4c4b3568db
Python (uv.lock, pyproject.toml): - authlib 1.6.6 → 1.6.9 (JWS header injection, OIDC hash binding, Bleichenbacher padding oracle) - pyasn1 0.6.2 → 0.6.3 (unbounded recursion DoS) - pyjwt 2.10.1 → 2.12.1 (unknown crit header extensions - also in integration-tests and crewai) - orjson 3.11.4 → 3.11.7 (deeply nested JSON recursion DoS) - tornado 6.5.2 → 6.5.5 (multipart DoS, incomplete cookie validation) npm (package.json, package-lock.json): - next ^16.1.6 → ^16.1.7 (HTTP smuggling, CSRF bypass, cache DoS, null origin bypass) - fast-xml-parser override updated to >=5.5.6 (numeric entity expansion bypass) - undici override added >=7.24.0 (WebSocket overflow, smuggling, CRLF injection, DoS) - flatted override added >=3.4.0 (unbounded recursion DoS) - svgo override added >=3.3.3 (DOCTYPE entity expansion DoS) - dompurify override added >=3.3.2 (XSS vulnerability) |
||
|---|---|---|
| .. | ||
| tests | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
Hindsight Integration Tests
E2E and integration tests for Hindsight API that require a running server.
Test Types
1. Tests with External Server
Tests like test_mcp_e2e.py expect a server to already be running.
Running:
# Start the API server
./scripts/dev/start-api.sh
# Run tests
cd hindsight-integration-tests
HINDSIGHT_API_URL=http://localhost:8888 uv run pytest tests/test_mcp_e2e.py -v
2. Self-Contained Tests
Tests like test_base_path_deployment.py manage their own server lifecycle and use docker-compose.
Running:
cd hindsight-integration-tests
# Run with pytest
uv run pytest tests/test_base_path_deployment.py -v
# Or run directly for nice output
uv run python tests/test_base_path_deployment.py
Requirements:
- Docker and docker-compose installed (for reverse proxy test)
- No nginx required on host!
What it tests:
- ✅ API with base path (direct server)
- ✅ Full reverse proxy via docker-compose + Nginx
- ✅ Regression: API without base path
- ✅ Full retain/recall workflow
These tests:
- Start their own API servers on dedicated ports (18888-18891)
- Use docker-compose to test actual deployment scenarios
- Run in parallel with other tests (no port conflicts)
- Clean up automatically
Running All Tests
cd hindsight-integration-tests
uv run pytest tests/ -v
This runs both types. Self-contained tests won't conflict with the external server.
Environment Variables
HINDSIGHT_API_URL- Base URL for external-server tests (default:http://localhost:8888)