Repository navigation
Staging #95
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Staging #95
Changes from 24 commits
a9bd021
6254299
e2185d1
9fdb9cc
ca15399
5d83637
2d1e095
2a6547c
689ece0
f83e8cf
200a418
9cb79e7
ead7353
9b2be20
88220c6
2fae72c
01181f9
975a5dc
4a7449a
e99a8ba
d8abc69
1f04885
4e7e08a
eeea600
fa56d03
39df81a
e59adbf
e41d8b8
ddb031e
cc71bd9
8d575df
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -4,16 +4,18 @@ verify_ssl = true | |||||||||||||||||||||||||||||||||
| name = "pypi" | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| [packages] | ||||||||||||||||||||||||||||||||||
| litellm = {extras = ["bedrock"], version = "~=1.74.14"} | ||||||||||||||||||||||||||||||||||
| fastapi = "~=0.115.0" | ||||||||||||||||||||||||||||||||||
| uvicorn = "~=0.32.0" | ||||||||||||||||||||||||||||||||||
| litellm = "~=1.74.14" | ||||||||||||||||||||||||||||||||||
| falkordb = "~=1.2.0" | ||||||||||||||||||||||||||||||||||
| flask = "~=3.1.0" | ||||||||||||||||||||||||||||||||||
| psycopg2-binary = "~=2.9.9" | ||||||||||||||||||||||||||||||||||
| pymysql = "~=1.1.0" | ||||||||||||||||||||||||||||||||||
| authlib = "~=1.4.0" | ||||||||||||||||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Remediate Starlette DoS advisory by bumping FastAPI so it can resolve a patched Starlette (>=0.47.2). Your CI flagged starlette@0.46.2 (GHSA-2c2j-9gv5-cj73). The fix is in Starlette 0.47.2. FastAPI 0.115.x caps Starlette below 0.47.0 in earlier patches; FastAPI 0.116.1 broadens support to <0.48.0, allowing 0.47.2+. Update FastAPI and refresh the lock to pull a patched Starlette, and do not pin Starlette directly. - fastapi = "~=0.115.0"
+ fastapi = "~=0.116.1"Then regenerate the lock (so Starlette resolves to >=0.47.2). References: CVE/GHSA advisory (fixed in 0.47.2) and FastAPI release notes expanding Starlette range. (nvd.nist.gov, osv.dev, fastapi.tiangolo.com) 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
| itsdangerous = "~=2.2.0" | ||||||||||||||||||||||||||||||||||
| jsonschema = "~=4.25.0" | ||||||||||||||||||||||||||||||||||
| tqdm = "~=4.67.1" | ||||||||||||||||||||||||||||||||||
| boto3 = "~=1.40.11" | ||||||||||||||||||||||||||||||||||
| psycopg2-binary = "~=2.9.9" | ||||||||||||||||||||||||||||||||||
| flask-dance = "~=7.1.0" | ||||||||||||||||||||||||||||||||||
| async-timeout = "~=4.0.3" | ||||||||||||||||||||||||||||||||||
| mysql-connector-python = "~=9.4.0" | ||||||||||||||||||||||||||||||||||
| python-multipart = "~=0.0.10" | ||||||||||||||||||||||||||||||||||
| jinja2 = "~=3.1.4" | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| [dev-packages] | ||||||||||||||||||||||||||||||||||
| pytest = "~=8.4.1" | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Targeting staging is sensible; verify branch protections and automations
Directing Dependabot PRs to
stagingis aligned with your flow. Ensure:staging.staging.stagingtomainare scheduled to avoid security updates stalling onmain.Quick checks to confirm:
🏁 Script executed:
Length of output: 982
🏁 Script executed:
Length of output: 954
CI and Branch Protection for
stagingAre Missing – Action RequiredOur scan shows:
stagingreturned a 403, indicating it’s either unprotected or inaccessible by your integration..github/workflows/found no references tostaging, so no CI runs or PR checks are configured for that branch.Please address the following before merging Dependabot PRs into
staging:• Configure branch protection for
staging(at minimum, require status checks).• Update your workflows in
.github/workflows/to include bothpushandpull_requesttriggers onstaging:on.push.branches:andon.pull_request.branches:the entry"staging".• Review any auto-merge or Renovate/Dependabot automations to ensure they target
staging.• Put in place a clear process or scheduled job to backport security updates from
stagingintomainso hotfixes don’t stall.Once these are in place, your weekly Dependabot PRs to
stagingwill be properly verified and merged—and any fixes will flow safely tomain.🤖 Prompt for AI Agents