/python-sdk). Updates `mcp` from 1.26.0 to 1.28.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/python-sdk/releases">mcp's releases</a>.</em></p> <blockquote> <h2>v1.28.0</h2> <h2>Deprecations</h2> <p>Two API surfaces now emit <code>DeprecationWarning</code> ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is <em>called</em> - importing the modules stays silent.</p> <ul> <li><strong>WebSocket transport</strong> - <code>mcp.client.websocket.websocket_client</code> and <code>mcp.server.websocket.websocket_server</code><code>modelcontextprotocol/typescript-sdk#1783</code></li> <li><strong>Experimental tasks API</strong> - <code>ClientSession.experimental</code>, <code>Server.experimental</code>, <code>ServerSession.experimental</code>, and the <code>experimental_task_handlers=</code> kwarg on <code>ClientSession</code>. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.</li> </ul> <p>If your test suite runs with <code>filterwarnings = ["error"]</code> and exercises these paths, add a scoped ignore such as <code>ignore:The experimental tasks API is deprecated:DeprecationWarning</code> or <code>ignore:The WebSocket .* transport is deprecated:DeprecationWarning</code>.</p> <p>See <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2828">#2828</a> for full details.</p> <h2>What's Changed</h2> <ul> <li>[v1.x] Support Python 3.14 by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2769">modelcontextprotocol/python-sdk#2769</a></li> <li>fix: omit null optional fields from task result payloads by <a href="https://github.com/liuzemei"><code>@liuzemei</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li> <li>[v1.x] Deprecate the WebSocket transport and the experimental tasks entry points by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2828">modelcontextprotocol/python-sdk#2828</a></li> <li>[v1.x] Add a v2 status banner to the README by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2835">modelcontextprotocol/python-sdk#2835</a></li> <li>[v1.x] Deflake the child process cleanup tests by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2839">modelcontextprotocol/python-sdk#2839</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/liuzemei"><code>@liuzemei</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0</a></p> <h2>v1.27.2</h2> <h2>What's Changed</h2> <ul> <li>[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2635">modelcontextprotocol/python-sdk#2635</a></li> <li>[v1.x] Add subject and claims to AccessToken by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2690">modelcontextprotocol/python-sdk#2690</a></li> <li>[v1.x] Bind transport sessions to the authenticated principal by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2719">modelcontextprotocol/python-sdk#2719</a></li> <li>[v1.x] Scope experimental tasks to the session that created them by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2720">modelcontextprotocol/python-sdk#2720</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2</a></p> <h2>v1.27.1</h2> <h2>What's Changed</h2> <ul> <li>[v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2435">modelcontextprotocol/python-sdk#2435</a></li> <li>[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2405">modelcontextprotocol/python-sdk#2405</a></li> <li>[v1.x] build: restrict httpx to <1.0.0 by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2559">modelcontextprotocol/python-sdk#2559</a></li> <li>[v1.x] refactor: import SSEError from httpx_sse public API by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2561">modelcontextprotocol/python-sdk#2561</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1</a></p> <h2>v1.27.0</h2> <h2>What's Changed</h2> <ul> <li>fix: remove unused <code>requests</code> dependency from simple-chatbot example by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1959">modelcontextprotocol/python-sdk#1959</a></li> <li>ci: backport conformance tests from main to v1.x by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2068">modelcontextprotocol/python-sdk#2068</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266"><code>777b8d0</code></a> [v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/47204674fb26185c2cf45f065831f27b8e5d5c65"><code>4720467</code></a> [v1.x] Set Development Status classifier to Production/Stable (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2976">#2976</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/6df3d734265eb49bf758a5e5eb420937337184e9"><code>6df3d73</code></a> [v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/32d32908feb7b15eddeb46872774bf95869cc5f0"><code>32d3290</code></a> [v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0dca751056dc87d04893d53af129fd00b56a18da"><code>0dca751</code></a> [v1.x] Deflake the child process cleanup tests (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2839">#2839</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/52258a95645c66fccbe925289c3382712b9bc68a"><code>52258a9</code></a> [v1.x] Add a v2 status banner to the README (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2835">#2835</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/b8f491724c45dbf89d6569364b58d6e8d25d7e42"><code>b8f4917</code></a> [v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/2309e5ef974062748e0268c396eba73cfdb6f5e3"><code>2309e5e</code></a> fix: omit null optional fields from task result payloads (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2809">#2809</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/494eb11d36b4238226cc0551da6015e1c73f7f3b"><code>494eb11</code></a> [v1.x] Support Python 3.14 (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2769">#2769</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7"><code>6213787</code></a> [v1.x] Scope experimental tasks to the session that created them (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2720">#2720</a>)</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.26.0...v1.28.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Anthony Stirling
|
bef83d80a1 |
Patch CVEs in engine Python dependencies (#6804)
# Description of Changes - Patch CVEs in engine Python dependencies (43 alerts): `starlette` 1.3.1, `cryptography` 49.0.0, `pyjwt` 2.13.0, `urllib3` 2.7.0, `aiohttp` 3.14.1, `python-multipart` 0.0.32, `langchain-core` 1.4.8, `langsmith` 0.9.1, `authlib` 1.7.2, `requests` 2.34.2, `idna` 3.18, `pytest` 9.1.1, `pygments` 2.20.0, `pydantic-settings` 2.14.2 - Cap `pydantic-ai` `<2.0.0` and bump to 1.107.0 (1.99.0 patches CVE-2026-46678; 2.0 is a separate major migration) --- ## Checklist ### General - [x] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [x] I have performed a self-review of my own code - [x] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs (if functionality has heavily changed) - [ ] I have read the section Add New Translation Tags (for new translation tags only) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally |
||
|
EthanHealy01
|
0570c4c4d9 | Create-PDF engine: render from a structured document (#7018) | ||
|
James Brunton
|
d995471a55 |
Merge remote-tracking branch 'origin/main' into SaaS-update
# Conflicts: # frontend/editor/src/proprietary/components/chat/ChatContext.tsx # frontend/editor/src/saas/components/shared/TrialStatusBanner.tsx |
||
|
James Brunton
|
d52c7ced7c |
Improvements to Stirling Engine to prepare for SaaS release (#6603)
# Description of Changes - Use pool for postgres connections - Add ability to require user ID to be set on API calls to the engine - Add process-wide concurrency cap on AI access (in addition to existing user caps) - Allow number of workers (threads) to be specified for stirling engine - Update env var names to reflect that the DB is not just for RAG |
||
|
EthanHealy01andAnthony Stirling
|
88adb7adad |
create agent (#6520)
Added the create agent. Use [these prompts](https://github.com/Stirling-Tools/Stirling-PDF-SaaS/blob/main/docgen/backend/default_templates/sample_prompts.md) to test or try your own :) Here’s the one I use ``` Hey, I need to generate an employee expense report for reimbursement. Company: Summit Consulting Partners Company address: 88 Riverside Plaza, Suite 1400, New York, NY 10069 Accounting department email: expenses@example.com Employee details: * Employee Name: Michael Tran * Employee ID: EMP-1047 * Department: Client Services * Report Date: January 20th, 2026 * Reporting Period: January 5th, 2026 – January 16th, 2026 * Manager Approver: Laura Simmons Trip purpose: Client onsite meetings with Atlantic Energy Solutions in Boston, MA. Expense items: * Flight (NYC to Boston roundtrip) — $325.40 — January 5th, 2026 — Airline ticket * Hotel (3 nights at Harborview Hotel) — $822.75 — January 5th-8th, 2026 * Taxi from airport to hotel — $48.00 — January 5th, 2026 * Client dinner (3 attendees) — $186.20 — January 6th, 2026 * Parking at JFK Airport — $72.00 — January 5th-8th, 2026 * Breakfast (per diem not used) — $18.50 — January 7th, 2026 * Uber to client office — $22.10 — January 7th, 2026 * Printing + presentation materials — $46.90 — January 8th, 2026 * Lunch with client — $39.75 — January 8th, 2026 * Office supplies (notebooks, pens) — $27.60 — January 10th, 2026 * Mileage reimbursement (client visit in NJ, 42 miles @ $0.67/mile) — $28.14 — January 14th, 2026 * Team lunch meeting (internal) — $64.30 — January 15th, 2026 Reimbursement method should be direct deposit. Add a notes section stating: "All receipts attached. Expenses are business-related and comply with company travel policy." ``` --------- Co-authored-by: Anthony Stirling <77850077+frooodle@users.noreply.github.com> |
||
|
Anthony Stirling
|
f779085d75 | setup RAG (#6146) | ||
|
|
e5767ed58b |
Change AI engine to execute tools in Java instead of on frontend (#6116)
# Description of Changes Redesign AI engine so that it autogenerates the `tool_models.py` file from the OpenAPI spec so the Python has access to the Java API parameters and the full list of Java tools that it can run. CI ensures that whenever someone modifies a tool endpoint that the AI enigne tool models get updated as well (the dev gets told to run `task engine:tool-models`). There's loads of advantages to having the Java be the one that actually executes the tools, rather than the frontend as it was previously set up to theoretically use: - The AI gets much better descriptions of the params from the API docs - It'll be usable headless in the future so a Java daemon could run to execute ops on files in a folder without the need for the UI to run - The Java already has all the logic it needs to execute the tools - We don't need to parse the TypeScript to find the API (which is hard because the TS wasn't designed to be computer-read to extract the API) I've also hooked up the prototype frontend to ensure it's working properly, and have built it in a way that all the tool names can be translated properly, which was always an issue with previous prototypes of this. --------- Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com> Co-authored-by: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com> |
||
|
James BruntonandConnorYoh
|
2bf5f0b18e |
Add tracking system to support optional PostHog tracking in AI engine (#6040)
Co-authored-by: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com> |
||
|
aikido-autofix[bot]
|
33b2b5827a |
[Aikido] Fix 16 security issues in fastmcp, aiohttp, cryptography and 1 more (#6091)
Upgrade fastmcp, aiohttp, cryptography, and anthropic to fix critical SSRF/path traversal, header injection, OAuth confused deputy, and DoS vulnerabilities. <details> <summary>✅ 16 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs</summary> <br> This PR will resolve the following CVEs: | Issue | Severity | Description | | --- | --- | --- | | <pre>[CVE-2026-32871](https://app.aikido.dev/issues/25944204/detail?groupId=70007#CVE-2026-32871)</pre> | <pre>🚨 CRITICAL</pre> | [fastmcp] Path traversal vulnerability in URL construction allows attackers to bypass API prefix restrictions and access arbitrary backend endpoints using unencoded path parameters, enabling authenticated SSRF attacks. | | <pre>[CVE-2026-27124](https://app.aikido.dev/issues/25944204/detail?groupId=70007#CVE-2026-27124)</pre> | <pre>HIGH</pre> | [fastmcp] OAuthProxy fails to validate user consent when receiving authorization codes from GitHub, allowing attackers to exploit GitHub's consent-skipping behavior to gain unauthorized access to FastMCP servers through a Confused Deputy attack. | | <pre>[CVE-2025-64340](https://app.aikido.dev/issues/25944204/detail?groupId=70007#CVE-2025-64340)</pre> | <pre>MEDIUM</pre> | [fastmcp] Server names with shell metacharacters can cause command injection on Windows when passed to install commands, allowing arbitrary code execution through cmd.exe interpretation of .cmd wrapper files. | | <pre>[CVE-2026-34520](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34520)</pre> | <pre>🚨 CRITICAL</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34516](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34516)</pre> | <pre>HIGH</pre> | [aiohttp] A response with an excessive number of multipart headers can consume more memory than intended, leading to a denial of service (DoS) vulnerability through resource exhaustion. | | <pre>[CVE-2026-22815](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-22815)</pre> | <pre>MEDIUM</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34515](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34515)</pre> | <pre>MEDIUM</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34525](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34525)</pre> | <pre>MEDIUM</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34513](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34513)</pre> | <pre>LOW</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34514](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34514)</pre> | <pre>LOW</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34517](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34517)</pre> | <pre>LOW</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-34518](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34518)</pre> | <pre>LOW</pre> | [aiohttp] When following redirects to a different origin, the framework fails to drop the Cookie and Proxy-Authorization headers alongside the Authorization header, potentially leaking sensitive authentication credentials to untrusted domains. | | <pre>[CVE-2026-34519](https://app.aikido.dev/issues/25944198/detail?groupId=70007#CVE-2026-34519)</pre> | <pre>LOW</pre> | [aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4. | | <pre>[CVE-2026-39892](https://app.aikido.dev/issues/25637201/detail?groupId=70007#CVE-2026-39892)</pre> | <pre>MEDIUM</pre> | [cryptography] Non-contiguous buffers passed to cryptographic APIs can cause buffer overflows, potentially leading to memory corruption and arbitrary code execution. | | <pre>[CVE-2026-34452](https://app.aikido.dev/issues/25944200/detail?groupId=70007#CVE-2026-34452)</pre> | <pre>MEDIUM</pre> | [anthropic] A time-of-check-time-of-use (TOCTOU) vulnerability in the async filesystem memory tool allows local attackers to escape the sandbox directory via symlink manipulation, enabling arbitrary file read/write operations outside the intended memory directory. | | <pre>[CVE-2026-34450](https://app.aikido.dev/issues/25944200/detail?groupId=70007#CVE-2026-34450)</pre> | <pre>MEDIUM</pre> | [anthropic] The local filesystem memory tool created world-readable and potentially world-writable files, allowing local attackers to read persisted agent state or modify memory files to influence model behavior. | </details> Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com> |
||
|
James Brunton
|
e10c5f6283 |
Redesign Python AI engine (#5991)
# Description of Changes Redesign the Python AI engine to be properly agentic and make use of `pydantic-ai` instead of `langchain` for correctness and ergonomics. This should be a good foundation for us to build our AI engine on going forwards. |
||
|
James Brunton
|
c58a6092ec | Add SaaS AI engine (#5907) |