Nicolò Boschi
b6a4f17cbe
fix: resolve all Dependabot security alerts ( #702 )
...
- requests: bump minimum to >=2.33.0 (CVE temp file reuse)
- streamlit: bump minimum to >=1.54.0 (SSRF/NTLM exposure)
- picomatch: add npm override for >=2.3.2/<3 || >=4.0.4 (ReDoS + method injection)
- flatted: tighten override to >=3.4.2 (prototype pollution)
- yaml: add npm override for >=1.10.3 (stack overflow)
- rustls-webpki: cargo update to 0.103.10 (CRL distribution point)
- Also fix pre-existing ty lint error in metrics.py (type: ignore for Windows resource import)
- Pygments: no patch available (<=2.19.2 vulnerable, no fix released)
2026-03-26 13:15:36 +01:00
Nicolò Boschi
ea27ef95ec
fix: resolve all Dependabot security vulnerabilities ( #486 )
...
* fix: resolve all Dependabot security vulnerabilities
npm (package-lock.json):
- fast-xml-parser: 4.5.3 → 4.5.4 (critical entity encoding bypass + DoS)
- serialize-javascript: 6.0.2 → 7.0.4 (high RCE via RegExp/Date)
- minimatch: 3.1.2 → 3.1.5, 5.1.6 → 5.1.9, 9.0.5 → 9.0.9 (high ReDoS)
- ajv: 6.12.6 → 6.14.0, 8.17.1 → 8.18.0 (medium ReDoS with $data option)
- qs: 6.14.1 → 6.15.0 (low arrayLimit bypass DoS)
- rollup: 4.57.x → 4.59.0 in ai-sdk and openclaw integrations (high path traversal)
Python (uv.lock / pyproject.toml):
- cryptography: 46.0.3 → 46.0.5 (high subgroup attack on SECT curves)
- pillow: 12.0.0 → 12.1.1 (high out-of-bounds write in PSD loading)
- langchain-core: 1.2.7 → 1.2.17 (low SSRF in ChatOpenAI token counting)
- langsmith: 0.4.42 → 0.7.11 (medium SSRF via tracing header injection)
- protobuf: 6.33.1 → 6.33.5 (high JSON recursion depth bypass)
Rust (Cargo.lock):
- bytes: 1.11.0 → 1.11.1 in hindsight-clients/rust (medium integer overflow)
Remaining unfixable: diskcache <= 5.6.3 (no patched version available)
* fix: remove over-broad schema-utils ajv override that broke docs build
The 'schema-utils': {'ajv': '^8.18.0'} override was forcing schema-utils@3.x
(used by url-loader/file-loader with ajv-keywords@3.x) to use ajv@8.18.0.
In 8.18.0, internal property _formats was renamed to formats, breaking
ajv-keywords@3.x's _formatLimit.js which accesses ajv._formats.date.
Removing the broad override: schema-utils@4.3.3 (root level) already has
ajv@8.18.0 in its nested install from the prior npm update, while
schema-utils@3.x correctly falls back to the hoisted root ajv@6.14.0.
2026-03-04 13:14:50 +01:00
Chris Bartholomew
39e3f7c528
Fix Python SDK not sending Authorization header ( #106 )
...
* Fix Python SDK not sending Authorization header
The Python SDK accepts an api_key parameter but never sends it as a
Bearer token in requests. The OpenAPI-generated Configuration class
stores the key in access_token, but auth_settings() returns an empty
dict because the OpenAPI spec doesn't define a security scheme.
This fix manually sets the Authorization header on the ApiClient,
bypassing the broken auth_settings() mechanism.
Tested against api.dev.hindsight.vectorize.io:
- Before: 401 "Authentication failed: API key required"
- After: Success
* chore: update Rust client Cargo.lock for CI verification
Run generate-clients.sh to sync Cargo.lock with current dependencies.
2026-01-07 09:46:50 +01:00
Nicolò Boschi
4f21886a0e
doc: changelog for 0.2.0 (and regenerate clients) ( #99 )
...
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
* doc: changelog for 0.2.0 (and regenerate clients)
2026-01-05 12:36:29 +01:00
Nicolò Boschi
e06a6120a3
feat(misc): update clients types, test coverage, improve /health endpoint and add changelog ( #70 )
...
* doc: changelog and delete doc info
* others
* others
* fixes
* fixes
2025-12-23 12:49:31 +01:00
Nicolò Boschi
040eb33ea6
improve ci and tests ( #22 )
...
* improve ci and tests
* add more tests
* fixes
* fix tests
* fix more
* fix
* fix
* fix
* fix
* fix for real
* tests and doc
* fix cp
* fix link pg0
* fix pg0
* fix pg0
* fix pg0
* even better
* more
* fix
2025-12-09 19:16:00 +01:00
Nicolò Boschi
04b2fcf0b5
update openapi spec
2025-12-09 10:02:14 +01:00
Nicolò Boschi
76cfa8f9c4
fix entity and migrate memory disposition
2025-12-08 16:14:49 +01:00
Nicolò Boschi
425c6f3fc9
rename bank facts to interactions
2025-12-04 17:15:12 +01:00
Nicolò Boschi
943f6e7844
control plane and api issues
2025-12-02 18:28:57 +01:00
Nicolò Boschi
f7cf33c610
fix regressions and bunch of issues
2025-12-01 18:44:49 +01:00
Nicolò Boschi
d099ef870d
rename to new names
2025-11-27 16:22:16 +01:00
