updating dev branch with main changes - #118
Open
cassiasamp wants to merge 24 commits into
Open
cassiasamp wants to merge 24 commits into
cassiasamp wants to merge 24 commits into
Conversation
…ation (#113) * Develop to Main (#77) * updating develop with latest main changes (#58) * Readme and demo update (closes issue #52) (#53) * Readme and demo update (closes issue #52) * D3js fix for graph visualization (closes #54) (#55) * Readme update * fixing HF broken link ref in README.md (#56) --------- Co-authored-by: Vagner Santana <santanavagner@users.noreply.github.com> * Readme and demo update (closes issue #52) (#53) * Readme and demo update (closes issue #52) * D3js fix for graph visualization (closes #54) (#55) * Readme update * update in requirements.txt (#59) downgrading tensorflow * update in requirements.txt (#60) fixing version * update requirements.txt (#61) * update requirements.txt (#62) leaving version problems to pip * update requirements.txt (#63) leaving torch without version * reverting requirements.txt (#64) removing libs added with autofix and package versions * Adding error message about ajax header setup * adding recipes folder with first cookbook (#70) * adding all cookbooks (#71) * Cookbook notebooks (closes #69) * Update README.md * Adding flags for running the notebook on colab (#69) * Adding the open in colab button (#69) * Fix for loading files from github (issue #69) * Adjustments for infovis notebook to work on colab (issue #69) * Adding populate embeddings to open in colab (issue #69) * Adding a recommend threshold notebook (#69) * Readme update * Readme update * Simplifying recommend threshold notebook (#69) * Comment update (#69) * Map keys TYPO * Removing deprecated models and adding SentenceTransformer as fallback (#75) * Adding sentences and updating umap models (closes #76) * Preventing a numpy error when saving json * Added a recipe for testing prompt dataset (closes #78) * Readme update --------- Co-authored-by: Cássia Sampaio <4005687+cassiasamp@users.noreply.github.com> Co-authored-by: Cássia Sanctos <csamp@ibm.com> * brazilian portuguese translation Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> * corrected 'your are' to 'you are' Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> * updated torch version in requirements.txt (#79) (#89) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> Co-authored-by: Ashwath V A <73862377+Mystic-Slice@users.noreply.github.com> * Recipe for Responsible Prompting using IBM Granite Embedding model (#88) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added recipe for responsible prompting using granite embedding model Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * renamed and included run outputs Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added more examples and set better thresholds Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added inference to the demo website (#86) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added inference to demo along with an endpoint in the Flask API to service inference requests Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated README.md Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated README and added route to swagger Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added the prompt-sentences file for `ibm-granite/granite-embedding-278m-multilingual` model populated with embeddings (#87) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * populated embeddings file for granite-embedding-278m-multilingual Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added visualization plot for ibm-granite/granite-embedding-278m-multilingual Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added the granite embedding notebook to readme (#93) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Switch to non parametric umap (#94) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * switched to non-parametric umap Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added Multi-turn conversation in the Demo (#91) * added multi-turn conversation in the demo Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * made some ui fixes to mimic the granite playground more Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added model selection + few other ui changes Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added svgs and css assets Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * model switch feature added + graph for each recommendation chosen Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * refactored code Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * loading tags + graph repositioned + model select repositioned + chat scroll issue fixed Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * markdown rendering for user and assistant messages Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * fix small ui issues Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * shortened value tags under user message Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * final touches Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated cookbooks and prompt json files to use non-parametric umap (#98) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Refactored code + Vectorized similarity & search operations (#95) * refactored recommend_prompt function to allow custom embeddings as input Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * refactored to make recommend_prompt function independent of embedding function Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * cleanup + model_id fix Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * vectorized similarity search Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * moved loading of umap model out of recommend_prompt method + other clean up Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * reverse debug settings --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Delete control/recommendation_handler.py * Delete cookbook/README.md * Added Replicate support for `demo_inference` (#111) * added replicate support for demo_inference Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated readme with replicate support info Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated readme Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * fixed readme Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> Co-authored-by: Vagner Santana <santanavagner@users.noreply.github.com> Co-authored-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> Co-authored-by: Ashwath V A <73862377+Mystic-Slice@users.noreply.github.com>
* Develop to Main (#77) * updating develop with latest main changes (#58) * Readme and demo update (closes issue #52) (#53) * Readme and demo update (closes issue #52) * D3js fix for graph visualization (closes #54) (#55) * Readme update * fixing HF broken link ref in README.md (#56) --------- Co-authored-by: Vagner Santana <santanavagner@users.noreply.github.com> * Readme and demo update (closes issue #52) (#53) * Readme and demo update (closes issue #52) * D3js fix for graph visualization (closes #54) (#55) * Readme update * update in requirements.txt (#59) downgrading tensorflow * update in requirements.txt (#60) fixing version * update requirements.txt (#61) * update requirements.txt (#62) leaving version problems to pip * update requirements.txt (#63) leaving torch without version * reverting requirements.txt (#64) removing libs added with autofix and package versions * Adding error message about ajax header setup * adding recipes folder with first cookbook (#70) * adding all cookbooks (#71) * Cookbook notebooks (closes #69) * Update README.md * Adding flags for running the notebook on colab (#69) * Adding the open in colab button (#69) * Fix for loading files from github (issue #69) * Adjustments for infovis notebook to work on colab (issue #69) * Adding populate embeddings to open in colab (issue #69) * Adding a recommend threshold notebook (#69) * Readme update * Readme update * Simplifying recommend threshold notebook (#69) * Comment update (#69) * Map keys TYPO * Removing deprecated models and adding SentenceTransformer as fallback (#75) * Adding sentences and updating umap models (closes #76) * Preventing a numpy error when saving json * Added a recipe for testing prompt dataset (closes #78) * Readme update --------- Co-authored-by: Cássia Sampaio <4005687+cassiasamp@users.noreply.github.com> Co-authored-by: Cássia Sanctos <csamp@ibm.com> * brazilian portuguese translation Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> * corrected 'your are' to 'you are' Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> * updated torch version in requirements.txt (#79) (#89) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> Co-authored-by: Ashwath V A <73862377+Mystic-Slice@users.noreply.github.com> * Recipe for Responsible Prompting using IBM Granite Embedding model (#88) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added recipe for responsible prompting using granite embedding model Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * renamed and included run outputs Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added more examples and set better thresholds Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added inference to the demo website (#86) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added inference to demo along with an endpoint in the Flask API to service inference requests Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated README.md Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated README and added route to swagger Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added the prompt-sentences file for `ibm-granite/granite-embedding-278m-multilingual` model populated with embeddings (#87) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * populated embeddings file for granite-embedding-278m-multilingual Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added visualization plot for ibm-granite/granite-embedding-278m-multilingual Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added the granite embedding notebook to readme (#93) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Switch to non parametric umap (#94) * updated torch version in requirements.txt Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * switched to non-parametric umap Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Added Multi-turn conversation in the Demo (#91) * added multi-turn conversation in the demo Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * made some ui fixes to mimic the granite playground more Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added model selection + few other ui changes Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * added svgs and css assets Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * model switch feature added + graph for each recommendation chosen Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * refactored code Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * loading tags + graph repositioned + model select repositioned + chat scroll issue fixed Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * markdown rendering for user and assistant messages Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * fix small ui issues Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * shortened value tags under user message Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * final touches Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated cookbooks and prompt json files to use non-parametric umap (#98) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Refactored code + Vectorized similarity & search operations (#95) * refactored recommend_prompt function to allow custom embeddings as input Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * refactored to make recommend_prompt function independent of embedding function Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * cleanup + model_id fix Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * vectorized similarity search Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * moved loading of umap model out of recommend_prompt method + other clean up Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * reverse debug settings --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * Delete control/recommendation_handler.py * Delete cookbook/README.md * Added Replicate support for `demo_inference` (#111) * added replicate support for demo_inference Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated readme with replicate support info Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated readme Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * fixed readme Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> * updated links in CONTRIBUTING.md (#116) Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> --------- Signed-off-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com> Co-authored-by: Vagner Santana <santanavagner@users.noreply.github.com> Co-authored-by: Thiago Nebuloni <thiago.nebuloni@gmail.com> Co-authored-by: Ashwath V A <73862377+Mystic-Slice@users.noreply.github.com>
Added back umap files
* Add functionality to load existing embeddings from output JSON file thereby optimizing the process of generating embeddings for new data. Signed-off-by: Ayesha Imran <ayesha.i1505@gmail.com> Signed-off-by: GitHub <noreply@github.com> * Add functionality to load existing embeddings from output JSON file thereby optimizing the process of generating embeddings for new data. Signed-off-by: Ayesha Imran <ayesha.i1505@gmail.com> Signed-off-by: GitHub <noreply@github.com> --------- Signed-off-by: Ayesha Imran <ayesha.i1505@gmail.com> Signed-off-by: GitHub <noreply@github.com>
* Recipe and Cookbook to evaluate embedding models Signed-off-by: ArionDas <ariondasad@gmail.com> * Updated all metrics and added a short synopsis. Signed-off-by: ArionDas <ariondasad@gmail.com> --------- Signed-off-by: ArionDas <ariondasad@gmail.com>
…d generate embeddings (prompt_sentences_ur-multilingual-e5-large.json) for them using multilingual-e5-large embedding model from Hugging Face. (#114) Signed-off-by: Ayesha Imran <ayesha.i1505@gmail.com>
#130) * Added a new endpoint to compute closest positive and negative values for individual sentences Signed-off-by: ArionDas <ariondasad@gmail.com> * Added validations and implemented cache compatibility to optimize subsequent calls Signed-off-by: ArionDas <ariondasad@gmail.com> --------- Signed-off-by: ArionDas <ariondasad@gmail.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.19 to 2.6.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.19...2.6.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update all packages flagged by Dependabot in issue #140 to their highest patched versions, including the critical Authlib CVE-2026-27962 and high-severity fixes across cryptography, pillow, torch, urllib3, Werkzeug, Flask, requests, marshmallow, fonttools, filelock, pytest, python-dotenv, and Pygments. Also bumps transitive dependencies required to resolve the majors: - cffi 1.17.1 -> 2.0.0 (cryptography 50 requires cffi>=2) - blinker 1.8.2 -> 1.9.0 (Flask 3.1 requires blinker>=1.9) - the safety tool tree (safety 3.8.1, safety-schemas 0.0.16, dparse 0.6.4, typer 0.25.1, click 8.2.1) to allow filelock>=3.20.3, plus its newly-required sub-deps now pinned (nltk, tenacity, tomlkit, truststore, defusedxml, annotated-doc). Full tree resolves and installs cleanly on Python 3.12 with numpy<2.0 honored; pytest passes and the app imports and serves correctly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
Python 3.9 is end-of-life and cannot install the patched dependency versions (pillow 12, torch 2.13, cryptography 50 all require a newer Python). Bump the base image to python:3.12 and align the separately installed CPU torch wheel from 2.0.0 to 2.13.0 to match requirements. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
The committed umap.pkl was pickled under Python 3.9 and embeds numba-jitted code objects that fail to unpickle on Python 3.11+ (TypeError: code() argument 13 must be str, not int), which broke the /recommend and /recommend_local endpoints after the base image bump. Regenerate the model under Python 3.12 using the same procedure as cookbook/populate_coordinates.ipynb (UMAP(n_neighbors=15, n_components=2) fit on the all-MiniLM-L6-v2 prompt-sentence embeddings). Both endpoints now return 200 with correct recommendations and coordinates. The fit is unseeded, so demo-graph x/y coordinates shift slightly; this affects visualization only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
Resolves the two CodeQL js/xss-through-dom alerts in the demo. The hover handlers saved the prompt area's innerHTML as a string and restored it via .html(), reinterpreting DOM text as HTML on hover-out. Snapshot the previous content as cloned DOM nodes and restore it with .empty().append(), so no string is ever reparsed as HTML. The highlight-preview behavior is preserved; the add-recommendation click handler still uses the string snapshot it needs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
Follow-up to the earlier dependency bumps, covering security alerts that Dependabot surfaced after the initial pass: - h11 0.14.0 -> 0.16.0 (GHSA-vqfr-h8mv-ghfj, critical); requires httpcore 0.14.x's cap to lift, so httpcore 1.0.5 -> 1.0.9 (needs h11>=0.16). httpx 0.27.0 is unchanged (accepts httpcore==1.*). - flask-cors 4.0.2 -> 6.0.0 (GHSA-43qf-4rqw-9q2g / -7rxf-gvfg-47g4 / -8vgw-p6qm-5gr7, medium). App only uses the bare @cross_origin() decorator, whose API is unchanged across the 4->6 jump. - idna 3.7 -> 3.15 (CVE-2026-45409 / GHSA-65pc-fj4g-8rjx, medium). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
The Docker base image is now python:3.12 and the regenerated UMAP pickle plus several pinned dependencies (e.g. requests, urllib3) require Python 3.10+, so the documented "python 3.9" minimum is stale. Align it with the runtime the project is actually built and tested against. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
Remediate security alerts: dependency, Python image, and XSS fixes
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.5 to 3.1.6. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.1.5...3.1.6) --- updated-dependencies: - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
CodeQL flagged py/reflective-xss on the /recommend (app.py:132) and /recommend_local (app.py:161) routes: the user-supplied `prompt` is split into sentences and echoed back in the response body. Both endpoints returned the recommendation dict directly. Flask already serializes a returned dict as application/json, but CodeQL's Flask model does not treat that implicit conversion as a safe sink. Wrap both returns in jsonify(), which is an explicit application/json response and the recognized barrier for this rule. Behavior is unchanged (same JSON body and content type; the frontend consumes it via $.getJSON). Signed-off-by: Ashwath Vaithinathan Aravindan <ashwath.vaithina@ibm.com>
Bump werkzeug from 3.1.5 to 3.1.6
Fix reflective XSS in /recommend and /recommend_local
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.