From 86f9795dac27bbc3d3c1a7116df920cbaaeaa13a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 03:52:37 +0000 Subject: [PATCH 1/2] Bump aieng-platform-onboard from 0.4.0 to 0.6.5 Bumps [aieng-platform-onboard](https://github.com/VectorInstitute/aieng-platform) from 0.4.0 to 0.6.5. - [Release notes](https://github.com/VectorInstitute/aieng-platform/releases) - [Commits](https://github.com/VectorInstitute/aieng-platform/compare/v0.4.0...v0.6.5) --- updated-dependencies: - dependency-name: aieng-platform-onboard dependency-version: 0.6.5 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- uv.lock | 48 ++++++++++++++++++++---------------------------- 2 files changed, 21 insertions(+), 29 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index d48e31e..a5c5ce3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -15,7 +15,7 @@ dependencies = [ [dependency-groups] dev = [ - "aieng-platform-onboard>=0.3.6", + "aieng-platform-onboard>=0.6.5", "codecov>=2.1.13", "mypy>=1.20.0", "nbqa>=1.9.1", diff --git a/uv.lock b/uv.lock index ed40e78..c479c8f 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 2 +revision = 3 requires-python = ">=3.12" resolution-markers = [ "python_full_version >= '3.15' and sys_platform == 'win32'", @@ -68,7 +68,7 @@ requires-dist = [ [package.metadata.requires-dev] dev = [ - { name = "aieng-platform-onboard", specifier = ">=0.3.6" }, + { name = "aieng-platform-onboard", specifier = ">=0.6.5" }, { name = "codecov", specifier = ">=2.1.13" }, { name = "mypy", specifier = ">=1.20.0" }, { name = "nbqa", specifier = ">=1.9.1" }, @@ -200,9 +200,12 @@ dev = [ [[package]] name = "aieng-platform-onboard" -version = "0.4.0" +version = "0.6.5" source = { registry = "https://pypi.org/simple" } dependencies = [ + { name = "authlib" }, + { name = "cryptography" }, + { name = "filelock" }, { name = "firebase-admin" }, { name = "google-auth" }, { name = "google-cloud-firestore" }, @@ -210,15 +213,18 @@ dependencies = [ { name = "google-cloud-storage" }, { name = "openai" }, { name = "pandas" }, + { name = "pygments" }, + { name = "pyjwt" }, { name = "python-dotenv" }, { name = "requests" }, { name = "rich" }, { name = "urllib3" }, + { name = "virtualenv" }, { name = "weaviate-client" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/29/7a/c646b4e0c7f94e6b6c17ecc6cd9b0b73dca969c1f2bdd7431d3f2dd8ee3a/aieng_platform_onboard-0.4.0.tar.gz", hash = "sha256:3cbd7b6cd214d16575ed700166d92c570a73fe531e2123a59c03ef00d54a7bce", size = 22353, upload-time = "2025-12-12T20:31:20.22Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c0/5c/22390ef203e1b4ca2a06f1aa1aa5ff1c89484b882e82b217b70869b3e814/aieng_platform_onboard-0.6.5.tar.gz", hash = "sha256:fbe0661f5bd0edbe7cd7d7417754f796f5f8dc6578b7d184b42b5ee659340491", size = 38516, upload-time = "2026-04-17T14:32:11.257Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/8c/53/2c14c5df333046a732272b15b3dfbacfe7c00f6b08759e1a7515b71397e6/aieng_platform_onboard-0.4.0-py3-none-any.whl", hash = "sha256:aa3c71aed820b0f28810d5b29891ab5dd9dc425a2fe8f1852d40162374ed5fda", size = 25542, upload-time = "2025-12-12T20:31:19.142Z" }, + { url = "https://files.pythonhosted.org/packages/7f/a2/3f5f391c500281f287720647c6937a4dd285583540ea5ca8e510c51c0195/aieng_platform_onboard-0.6.5-py3-none-any.whl", hash = "sha256:d276dc8034cf3145a08fb92c064900190bcbc8fe73ab83e4f719fe8630938a97", size = 47735, upload-time = "2026-04-17T14:32:09.892Z" }, ] [[package]] @@ -444,14 +450,14 @@ wheels = [ [[package]] name = "authlib" -version = "1.6.11" +version = "1.6.9" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/28/10/b325d58ffe86815b399334a101e63bc6fa4e1953921cb23703b48a0a0220/authlib-1.6.11.tar.gz", hash = "sha256:64db35b9b01aeccb4715a6c9a6613a06f2bd7be2ab9d2eb89edd1dfc7580a38f", size = 165359, upload-time = "2026-04-16T07:22:50.279Z" } +sdist = { url = "https://files.pythonhosted.org/packages/af/98/00d3dd826d46959ad8e32af2dbb2398868fd9fd0683c26e56d0789bd0e68/authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04", size = 165134, upload-time = "2026-03-02T07:44:01.998Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/57/2f/55fca558f925a51db046e5b929deb317ddb05afed74b22d89f4eca578980/authlib-1.6.11-py2.py3-none-any.whl", hash = "sha256:c8687a9a26451c51a34a06fa17bb97cb15bba46a6a626755e2d7f50da8bff3e3", size = 244469, upload-time = "2026-04-16T07:22:48.413Z" }, + { url = "https://files.pythonhosted.org/packages/53/23/b65f568ed0c22f1efacb744d2db1a33c8068f384b8c9b482b52ebdbc3ef6/authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3", size = 244197, upload-time = "2026-03-02T07:44:00.307Z" }, ] [[package]] @@ -1237,11 +1243,11 @@ wheels = [ [[package]] name = "filelock" -version = "3.28.0" +version = "3.20.3" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/d6/17/6e8890271880903e3538660a21d63a6c1fea969ac71d0d6b608b78727fa9/filelock-3.28.0.tar.gz", hash = "sha256:4ed1010aae813c4ee8d9c660e4792475ee60c4a0ba76073ceaf862bd317e3ca6", size = 56474, upload-time = "2026-04-14T22:54:33.625Z" } +sdist = { url = "https://files.pythonhosted.org/packages/1d/65/ce7f1b70157833bf3cb851b556a37d4547ceafc158aa9b34b36782f23696/filelock-3.20.3.tar.gz", hash = "sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1", size = 19485, upload-time = "2026-01-09T17:55:05.421Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/3b/21/2f728888c45033d34a417bfcd248ea2564c9e08ab1bfd301377cf05d5586/filelock-3.28.0-py3-none-any.whl", hash = "sha256:de9af6712788e7171df1b28b15eba2446c69721433fa427a9bee07b17820a9db", size = 39189, upload-time = "2026-04-14T22:54:32.037Z" }, + { url = "https://files.pythonhosted.org/packages/b5/36/7fb70f04bf00bc646cd5bb45aa9eddb15e19437a28b8fb2b4a5249fac770/filelock-3.20.3-py3-none-any.whl", hash = "sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1", size = 16701, upload-time = "2026-01-09T17:55:04.334Z" }, ] [[package]] @@ -3966,19 +3972,6 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" }, ] -[[package]] -name = "python-discovery" -version = "1.2.2" -source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "filelock" }, - { name = "platformdirs" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/de/ef/3bae0e537cfe91e8431efcba4434463d2c5a65f5a89edd47c6cf2f03c55f/python_discovery-1.2.2.tar.gz", hash = "sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb", size = 58872, upload-time = "2026-04-07T17:28:49.249Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/d8/db/795879cc3ddfe338599bddea6388cc5100b088db0a4caf6e6c1af1c27e04/python_discovery-1.2.2-py3-none-any.whl", hash = "sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a", size = 31894, upload-time = "2026-04-07T17:28:48.09Z" }, -] - [[package]] name = "python-dotenv" version = "1.2.2" @@ -4994,17 +4987,16 @@ wheels = [ [[package]] name = "virtualenv" -version = "21.2.4" +version = "20.36.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "distlib" }, { name = "filelock" }, { name = "platformdirs" }, - { name = "python-discovery" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/0c/98/3a7e644e19cb26133488caff231be390579860bbbb3da35913c49a1d0a46/virtualenv-21.2.4.tar.gz", hash = "sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada", size = 5850742, upload-time = "2026-04-14T22:15:31.438Z" } +sdist = { url = "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz", hash = "sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba", size = 6032239, upload-time = "2026-01-09T18:21:01.296Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/27/8d/edd0bd910ff803c308ee9a6b7778621af0d10252219ad9f19ef4d4982a61/virtualenv-21.2.4-py3-none-any.whl", hash = "sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac", size = 5831232, upload-time = "2026-04-14T22:15:29.342Z" }, + { url = "https://files.pythonhosted.org/packages/6a/2a/dc2228b2888f51192c7dc766106cd475f1b768c10caaf9727659726f7391/virtualenv-20.36.1-py3-none-any.whl", hash = "sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f", size = 6008258, upload-time = "2026-01-09T18:20:59.425Z" }, ] [[package]] From dc59496bdfbadc7fd01f0c9918b538b4b673cb80 Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Mon, 4 May 2026 01:00:18 +0000 Subject: [PATCH 2/2] chore: bump authlib to >=1.6.11 to fix GHSA-jj8c-mmj3-mmgv Override aieng-platform-onboard's exact authlib==1.6.9 pin using uv override-dependencies to resolve the CSRF vulnerability in authlib's OAuth cache feature. Authlib resolved to 1.7.0. Co-authored-by: aieng-bot --- pyproject.toml | 3 +++ uv.lock | 20 +++++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index a5c5ce3..39558c3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -48,6 +48,9 @@ packages = ["implementations"] # Default dependency groups to be installed [tool.uv] default-groups = ["dev", "docs"] +override-dependencies = [ + "authlib>=1.6.11", # Override aieng-platform-onboard's exact pin to fix GHSA-jj8c-mmj3-mmgv +] [tool.uv.workspace] members = [ diff --git a/uv.lock b/uv.lock index c479c8f..8319cc4 100644 --- a/uv.lock +++ b/uv.lock @@ -21,6 +21,7 @@ members = [ "agent-bootcamp", "aieng-agents", ] +overrides = [{ name = "authlib", specifier = ">=1.6.11" }] [[package]] name = "agent-bootcamp" @@ -450,14 +451,15 @@ wheels = [ [[package]] name = "authlib" -version = "1.6.9" +version = "1.7.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, + { name = "joserfc" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/af/98/00d3dd826d46959ad8e32af2dbb2398868fd9fd0683c26e56d0789bd0e68/authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04", size = 165134, upload-time = "2026-03-02T07:44:01.998Z" } +sdist = { url = "https://files.pythonhosted.org/packages/d9/82/4d0603f30c1b4629b1f091bb266b0d7986434891d6940a8c87f8098db24e/authlib-1.7.0.tar.gz", hash = "sha256:b3e326c9aa9cc3ea95fe7d89fd880722d3608da4d00e8a27e061e64b48d801d5", size = 175890, upload-time = "2026-04-18T11:00:28.559Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/53/23/b65f568ed0c22f1efacb744d2db1a33c8068f384b8c9b482b52ebdbc3ef6/authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3", size = 244197, upload-time = "2026-03-02T07:44:00.307Z" }, + { url = "https://files.pythonhosted.org/packages/ca/48/c954218b2a250e23f178f10167c4173fecb5a75d2c206f0a67ba58006c26/authlib-1.7.0-py2.py3-none-any.whl", hash = "sha256:e36817afb02f6f0b6bf55f150782499ddd6ddf44b402bb055d3263cc65ac9ae0", size = 258779, upload-time = "2026-04-18T11:00:26.64Z" }, ] [[package]] @@ -2092,6 +2094,18 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/7b/91/984aca2ec129e2757d1e4e3c81c3fcda9d0f85b74670a094cc443d9ee949/joblib-1.5.3-py3-none-any.whl", hash = "sha256:5fc3c5039fc5ca8c0276333a188bbd59d6b7ab37fe6632daa76bc7f9ec18e713", size = 309071, upload-time = "2025-12-15T08:41:44.973Z" }, ] +[[package]] +name = "joserfc" +version = "1.6.4" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "cryptography" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/de/c6/de8fdbdfa75c8ca04fead38a82d573df8a82906e984c349d58665f459558/joserfc-1.6.4.tar.gz", hash = "sha256:34ce5f499bfcc5e9ad4cc75077f9278ab3227b71da9aaf28f9ab705f8a560d3c", size = 231866, upload-time = "2026-04-13T13:15:40.632Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b6/f7/210b27752e972edb36d239315b08d3eb6b14824cc4a590da2337d195260b/joserfc-1.6.4-py3-none-any.whl", hash = "sha256:3e4a22b509b41908989237a045e25c8308d5fd47ab96bdae2dd8057c6451003a", size = 70464, upload-time = "2026-04-13T13:15:39.259Z" }, +] + [[package]] name = "jsonschema" version = "4.26.0"