fix(ingestion): resolve nltk and langchain-core to fixed versions (#2061) - #2083
Merged
Merged
Conversation
Contributor
|
📝 WalkthroughWalkthroughAdded uv dependency overrides to seven connector projects and the connector test harness. The overrides raise NLTK minimum versions and raise the harness ChangesPython dependency overrides
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+24
to
+27
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+25
to
+28
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+24
to
+27
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+23
to
+26
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+23
to
+26
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+26
to
+29
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+20
to
+23
| [tool.uv] | ||
| # airbyte-cdk pins nltk==3.9.1 (fixed CRITICAL CVE-2025-14009); the image installs 3.10.0 | ||
| # over it (see Dockerfile), so keep the resolved dependency graph on the same version. | ||
| override-dependencies = ["nltk>=3.10.0"] |
Comment on lines
+30
to
+35
| [tool.uv] | ||
| # airbyte-cdk 6.60.x pins nltk and langchain-core to exact versions carrying fixed | ||
| # CRITICALs (CVE-2025-14009, CVE-2025-68664). Neither is reachable from the mock | ||
| # harness: nltk serves the file-based unstructured parser and langchain-core the | ||
| # vector-db sink, and no nocode manifest uses either. | ||
| override-dependencies = [ |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json (1)
10-18: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove generated NuGet
obj/artifacts from source control.These files embed machine-specific paths and restore state. NuGet must regenerate them during restore. Remove the tracked artifacts. If the repository does not already ignore this directory, add an
obj/ignore rule.
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json#L10-L18: remove the generated restore specification.src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.props#L6-L13: remove the generated restore properties.src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.targets#L3-L6: remove the generated restore targets.src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.dgspec.json#L10-L18: remove the generated restore specification.src/backend/services/identity/src/Insight.Identity.Domain/obj/project.nuget.cache#L3-L6: remove the generated restore cache.src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.assets.json#L423-L468: remove the generated dependency graph.src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.nuget.cache#L3-L16: remove the generated restore cache.src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.nuget.cache#L3-L68: remove the generated restore cache.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json` around lines 10 - 18, Remove all listed generated NuGet artifacts from source control: src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json (lines 10-18), src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.props (lines 6-13), src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.targets (lines 3-6), src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.dgspec.json (lines 10-18), src/backend/services/identity/src/Insight.Identity.Domain/obj/project.nuget.cache (lines 3-6), src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.assets.json (lines 423-468), src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.nuget.cache (lines 3-16), and src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.nuget.cache (lines 3-68); add an obj/ ignore rule if the repository does not already ignore these generated directories.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cache`:
- Around line 1-6: Remove all tracked generated restore artifacts under
src/backend/services/identity/src/Insight.Identity.Api/obj,
Insight.Identity.Infrastructure/obj, and Insight.Identity.Domain/obj, including
the listed cache, assets, dgspec, props, and targets files; add an obj/ and bin/
ignore pattern for the Identity service. Keep any packages.lock.json tracked,
and move required restore settings from generated metadata into the relevant
tracked *.csproj or Directory.Build.props/.targets files.
In
`@src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.json`:
- Around line 37-39: Commit the generated packages.lock.json files for the
Insight.Identity.Domain and Insight.Identity.Infrastructure projects alongside
their respective csproj files under the identity service. Generate them using
the existing restorePackagesWithLockFile setting, and ensure both lock files are
added to version control without changing the restore configuration.
In
`@src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json`:
- Around line 1-5: Generated .NET restore artifacts are tracked and must be
removed. Add [Oo]bj/ and [Bb]in/ to .gitignore, untrack all obj contents with
git rm -r --cached "src/backend/services/identity/**/obj", and remove the listed
generated files from both integration and unit test projects:
src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json
(1-5), Insight.Identity.Tests.Integration.csproj.nuget.g.props (1-26),
Insight.Identity.Tests.Integration.csproj.nuget.g.targets (1-14),
project.assets.json (1-4), project.nuget.cache (1-6), and
src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.dgspec.json
(1-5), Insight.Identity.Tests.Unit.csproj.nuget.g.props (1-25),
Insight.Identity.Tests.Unit.csproj.nuget.g.targets (1-12), project.assets.json
(1-4).
---
Nitpick comments:
In
`@src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json`:
- Around line 10-18: Remove all listed generated NuGet artifacts from source
control:
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.json
(lines 10-18),
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.props
(lines 6-13),
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.targets
(lines 3-6),
src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.dgspec.json
(lines 10-18),
src/backend/services/identity/src/Insight.Identity.Domain/obj/project.nuget.cache
(lines 3-6),
src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.assets.json
(lines 423-468),
src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.nuget.cache
(lines 3-16), and
src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.nuget.cache
(lines 3-68); add an obj/ ignore rule if the repository does not already ignore
these generated directories.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bd53f47c-b04f-4531-9abb-979c0fa7077f
📥 Commits
Reviewing files that changed from the base of the PR and between db65ea1 and 4a6b454709173d80ff085d94657c5a32d4c2b5b3.
📒 Files selected for processing (33)
src/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.dgspec.jsonsrc/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.propssrc/backend/services/identity/src/Insight.Identity.Api/obj/Insight.Identity.Api.csproj.nuget.g.targetssrc/backend/services/identity/src/Insight.Identity.Api/obj/project.assets.jsonsrc/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cachesrc/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.dgspec.jsonsrc/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.propssrc/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.targetssrc/backend/services/identity/src/Insight.Identity.Domain/obj/project.assets.jsonsrc/backend/services/identity/src/Insight.Identity.Domain/obj/project.nuget.cachesrc/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.jsonsrc/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.propssrc/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.targetssrc/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.assets.jsonsrc/backend/services/identity/src/Insight.Identity.Infrastructure/obj/project.nuget.cachesrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.jsonsrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.propssrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.targetssrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.assets.jsonsrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.nuget.cachesrc/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.dgspec.jsonsrc/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.propssrc/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.targetssrc/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.assets.jsonsrc/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.nuget.cachesrc/ingestion/connectors/ai/github-copilot/pyproject.tomlsrc/ingestion/connectors/crm/hubspot/pyproject.tomlsrc/ingestion/connectors/crm/salesforce/pyproject.tomlsrc/ingestion/connectors/git/bitbucket-cloud/pyproject.tomlsrc/ingestion/connectors/git/github-v2/pyproject.tomlsrc/ingestion/connectors/git/gitlab/pyproject.tomlsrc/ingestion/connectors/hr-directory/active-directory/pyproject.tomlsrc/ingestion/tests/connectors/pyproject.toml
Comment on lines
+1
to
+6
| { | ||
| "version": 2, | ||
| "dgSpecHash": "v0dND2Djyn4=", | ||
| "success": true, | ||
| "projectFilePath": "/repo/src/backend/services/identity/src/Insight.Identity.Api/Insight.Identity.Api.csproj", | ||
| "expectedPackageFiles": [ |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
# Untrack the generated restore output.
git rm -r --cached 'src/backend/services/identity/**/obj'Repository: constructorfabric/insight
Length of output: 246
🏁 Script executed:
#!/bin/bash
# Description: Check existing .NET ignore rules and list all tracked bin/obj artifacts.
set -uo pipefail
echo "=== .gitignore files in the repository ==="
fd -H '^\.gitignore$' . --exec echo "--- {} ---" \; --exec cat {} \;
echo "=== Tracked files under any obj/ or bin/ directory ==="
git ls-files | rg -n '/(obj|bin)/' | head -100
echo "=== Count of tracked obj/bin files ==="
git ls-files | rg -c '/(obj|bin)/' || echo 0
echo "=== Are the Identity obj paths currently ignored? ==="
git check-ignore -v \
src/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cache \
src/backend/services/identity/src/Insight.Identity.Domain/obj/project.assets.json \
|| echo "NOT ignored"Repository: constructorfabric/insight
Length of output: 22683
🏁 Script executed:
#!/bin/bash
set -uo pipefail
echo "=== Files in the PR diff stat ==="
git diff --stat
echo "=== Identity service lock files under src/backend/services/identity ==="
git ls-files 'src/backend/services/identity/**/packages.lock.json' | sort
echo "=== Root commit hash, if available ==="
git rev-parse HEAD 2>/dev/null || true
echo "=== Content snippets for referenced Identity obj files ==="
for f in \
src/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cache \
src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.json \
src/backend/services/identity/src/Insight.Identity.Api/obj/project.assets.json \
src/backend/services/identity/src/Insight.Identity.Domain/obj/project.assets.json \
src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.props \
src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.targets \
src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.props \
src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.targets
do
echo "--- $f ---"
wc -l "$f"
case "$f" in
*.nuget.dgspec.json|project.assets.json|project.nuget.cache)
sed -n '1,80p' "$f"
;;
*.csproj.nuget.g.props|*.csproj.nuget.g.targets)
sed -n '1,40p' "$f"
;;
esac
done
echo "=== Search for RestoreSettings in Identity CSProj / props files ==="
rg -n "RestoreSettings|Audit|packages\.lock\.json|RestoreLockedMode" src/backend/services/identity -g '*.csproj' -g '*.props' -g '*.targets' || trueRepository: constructorfabric/insight
Length of output: 8391
🌐 Web query:
dotnet restore generated obj project.assets.json project.nuget.cache NuGet lock File NuGet.lock packages.lock.json
💡 Result:
The files you mentioned are part of the NuGet package restore process in.NET, which ensures that all project dependencies are identified, resolved, and made available for the build [1][2][3]. project.assets.json Located in the obj folder (or the configured intermediate output path), this file is generated by the NuGet restore process [2][4]. It contains the complete dependency graph—including direct and transitive dependencies—for your project [2][5]. It is essential for the build process; the.NET SDK uses it to resolve reference assemblies and identify package locations [6][7]. It is a temporary, generated file and should not be added to source control [2]. packages.lock.json This is an optional project lock file that enables repeatable, deterministic restores [8][9]. When enabled (by setting the MSBuild property RestorePackagesWithLockFile), it records the exact versions of all packages in your dependency graph [8][9]. Unlike project.assets.json, this file is intended to be committed to source control to ensure that every build of the project uses the exact same package versions [8][9]. You can use the --locked-mode flag with dotnet restore to enforce that the restore operation strictly follows the versions defined in this file [3][10]. Other mentioned items - project.nuget.cache: While not explicitly detailed as a primary documentation artifact in the latest docs, NuGet uses various local cache locations (such as the http-cache or global-packages folder) to speed up restore operations [1][3][11]. - NuGet lock File: This generally refers to the packages.lock.json mechanism described above [8]. - obj: This is the default directory where MSBuild and NuGet place temporary build outputs and generated files, such as project.assets.json [2][4]. In summary, project.assets.json is a transient, required file for the build system to understand dependencies, while packages.lock.json is an optional, persistent file used to lock dependencies to specific versions for consistent, repeatable builds [2][6][8].
Citations:
- 1: https://learn.microsoft.com/en-us/nuget/consume-packages/package-restore
- 2: https://learn.microsoft.com/en-us/nuget/concepts/dependency-resolution
- 3: https://github.com/dotnet/docs/blob/main/docs/core/tools/dotnet-restore.md
- 4: https://github.com/NuGet/Home/wiki/%5BSpec%5D-MSBuild-restore-target
- 5: https://github.com/NuGet/Home/blob/dev/accepted/2022/dotnet-nuget-why-proposal.md
- 6: https://learn.microsoft.com/en-us/dotnet/core/tools/sdk-errors/netsdk1004
- 7: https://www.kimsereylam.com/dotnetcore/2018/08/17/sdk-projects-and-assets-json.html
- 8: https://devblogs.microsoft.com/dotnet/enable-repeatable-package-restores-using-a-lock-file/
- 9: https://guides.inedo.com/nuget-at-scale/lock-files/
- 10: https://github.com/NuGet/Home/wiki/Repeatable-build-using-lock-file-implementation
- 11: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-restore
Do not commit generated obj/ restore artifacts.
All referenced files are generated .NET/NuGet restore output and should be ignored, not committed. The committed state embeds machine-local absolute restore paths such as /root/.nuget/packages/, /repo/..., and SDK paths, so these do not work outside that generated environment. Keep packages.lock.json under version control if you need reproducible restores, and move any restore settings from generated .nupkg metadata into tracked *.csproj or Directory.Build.props/.targets.
Untrack the Identity obj/ contents and add an obj//bin/ ignore pattern for this service.
📍 Affects 8 files
src/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cache#L1-L6(this comment)src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.json#L1-L5src/backend/services/identity/src/Insight.Identity.Api/obj/project.assets.json#L1529-L1536src/backend/services/identity/src/Insight.Identity.Domain/obj/project.assets.json#L13-L20src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.props#L1-L15src/backend/services/identity/src/Insight.Identity.Domain/obj/Insight.Identity.Domain.csproj.nuget.g.targets#L1-L2src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.props#L1-L15src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.g.targets#L1-L7
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/backend/services/identity/src/Insight.Identity.Api/obj/project.nuget.cache`
around lines 1 - 6, Remove all tracked generated restore artifacts under
src/backend/services/identity/src/Insight.Identity.Api/obj,
Insight.Identity.Infrastructure/obj, and Insight.Identity.Domain/obj, including
the listed cache, assets, dgspec, props, and targets files; add an obj/ and bin/
ignore pattern for the Identity service. Keep any packages.lock.json tracked,
and move required restore settings from generated metadata into the relevant
tracked *.csproj or Directory.Build.props/.targets files.
Comment on lines
+37
to
+39
| "restoreLockProperties": { | ||
| "restorePackagesWithLockFile": "true" | ||
| }, |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check whether packages.lock.json files exist and are tracked for the Identity projects.
set -uo pipefail
echo "=== packages.lock.json files present in the working tree ==="
fd 'packages.lock.json' src/backend/services/identity || echo "none found"
echo "=== packages.lock.json files tracked by git ==="
git ls-files 'src/backend/services/identity/**/packages.lock.json' || echo "none tracked"
echo "=== csproj files for comparison ==="
fd -e csproj . src/backend/services/identityRepository: constructorfabric/insight
Length of output: 308
🏁 Script executed:
#!/bin/bash
set -uo pipefail
echo "=== restore spec around lock settings ==="
sed -n '1,90p' src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.json 2>/dev/null || true
echo "=== Identity csproj files and lock files (case-sensitive) ==="
git ls-files 'src/backend/services/identity/*/*.csproj' 'src/backend/services/identity/*/*/*.csproj' 'src/backend/services/identity/**/packages.lock.json' | sort
echo "=== all packages.lock.json in repository ==="
git ls-files 'packages.lock.json' '**/packages.lock.json' | sort | sed -n '1,120p'Repository: constructorfabric/insight
Length of output: 3540
Commit the packages.lock.json files for the Identity projects.
The restore spec enables restorePackagesWithLockFile for Insight.Identity.Domain and Insight.Identity.Infrastructure, but no git-tracked packages.lock.json files exist under src/backend/services/identity. Without committed lock files next to the csproj files, NuGet regenerates them on restore and reproducible package resolution is lost.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/backend/services/identity/src/Insight.Identity.Infrastructure/obj/Insight.Identity.Infrastructure.csproj.nuget.dgspec.json`
around lines 37 - 39, Commit the generated packages.lock.json files for the
Insight.Identity.Domain and Insight.Identity.Infrastructure projects alongside
their respective csproj files under the identity service. Generate them using
the existing restorePackagesWithLockFile setting, and ensure both lock files are
added to version control without changing the restore configuration.
Comment on lines
+1
to
+5
| { | ||
| "format": 1, | ||
| "restore": { | ||
| "/repo/src/backend/services/identity/tests/Insight.Identity.Tests.Integration/Insight.Identity.Tests.Integration.csproj": {} | ||
| }, |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Generated obj/ restore artifacts are committed across all 9 files. The shared root cause is that the obj/ intermediate output directory is tracked in version control. Every file here is regenerated by dotnet restore and embeds environment-specific values: the container path /repo/..., the home path /root/.nuget/packages/, and the exact SDK patch /usr/share/dotnet/sdk/9.0.316/. A developer or CI agent with a different path or SDK patch regenerates different content, so each restore causes diff churn and merge conflicts. The projects already set restorePackagesWithLockFile to true, so packages.lock.json is the correct committed artifact for reproducible restore.
Apply one fix: add [Oo]bj/ and [Bb]in/ to .gitignore, then run git rm -r --cached "src/backend/services/identity/**/obj". Remove each file below from the pull request.
src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json#L1-L5: remove this generated dependency-graph spec; it hardcodes/repo/...project paths and the9.0.316SDK path.src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.props#L1-L26: remove this generated props file; it hardcodesNuGetPackageRootas/root/.nuget/packages/.src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.targets#L1-L14: remove this generated targets file; its imports resolve through the hardcodedNuGetPackageRoot.src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.assets.json#L1-L4: remove this 3597-line resolved asset manifest; it also inflates repository size.src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.nuget.cache#L1-L6: remove this local restore cache; itsdgSpecHashinvalidates on any path difference.src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.dgspec.json#L1-L5: remove this generated dependency-graph spec for the same reason.src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.props#L1-L25: remove this generated props file for the same reason.src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.targets#L1-L12: remove this generated targets file for the same reason.src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.assets.json#L1-L4: remove this 2691-line resolved asset manifest for the same reason.
📍 Affects 9 files
src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json#L1-L5(this comment)src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.props#L1-L26src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.g.targets#L1-L14src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.assets.json#L1-L4src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/project.nuget.cache#L1-L6src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.dgspec.json#L1-L5src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.props#L1-L25src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.g.targets#L1-L12src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/project.assets.json#L1-L4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json`
around lines 1 - 5, Generated .NET restore artifacts are tracked and must be
removed. Add [Oo]bj/ and [Bb]in/ to .gitignore, untrack all obj contents with
git rm -r --cached "src/backend/services/identity/**/obj", and remove the listed
generated files from both integration and unit test projects:
src/backend/services/identity/tests/Insight.Identity.Tests.Integration/obj/Insight.Identity.Tests.Integration.csproj.nuget.dgspec.json
(1-5), Insight.Identity.Tests.Integration.csproj.nuget.g.props (1-26),
Insight.Identity.Tests.Integration.csproj.nuget.g.targets (1-14),
project.assets.json (1-4), project.nuget.cache (1-6), and
src/backend/services/identity/tests/Insight.Identity.Tests.Unit/obj/Insight.Identity.Tests.Unit.csproj.nuget.dgspec.json
(1-5), Insight.Identity.Tests.Unit.csproj.nuget.g.props (1-25),
Insight.Identity.Tests.Unit.csproj.nuget.g.targets (1-12), project.assets.json
(1-4).
Contributor
|
Why you change removed .NET insight? |
Contributor
|
By the way, how the python can get old nltk if the installed version is already 3.10 ? |
This was referenced Jul 31, 2026
Gregory91G
force-pushed
the
fix/nltk-langchain-critical-cves
branch
from
July 31, 2026 08:48
4a6b454 to
3684181
Compare
This was referenced Jul 31, 2026
Contributor
Author
fixed |
Contributor
Author
And |
cyberantonz
reviewed
Jul 31, 2026
| @@ -423,3 +423,8 @@ trivy-fs.sarif | |||
| trivy-image.json | |||
| trivy-image.sarif | |||
| trufflehog-findings.jsonl | |||
|
|
|||
| # .NET build output. No .csproj is tracked today, but a working copy predating the | |||
Contributor
There was a problem hiding this comment.
useless comment and ignored files
Gregory91G
force-pushed
the
fix/nltk-langchain-critical-cves
branch
from
July 31, 2026 12:35
f566521 to
ca4a423
Compare
) airbyte-cdk pins nltk==3.9.1 in every CDK connector, and additionally langchain-core==0.1.42 in the 6.60.x line the nocode test harness runs on. Both pins have a released fix for a CRITICAL (CVE-2025-14009, CVE-2025-68664), and no downstream project can move them by declaring a version floor. Declare uv override-dependencies so a resolved graph lands on the fixed versions. For the connectors this also makes the declared graph agree with the image, which already installs nltk 3.10.0 over the pin with --no-deps. Signed-off-by: Gregory Gogin <grigoriy.gogin@constructor.tech>
A version pushed in the last few days is where a compromised maintainer account surfaces first, and an override that only sets a floor would resolve straight to it. Verified the cooldown does not undo the point of the override: resolution still lands on nltk 3.10.0 and a langchain-core above the fix, with the newest release held back as intended. Signed-off-by: Gregory Gogin <grigoriy.gogin@constructor.tech>
Gregory91G
force-pushed
the
fix/nltk-langchain-critical-cves
branch
from
July 31, 2026 18:05
ca4a423 to
a2d75d1
Compare
Gregory91G
force-pushed
the
fix/nltk-langchain-critical-cves
branch
from
August 2, 2026 00:08
a2d75d1 to
1f11a51
Compare
cyberantonz
approved these changes
Aug 3, 2026
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2061, closes #2102.
airbyte-cdkpinsnltk==3.9.1in all seven CDK connectors and, in the 6.60.x line the nocode harness runs on,langchain-core==0.1.42. Both have a released fix for a CRITICAL. An exact upstream pin cannot be moved by declaring a floor downstream — a resolver reports the conflict and fails — so the version is stated as[tool.uv] override-dependencies.nltklangchain-coreThe connector images were already clean: their Dockerfiles install
nltk==3.10.0with--no-deps, which skips resolution entirely, so the fixed version lived only inside the image while the declared dependencies still resolved to 3.9.1. Scanners anduv syncread the declared side. This makes the two agree.exclude-newer = "7 days"accompanies each override: an override that only sets a floor would otherwise resolve straight into a release published minutes ago, which is where a compromised maintainer account surfaces first.Raising the harness to CDK 7 was measured and rejected: 7 failures in the zoom parent-child substream suite, because CDK 7 emits a different parent request. Details in #2061.
Test plan
uv pip compile+trivy fs --scanners vuln --severity CRITICALon each of the 8 projects — 0 CRITICAL (was 8), resolvingnltk==3.10.0and a fixedlangchain-corelangchain-coreback one patch, as intendeduv:pytest --suites-only→ 42 passed, 1 skipped — identical to the pre-change baselinesource-gitlabemits a validSPEC, and the image already carried 3.10.0trivy-fson this branch reports 8 fewer CRITICAL than the base