chore: bump Python backend dependencies, drop unused peewee (#25786)
* chore: bump Python backend dependencies, drop unused peewee Minor/patch + reviewed major bumps across requirements.txt, requirements-min.txt, pyproject.toml and uv.lock; playwright image bumped in docker-compose.playwright.yaml. peewee/peewee-migrate removed (zero imports). Security-relevant: cryptography 46->48, authlib 1.6.10->1.7.2, PyJWT 2.11->2.13, requests 2.33.1->2.34.2, RestrictedPython 8.1->8.2, pillow 12.1.1->12.2.0. Reviewed majors: redis 7->8, pymilvus ->2.6.14, azure-search-documents 11->12, chardet 5->7, unstructured 0.18->0.22, pycrdt 0.12->0.13. Testing: - Resolution: `uv lock` resolves the full bumped set with no conflicts; uv.lock regenerated to match (peewee dropped, every pin including azure-search-documents==12.0.0 resolves). - Per-dependency contract tests (external tests repo, unit/deps/): 105 files, 2205 passed / 6 skipped, ruff-clean. One file per dependency pins the symbols, signatures and behaviour the backend actually uses, so an API removal/rename in a bumped version fails loudly instead of at runtime. Offline/deterministic. - End-to-end embed->retrieve test driving transformers + sentence-transformers + chromadb together through Open WebUI's real RAG path (cached model, in-memory chroma, semantic retrieval asserted). - Install/startup/health resolution gate added to the dep-bump workflow and the integration suite (uv/pip resolve + uvicorn /health + Playwright dev visibility). - Bugs surfaced while testing each got an isolated fix branch + regression test: Mistral OCR aiohttp FilePayload (#25779), chroma has_collection (#25780), aiocache per-user model-cache key (security), otel semconv deprecation, pydub/audioop <3.13 note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Bump python-multipart 0.0.22 -> 0.0.27 (CVE-2026-42561, CVE-2026-40347) 0.0.22 is affected by two DoS CVEs in the multipart parser that Starlette/FastAPI run for every multipart/form-data request, so any authenticated user hitting an upload endpoint can trigger them: - CVE-2026-42561: unbounded part-header count/size -> CPU exhaustion (fixed 0.0.27) - CVE-2026-40347: large multipart preamble/epilogue DoS (fixed 0.0.26) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Classic298andClaude Opus 4.8 authored and GitHub committed
1 parent
f923edcaaa
commit
b295a20b9d
5 files changed
+3129
-2680
No files matched your search
@@ -1,59 +1,57 @@
|
||||
# Minimal requirements for backend to run
|
||||
# WIP: use this as a reference to build a minimal docker image
|
||||
|
||||
fastapi==0.135.1
|
||||
fastapi==0.136.3
|
||||
uvicorn[standard]==0.41.0
|
||||
pydantic==2.12.5
|
||||
python-multipart==0.0.22
|
||||
pydantic==2.13.4
|
||||
python-multipart==0.0.27
|
||||
itsdangerous==2.2.0
|
||||
|
||||
python-socketio==5.16.1
|
||||
python-socketio==5.16.2
|
||||
python-jose==3.5.0
|
||||
cryptography
|
||||
bcrypt==5.0.0
|
||||
argon2-cffi==25.1.0
|
||||
PyJWT[crypto]==2.11.0
|
||||
authlib==1.6.10
|
||||
PyJWT[crypto]==2.13.0
|
||||
authlib==1.7.2
|
||||
|
||||
requests==2.33.1
|
||||
requests==2.34.2
|
||||
aiohttp==3.13.5 # do not update to 3.13.3 - broken
|
||||
async-timeout
|
||||
aiocache
|
||||
aiofiles
|
||||
starlette-compress==1.7.0
|
||||
starlette-compress==1.7.1
|
||||
Brotli==1.2.0
|
||||
brotlicffi==1.2.0.1
|
||||
httpx[socks,http2,zstd,cli,brotli]==0.28.1
|
||||
starsessions[redis]==2.2.1
|
||||
|
||||
sqlalchemy==2.0.48
|
||||
aiosqlite==0.21.0
|
||||
psycopg[binary]==3.2.9
|
||||
sqlalchemy==2.0.50
|
||||
aiosqlite==0.22.1
|
||||
psycopg[binary]==3.3.4
|
||||
alembic==1.18.4
|
||||
peewee==3.19.0
|
||||
peewee-migrate==1.14.3
|
||||
|
||||
pycrdt==0.12.47
|
||||
pycrdt==0.13.1
|
||||
redis
|
||||
|
||||
APScheduler==3.11.2
|
||||
RestrictedPython==8.1
|
||||
RestrictedPython==8.2
|
||||
|
||||
loguru==0.7.3
|
||||
asgiref==3.11.1
|
||||
|
||||
mcp==1.26.0
|
||||
mcp==1.27.2
|
||||
openai
|
||||
|
||||
langchain==1.2.10
|
||||
langchain-community==0.4.1
|
||||
langchain-classic==1.0.1
|
||||
langchain-text-splitters==1.1.1
|
||||
langchain-community==0.4.2
|
||||
langchain-classic==1.0.7
|
||||
langchain-text-splitters==1.1.2
|
||||
|
||||
fake-useragent==2.2.0
|
||||
|
||||
chromadb==1.5.2
|
||||
black==26.3.1
|
||||
chromadb==1.5.9
|
||||
black==26.5.1
|
||||
pydub
|
||||
chardet==5.2.0
|
||||
chardet==7.4.3
|
||||
beautifulsoup4
|
||||
+60
-62
@@ -1,85 +1,83 @@
|
||||
fastapi==0.135.1
|
||||
fastapi==0.136.3
|
||||
uvicorn[standard]==0.41.0
|
||||
pydantic==2.12.5
|
||||
python-multipart==0.0.22
|
||||
pydantic==2.13.4
|
||||
python-multipart==0.0.27
|
||||
itsdangerous==2.2.0
|
||||
|
||||
python-socketio==5.16.1
|
||||
python-socketio==5.16.2
|
||||
python-jose==3.5.0
|
||||
cryptography==46.0.5
|
||||
cryptography==48.0.0
|
||||
bcrypt==5.0.0
|
||||
argon2-cffi==25.1.0
|
||||
PyJWT[crypto]==2.11.0
|
||||
authlib==1.6.10
|
||||
PyJWT[crypto]==2.13.0
|
||||
authlib==1.7.2
|
||||
|
||||
requests==2.33.1
|
||||
requests==2.34.2
|
||||
aiohttp==3.13.5 # do not update to 3.13.3 - broken
|
||||
async-timeout==5.0.1
|
||||
aiocache==0.12.3
|
||||
aiofiles==25.1.0
|
||||
starlette-compress==1.7.0
|
||||
starlette-compress==1.7.1
|
||||
Brotli==1.2.0
|
||||
brotlicffi==1.2.0.1
|
||||
httpx[socks,http2,zstd,cli,brotli]==0.28.1
|
||||
starsessions[redis]==2.2.1
|
||||
python-mimeparse==2.0.0
|
||||
|
||||
sqlalchemy[asyncio]==2.0.48
|
||||
aiosqlite==0.21.0
|
||||
psycopg[binary]==3.2.9
|
||||
sqlalchemy[asyncio]==2.0.50
|
||||
aiosqlite==0.22.1
|
||||
psycopg[binary]==3.3.4
|
||||
alembic==1.18.4
|
||||
peewee==3.19.0
|
||||
peewee-migrate==1.14.3
|
||||
|
||||
pycrdt==0.12.47
|
||||
redis==7.4.0
|
||||
pycrdt==0.13.1
|
||||
redis==8.0.0
|
||||
|
||||
APScheduler==3.11.2
|
||||
RestrictedPython==8.1
|
||||
pytz==2026.1.post1
|
||||
RestrictedPython==8.2
|
||||
pytz==2026.2
|
||||
|
||||
loguru==0.7.3
|
||||
asgiref==3.11.1
|
||||
|
||||
# AI libraries
|
||||
tiktoken==0.12.0
|
||||
mcp==1.26.0
|
||||
tiktoken==0.13.0
|
||||
mcp==1.27.2
|
||||
|
||||
openai==2.29.0
|
||||
anthropic==0.86.0
|
||||
google-genai==1.66.0
|
||||
|
||||
langchain==1.2.10
|
||||
langchain-community==0.4.1
|
||||
langchain-classic==1.0.1
|
||||
langchain-text-splitters==1.1.1
|
||||
langchain-community==0.4.2
|
||||
langchain-classic==1.0.7
|
||||
langchain-text-splitters==1.1.2
|
||||
|
||||
fake-useragent==2.2.0
|
||||
chromadb==1.5.2
|
||||
chromadb==1.5.9
|
||||
weaviate-client==4.20.3
|
||||
opensearch-py==3.1.0
|
||||
opensearch-py==3.2.0
|
||||
|
||||
transformers==5.5.4
|
||||
sentence-transformers==5.4.0
|
||||
sentence-transformers==5.5.1
|
||||
accelerate==1.13.0
|
||||
pyarrow==20.0.0 # fix: pin pyarrow version to 20 for rpi compatibility #15897
|
||||
einops==0.8.2
|
||||
|
||||
ftfy==6.3.1
|
||||
chardet==5.2.0
|
||||
chardet==7.4.3
|
||||
pypdf==6.7.5
|
||||
fpdf2==2.8.7
|
||||
pymdown-extensions==10.21
|
||||
pymdown-extensions==10.21.3
|
||||
docx2txt==0.9
|
||||
python-pptx==1.0.2
|
||||
msoffcrypto-tool==6.0.0
|
||||
unstructured==0.18.31
|
||||
unstructured==0.22.31
|
||||
|
||||
nltk==3.9.3
|
||||
nltk==3.9.4
|
||||
Markdown==3.10.2
|
||||
beautifulsoup4==4.14.3
|
||||
pypandoc==1.16.2
|
||||
pandas==3.0.1
|
||||
pypandoc==1.17
|
||||
pandas==3.0.3
|
||||
openpyxl==3.1.5
|
||||
pyxlsb==1.0.10
|
||||
xlrd==2.0.2
|
||||
@@ -88,48 +86,48 @@ psutil==7.2.2
|
||||
sentencepiece==0.2.1
|
||||
soundfile==0.13.1
|
||||
|
||||
pillow==12.1.1
|
||||
pillow==12.2.0
|
||||
opencv-python-headless==4.13.0.92
|
||||
rapidocr-onnxruntime==1.4.4
|
||||
rank-bm25==0.2.2
|
||||
|
||||
onnxruntime==1.24.3
|
||||
onnxruntime==1.26.0
|
||||
faster-whisper==1.2.1
|
||||
|
||||
black==26.3.1
|
||||
black==26.5.1
|
||||
youtube-transcript-api==1.2.4
|
||||
pytube==15.0.0
|
||||
|
||||
pydub==0.25.1
|
||||
ddgs==9.11.3
|
||||
ddgs==9.14.4
|
||||
|
||||
azure-ai-documentintelligence==1.0.2
|
||||
azure-identity==1.25.2
|
||||
azure-storage-blob==12.28.0
|
||||
azure-search-documents==11.6.0
|
||||
azure-identity==1.25.3
|
||||
azure-storage-blob==12.29.0
|
||||
azure-search-documents==12.0.0
|
||||
|
||||
## Google Drive
|
||||
google-api-python-client==2.193.0
|
||||
google-auth-httplib2==0.3.0
|
||||
google-auth-oauthlib==1.3.0
|
||||
google-api-python-client==2.197.0
|
||||
google-auth-httplib2==0.4.0
|
||||
google-auth-oauthlib==1.4.0
|
||||
|
||||
googleapis-common-protos==1.72.0
|
||||
googleapis-common-protos==1.75.0
|
||||
google-cloud-storage==3.9.0
|
||||
|
||||
## Databases
|
||||
pymongo==4.16.0
|
||||
psycopg2-binary==2.9.11
|
||||
pymongo==4.17.0
|
||||
psycopg2-binary==2.9.12
|
||||
pgvector==0.4.2
|
||||
|
||||
PyMySQL==1.1.2
|
||||
PyMySQL==1.2.0
|
||||
boto3==1.42.62
|
||||
# mariadb==1.1.14 should be added if you want to support MariaDB
|
||||
# valkey-glide-sync==2.3.1 # optional: install manually if VECTOR_DB=valkey
|
||||
|
||||
pymilvus==2.6.9
|
||||
qdrant-client==1.17.0
|
||||
playwright==1.58.0 # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
|
||||
elasticsearch==9.3.0
|
||||
pymilvus==2.6.14
|
||||
qdrant-client==1.18.0
|
||||
playwright==1.60.0 # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
|
||||
elasticsearch==9.4.1
|
||||
pinecone==6.0.2
|
||||
oracledb==3.4.2
|
||||
|
||||
@@ -147,15 +145,15 @@ pytest-docker~=3.2.5
|
||||
ldap3==2.9.1
|
||||
|
||||
## Trace
|
||||
opentelemetry-api==1.40.0
|
||||
opentelemetry-sdk==1.40.0
|
||||
opentelemetry-exporter-otlp==1.40.0
|
||||
opentelemetry-instrumentation==0.61b0
|
||||
opentelemetry-instrumentation-fastapi==0.61b0
|
||||
opentelemetry-instrumentation-sqlalchemy==0.61b0
|
||||
opentelemetry-instrumentation-redis==0.61b0
|
||||
opentelemetry-instrumentation-requests==0.61b0
|
||||
opentelemetry-instrumentation-logging==0.61b0
|
||||
opentelemetry-instrumentation-httpx==0.61b0
|
||||
opentelemetry-instrumentation-aiohttp-client==0.61b0
|
||||
opentelemetry-instrumentation-system-metrics==0.61b0
|
||||
opentelemetry-api==1.42.1
|
||||
opentelemetry-sdk==1.42.1
|
||||
opentelemetry-exporter-otlp==1.42.1
|
||||
opentelemetry-instrumentation==0.63b1
|
||||
opentelemetry-instrumentation-fastapi==0.63b1
|
||||
opentelemetry-instrumentation-sqlalchemy==0.63b1
|
||||
opentelemetry-instrumentation-redis==0.63b1
|
||||
opentelemetry-instrumentation-requests==0.63b1
|
||||
opentelemetry-instrumentation-logging==0.63b1
|
||||
opentelemetry-instrumentation-httpx==0.63b1
|
||||
opentelemetry-instrumentation-aiohttp-client==0.63b1
|
||||
opentelemetry-instrumentation-system-metrics==0.63b1
|
||||
Reference in new issue
Block a user