This repository was archived by the owner on Aug 27, 2026. It is now read-only.
Promote staging to main - #35
Merged
Merged
Conversation
Remove unused pypdf, pdf2image, opencv-python, openai, anthropic, ollama, wget, nbformat, and jsonlines (nothing in the repo imports them) — eliminating the pypdf and pillow advisory stacks outright. Raise aiohttp, filelock, idna, setuptools, virtualenv, and requests past their advisory fix versions, and force qs >= 6.15.2 via npm overrides for the express-resolved copy. Replace the ../unify path dependency with the published unifyai package: the sibling checkout renamed itself to 'unify' and grew uv-only URL sources (en-core-web-sm) that poetry cannot resolve, so the path dependency no longer locks — and never installed on a lone CI checkout. pytest stays on the 8.x line because unifyai pins pytest<9; the remaining pytest advisory clears when the SDK relaxes that pin.
magic-marty
approved these changes
Aug 21, 2026
YushaArif99
enabled auto-merge
August 21, 2026 07:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the dependency-security cleanup: removes unused pypdf/pdf2image/opencv/openai/anthropic/ollama/wget/nbformat/jsonlines (clearing the pypdf and pillow Dependabot stacks entirely), bumps aiohttp/filelock/idna/setuptools/virtualenv/requests past advisory fix versions, adds an npm override forcing qs >= 6.15.2, and repoints the SDK dependency at the published unifyai package (the ../unify path dep no longer resolves under poetry and could never install in CI). Clears 62 of 63 open Dependabot alerts; the last (pytest tmpdir advisory) is blocked on unifyai relaxing its pytest<9 pin.