holetron-lab/fleet-memory
1
0
Fork 0
Code Releases Packages Activity Actions
fleet-memory/hindsight-api-slim/tests
History
Derek Bouius ee4510a762
fix(deps): address critical and high severity security vulnerabilities (#827) 
* fix(deps): address critical and high severity security vulnerabilities

Bump vulnerable dependencies to patched versions across the monorepo:

Python (critical/high):
- fastmcp >=2.14.0 → >=3.2.0 (SSRF, path traversal, OAuth confused deputy, command injection)
- langchain-core >=1.2.11 → >=1.2.22 (path traversal in legacy load_prompt)

Python (low):
- cryptography >=46.0.5 → >=46.0.6 (incomplete DNS name constraint enforcement)
- pygments: add >=2.20.0 pin (ReDoS via GUID regex)

Node.js:
- serialize-javascript ^7.0.3 → ^7.0.5 (CPU exhaustion DoS)
- handlebars: add >=4.7.9 override (JS injection via AST type confusion)
- path-to-regexp: add >=0.1.13 override (ReDoS via route params)
- brace-expansion: add version range override (process hang/memory exhaustion)

Also adds type: ignore comments for FastMCP 2.x private attribute access that
ty now flags since FastMCP 3.x removed _tool_manager (guarded by try/except
and hasattr at runtime).

Regenerated all lock files across API, integrations, and tests.

* fix(deps): add ajv v8 scoped overrides for schema-utils and ajv-keywords

The global ajv ^6.14.0 override caused schema-utils and ajv-keywords to
receive ajv v6, but they require ajv v8 (for dist/compile/codegen). Add
scoped overrides to ensure these packages get ajv v8 while the global
override remains for packages that need v6.

* fix(tests): remove stateless_http from FastMCP() constructor calls

FastMCP 3.x no longer accepts stateless_http in the constructor. The
tests call tools directly without HTTP transport, so the parameter is
not needed.

* fix: update MCP tests for FastMCP 3.x _tool_manager removal

FastMCP 3.x removed _tool_manager. Tests now use
_local_provider._components for sync tool dict access and
mcp.list_tools() for async filtered tool listing.

* fix: resolve docusaurus build failures (ajv overrides + missing blog date)

- Remove global ajv ^6.14.0 override and scoped ajv-keywords/schema-utils
  overrides that caused webpack compilation errors manifesting as
  "Cannot read properties of undefined (reading 'date')" during SSR
  and "these parameters are deprecated" warnings. Natural version
  resolution (v6.12.6+ for v6 consumers, v8+ for v8 consumers) already
  satisfies the security fix (>= 6.12.3).
- Add missing date frontmatter to learning-capabilities blog post.

* chore: regenerate openapi spec and docs skill
2026-04-01 09:20:34 +02:00
..
fixtures feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
__init__.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
conftest.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_admin_backup_restore.py fix(migrations): bypass PgBouncer for advisory locks via MIGRATION_DATABASE_URL (#726) 2026-03-27 16:01:38 +01:00
test_agents_api.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_async_batch_retain.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_async_retain_tags.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_audit_log.py feat: add audit log for feature usage tracking (#717) 2026-03-27 09:52:03 +01:00
test_base_path.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_batch_api.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_batch_api_integration.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_batch_api_validation.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_batch_chunking.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_causal_relations.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_causal_relationships.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_chunking.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_codex_tool_choice.py Convert codex tool_choice test to pytest style (#752) 2026-03-30 11:58:59 +02:00
test_cohere_cross_encoder.py fix(reranker): use httpx for Cohere Azure endpoints to avoid 404 errors (#790) 2026-03-31 17:44:42 +02:00
test_combined_scoring.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_config_validation.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_consolidation.py feat: add max_observations_per_scope bank config (#729) 2026-03-30 10:29:56 +02:00
test_consolidation_failure_recovery.py fix: prevent silent memory loss on consolidation LLM failure (#601) 2026-03-17 20:15:33 +01:00
test_custom_embedding_dimension.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_delta_retain.py feat(retain): delta retain — skip LLM for unchanged chunks on upsert (#701) 2026-03-26 13:50:55 +01:00
test_document_tracking.py feat: expose document_metadata in API and control plane (#798) 2026-03-31 11:42:02 +02:00
test_entity_labels.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_entity_resolver.py fix(entity_resolver): prevent _pending_stats/_pending_cooccurrences memory leak (#662) 2026-03-23 16:06:04 +01:00
test_entity_resolver_pg_trgm.py test: add unit tests for pg_trgm auto-detection and ValidationResult.accept_with() enrichment (#650) 2026-03-23 10:33:09 +01:00
test_extensions.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_fact_extraction_agent_experience.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_fact_extraction_analysis.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_fact_extraction_metadata.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_fact_extraction_output_ratio.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_fact_extraction_quality.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_fact_extraction_retry.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_fact_ordering.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_file_retain.py Fix non-atomic async operation creation (#619) 2026-03-19 16:38:04 +01:00
test_file_storage_s3.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_gemini_safety_settings.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_graph_filtering.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_hierarchical_config.py Convert codex tool_choice test to pytest style (#752) 2026-03-30 11:58:59 +02:00
test_hnsw_indexes.py fix: per-bank index creation respects HINDSIGHT_API_VECTOR_EXTENSION config (#755) 2026-03-30 11:37:26 +02:00
test_http_api_integration.py feat(api): warn on unknown request parameters via X-Ignored-Params header (#802) 2026-03-31 10:34:04 +02:00
test_iris_parser.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_link_expansion_retrieval.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_link_utils.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_list_documents.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_litellm_sdk_cross_encoder.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_litellm_sdk_embeddings.py feat: add optional LiteLLM SDK embedding output dimensions (#809) 2026-03-31 14:58:02 +02:00
test_llm_provider.py feat: add LiteLLM LLM provider for Bedrock and 100+ providers (#679) 2026-03-25 14:17:38 +01:00
test_llm_token_metrics.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_llm_tools.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_llm_wrapper.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_lmstudio_tool_choice.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_load_large_batch.py fix: prevent silent memory loss on consolidation LLM failure (#601) 2026-03-17 20:15:33 +01:00
test_main_module.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_mcp_endpoint_routing.py fix: MCP tool calls fail when MCP_AUTH_TOKEN and TENANT_API_KEY differ (#635) 2026-03-20 18:36:05 +01:00
test_mcp_extension.py fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00
test_mcp_routing.py fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00
test_mcp_tool_filtering.py feat(mcp): add filter_mcp_tools hook for per-user tool visibility (#737) 2026-03-30 10:33:09 +02:00
test_mcp_tools.py fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00
test_mental_model_hooks.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_mental_models.py fix(mental-models): add tags_match and tag_groups to trigger config (#786) (#804) 2026-03-31 18:09:01 +02:00
test_metrics.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_migration_backsweep.py fix(migration): backsweep orphaned observation memory units (#584) 2026-03-16 14:06:33 +01:00
test_migrations_thread_safety.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_mpfp_retrieval.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_multilingual.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_none_llm_provider.py feat: add 'none' LLM provider for chunk-only storage mode (#691) 2026-03-25 18:01:20 +01:00
test_observation_invalidation.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_observations.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_op_cancellation.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_per_operation_llm_config.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_provider_default_models.py security: exclude litellm 1.82.8 (supply chain compromise) (#673) 2026-03-25 10:21:02 +01:00
test_query_analyzer.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_recall_chunks_independence.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_reflect_agent.py Add wall-clock timeout to reflect operations (#643) 2026-03-23 09:19:26 +01:00
test_reflect_empty_based_on.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_reflect_source_facts_config.py feat(reflect): make source facts in search_observations configurable (#688) 2026-03-25 17:54:49 +01:00
test_reflect_tracing.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_reflections.py feat: fact_types and mental model exclusion filters for reflect (#615) 2026-03-19 17:03:41 +01:00
test_reranker_error_handling.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_retain.py refactor: replace LLMProvider classmethods with from_env() and document missing config fields (#816) 2026-03-31 18:00:41 +02:00
test_schema_isolation.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_search_trace.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_server_module.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_source_facts_tokens.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_sql_schema_safety.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_strip_code_fences.py fix: strip markdown code fences from all LLM providers, not just local (#646) 2026-03-22 21:29:16 +01:00
test_supabase_tenant.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_tags_visibility.py feat: compound tag filtering via tag_groups (#562) 2026-03-13 14:30:11 +01:00
test_tei_cross_encoder.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_temporal_ranges.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_think.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_tracing.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_tracing_integration.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_tracing_spans_verification.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_unknown_params.py feat(api): warn on unknown request parameters via X-Ignored-Params header (#802) 2026-03-31 10:34:04 +02:00
test_validation_result_enrichment.py test: add unit tests for pg_trgm auto-detection and ValidationResult.accept_with() enrichment (#650) 2026-03-23 10:33:09 +01:00
test_vertexai_provider.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_webhooks.py feat: introduce hindsight-api-slim and hindsight-all-slim packages (#560) 2026-03-13 13:50:03 +01:00
test_worker.py Fix orphaned batch_retain parents when child fails via unhandled exception (#618) 2026-03-19 14:55:26 +01:00