Repository navigation
[Frontend] Add stateless /v1/responses/render endpoint - #4
Open
anurag6569201 wants to merge 1 commit into
Open
anurag6569201 wants to merge 1 commit into
anurag6569201 wants to merge 1 commit into
ShipWright Agent / Shipwright / release-recommendation
completed
Sep 13, 2026 in 0s
Approve with conditions · T3 · 0 checks, 0 failed
⚠️ Shipwright: Approve with conditions · Tier T3 · run swr_20260913102112_pr4_540bec0
Shipwright recommended approve this PR with conditions.
Verdict: approve-with-conditions
Tier: T3
Summary: 0 checks, 0 failed
Next step: an authorized approver must apply the
shipwright:approvedlabel (any new push invalidates it).
Vulnerabilities (5)
| Vulnerability | Severity | Impact | Recommendation |
|---|---|---|---|
| adversarial.New Hire: The render endpoint is stateless and rejects previous_response_id, but render_responses accepts previous_messages and previous_response_outputs as… | HIGH | The render endpoint is stateless and rejects previous_response_id, but render_responses accepts previous_messages and previous_response_outputs as separate optional arguments. The public endpoint always passes None for… Evidence: docs/serving/online_serving/renderer.md:28. | Review the cited evidence, fix the risk if confirmed, and rerun Shipwright. |
| adversarial.Saboteur: render_responses_request returns GenerateRequest with token_offsets=engine_input.get("prompt_token_offsets") and features=self._extract_mm_features… | HIGH | render_responses_request returns GenerateRequest with token_offsets=engine_input.get("prompt_token_offsets") and features=self._extract_mm_features(engine_input). If engine_input is a plain dict without prompt_token_off… Evidence: vllm/entrypoints/scale_out/render/serving.py:237. | Review the cited evidence, fix the risk if confirmed, and rerun Shipwright. |
| adversarial.Saboteur: render_responses_harmony_messages applies tok_params.apply_post_tokenization to a TokensPrompt and then reads prompt["prompt_token_ids"]. | HIGH | render_responses_harmony_messages applies tok_params.apply_post_tokenization to a TokensPrompt and then reads prompt["prompt_token_ids"]. If apply_post_tokenization mutates the prompt in place or returns a new object wi… Evidence: vllm/renderers/online_renderer.py:269. | Review the cited evidence, fix the risk if confirmed, and rerun Shipwright. |
| adversarial.Security Auditor: The new /v1/responses/render endpoint is documented as requiring Bearer token auth when --api-key is configured, but the diff only updates… | HIGH | The new /v1/responses/render endpoint is documented as requiring Bearer token auth when --api-key is configured, but the diff only updates docs/usage/security.md. No code change in vllm/entrypoints/scale_out/render/api_… Evidence: docs/usage/security.md:173. | Review the cited evidence, fix the risk if confirmed, and rerun Shipwright. |
| adversarial.Security Auditor: The new endpoint returns NotImplementedError when the model does not support Responses Render API, but the route is registered unconditiona… | LOW | The new endpoint returns NotImplementedError when the model does not support Responses Render API, but the route is registered unconditionally. This exposes a capability probe to unauthenticated callers if auth is not e… Evidence: vllm/entrypoints/scale_out/render/api_router.py:96. | Review the cited evidence, fix the risk if confirmed, and rerun Shipwright. |
Conditions (1)
- human approval required (T3): apply the approval label
Fireworks usage: 46,001 input · 707 output · 46,708 total tokens · $0.0106 · 12s · 0 fix iteration(s) | Receipt: ◻ unsigned | Bundle: shipwright-run-swr_20260913102112_pr4_540bec0 | policy sha256:739716f4… · plan sha256:c871febb… | /shipwright rerun
Loading