From 2d161e3473997e2b3d0fc856186edb174f6f533a Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Tue, 27 Oct 2026 00:33:50 +0000 Subject: [PATCH 01/10] fix(deps): remove ragas from main requirements to fix CVE reports ragas is already optional in pyproject.toml (dokimi[ragas] extra). requirements.txt should not contain it; lock files are regenerated from it. This removes CVE reports for ragas and diskcache. After this change: - pip install dokimi: the base install, without ragas - pip install dokimi[ragas]: adds the `eval ragas` functionality - pip install dokimi[dev]: for development (includes the ragas extra) All code protections (_require_ragas checks) are already in place. Fixes: CVE-2026-2447, CVE-2026-3046 Signed-off-by: Alexander Rybkin --- .../20261027_000000_cve_ragas_fix.md | 11 + dokimi/requirements-ci.lock.txt | 19 +- dokimi/requirements-docs.lock.txt | 123 ++- dokimi/requirements.lock.txt | 921 +----------------- dokimi/requirements.txt | 11 +- 5 files changed, 145 insertions(+), 940 deletions(-) create mode 100644 dokimi/changelog.d/20261027_000000_cve_ragas_fix.md diff --git a/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md b/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md new file mode 100644 index 000000000..2abffa4c7 --- /dev/null +++ b/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md @@ -0,0 +1,11 @@ +### Fixed + +- **RAGAS dependency**: removed from main `requirements.txt` to fix recurring CVE + reports. ragas is already optional in `pyproject.toml` as the `[ragas]` extra. + `pip install dokimi` no longer installs ragas, langchain-community, + langchain-anthropic, langchain-openai, or langchain-core. Commands that + require the `[ragas]` extra (`eval ragas`, `answers generate --ragas`) now + check for the extra at entry and exit with a helpful install message before + any model call. This fixes CVE-2026-2447 (diskcache) and CVE-2026-3046 (ragas). + The optional filelock CVEs (GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, + GHSA-567q-5qvw-pf92) remain because litellm requires `filelock<4.0`. diff --git a/dokimi/requirements-ci.lock.txt b/dokimi/requirements-ci.lock.txt index 4ecb25639..127e86ed7 100644 --- a/dokimi/requirements-ci.lock.txt +++ b/dokimi/requirements-ci.lock.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --exclude-newer-package=virtualenv=false --exclude-newer-package=setuptools=false --generate-hashes --output-file=requirements-ci.lock.txt +# uv pip compile requirements-ci.txt -c requirements.lock.txt --universal --python-version=3.11 --generate-hashes --output-file=requirements-ci.lock.txt ast-serialize==0.13.0 \ --hash=sha256:017ddd4f22e727ef93e66df2d53340a6ff809b7e34cc2218f67918ae6239aad0 \ --hash=sha256:12441bc7e41e495db5634c98adc8f8886b619ce2f1e68effe3f792a2adca9f47 \ @@ -757,9 +757,7 @@ license-expression==30.4.4 \ markdown-it-py==4.2.0 \ --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a - # via - # -c requirements.lock.txt - # rich + # via rich markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -918,9 +916,7 @@ markupsafe==3.0.4 \ mdurl==0.1.2 \ --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba - # via - # -c requirements.lock.txt - # markdown-it-py + # via markdown-it-py more-itertools==11.1.0 ; platform_machine != 'ppc64le' and platform_machine != 's390x' \ --hash=sha256:48e8f4d9e7e5878571ecf6f2b4e57634f93cd474cc8cfbd2376f2d11b396e30d \ --hash=sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192 @@ -1077,9 +1073,7 @@ mypy==2.4.0 \ mypy-extensions==1.1.0 \ --hash=sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505 \ --hash=sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558 - # via - # -c requirements.lock.txt - # mypy + # via mypy nh3==0.3.7 \ --hash=sha256:157ec1eb7a62f3d9a7badb8d82d89aa810e3e24e097eedfa481a25d0c8a99877 \ --hash=sha256:15f5fbf090f5c88d61c820e1fc1fceecb6520cca9fe85649c06b57ef9dc9ff62 \ @@ -1302,9 +1296,7 @@ requests==2.34.2 \ requests-toolbelt==1.0.0 \ --hash=sha256:7681a0a3d047012b5bdc0ee37d7f8f07ebe76ab08caeccfc3921ce23c88d5bc6 \ --hash=sha256:cccfdd665f0a24fcf4726e690f65639d272bb0637b9b92dfd91a5568ccf6bd06 - # via - # -c requirements.lock.txt - # twine + # via twine requirements-parser==0.13.1 \ --hash=sha256:6e385663eb32589d16e5b22bb6e5251a57908e73803ffff438b53cd6ea2056e0 \ --hash=sha256:78811383b2089b6c5197a1431bc2c12ff950245edca39a23eea3460782038dd3 @@ -1317,7 +1309,6 @@ rich==14.3.4 \ --hash=sha256:07e7adb4690f68864777b1450859253bed81a99a31ac321ac1817b2313558952 \ --hash=sha256:817e02727f2b25b40ef56f5aa2217f400c8489f79ca8f46ea2b70dd5e14558a9 # via - # -c requirements.lock.txt # bandit # pip-audit # twine diff --git a/dokimi/requirements-docs.lock.txt b/dokimi/requirements-docs.lock.txt index af55e90e8..67a5ab03b 100644 --- a/dokimi/requirements-docs.lock.txt +++ b/dokimi/requirements-docs.lock.txt @@ -1,14 +1,9 @@ -# Locked dependency closure of requirements-docs.txt (the documentation site), -# resolved for every supported Python (3.11+) and constrained to the pins in -# requirements.lock.txt, which it is installed on top of. CI installs from this file. -# Regenerate (uv keeps the pins already in the -o file; add --upgrade to take upgrades): -# uv pip compile requirements-docs.txt -c requirements.lock.txt --universal \ -# --python-version 3.11 --no-header --no-annotate --generate-hashes \ -# -o requirements-docs.lock.txt -# Install with: pip install --require-hashes -r requirements.lock.txt -r requirements-docs.lock.txt +# This file was autogenerated by uv via the following command: +# uv pip compile requirements-docs.txt -c requirements.lock.txt --universal --python-version=3.11 --generate-hashes --output-file=requirements-docs.lock.txt babel==2.18.0 \ --hash=sha256:b80b99a14bd085fcacfa15c9165f651fbb3406e66cc603abf11c5750937c992d \ --hash=sha256:e2b422b277c2b9a9630c1d7903c2a00d0830c409c59ac8cae9081c92f1aeba35 + # via mkdocs-material backrefs==8.1 \ --hash=sha256:11f61846e446fa8637af2f5c073f1083aa58dbb7460b019fd51689f564e44f7e \ --hash=sha256:1e857c32e91b8fe46ddb359ac21021a37b090fa4239566a61e9856123e334041 \ @@ -17,9 +12,13 @@ backrefs==8.1 \ --hash=sha256:b472c76082769f86a97ffccfd1f2599b2b706610c6154955664fffe67e909035 \ --hash=sha256:db577dbae1c61187534d35fc9bfbd0c01158fff6239a66fecf7590e5b17879a9 \ --hash=sha256:f86d9312df3ebae1241758af80809a319cafa1d8f32189edfb242c9aa55573b6 + # via mkdocs-material certifi==2026.10.19 \ --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b + # via + # -c requirements.lock.txt + # requests charset-normalizer==3.5.2 \ --hash=sha256:01077390b03f7988f11d700a2194e69b119741a86b1a638b1db88891e3eced8e \ --hash=sha256:01b0c0d2262a9e28e8484a278c7e1b5d650e3ac8cf2683d2967e25899f208bdf \ @@ -193,30 +192,63 @@ charset-normalizer==3.5.2 \ --hash=sha256:fcff63213e8e6e47770541a4607175404f47cbb3ebea7b6058cc82d524a0e424 \ --hash=sha256:fd1fbe0f116b6e55da77aca2c6ddcddcfac2186cbf78bdebf40fc156efca389d \ --hash=sha256:fe9753dfee015c570d73df76f899f18444d41388bffcde097deba51c4fadbb9f + # via + # -c requirements.lock.txt + # requests click==8.5.0 \ --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 \ --hash=sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34 + # via + # -c requirements.lock.txt + # mkdocs + # properdocs colorama==0.4.6 \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 + # via + # -c requirements.lock.txt + # mkdocs + # mkdocs-material + # properdocs ghp-import==2.1.0 \ --hash=sha256:8337dd7b50877f163d4c0289bc1f1c7f127550241988d568c1db512c4324a619 \ --hash=sha256:9c535c4c61193c2df8871222567d7fd7e5014d835f97dc7b7439069e2413d343 + # via + # mkdocs + # properdocs griffelib==2.3.2 \ --hash=sha256:8e710afededd5607f95bf3c8ccc175ee306e7084459faf27b9f9f44ef2a7a274 \ --hash=sha256:df00c7a0dee3d86268d76788997a1859272cb1fb7b865658e043d2c0c3d52e60 + # via mkdocstrings-python idna==3.20 \ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c + # via + # -c requirements.lock.txt + # requests jinja2==3.1.6 \ --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \ --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67 + # via + # -c requirements.lock.txt + # mkdocs + # mkdocs-material + # mkdocstrings + # properdocs markdown==3.11.1 \ --hash=sha256:496f4f80f9ebd3395a04c8ec9595c40bbe8ec19e9c67d21fe071a1643e876606 \ --hash=sha256:f1fa378ba5d682900c9ecb55ccceacca936016dda7c3b27097e8ae03ff78feb5 + # via + # mkdocs + # mkdocs-autorefs + # mkdocs-material + # mkdocstrings + # properdocs + # pymdown-extensions markdown-it-py==4.2.0 \ --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a + # via -r requirements-docs.txt markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -369,63 +401,116 @@ markupsafe==3.0.4 \ --hash=sha256:fa95848c929b6a75f6848d3c9793e59db365ee436776e57db835cdbfa79ba977 \ --hash=sha256:fd9f8797427910198f95bced71ddfed61130d7e349213bfb8466c9c99e2c46a8 \ --hash=sha256:fdb4ca07ab75ffadab4a8b135ad59cdbb3156b99310f3d565370da74a15d6bd3 + # via + # -c requirements.lock.txt + # jinja2 + # mkdocs + # mkdocs-autorefs + # mkdocstrings + # properdocs mdurl==0.1.2 \ --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba + # via markdown-it-py mergedeep==1.3.4 \ --hash=sha256:0096d52e9dad9939c3d975a774666af186eda617e6ca84df4c94dec30004f2a8 \ --hash=sha256:70775750742b25c0d8f36c55aed03d24c3384d17c951b3175d898bd778ef0307 + # via + # mkdocs + # mkdocs-get-deps mkdocs==1.6.1 \ --hash=sha256:7b432f01d928c084353ab39c57282f29f92136665bdd6abf7c1ec8d822ef86f2 \ --hash=sha256:db91759624d1647f3f34aa0c3f327dd2601beae39a366d6e064c03468d35c20e + # via + # -r requirements-docs.txt + # mkdocs-autorefs + # mkdocs-gen-files + # mkdocs-literate-nav + # mkdocs-material + # mkdocstrings mkdocs-autorefs==1.4.4 \ --hash=sha256:834ef5408d827071ad1bc69e0f39704fa34c7fc05bc8e1c72b227dfdc5c76089 \ --hash=sha256:d54a284f27a7346b9c38f1f852177940c222da508e66edc816a0fa55fc6da197 + # via + # mkdocstrings + # mkdocstrings-python mkdocs-gen-files==0.6.1 \ --hash=sha256:57d7ff2229e23d077e46d14a33db6d37c8823f6ce1a503c874c1764a71679763 \ --hash=sha256:b3182bfc6219e35b8d26658cb988368659d5d023aac30c2a819247558fc12189 + # via -r requirements-docs.txt mkdocs-get-deps==0.2.2 \ --hash=sha256:8ee8d5f316cdbbb2834bc1df6e69c08fe769a83e040060de26d3c19fad3599a1 \ --hash=sha256:e7878cbeac04860b8b5e0ca31d3abad3df9411a75a32cde82f8e44b6c16ff650 + # via mkdocs mkdocs-literate-nav==0.6.3 \ --hash=sha256:2c421561280fa9184f88cbf399bebbd4cc17ee507e978a31ce11fd6f3aabf233 \ --hash=sha256:edbaca22343f861fe4e34aac47d55a0c9955c640dbf02eea99fe631e914cf9ee + # via -r requirements-docs.txt mkdocs-material==9.7.7 \ --hash=sha256:8ea9bb1737a5b524a5f9dcf2e1b4ebda8274ae3008aa7845720a97083bef708f \ --hash=sha256:c0649c065b1b0512d60aad8c10f947f8e455284475239b364b610f2deb4d0855 + # via -r requirements-docs.txt mkdocs-material-extensions==1.3.1 \ --hash=sha256:10c9511cea88f568257f960358a467d12b970e1f7b2c0e5fb2bb48cab1928443 \ --hash=sha256:adff8b62700b25cb77b53358dad940f3ef973dd6db797907c49e3c2ef3ab4e31 + # via mkdocs-material mkdocstrings==1.0.7 \ --hash=sha256:0951b147f352118a45a3db85f0f3b660833d34cb5120a2751315b8d08dafd159 \ --hash=sha256:9563828667eeb35256f87a6b61fe857676ac628ec1abbce9aea9839a502c9cb1 + # via + # -r requirements-docs.txt + # mkdocstrings-python mkdocstrings-python==2.0.9 \ --hash=sha256:ae945637dc0618c6beedbee169f10c0234b77f322c53db3fc9fb4c29b3013038 \ --hash=sha256:c0233eff3f84d78110df50541918e7ec2bcff8e1614faddea34290a90321a416 + # via mkdocstrings packaging==26.3 \ --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c + # via + # -c requirements.lock.txt + # mkdocs + # properdocs paginate==0.5.7 \ --hash=sha256:22bd083ab41e1a8b4f3690544afb2c60c25e5c9a63a30fa2f483f6c60c8e5945 \ --hash=sha256:b885e2af73abcf01d9559fd5216b57ef722f8c42affbb63942377668e35c7591 + # via mkdocs-material pathspec==1.1.1 \ --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \ --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189 + # via + # mkdocs + # properdocs platformdirs==4.13.0 \ --hash=sha256:1aa0b0d3f224c1f07c295121e312a5a24a180d6ae5a8425ea1784b3e3863e9c0 \ --hash=sha256:3dbcf4cd708f21cf876c4eaa90e58412bc4f033d87143f41b1493ff77c25b7e1 + # via + # mkdocs-get-deps + # properdocs properdocs==1.6.7 \ --hash=sha256:6fa0cfa2e01bf338f684892c8a506cf70ea88ae7f3479c933b6fa20168101cbd \ --hash=sha256:adc7b16e562890af0e098a7e5b02e3a81c20894a87d6a28d345c9300de73c26e + # via + # mkdocs-gen-files + # mkdocs-literate-nav pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \ --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c + # via + # -c requirements.lock.txt + # mkdocs-material pymdown-extensions==12.2 \ --hash=sha256:02da896c362b548d85123e7a377a40024ea6ea938b4e45ca064e408afd994b64 \ --hash=sha256:caea66e916b4cfe987b5dabb0a78558e3506988f6353812b0b0288be8f976c16 + # via + # mkdocs-material + # mkdocstrings python-dateutil==2.9.0.post0 \ --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \ --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427 + # via + # -c requirements.lock.txt + # ghp-import pyyaml==6.0.3 \ --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \ --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \ @@ -500,18 +585,37 @@ pyyaml==6.0.3 \ --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \ --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \ --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0 + # via + # -c requirements.lock.txt + # mkdocs + # mkdocs-get-deps + # properdocs + # pymdown-extensions + # pyyaml-env-tag pyyaml-env-tag==1.1 \ --hash=sha256:17109e1a528561e32f026364712fee1264bc2ea6715120891174ed1b980d2e04 \ --hash=sha256:2eb38b75a2d21ee0475d6d97ec19c63287a7e140231e4214969d0eac923cd7ff + # via + # mkdocs + # properdocs requests==2.34.2 \ --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed + # via + # -c requirements.lock.txt + # mkdocs-material six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 + # via + # -c requirements.lock.txt + # python-dateutil urllib3==2.8.0 \ --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 + # via + # -c requirements.lock.txt + # requests watchdog==6.0.0 \ --hash=sha256:07df1fdd701c5d4c8e55ef6cf55b8f0120fe1aef7ef39a1c6fc6bc2e606d517a \ --hash=sha256:20ffe5b202af80ab4266dcd3e91aae72bf2da48c0d33bdb15c66658e685e94e2 \ @@ -543,3 +647,6 @@ watchdog==6.0.0 \ --hash=sha256:e6f0e77c9417e7cd62af82529b10563db3423625c5fce018430b249bf977f9e8 \ --hash=sha256:e7631a77ffb1f7d2eefa4445ebbee491c720a5661ddf6df3498ebecae5ed375c \ --hash=sha256:ef810fbf7b781a5a593894e4f439773830bdecb885e6880d957d5b9382a960d2 + # via + # mkdocs + # properdocs diff --git a/dokimi/requirements.lock.txt b/dokimi/requirements.lock.txt index c1f181077..d067241d9 100644 --- a/dokimi/requirements.lock.txt +++ b/dokimi/requirements.lock.txt @@ -168,38 +168,21 @@ aiohttp==3.14.4 \ --hash=sha256:ff4b366510c733974adb7a4102c094e4a6308e6f369315a4cf14d2d0a619cf82 # via # fsspec - # instructor - # langchain-community # litellm aiosignal==1.4.0 \ --hash=sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e \ --hash=sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7 # via aiohttp -annotated-doc==0.0.5 \ - --hash=sha256:117bac03a25ede5df5440e855b32d556049ca169ead221505badf432fed4b101 \ - --hash=sha256:c7e58ce09192557605d8bbd92836d7e1d520ac9580096042c0bfd197efacf1bb - # via typer annotated-types==0.8.0 \ --hash=sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7 \ --hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0 # via pydantic -anthropic==1.13.0 \ - --hash=sha256:157bd74dbf6a595cf9e5fcac557c791fd297924dc48261f57470c2ed6f4e6671 \ - --hash=sha256:ad11d9bb9adafdfea26113943bcde9973e2a439ebeeda6c89ff3e3d85bb2f5c1 - # via langchain-anthropic anyio==4.15.1 \ --hash=sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101 \ --hash=sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94 # via - # anthropic # httpx - # httpx2 - # langsmith # openai -appdirs==1.4.4 \ - --hash=sha256:7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41 \ - --hash=sha256:a841dacd6b99318a741b166adb07e19ee71a274450e68237b4650ca1055ab128 - # via ragas attrs==26.1.0 \ --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \ --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32 @@ -223,7 +206,6 @@ certifi==2026.10.19 \ # via # httpcore # httpx - # langchain-openai # requests cffi==2.1.1 ; platform_python_implementation != 'PyPy' \ --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ @@ -556,7 +538,6 @@ click==8.5.0 \ --hash=sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34 # via # huggingface-hub - # instructor # litellm colorama==0.4.6 ; sys_platform == 'win32' \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ @@ -564,7 +545,6 @@ colorama==0.4.6 ; sys_platform == 'win32' \ # via # pytest # tqdm - # typer coverage==7.16.2 \ --hash=sha256:00d3eb96e9988c45f50cccd1f1496571ac5c1f91386ac02c4d55516eeda19a24 \ --hash=sha256:01c6908bc613b420c26c818fe948e1b97dfd041a53c98b01c63bd8321f5c9aae \ @@ -749,16 +729,10 @@ cryptography==50.0.2 \ --hash=sha256:fa8f5efb344d6908a1ce62f4a24e2e5780f825d6f53f5f50ec5ffacac72936cb \ --hash=sha256:fdd28f912fccfec1846a94e2e1e8f9b0012f557f0c46fe4f3eb0d7a87afcf90b # via pyjwt -dataclasses-json==0.6.7 \ - --hash=sha256:0dbf33f26c8d5305befd61b39d2b3414e8a407bedc2834dea9b8d642666fb40a \ - --hash=sha256:b6b3e528266ea45b9535223bc53ca645f5208833c29229e847b3f26a1cc55fc0 - # via langchain-community datasets==5.1.0 \ --hash=sha256:1561347daa8841b51351ef2ad1647b4ee4af406852c0f7bd1df587ac1ca7888e \ --hash=sha256:86fd08b280485aab82894d2c81842c4151d93b575efea0054315104cb7bc3cec - # via - # -r requirements.txt - # ragas + # via -r requirements.txt diff-cover==10.6.0 \ --hash=sha256:8d1194dfb537f70480ac97c9c45dd40721cf4c326c9903fbe997db67a4db6195 \ --hash=sha256:a701553060f72d59b81f9cb1645b75ef66204427eb9dd99873c91092220e52ce @@ -769,22 +743,10 @@ dill==0.4.1 \ # via # datasets # multiprocess -diskcache==5.6.3 \ - --hash=sha256:2c3a3fa2743d8535d832ec61c2054a1641f41775aa7c556758a109941e33e4fc \ - --hash=sha256:5e31b2d5fbad117cc363ebaf6b689474db18a1f6438bc82358b024abd4c2ca19 - # via ragas distro==1.9.0 \ --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \ --hash=sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2 - # via - # langsmith - # openai -docstring-parser==0.18.0 \ - --hash=sha256:292510982205c12b1248696f44959db3cdd1740237a968ea1e2e7a900eeb2015 \ - --hash=sha256:b3fcbed555c47d8479be0796ef7e19c2670d428d72e96da63f3a40122860374b - # via - # anthropic - # instructor + # via openai execnet==2.1.2 \ --hash=sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd \ --hash=sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec @@ -1016,20 +978,10 @@ fsspec==2026.7.0 \ # via # datasets # huggingface-hub -gitdb==4.0.12 \ - --hash=sha256:5ef71f855d191a3326fcfbc0d5da835f26b13fbcba60c32c21091c349ffdb571 \ - --hash=sha256:67073e15955400952c6565cc3e707c554a4eea2e428946f7a4c162fab9bd9bcf - # via gitpython -gitpython==3.2.1 \ - --hash=sha256:0f1229ec5c057bdabdeeda8bda4f17bda679ab33dbccc00f24e6a480553c8613 \ - --hash=sha256:d66b0832aa8755c1a84892937282df0befb16c97e5a64aeebd68be9c5e323f53 - # via ragas h11==0.16.0 \ --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \ --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86 - # via - # httpcore - # httpcore2 + # via httpcore h2==4.4.1 \ --hash=sha256:0e25f1462b23c9cb82d9eb02e28bc706dac2a68cb457c6a0d74d63c8a2a5d0e6 \ --hash=sha256:4e866ffb1a869ae14dd9b5e6beb5c24a13da0495ad72b65925ded182521c1516 @@ -1061,10 +1013,6 @@ httpcore==1.0.9 \ --hash=sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55 \ --hash=sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8 # via httpx -httpcore2==2.13.1 ; sys_platform != 'emscripten' \ - --hash=sha256:e0aa977abe17e69a3b820a24542a6fa88702676d83880b8d194dcd18408e5103 \ - --hash=sha256:e1e05d4f25f7d7d496bfb96748f6f4b67657b03da069b3a68c36069f3db73d0a - # via httpx2 httpx==0.28.1 \ --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \ --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad @@ -1072,24 +1020,8 @@ httpx==0.28.1 \ # -r requirements-test.txt # -r requirements.txt # huggingface-hub - # langchain-core - # langgraph-sdk # litellm # openai -httpx-sse==0.4.3 \ - --hash=sha256:0ac1c9fe3c0afad2e0ebb25a934a59f4c7823b60792691f779fad2c5568830fc \ - --hash=sha256:9b1ed0127459a66014aec3c56bebd93da3c1bc8bb6618c8082039a44889a755d - # via langchain-community -httpx2==2.13.1 \ - --hash=sha256:6dff50fabc270ee5fd25d845d0b078ed20564579744d6d962850975996d2f9a4 \ - --hash=sha256:e48744a19e3af5ee48313d0ce5fe941d5422fae5705ea922a4aabf94d7800dfa - # via - # anthropic - # langsmith -httpx2-jsfetch==1.0 ; python_full_version >= '3.12' and sys_platform == 'emscripten' \ - --hash=sha256:70a0e3eabfef7cce5ad9c629f7d01ca05e418f586646f4ddf14782e4c1454c60 \ - --hash=sha256:cb916b707601e69a07721aabc8f3f6659be3a6893bc1ff5c6f9e02241df2da32 - # via httpx2 huggingface-hub==1.33.0 \ --hash=sha256:04e434b06e100eddbce9a6e817d72693a7884b10a79bd67ab48080d5c07eb899 \ --hash=sha256:367be21a201db9523eddf8aeac7048f2602c1b308691c97640d5e72ed188007e @@ -1187,8 +1119,6 @@ idna==3.20 \ # via # anyio # httpx - # httpx2 - # instructor # requests # yarl importlib-metadata==8.9.0 \ @@ -1199,16 +1129,11 @@ iniconfig==2.3.1 \ --hash=sha256:67f4b9c50da0dedf52af349e7749a80a9057a5031199791b906c3bb3ae878960 \ --hash=sha256:9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7 # via pytest -instructor==1.17.0 \ - --hash=sha256:aeab1e7f21f5214deedf60e8e264951408057ce21d9589743f533580dc0d6bfb \ - --hash=sha256:f6b1832d178e899ee0a6a3f247e221f19580fa525c815211c02447691d761217 - # via ragas jinja2==3.1.6 \ --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \ --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67 # via # diff-cover - # instructor # litellm jiter==0.14.0 \ --hash=sha256:004df5fdb8ecbd6d99f3227df18ba1a259254c4359736a2e6f036c944e02d7c5 \ @@ -1320,24 +1245,13 @@ jiter==0.14.0 \ --hash=sha256:fc7e37b4b8bc7e80a63ad6cfa5fc11fab27dbfea4cc4ae644b1ab3f273dc348f \ --hash=sha256:ff3a6465b3a0f54b1a430f45c3c0ba7d61ceb45cbc3e33f9e1a7f638d690baf3 \ --hash=sha256:ffb2a08a406465bb076b7cc1df41d833106d3cf7905076cc73f0cb90078c7d10 - # via - # anthropic - # instructor - # openai + # via openai jmespath==1.1.0 \ --hash=sha256:472c87d80f36026ae83c6ddd0f1d05d4e510134ed462851fd5f754c8c3cbb88d \ --hash=sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64 # via # boto3 # botocore -jsonpatch==1.33 \ - --hash=sha256:0ae28c0cd062bbd8b8ecc26d7d164fbbea9652a1a3693f3b956c1eae5145dade \ - --hash=sha256:9fcd4009c41e6d12348b4a0ff2563ba56a2923a7dfee731d004e212e1ee5030c - # via langchain-core -jsonpointer==3.2.0 \ - --hash=sha256:3e25c9bcadf5ae20c3420922234eaba1ae36ab9bef64cd72454aeaceb0b29aad \ - --hash=sha256:807db557622fbe07a0d49e19cf4795a269d55eee5ba345fb9959d148eba5ef94 - # via jsonpatch jsonschema==4.26.0 \ --hash=sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326 \ --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce @@ -1349,81 +1263,6 @@ jsonschema-specifications==2025.9.1 \ --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \ --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d # via jsonschema -langchain==1.4.3 \ - --hash=sha256:0334066939dd1c7551889727ed2d09a72dea7a6aed2193ffb61817fb658d8921 \ - --hash=sha256:aed5c1a7cd581f70ddc076b75fdbcbae8031b8373983f86efd287aa70798abc2 - # via ragas -langchain-anthropic==1.7.6 \ - --hash=sha256:06bee97006d99e9a04abc4bd56599fc356c0c7f7f2a97629645cb603d9785c73 \ - --hash=sha256:e5b41959a39810e69bc608fd6622b7d5d017bde93f858b09332fbb6ac764c393 - # via -r requirements.txt -langchain-classic==1.0.8 \ - --hash=sha256:1a11ea7fbe630c4f2af2f3873d27718ceac9488cf32d0821030be7cf039a6213 \ - --hash=sha256:ada0cc341a8a5b80fb24d73bdfaaeb849056ee2d8a41cc468355163fd3667484 - # via langchain-community -langchain-community==0.4.1 \ - --hash=sha256:2135abb2c7748a35c84613108f7ebf30f8505b18c3c18305ffaecfc7651f6c6a \ - --hash=sha256:f3b211832728ee89f169ddce8579b80a085222ddb4f4ed445a46e977d17b1e85 - # via - # -r requirements.txt - # ragas -langchain-core==1.6.12 \ - --hash=sha256:39b07aed976baac14c47b7a21e3c7d4073362bccf06cf8799c585dcc9548547d \ - --hash=sha256:dc6b2a965c351b4cc94df1c80220bcf3c5472e14437d2186c8290ea22f4d0219 - # via - # -r requirements.txt - # langchain - # langchain-anthropic - # langchain-classic - # langchain-community - # langchain-openai - # langchain-text-splitters - # langgraph - # langgraph-checkpoint - # langgraph-prebuilt - # langgraph-sdk - # ragas -langchain-openai==1.7.2 \ - --hash=sha256:9be7980edf355ca2dd595b795a5125836ccf04515ef9377228913246156e59f5 \ - --hash=sha256:e1fcbc7a96f7c8c94679d61639a979bba88f27889c0a68dfa225b8057345328d - # via - # -r requirements.txt - # ragas -langchain-protocol==0.0.19 \ - --hash=sha256:4cdf879a492a35980fd859ae792d3c65458ccaae504e183c9a10d7eac1f0720f \ - --hash=sha256:79d90a1425122ac87e8052e2ec054fbd09c3edbf341bdfb6397112a495c7bf8c - # via - # langchain-core - # langgraph-sdk -langchain-text-splitters==1.1.3 \ - --hash=sha256:50edeb318b3be6a6308dddd7d616ab82823a9ccbea59a9c14c58a7b91df60295 \ - --hash=sha256:929b6c76f99d611a5b1d8f5591ef302909b86a436ceb3217034d24e4757868d8 - # via langchain-classic -langgraph==1.2.14 \ - --hash=sha256:5b1a72b7a7f994ac6947b7751fbbe00e949f8bb44d9ab78881604b703247ae55 \ - --hash=sha256:e3f5f8ff4259f9281b73ff50fc9ef5cc3b025b8936b8283ecdca7cc0c4128690 - # via langchain -langgraph-checkpoint==4.2.0 \ - --hash=sha256:0547fd228935a0b758865de3a3d6d7a2537c308895d0f9ab092ce9151b5da942 \ - --hash=sha256:51a593b6bee684b0818e5d6e58e28ab340c6db7794575056ce7bd1b746a84ed7 - # via - # langgraph - # langgraph-prebuilt -langgraph-prebuilt==1.1.0 \ - --hash=sha256:3c579cf6eed2d17f9c157c2d0fcaddcd8688524e7022d3b22b37a3bf4589d528 \ - --hash=sha256:51e311747d755b751d5c6b39b0c1446124d3a7643d2515017e6714b323508fc9 - # via langgraph -langgraph-sdk==0.4.6 \ - --hash=sha256:57122b02bda41d37a97a5e09eb018aa8c9b3dc85c433880073779bd9324b7eea \ - --hash=sha256:ea5b1749d70987d741c9b9fe2b7e1c5f7da7e4d102f64e390333c1890c9bbd5b - # via langgraph -langsmith==0.14.11 \ - --hash=sha256:9ecca7633df228ef2c44563f7187e426b8a79e7c5c2351c5dd8c9074c61512e7 \ - --hash=sha256:d9e7ffe587e12ce51573cab654d02e84feb924d3b1f582274c4b1412ebeabf4c - # via - # langchain-classic - # langchain-community - # langchain-core litellm==1.106.0 \ --hash=sha256:5c84cc7d928cdb6ec57c5d87f221e3d27ca755958ebae389d5663f822b6f7a19 \ --hash=sha256:791625a05eb1481d14633d593c19dfaa4b91ad69ec9c3e0886a72855cd76c1d1 \ @@ -1436,10 +1275,6 @@ litellm==1.106.0 \ # via # -r requirements-test.txt # -r requirements.txt -markdown-it-py==4.2.0 \ - --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ - --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a - # via rich markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -1593,14 +1428,6 @@ markupsafe==3.0.4 \ --hash=sha256:fd9f8797427910198f95bced71ddfed61130d7e349213bfb8466c9c99e2c46a8 \ --hash=sha256:fdb4ca07ab75ffadab4a8b135ad59cdbb3156b99310f3d565370da74a15d6bd3 # via jinja2 -marshmallow==3.26.2 \ - --hash=sha256:013fa8a3c4c276c24d26d84ce934dc964e2aa794345a0f8c7e5a7191482c8a73 \ - --hash=sha256:bbe2adb5a03e6e3571b573f42527c6fe926e17467833660bebd11593ab8dfd57 - # via dataclasses-json -mdurl==0.1.2 \ - --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ - --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba - # via markdown-it-py multidict==6.9.1 \ --hash=sha256:006c4478de0a1876f4834e14255776286f09b9846b505fe63f67f9d173a9487c \ --hash=sha256:024123f0ab402ab33828e24eb80fa8f25167d0d3783ba5f287e39ed741e6abf9 \ @@ -1794,22 +1621,6 @@ multiprocess==0.70.19 \ --hash=sha256:e6c0674d34b8adac22533f6786576b3de4e396aaeda9e0c15378af9b8ada2702 \ --hash=sha256:e8cc7fbdff15c0613f0a1f1f8744bef961b0a164c0ca29bdff53e9d2d93c5e5f # via datasets -mypy-extensions==1.1.0 \ - --hash=sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505 \ - --hash=sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558 - # via typing-inspect -nest-asyncio==1.6.0 \ - --hash=sha256:6f172d5449aca15afd6c646851f4e31e02c598d553a667e38cafa997cfec55fe \ - --hash=sha256:87af6efd6b5e897c81050477ef65c62e2b2f35d51703cae01aff2905b1852e1c - # via ragas -networkx==3.6.1 ; python_full_version < '3.12' \ - --hash=sha256:26b7c357accc0c8cde558ad486283728b65b6a95d85ee1cd66bafab4c8168509 \ - --hash=sha256:d47fbf302e7d9cbbb9e2555a0d267983d2aa476bac30e90dfbe5669bd57f3762 - # via ragas -networkx==3.7 ; python_full_version >= '3.12' \ - --hash=sha256:e3fd2c13a7814cee3746340d8d7f8598a67f16a58bf47fb7f8793fab6efca1b0 \ - --hash=sha256:fd77a511bd90f39f3d016351345b52cf5319b813bdca01de3f755d3cca62e96a - # via ragas numpy==2.4.6 ; python_full_version < '3.12' \ --hash=sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1 \ --hash=sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4 \ @@ -1887,10 +1698,7 @@ numpy==2.4.6 ; python_full_version < '3.12' \ # -r requirements-test.txt # -r requirements.txt # datasets - # langchain-community # pandas - # ragas - # scikit-network # scipy numpy==2.5.3 ; python_full_version >= '3.12' \ --hash=sha256:012e66aca395d795496446e52aeeb5866312a5d4d3f27da270e5a0b43f70dc5c \ @@ -1963,144 +1771,21 @@ numpy==2.5.3 ; python_full_version >= '3.12' \ # -r requirements-test.txt # -r requirements.txt # datasets - # langchain-community # pandas - # ragas - # scikit-network # scipy openai==2.54.0 \ --hash=sha256:89089789197ccdb87f173a03145ed1598d00795220c93e96cf712b1cbf5e5f2b \ --hash=sha256:e3e6f8bc1ba30ddf381ace1a14340eed381cb984a1a59bd0f34b5be3b5d49cfa # via # -r requirements.txt - # instructor - # langchain-openai # litellm - # ragas -orjson==3.13.0 \ - --hash=sha256:0526a3456db67b264c6d661b5f090077f326b6cd074d0ef53a72763595dec5d7 \ - --hash=sha256:08bf722f923d2100bc5e5a5dcf72c656db557049c1bea26582fdd5dd9d5395a1 \ - --hash=sha256:1807c2fa49d393c7ee95fd1ef1b39cbb24aa3ccd81f30b84503ba59407666960 \ - --hash=sha256:1d84820b2ec4ac975cba482214032de5b0dbdd17046170c98e642ef9c4a4ee4b \ - --hash=sha256:2715c4808d1571029ed18fd07a82140bf3ba7def0dc89f8d015c416e3649bf87 \ - --hash=sha256:3ef75ed7e81dae34a3649f82df52cd85f9ac839a7d6ec78ab355b33b3b27ef7f \ - --hash=sha256:4329c19b8a25693f60a77b867c9d2a3ab637b20e36f5b7bea7f5acb492b44b15 \ - --hash=sha256:45e34deb3437509f4ec9888dd9ee5dc426cfe21be10f1eb4ea3a9e4d33034f9e \ - --hash=sha256:4e5c8175e1574dcbe446ee654275d353c1d78bbd9a0dc9f209bf35c9df72d171 \ - --hash=sha256:4ee06e53b998c71ce3eb93b86222912fdd9dcced685ac64d4525d36fac338ea4 \ - --hash=sha256:4f66eac85b072092e9941c3111882afd7527bf926cbc717038fa3654b582002b \ - --hash=sha256:50a5202ba388b3850ba24437951727d3aa6d79a21964a30ae8dc6a059a5fd34c \ - --hash=sha256:51d11525bc3ca736fa97ce4e4c7da9999cc00bf261522bede43b4e7531bd7965 \ - --hash=sha256:554948becd1110123ef9f6a6e1310fd92b2d07d2cbac6dbf65df3de75702e736 \ - --hash=sha256:58a9619d88f8818d9ab6b39d70d203789457ba13c1ed5d274f33ce9ae7e81a36 \ - --hash=sha256:5ef4d4157392a0439b74f7e49e5636b4ea43d9616bd0884effc0195fffcaa2d5 \ - --hash=sha256:637dbca1fccffe83780e806fbc0f17427c0c59bf822528eb0acc8f0aa9f19acb \ - --hash=sha256:64e8f345048d988c8b68d3882e5d41028fca1219a9939b32e4a77be34c8ae8e3 \ - --hash=sha256:65c4e0e106ccc7265b488385659117a6805c37d042f737558ecd68aa0c67ad8f \ - --hash=sha256:6adcaa85d79977659a448b4123a88eb33511a11ed2db243535ad7ea88a6668e0 \ - --hash=sha256:6c8bfe728b81b0fd58a3c7f3f9c5a113f87f2992c9948e0f28707aafd737c0bc \ - --hash=sha256:6d0684895b119ad167fb4ec05113639dc7f728022deec4756a710e838ed92e7a \ - --hash=sha256:6ff2a2c67f35202f7d823753d38ad371a9b7fc297567cdfff4420e763cb9f6f8 \ - --hash=sha256:7804dd1d6161da0e53b284c2aebf20f23e78eaac617300803e1467d1828d987f \ - --hash=sha256:78a12d4f8d740cc9ae197f5223682e5e960ba61b4fb2ce5a6a3bb54e83fde28e \ - --hash=sha256:7991921c5da527a963b6d4cffd0e4ea89c7e71d4be0c8be1bfe6edb223ce7d96 \ - --hash=sha256:7b3bc6b81835ce65f4729ae401607583d41139c6de95bc7453f450f1391d3e7b \ - --hash=sha256:83705c12b4afde10c62a5dd3fe6fdb21b7900bd0dcd5af1c85612ae94d0ee590 \ - --hash=sha256:84d87e322e1674408f85adea63f11aa19201eba082755aec20ebc217f493bbd2 \ - --hash=sha256:8594956a75223f657e1e68c568c0eeb3dd145f02cd6b78a47fd9a8095dbc4eae \ - --hash=sha256:89bcf2d4bc6c9a7e1763c8cf534f38712e66b76a0fefda7fb7785462f0d635e4 \ - --hash=sha256:89efecad02515df7f318d0613b5dfd6d2a1acd323a2b8294712789a715945525 \ - --hash=sha256:8c2ac5c09b017c484df1b4c68b2cf250b4e8ba08204cb58e7cd6cbbc71a9c902 \ - --hash=sha256:91d933e668ff0ffe164d7c2daec36beba6d1ce7fadb71538fbe142a71f8a1e6e \ - --hash=sha256:93c70a5e22bbbbdeafc7b273441e8452a196041d67fd4d9a9c450c66370a8486 \ - --hash=sha256:948bad47f2e2e43527f14248364a0e5dee26dd3184691010ec4a1ebeb0fd6771 \ - --hash=sha256:9825b954155b345c4759f24e5f8d652b9aec2261bb5d4e1abe06bba0a1200535 \ - --hash=sha256:a0377d6962fa431c93ecd78fdea771bb62ec545b24ee0c5d4e32acf2260af259 \ - --hash=sha256:a79cdc4934fe81f593072c94e13da3095e9d41c2deef8f6ff2901794ca1c5042 \ - --hash=sha256:a7bfc7db961c7d96cb75889dc6a1e4ae1e91d87ee61da564f582bd742b8dfeef \ - --hash=sha256:ac81530647c3423107cf61c3481e91f57134e9ddfb6ef83f5150ccbdcbc3a3ee \ - --hash=sha256:ae1d895cf7bbfd50ef34bb63bb727b14514f259f3e3f8dd010783bd38e864c6e \ - --hash=sha256:b081f0e7b600ff24513dec4ca75507fa05e904607847e386e8310d5b7b96b6c7 \ - --hash=sha256:b571236d8393edcd3236e07423f762bfcf571f852aad667a3bce9e7b755e0790 \ - --hash=sha256:b74c30e56346aad067937d766846ee74c231d1d18aad3f324e9b9261de3b2d5e \ - --hash=sha256:bceadfd314bd238f584fc229a4bbaf0e573597e7a026dec5429fbf29fd66c641 \ - --hash=sha256:c5e3ccaac3106e8fa6e2f2f6962449d7c757d7b067e41b395a19d6f0d6cec892 \ - --hash=sha256:c749ab3ac30b5ab1ffb7677f8b92eacfdfdc5260210baa398f845bc3714c05d8 \ - --hash=sha256:cbed5f4c4b88d94bcc36115f4c3bb3aa25da1563a5c3328aa3acebce2b083040 \ - --hash=sha256:d1de5eb04485110c5da4c657e49168995d55e076b1ce60f1a042e254f4186c4f \ - --hash=sha256:dd61e64802d51d1e4f16531c64536354fc3bc67932dc0cff254044f72bf0f187 \ - --hash=sha256:dd9d9a101bd8dbfad112170f009cd155e52bb8c936468821a0d03cbb96c0e426 \ - --hash=sha256:ded33b972cffdaf4ca0ac917338ab61d2bb10d68987dbcae641c313fbfdbf499 \ - --hash=sha256:e8e05549f3b30f9d8a8e28c5aba11cc2a4b90b90961ec685ca58444b0815fc09 \ - --hash=sha256:e9b61676116f755126b90e740a9cff36b91562f47ec330056cc88cc3b9f02f4b \ - --hash=sha256:efa160215c4630836d3b1250af4c7a305acd8239e0d75aff986b8088c2fcacb6 \ - --hash=sha256:f5c05a8fee59309f537590a1ff12d3c1009c485e96a50a9ac60dd085c09d0fc0 \ - --hash=sha256:fb8644dc6d705e1269ed2842bf4dbe2b4e50d670de503bf79d5cef3a5148a4c7 \ - --hash=sha256:fbbad6b9b1da43f25c1f5b20cd5a268e028a2fc95d5a8d1ade6059973bc71584 - # via - # langgraph-sdk - # langsmith -ormsgpack==1.12.2 \ - --hash=sha256:0b39e629fd2e1c5b2f46f99778450b59454d1f901bc507963168985e79f09c5d \ - --hash=sha256:118576ea6006893aea811b17429bfc561b4778fad393f5f538c84af70b01260c \ - --hash=sha256:18867233df592c997154ff942a6503df274b5ac1765215bceba7a231bea2745d \ - --hash=sha256:1dcc17d92b6390d4f18f937cf0b99054824a7815818012ddca925d6e01c2e49e \ - --hash=sha256:21f4276caca5c03a818041d637e4019bc84f9d6ca8baa5ea03e5cc8bf56140e9 \ - --hash=sha256:292410a7d23de9b40444636b9b8f1e4e4b814af7f1ef476e44887e52a123f09d \ - --hash=sha256:29a9f17a3dac6054c0dce7925e0f4995c727f7c41859adf9b5572180f640d172 \ - --hash=sha256:34d5b28b3570e9fed9a5a76528fc7230c3c76333bc214798958e58e9b79cc18a \ - --hash=sha256:3708693412c28f3538fb5a65da93787b6bbab3484f6bc6e935bfb77a62400ae5 \ - --hash=sha256:39c1bd2092880e413902910388be8715f70b9f15f20779d44e673033a6146f2d \ - --hash=sha256:43013a3f3e2e902e1d05e72c0f1aeb5bedbb8e09240b51e26792a3c89267e181 \ - --hash=sha256:458e4568be13d311ef7d8877275e7ccbe06c0e01b39baaac874caaa0f46d826c \ - --hash=sha256:46d084427b4132553940070ad95107266656cb646ea9da4975f85cb1a6676553 \ - --hash=sha256:4ee766d2e78251b7a63daf1cddfac36a73562d3ddef68cacfb41b2af64698033 \ - --hash=sha256:50b7249244382209877deedeee838aef1542f3d0fc28b8fe71ca9d7e1896a0d7 \ - --hash=sha256:58d379d72b6c5e964851c77cfedfb386e474adee4fd39791c2c5d9efb53505cc \ - --hash=sha256:59f5da97000c12bc2d50e988bdc8576b21f6ab4e608489879d35b2c07a8ab51a \ - --hash=sha256:5af04800d844451cf102a59c74a841324868d3f1625c296a06cc655c542a6685 \ - --hash=sha256:5ea60cb5f210b1cfbad8c002948d73447508e629ec375acb82910e3efa8ff355 \ - --hash=sha256:5f13034dc6c84a6280c6c33db7ac420253852ea233fc3ee27c8875f8dd651163 \ - --hash=sha256:7121b3d355d3858781dc40dafe25a32ff8a8242b9d80c692fd548a4b1f7fd3c8 \ - --hash=sha256:73670ed0375ecc303858e3613f407628dd1fca18fe6ac57b7b7ce66cc7bb006c \ - --hash=sha256:7a1c460655d7288407ffa09065e322a7231997c0d62ce914bf3a96ad2dc6dedd \ - --hash=sha256:7a29d09b64b9694b588ff2f80e9826bdceb3a2b91523c5beae1fab27d5c940e7 \ - --hash=sha256:7c8b1667a72cbba74f0ae7ecf3105a5e01304620ed14528b2cb4320679d2869b \ - --hash=sha256:837dd316584485b72ef451d08dd3e96c4a11d12e4963aedb40e08f89685d8ec2 \ - --hash=sha256:8463a3fc5f09832e67bdb0e2fda6d518dc4281b133166146a67f54c08496442e \ - --hash=sha256:8cde5eaa6c6cbc8622db71e4a23de56828e3d876aeb6460ffbcb5b8aff91093b \ - --hash=sha256:944a2233640273bee67521795a73cf1e959538e0dfb7ac635505010455e53b33 \ - --hash=sha256:958dcb270d30a7cb633a45ee62b9444433fa571a752d2ca484efdac07480876e \ - --hash=sha256:9e4459c3f27066beadb2b81ea48a076a417aafffff7df1d3c11c519190ed44f2 \ - --hash=sha256:ae3aba7eed4ca7cb79fd3436eddd29140f17ea254b91604aa1eb19bfcedb990f \ - --hash=sha256:b009049086ddc6b8f80c76b3955df1aa22a5fbd7673c525cd63bf91f23122ede \ - --hash=sha256:baca4b6773d20a82e36d6fd25f341064244f9f86a13dead95dd7d7f996f51709 \ - --hash=sha256:bc68dd5915f4acf66ff2010ee47c8906dc1cf07399b16f4089f8c71733f6e36c \ - --hash=sha256:bd5f4bf04c37888e864f08e740c5a573c4017f6fd6e99fa944c5c935fabf2dd9 \ - --hash=sha256:c010da16235806cf1d7bc4c96bf286bfa91c686853395a299b3ddb49499a3e13 \ - --hash=sha256:c1429217f8f4d7fcb053523bbbac6bed5e981af0b85ba616e6df7cce53c19657 \ - --hash=sha256:c2be829954434e33601ae5da328cccce3266b098927ca7a30246a0baec2ce7bd \ - --hash=sha256:c6a4c34ddef109647c769d69be65fa1de7a6022b02ad45546a69b3216573eb4a \ - --hash=sha256:cec70477d4371cd524534cd16472d8b9cc187e0e3043a8790545a9a9b296c258 \ - --hash=sha256:d024b40828f1dde5654faebd0d824f9cc29ad46891f626272dd5bfd7af2333a4 \ - --hash=sha256:da538c542bac7d1c8f3f2a937863dba36f013108ce63e55745941dda4b75dbb6 \ - --hash=sha256:dc7a33be14c347893edbb1ceda89afbf14c467d593a5ee92c11de4f1666b4d4f \ - --hash=sha256:df6961442140193e517303d0b5d7bc2e20e69a879c2d774316125350c4a76b92 \ - --hash=sha256:eddffb77eff0bad4e67547d67a130604e7e2dfbb7b0cde0796045be4090f35c6 \ - --hash=sha256:f04b5e896d510b07c0ad733d7fce2d44b260c5e6c402d272128f8941984e4285 \ - --hash=sha256:f3601f19afdbea273ed70b06495e5794606a8b690a568d6c996a90d7255e51c1 \ - --hash=sha256:fcd55e5f6ba0dbce624942adf9f152062135f991a0126064889f68eb850de0dd - # via langgraph-checkpoint packaging==26.3 \ --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c # via # datasets # huggingface-hub - # langchain-core - # langsmith # litellm - # marshmallow # pytest pandas==3.0.6 \ --hash=sha256:0704044b676496b8350e023b09f174a26772456c974a2b11c36bebb558c9490d \ @@ -2162,91 +1847,6 @@ pandas==3.0.6 \ --hash=sha256:fb625f426b375bcc96e3a04c5d5d266cd7be6ae5d6866e0e703382ab5164068c \ --hash=sha256:ff51a4459ed036e93d1eb1bb5e6e7b28685d3cb6b7c12b91c05b31024e234729 # via datasets -pillow==13.0.0 \ - --hash=sha256:02464da86f561f410e13b061ec37c3068a9cb557a095494157742d07b3c24a27 \ - --hash=sha256:04a63720f79e22fd54d897c233a68314c50ca0603360f54ce2bd5db8f0f43782 \ - --hash=sha256:05cd2cd39055d0b9650060e4513ef4a9a0aea870083950bd046a0d6490f93a22 \ - --hash=sha256:06903aac074d00c988e77a1fc435286dc498506d4ca8d6f69df9babddf4ecc15 \ - --hash=sha256:08b826a9bf1265c76de04a42061d61ea6b109418b7826f28ff1ecdfaa26c5502 \ - --hash=sha256:0d1a9cf7bc6917538b20f8d06b9ab2147e542f68849e96fc58eb66bdf6acc692 \ - --hash=sha256:10b5019883c98f1dd819ca48ffc6f33a91cee04948fe637c605f4345c7cafd6f \ - --hash=sha256:12b0fa15879fe5a9d9eebe66e4e2d74128a773b1a4448010c9c714f45e04b9d8 \ - --hash=sha256:12fbb851cf323cc19aac3eea1df5ad17b57e91e9fe3cfd06100dba7bb8208c13 \ - --hash=sha256:149a1c323ba366f90b48e6f1a6db6582eb50512df374588de56fc909abc0f0f3 \ - --hash=sha256:19b66ca0a4d25cc0200b381ce824c7ea090db61427315e73cfb05dbf1b35c369 \ - --hash=sha256:1c774b9c0ba0d0b356f71530677b39028878a2cae5a93e0a13779cfd17120f88 \ - --hash=sha256:20722cd5375533ad754053363a80b8fb30c79d37930a6f7228030e237ce3bd5d \ - --hash=sha256:20822140c9a2ba9c5e42df342b0a892ab2e102fc0e3db967a133bb9ce3f898bb \ - --hash=sha256:21c32061a5512dc13f87cc7303e120e4d77c2f70df89a35af0e3ce246e5ac57f \ - --hash=sha256:2310e2adfc13c6d457d7d0f2ffdd5c56a74a317650cf765887df8d515a647ac0 \ - --hash=sha256:23edf4ec4b6f4f240e8df6e4985e9ee2ced86474632433e55fb1e2548744bf40 \ - --hash=sha256:2d50500a4a3bc6469adcdb319cf05d688b08ca3bf0f22a05339f3b25b433a599 \ - --hash=sha256:2e31c4e68cffd7b1f116127626813b82fcba19edf6b940a7b0c266d6484d0055 \ - --hash=sha256:34fb3db1149c879343861831728c243c432d4a5afc8f1878ca7612ef8de2a033 \ - --hash=sha256:37290fbef0c73e2d51d594eb78fded7dc7170d1c3ad0a890269e6fd8c8c4e061 \ - --hash=sha256:405be6058e206a86fedce2f715ecc2343f94072d7925251632dffa2c05f70dca \ - --hash=sha256:40a266371ece581e5de13b6635ef78d7487824af80561b6ca27694a88c19bc0f \ - --hash=sha256:42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca \ - --hash=sha256:44629d4498c9cb6b2051806155f22141df0d8a929c56134b166655232dfb2f8c \ - --hash=sha256:49c12af515073e9bf511e4ef736743bf70d531a643668722279314b937742ba4 \ - --hash=sha256:4a25756244bdcce3b50580baadf320fa48297f0eeb8e114ba64139a40d4d0fc8 \ - --hash=sha256:4bd024d567eca931b668978d672dba914d4b8e2628e2c3073a2ad178de8a2620 \ - --hash=sha256:4f8db54177035a2b5f717f94475b74907e12a96dc74f6d487f3966b0a4694071 \ - --hash=sha256:51ebb529fc5e8abdd55302f6c3f8943037348ec2384329a3e55677f69ae2fdfc \ - --hash=sha256:567f20f1c75897d7663830da6ea8af719e03d712b1d9ee7f813319f9ece42e5a \ - --hash=sha256:5933fcea5a5ba64c686f55c886a115cbfd92f2900460784a1e79909fdbafd7b6 \ - --hash=sha256:5bdb38ba220b61b4ec31dd1046dea6b016d3c6850a23f43ed8b58332b2fc668e \ - --hash=sha256:5f56499c1a74d2b862beb0c33b8016f99d095858455df9d21583bbbc1c15b582 \ - --hash=sha256:67871a13cf47275201553b536c025da777f997fa562a19eb798af4ad4b97c18f \ - --hash=sha256:67c8d44ad89fa7eb88de5d6ef6199b1e03dd24974f85a67639fc8badb801fe79 \ - --hash=sha256:6a0920cb55df5a4d3f6862964908078c0bd59332bdd1bcd20d14e8c70ef27cc5 \ - --hash=sha256:6bce6a29c3898191f4c9998e4d4e8f69790caeabde46e54da4bc235ce5bde683 \ - --hash=sha256:6f38f3f885a09cafc93fd667b1173a92f379e43785d635e7983c893f0da319fb \ - --hash=sha256:73ee25cf8cf8b75d5a5aeed7cb6588f5e5dbfbb0fde51707b630bbb23897645c \ - --hash=sha256:7b999816b5850a35ada08443e6e03945f1f6488144a83afe2d37b240a552aafa \ - --hash=sha256:7c88c10dd432f3b39ccdafc9ed81d0c21b8fd634502574da76d1bfa4fe2c76d0 \ - --hash=sha256:7d5e097eabd5d4915c27ac9f6e9325bb1e01a7c94d7348b5c4451d3fc30e8521 \ - --hash=sha256:7e91e97a929232cdb828889ee6ad0e48d7f40f4ec38818f4e4a8968b2b1af22e \ - --hash=sha256:7f6299e494e46253d40c34653cac369412f44ca53b5f85d848d3f95b1ed0546c \ - --hash=sha256:816752a5ef76a80484c8c441c85593b7ea9304f6231fc5776ad1fbff7e773058 \ - --hash=sha256:83b37abd87b590acd8f47ca8a61f70893322b11834d36e07c2298dacad4d14d2 \ - --hash=sha256:8619685cad8efc4c38c66d3b36aad854523297c43d748b3b6f0cc03c90ba3463 \ - --hash=sha256:8bf295fe459343bc6093c8e5e0df60bfa189e0fcb775a22e2c2488fdeccc6c0d \ - --hash=sha256:8e459b613cf31f8980f584387b4fe47bf08e076e288d61aa8eba1f7fd4ddbb81 \ - --hash=sha256:8f36aa77f74b14a2103622b196402c71330e4e7cf4122ee45c854e9a01e0eecf \ - --hash=sha256:93ff9c9c3663ce23aaa5d0b6b6abac55359e2a0c06c7e30f3771829af816be63 \ - --hash=sha256:9a635068d9793c7f0d929f39f18b58f1bd86c236e8e7b64167b86af9232ebca0 \ - --hash=sha256:9dda0788a9932776a75d8bcc020076edc308ce2508b51f6739a45e3158b3fc42 \ - --hash=sha256:a192360d512305fe92d3053e4f7627bbad1f7708f1f4ad38cccd9336acabe9ad \ - --hash=sha256:a2a14cd73d5e6c927f644b0110ee81f59c4ef506259ec9183904747f2caacc81 \ - --hash=sha256:a625df9a2a5597fa5e5266e01aefc82604bb85d291e3547981e863560d75da6c \ - --hash=sha256:a6aaa7871aebca081eb5c45f83e845bbd9712ae99fa9286dbfdcee835e63f4b4 \ - --hash=sha256:aa694c49787040943570d61c9b8fc01271bd2a2cfdd55f0d896f8aecdce1a981 \ - --hash=sha256:adb3c2124c68e480f4632d06cb7caa3b48a51678475f483b4edb1c6dee29ea43 \ - --hash=sha256:b84be41387fc00db28c13c02e30d42b02d8d8f6a4a741a1aee6012ca7f1f6039 \ - --hash=sha256:bf97ba1b5542050e9b0c74e632323b6d8136cc99d64e193abebee22fe6013c76 \ - --hash=sha256:c3bc8ee0271387e0b1e3ad0ff893645990a656e79bf9c42f4f734a3642b11d51 \ - --hash=sha256:c50c80e3591e5cf9a8dfa6007d4f10732f02e32263850999286e56ccd650cfb2 \ - --hash=sha256:c6fd031333dedcad7ce3e03d244093f43504f209e86925ebdb2b868fa4037630 \ - --hash=sha256:c87a04e7f152ee4db5dbe15f0bfa3fe628a1aeedbe66b81c43b87f52c813f9ac \ - --hash=sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510 \ - --hash=sha256:d4737f50d23ddd11d6685faacbb9252887dde0bc7997127757247983d74399d6 \ - --hash=sha256:d7710eb676e9bb68965cb045be0d333b4c0d7f9dfbaa7fbf121385b1588683d3 \ - --hash=sha256:d9b0a2bee3f3e03e9f29057aedb807dbf1e1d96ee1b9d0f422d9db6c8583271d \ - --hash=sha256:e65dd6e75de67b2362a4fa3e16aa627595f65054dc4ec73d64680c84d592fa61 \ - --hash=sha256:e892354a424b1e82a78ba16785822bdd40de06f19446a3d4a28047df1a4f8932 \ - --hash=sha256:e8ca8f69b7c77fa96dad99f8638c1fc4f1c0bed4acaa1baf7a3c31bdb80a0ab1 \ - --hash=sha256:e91c2b1cbeae768c98752e67e717e283d68dae45717b41f2d91eaee648e37b7d \ - --hash=sha256:e98b4f91f99b24b1da72e10621ba181f7281922384a7403094debb4199de6c00 \ - --hash=sha256:ef5fe6b7db3f501c56000ba8fe7c7e1a35ca1d45824fbeb95a67daa85cff4dbe \ - --hash=sha256:f11a3c1358bb3c68012a7b1f41b223c3db9f7bfde90b481df028cfe1c3363313 \ - --hash=sha256:f391dc92a015c478745192fe4f2e120c2af2aba18d9fe0616341cbf537599806 \ - --hash=sha256:f7cbb7a64e7ec664775195e4f81923bc8a93d9451b963f844e59118f63147a7a \ - --hash=sha256:f9bd7d260d986f3553518c5d723544346fa48031f8aef3265d786aeb59845bc0 \ - --hash=sha256:fc481f742ccda20e9ed760b8f978dff50f2a4e9bc253ac167fb0a05b0783ef52 \ - --hash=sha256:ff3fe9eb621fbb9db4c4be33ab946f6bac5f98ab50ca8d3260503653656c961b \ - --hash=sha256:ffea6b2986a797c84b6d1d27d4f43e0b83c73fc16281a930891cd237cf0d08fe - # via ragas pluggy==1.6.0 \ --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \ --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746 @@ -2449,18 +2049,9 @@ pydantic==2.13.5 \ --hash=sha256:346a034f080da3755d8e9cb5e00e8b07de1d39e4f6e2c87d8ab7cafa0b269a73 \ --hash=sha256:51a9c5f7b2f8e636f04c6cada605d9b6a3bf1348fdf945a3d8869b19bba0ee08 # via - # anthropic - # instructor - # langchain - # langchain-anthropic - # langchain-classic - # langchain-core - # langgraph - # langsmith # litellm # openai # pydantic-settings - # ragas pydantic-core==2.46.5 \ --hash=sha256:013d6f3483d81e02e7c328831808f336c8596ee33b4bd4026b9ffb1e960b8942 \ --hash=sha256:03b9666e41e35d8909852ba191a0607520f81b74eaf12ccf8737005dbb313821 \ @@ -2582,15 +2173,11 @@ pydantic-core==2.46.5 \ --hash=sha256:fc5d783bd4a2387e97b8a2d5ec781cfb92b3d893bf82370548e99db5915935d3 \ --hash=sha256:fc8515076c11f3cfdf4fb142dcca0fe384b1230a3b5415458ac84f3e0903ec13 \ --hash=sha256:ff218293c9c806138dca139765e3b067621be52bcd93cdc14c7711be7ddc90a9 - # via - # instructor - # pydantic + # via pydantic pydantic-settings==2.15.0 \ --hash=sha256:0ba092c291c94baceb5eff768aa0d56400a457585bc0175925a5a5510303da42 \ --hash=sha256:694b793e84f766ba76a90ebdefc01d0a9a045dab0382bee70393da93712ad117 - # via - # langchain-community - # litellm + # via litellm pygithub==2.10.0 \ --hash=sha256:192ada2a76e4afc7d6b37e500c9bfeba1731e6506697445a5ba1c4af8bf0b924 \ --hash=sha256:90ff24ef1cd1bd57124c2a3869cafee9d7b066909129ecdaba2c2d1903bc118d @@ -2601,7 +2188,6 @@ pygments==2.21.0 \ # via # diff-cover # pytest - # rich pyjwt==2.15.1 \ --hash=sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193 \ --hash=sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8 @@ -2759,14 +2345,7 @@ pyyaml==6.0.3 \ # -r requirements.txt # datasets # huggingface-hub - # langchain-classic - # langchain-community - # langchain-core # litellm -ragas==0.3.9 \ - --hash=sha256:1be77af14c7101f26125cc025ff1026f49e2d564162471ae590c3d832527f9c5 \ - --hash=sha256:7807cfc3f01c0297ef99ab3e6a5f53e7cac0a73267d273273b17871437c55786 - # via -r requirements.txt referencing==0.37.0 \ --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \ --hash=sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8 @@ -2904,31 +2483,13 @@ regex==2026.9.29 \ --hash=sha256:fb99cc9d45f48895d9d67f6a0b8a57f08d39c174d9f25ad97a313e0470267b1c \ --hash=sha256:fdd88ed5e20b1bcdd234421e454962c971aa44b653bdb7f1ea9ef683e90fb649 \ --hash=sha256:fe3fa1dd453ed5c7f5ea23a26218329790ed7197a99b90e94330e313959a7f52 - # via - # instructor - # tiktoken + # via tiktoken requests==2.34.2 \ --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed # via - # instructor - # langchain-classic - # langchain-community - # langsmith # pygithub - # requests-toolbelt # tiktoken -requests-toolbelt==1.0.0 \ - --hash=sha256:7681a0a3d047012b5bdc0ee37d7f8f07ebe76ab08caeccfc3921ce23c88d5bc6 \ - --hash=sha256:cccfdd665f0a24fcf4726e690f65639d272bb0637b9b92dfd91a5568ccf6bd06 - # via langsmith -rich==14.3.4 \ - --hash=sha256:07e7adb4690f68864777b1450859253bed81a99a31ac321ac1817b2313558952 \ - --hash=sha256:817e02727f2b25b40ef56f5aa2217f400c8489f79ca8f46ea2b70dd5e14558a9 - # via - # instructor - # ragas - # typer rpds-py==2026.9.1 \ --hash=sha256:00ba2d8c7dd4ee537978ddf4b3fbd712bef2d8751603f7f3146b3f4287768e25 \ --hash=sha256:01445c8d194aa032a08e944f16567672da1c62dbdbefd8b6d0693032e290cf68 \ @@ -3065,29 +2626,6 @@ s3transfer==0.19.2 \ --hash=sha256:ba0309fd86be3c27dbf78cdd813c13c5e1df16e5874b99d2535ebbdfb9892993 \ --hash=sha256:d8168eccca828cbb2cd573675333f3bddd254313a9c42494b84c76b539e8ba25 # via boto3 -scikit-network==0.33.5 \ - --hash=sha256:2408d3f4c81256a3193d536aad4a6ffcfbb05d096abe6a9cc0b6b5e275df876d \ - --hash=sha256:2866b16aed9ef25ba42cb2f2e44ef2ad079337f336ce48d0604b55fa4af87688 \ - --hash=sha256:3615d073ba9ae1ae30dda2de747474cd23c86cededa82b317471ee9f9bebd1b2 \ - --hash=sha256:38a5a55f125b9ff574b085994e6374f783469faf1542d140c1630ad2c14127b9 \ - --hash=sha256:3c4c5400b9477c5538f9b1a5b59f51c16922d05301dbfd684defd97bfe12658e \ - --hash=sha256:406af38a07ee1d631b62616496013fc5d941fffb5221fdb9e9091b87352a3f0c \ - --hash=sha256:526490a1e0e8e49ad0f4cca193f581d60082a2fa8c9a825eb0b6936050b0d02b \ - --hash=sha256:6d001988f07abe03ef4d8189da148968ad520f8cb8666d9ecee0d51c277bd466 \ - --hash=sha256:6d796382dd914ccaa7d3fb990e148f5f095817690f07119d614f4d5bd63b347e \ - --hash=sha256:722c15fcede5e07ac008354bbd6ef375e0f5bf1fd52bd40271775997be2fb715 \ - --hash=sha256:808b625d28005c24b47cbdf65f780a3a355aa4080992e6b78f03434e873d06e6 \ - --hash=sha256:854d33b2056dff4fca1b956b46955f3d668148ba63c5cc51a5c497e7ee765def \ - --hash=sha256:8b9338feb0b2bae0f32ddd77453125b4e6c2d365cfb1bb1334b016888466e42f \ - --hash=sha256:aa8b490a777e081dd6f69627a26b50cc4012f27fff683a1e4828819a88a5dcf2 \ - --hash=sha256:aac2d3bc14214f02dac300624f5ec2650af9a98b52f304d300f0ec2813a0e544 \ - --hash=sha256:ae2149d9a280fdc4bbadd5f8a7b17c8af61c054bc3f834792bc61483e6783c12 \ - --hash=sha256:bfcb4b945286154800eb61998fae85675d9a05ee78e776a82e7d222bf978e171 \ - --hash=sha256:cea820628f1079fba2489d55e7d93e4b223f69b5efe00cccc919280a3852d7ff \ - --hash=sha256:ced625228be1632595d11adaf22d61d1d4c788909cd4d8c364e720b2814aac7f \ - --hash=sha256:eb2770c61eec21e915b3dcac03f36ca5450cb8fe2bb99a8733f7daa37037820e \ - --hash=sha256:f9f2d98059cd79bdb935ff6a638f1c3a12b0b1cb7ace9e1d3fb35476eeeaabaa - # via ragas scipy==1.17.1 ; python_full_version < '3.12' \ --hash=sha256:010f4333c96c9bb1a4516269e33cb5917b08ef2166d5556ca2fd9f082a9e6ea0 \ --hash=sha256:02ae3b274fde71c5e92ac4d54bc06c42d80e399fec704383dcd99b301df37458 \ @@ -3153,7 +2691,6 @@ scipy==1.17.1 ; python_full_version < '3.12' \ # via # -r requirements-test.txt # -r requirements.txt - # scikit-network scipy==1.18.1 ; python_full_version >= '3.12' \ --hash=sha256:011413b7426b75012840e35649e00fe0a2c3bae89fed433876e3a99251572efc \ --hash=sha256:0ac49ea97594532dd44b7136094d35f5440fa06e6d9c6384a74c01764df388c5 \ @@ -3219,113 +2756,18 @@ scipy==1.18.1 ; python_full_version >= '3.12' \ # via # -r requirements-test.txt # -r requirements.txt - # scikit-network -shellingham==1.5.4 \ - --hash=sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686 \ - --hash=sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de - # via typer six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 # via python-dateutil -smmap==5.0.3 \ - --hash=sha256:4d9debb8b99007ae47165abc08670bd74cb74b5227dda7f643eccc4e9eb5642c \ - --hash=sha256:c106e05d5a61449cf6ba9a1e650227ecfb141590d2a98412103ff35d89fc7b2f - # via gitdb sniffio==1.3.1 \ --hash=sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2 \ --hash=sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc - # via - # anthropic - # langsmith - # openai + # via openai sortedcontainers==2.4.0 \ --hash=sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88 \ --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0 # via hypothesis -sqlalchemy==2.1.4 \ - --hash=sha256:07c60abaffb980b7382f2c75be8a5279c2b5df2626a0f5d751dd942799bf3b5c \ - --hash=sha256:080f8d853aac5bb5620f0ae6f46527397cf18dce0ec2b478b478469ef3cae2c4 \ - --hash=sha256:0970394ec5d9e397aafc5bc5fa2b7f8b58cb191f2703006b19a96ef4bf00b8d9 \ - --hash=sha256:0a9a464bc360856b7ea9bf8aa26aab92ca115dd08149cb0e004063d5db13584b \ - --hash=sha256:0b96edcc2cd60fe1e35f67a46f4eb076e57297841b9eae949ac5f196593f00a7 \ - --hash=sha256:0d1ca95e42ce3c18818f170b741d30a33b292c6f6b9a202ffd717e28fc99b8c7 \ - --hash=sha256:0e01a3e199ae219381c4889993c5584b1b905fffe6830f639adb6770036a8913 \ - --hash=sha256:0f672ed6972164fec94a8f0b21dcf8545080d0727866335fb8adf9f4764ce6ec \ - --hash=sha256:12642e105b4e0cb2ca8428037368c1cbcded7b9d0344174607174d82b700e1eb \ - --hash=sha256:14528d37d7d46a92f2a483f188f7fecd86cdd789254a0412b960c9fc5e9efd6d \ - --hash=sha256:1541ba5bf0f232cd61f9ef3df78c93977c72ba6031506a0e6d057b2a3ddb76e9 \ - --hash=sha256:1ac64fce94c5b389062d2e3806db5dc780447591e0dfd5ead218c884f0703f2e \ - --hash=sha256:1d66fdcc5506e0f8bb8d3f4f95125220a7cd6c46e8b1762750f01e9639973dd8 \ - --hash=sha256:22129e7d00ac66b291840c4dc83a9c497456ab5bffa682dcbfdc2356f9e49e5a \ - --hash=sha256:283914efed30e4d44301e36ac90ad048570538b8a70f072fe01578d9b205d09c \ - --hash=sha256:2e1b5343d315b10a4a71da481729f66f830a561595e02b61e8a5a65d658325ac \ - --hash=sha256:308f96d24e773d64609a2a0d1161a068f9f6e9165523bc4e07aa9c45f0c4213f \ - --hash=sha256:3341ddc430733cd961bc064889f42712a0b4056733a21c83176842aad67d12a6 \ - --hash=sha256:343a0493a81278bfe30be1ec81214a55f2f44aaa4662d230be359ab2aa18cc2a \ - --hash=sha256:346d144e8912ae087b10d3c2081657cb634728600693eee6dbb71d7eb4768101 \ - --hash=sha256:3c998d70e60fc95e93e5971395818c50f8a34396a6352075256fefac6b5cf81b \ - --hash=sha256:3d2eacdbeb990b80235763860923c60a8393745b66f7149a734980c65896da72 \ - --hash=sha256:3d675b0856b6703b29d023517a4c19fecfbb55214ff5c72cd813527e40aed9b4 \ - --hash=sha256:3e5045fb6aadbb0f978ab9b9d8822f7b7a97d2281814e7d13d791155664eace3 \ - --hash=sha256:3e5de57c71b3460e2ca6137e82cd3cb8c9f711f301f50d5c77156fdb9c822999 \ - --hash=sha256:3fd608a06bafa768ad5711df4e17eb058bdc490e9df7d39b12a90947471e8712 \ - --hash=sha256:418786f05387ddb66ee683a1d016c5a8d9bf7be921e6ee8f285c7b6ac961a731 \ - --hash=sha256:42c37c06adcecf444e8c981f7e9237a41bdd445c83da0df9e08b4ad958becbbc \ - --hash=sha256:55072780d1aae84dea443ce27edeb745f6cc4d19ad89416abbb6b49712080e7c \ - --hash=sha256:596a95611c217cb19c21f02f43c637cb507cab71dcf0467c5c7d98fcdd703007 \ - --hash=sha256:6005f2f5fcd67fdd721446128e6a2a1d18f77387a604fbd26b0006a086b33096 \ - --hash=sha256:61a2c48771cf314b6613d327c795902bbc0eb6d6169deb23b35004ba6ad6cc0d \ - --hash=sha256:63dc25b21fd9a41dc09b7aada4b3b0d97cf4b6414f74bced6ac45326bc799ac9 \ - --hash=sha256:64d41be1dd88f184de1931f0173f4827122a1b49fd1150656641200c0bdf640c \ - --hash=sha256:6929a11ad26a91a4efd891c1252b373c2e88f056910b83ec6030ed3f2cbcb734 \ - --hash=sha256:6c79e0c824d51c586757ecd342160bbdede9010df04bb71b9bbfffd5c7b6ee29 \ - --hash=sha256:70006e9e6157200b795beeee04bd5cb15bccb40a14de595eb9f5dcf5945ed244 \ - --hash=sha256:71040390ef01c85e9d26e5c83cb0c5942dcc8725c49186430af160ce2f54234d \ - --hash=sha256:72e3fa41d1fdab87d4e88bbdd69c9522e2795549fbe7b07bcf4ae9ec175f4b11 \ - --hash=sha256:778094c83e36c430756a7e1a1ac66fc3cffb2c6a1067958fe6b920abcec7bc5a \ - --hash=sha256:7a2f6164c0527cd8fc4cea79a5c9d8369ffee417b8ba444a42342f36b91deb75 \ - --hash=sha256:7b3f58bd26fc010ea28976d401845e4e6ce02e1b7c0288b3ea9c9a3c396f0bcc \ - --hash=sha256:7bd7ad604487daa7eab8716471c29a7185f17b5287ce73bb7bc79fea050d8cfd \ - --hash=sha256:8080022e101afb17565dc5a358a165ff4a20cd97b20b4db49ebed66315b3c733 \ - --hash=sha256:81f802c96dbf96e59c6982fa1b87da7868920fb0c27b9b81e560a62f57c2ccfb \ - --hash=sha256:82d728075d42bd457d09655cf22e99d772a648c6f67e86743a4f05b7d063ca18 \ - --hash=sha256:84272f329c15081a1e09b4a7261118b4e8a547f43e00fca98e55bbdf19eff3be \ - --hash=sha256:89db94855287fdac98d74595cf13ea59fbffa608d6400ff972b0fd4c036d873f \ - --hash=sha256:93b9416b9011a3b7689a933e04ac9f61d15686b6cb1948ebc1f41467153116c3 \ - --hash=sha256:948dff080b5ac00c8e63bf9e59fa70e386cca1476f55c672a72b6ec12e5cdb05 \ - --hash=sha256:963348422b22f760e9462e56bc32bf4d95d224cc5b8c79a3c6e3b786d3d2a2b2 \ - --hash=sha256:976bd3fecfcfa58d69eab67e76325f564ed775aa0c0accf138ae17324b461431 \ - --hash=sha256:98f7a4bfeaed3722804f737ae2bd4077b35e57d6f4531fe612bac8160cda5acd \ - --hash=sha256:a0bb9ee6a38cb36240dc88da11888348f61506047be54de3f09496c3b0ead6f5 \ - --hash=sha256:a577e2127e52b0fe2bc54c73abb375a20ffe6f59fbc5568ccafc233f5bfcf8ef \ - --hash=sha256:a64d54015233f824f171009977bfbb6b08bd0347b700cf17cb047ffb94c4148f \ - --hash=sha256:a6d147c31e189541ae7cd990482c4f960f9e8abce186551225fa355856dbf1a5 \ - --hash=sha256:acf8982c70471a68aa90d1aba08b48860c55b3357ec84ccb0f09368ead2ce099 \ - --hash=sha256:b756d74527c56a7e4cfae297f7930c1d75bdf4b23f214c8c13779746d28060cb \ - --hash=sha256:bab7f51d38766d6a64da2b41976f1b3f9cc2ff37d3f2f63bdbac876199f3a48e \ - --hash=sha256:bc33d3e59d4e84b8866cc9ba13732585e37212dbe3542cb09f232682b36f47a5 \ - --hash=sha256:cb2cb98d056e63e353ed697750004e07c79b054d73059ba3184ca3bb07296bea \ - --hash=sha256:d045e63095828d2f1fd84d499936e6791522c15c390373fc755f118e4040393a \ - --hash=sha256:d2cb669c6bd1f19caf51db6e3c4fdd4cbb76f9db3ef81c3aeb5e288d9bae101b \ - --hash=sha256:dffa69d2f3ba1933c1c1882dbef8fb3231b33eb19263e8b8c5cea24995071f06 \ - --hash=sha256:e2ace725a430e5b303fc3c422196966328ce77fb4fd053ad85572b46ed5fb71a \ - --hash=sha256:e30524ae24e31d83e1b5f734862882c442f4158e3566f2c5f5e9bd3c659bb517 \ - --hash=sha256:e3a026436c51f296aa1d01243909a3b76490950e927824b10899a083cc26e7c3 \ - --hash=sha256:e43fca5fdd5f34a3f8c54107a3648d3139de8bbf596a189f3f0de94bd84949bb \ - --hash=sha256:ec5d079935f67febe0ab8a3a203ad591b99508adc34ae0027f696dcb20373537 \ - --hash=sha256:f953be9ba26039a24a5205c65d33518b608ce6f4f0f4e9b9c14eaf42a10dfc52 \ - --hash=sha256:fba3500e170d25f581e053009edeb0b158116084d91d465de218718d336b67c3 - # via - # langchain-classic - # langchain-community -tenacity==9.2.1 \ - --hash=sha256:9e56f17539296baab7beabb08b92f6ee3d7be92d8be72d763360677c2ad6580e \ - --hash=sha256:a606b5c808d0cded4a359d5b9932d867ff2a6a6b64d37350260fd01bbdf83839 - # via - # instructor - # langchain-community - # langchain-core tiktoken==0.14.0 \ --hash=sha256:087538c080e5ff421abd3a0785ed63c5111d06af98e6cd0d374dbe5969147ca3 \ --hash=sha256:10f31e63e40313f2e518d87f7086cfa44e45f64cc14d8ae14103b41220c30a14 \ @@ -3391,10 +2833,7 @@ tiktoken==0.14.0 \ --hash=sha256:f3d6cf93fbe2e7117eb7bedca684216fbe328a41f0843ce34245451d8eb2df1c \ --hash=sha256:f5e7665f6624e052e5e7f6a36919ab69279decdc976d7b16b4fa15e1897d0513 \ --hash=sha256:f702e0aeeb6506e57687e881c59e844ebe8f0a6a097ddafe20e3ab25f387be4e - # via - # langchain-openai - # litellm - # ragas + # via litellm tokenizers==0.23.2 \ --hash=sha256:12f0835dc2ee694746a76adf7b1567d4346a4a502ebe93fb1f5f80ea49799b78 \ --hash=sha256:2e96f5699d5249c9c64aa8412e044f727aae3a4098cf830f9901ec1afc361cde \ @@ -3488,45 +2927,21 @@ tqdm==4.70.1 \ # datasets # huggingface-hub # openai - # ragas -truststore==0.10.4 ; sys_platform != 'emscripten' \ - --hash=sha256:9d91bd436463ad5e4ee4aba766628dd6cd7010cf3e2461756b3303710eebc301 \ - --hash=sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981 - # via - # httpcore2 - # httpx2 -typer==0.27.3 \ - --hash=sha256:d0396f770a560ab1b0a8504e13b5f254b728cedb05c61cf0359e944e50ce8901 \ - --hash=sha256:e50022f28b82a86313e54501317a1db64bf8f8d036ff8cfe5ca7e47675454aff - # via - # instructor - # ragas typing-extensions==4.16.0 \ --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \ --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5 # via # aiohttp # aiosignal - # anthropic # anyio - # httpx2 # huggingface-hub - # langchain-core - # langchain-protocol - # langsmith # litellm # openai # pydantic # pydantic-core # pygithub # referencing - # sqlalchemy - # typing-inspect # typing-inspection -typing-inspect==0.9.0 \ - --hash=sha256:9ee6fc59062311ef8547596ab6b955e1b8aa46242d854bfc78f4f6b0eff35f9f \ - --hash=sha256:b23fc42ff6f6ef6954e4852c1fb512cdd18dbea03134f91f856a95ccc9461f78 - # via dataclasses-json typing-inspection==0.4.4 \ --hash=sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47 \ --hash=sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147 @@ -3542,220 +2957,8 @@ urllib3==2.8.0 \ --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 # via # botocore - # instructor # pygithub # requests -uuid-utils==0.17.1 \ - --hash=sha256:01d9209d6fed20226af0d29b95c5e253a1907b61f1a00153187ac5412f1df9b6 \ - --hash=sha256:0721f05b4f10cc7d49d91be65524a3bc6e6a5d88be054cdca05dff487a022091 \ - --hash=sha256:0956a9422e132c8d4a3d808cc3d754fc8e81d34295a3a202b332c9dce064eda9 \ - --hash=sha256:10c51d54ecdf0617640e505eae6d2e6443d8e414d4f9d6e8d43949a450c56e6b \ - --hash=sha256:1a9e8c876a5d6247572e7f8eace39b4de9a91cd1b026e24552ec631c08c91394 \ - --hash=sha256:1c8124c9b91fa8353d79e4e7bd44ed0f2ae683990c01818199668f7579e236ab \ - --hash=sha256:1cf7a837c3467f69ba3ef32caa43b1c5f5a462b7d960bcc59083459aed2b4202 \ - --hash=sha256:297c6be22e0dd0f7d372845b171ffee5657581759982413c0a5b01b900c5f592 \ - --hash=sha256:2ff6a84cf6a0a28e4a75c7b11f0d52464ddce4b7a0bfcf14c8de2e740299903d \ - --hash=sha256:304497d360e9ca5b019254bb25a2ee886b66de884aa08a949c8812fe5bf5327f \ - --hash=sha256:33fa18507488c4dbde9a3969b6483183d934dbf7a7d46aba90bd5d664d4c81ea \ - --hash=sha256:3404d50a60ec74642fd590b9d639d98770022f4b1ff8a4055b3c70742c85f096 \ - --hash=sha256:3ca89347a01ddac94727578369feacc0969d9fc033b2c17ff7919121ee441e2f \ - --hash=sha256:3d6ccaebaa3b2ff2e59d11d70c64e97ba572120162a00c25d6f8e5e0c1004b9a \ - --hash=sha256:3dd5706a9874799013e82ac567425c535a0a4a7779c8551154915a4ba2fcb1c4 \ - --hash=sha256:4adbea226bef0c619b33fa257113e36269a475b2c2049f55b8b83b4c6d507a9a \ - --hash=sha256:4cdcb565ac4d8a005833e7c389867977e19670f1bee6ee9f8811872b86225274 \ - --hash=sha256:4f04ba62482858a975d1d38cbb5ade181faae59e8ddc1499eacc9b6b6def3115 \ - --hash=sha256:5141fc9cfc98d3802d6f1c2451e6822bf1d474c9beba7cba0a6fee7643dee46f \ - --hash=sha256:53abc29fcfa4cdbf53988409f297fce76a8de6ad292115f5e48ff5e9e3606d79 \ - --hash=sha256:548b33dddedefe5cd02e4ac421b7b3b3ad5411bdbd7f5b5f792d9e7ba288d894 \ - --hash=sha256:55e2cec52e2c78d94277d4c990badd3ce97f5746d05029e63d81fb2433bc9684 \ - --hash=sha256:5629c94f65249384314831ca0a95ca5f1dce5bcd5ee79600a5cd31d4f7d0f5f6 \ - --hash=sha256:586a93993769873c389d38bd9a70c51e228e734e8f78742d959610509635b86b \ - --hash=sha256:5e1b7aec35ee0dbb3875a3f151866f3362ef30ae5e7f95a42adf8779d305bb47 \ - --hash=sha256:601d03cce6b8ec3734025c7dca9ab276df1ab649ca7b13d76ea03824724f5108 \ - --hash=sha256:61378863a5e9410fa6e816364442b9d35cccf94fa83e3f67997d0ff57d901d0e \ - --hash=sha256:617acaeb2586e87c9bd0c2e192e4f1d33caacaeb7f3e0cc75972bc38e703e099 \ - --hash=sha256:653bf91ec2d1c3b0f10157815ca58b0b572d15ce17ed0823aae08ff0df207fad \ - --hash=sha256:66ce3e84067261b2721dde6539427f4eb9286289769332ff07c859a661f87694 \ - --hash=sha256:66f695b0950a630ce5f287d6d17acd1523e0e071863596bed73a7d11b8334a28 \ - --hash=sha256:691a9c16db041a8d5c55d6414398b0fc97e33aad41ad3aef67a6f3c0661dcde1 \ - --hash=sha256:6cca251f83d3ec2988fb7355b52c4b4fd2d96159f6f040e68f51af15fab49540 \ - --hash=sha256:6ed203ff60932fe5b3a38453945bee4aa8dfb387789fd420698f607786ba42b8 \ - --hash=sha256:71eabda671e055415ecfa8859364438a575eda84e6f43a513436977d9377b532 \ - --hash=sha256:71f7ec7a1b54c1f84d6f8fd4e1110a66b3d1b936dbb17cda2927442621fc1e3d \ - --hash=sha256:738b8fc2062c3dc17f1624af4aa8763bec4172cf295b13ffa3dfad3ddbdb4e0e \ - --hash=sha256:7558c84414785d6ea54a186a3c68267eb8f33e2a0d792698bd9fa50d62150f77 \ - --hash=sha256:764e4505821c20f1a45a54e9da076e6a97e4e46947159490aea893dc6b8d77be \ - --hash=sha256:7970905d66e55f9a52d0e694d306501e8a9468aa99da73867cc1f8eba2817261 \ - --hash=sha256:7a93b046552730b843e9d8784691cf8b0b3d5430dd9d053ade33383ccb2574ff \ - --hash=sha256:7a9537e7afe2cd8851e636789124bcc26ff1d671906c5e56f6e8f293fa477ec2 \ - --hash=sha256:7b296b67bf880085daa11ee496d385b941a3bf3e3d5691db7178d21f18f56f9b \ - --hash=sha256:7e32ff7bd0fe4fdefce1d95f8f673a9b012286a7f40918ed1c08936d565aac4a \ - --hash=sha256:7f3deaca1ba34f48da053884c1255c360fb123c4a9bc3815c05a7a8093e0bda5 \ - --hash=sha256:87b3cccf71cbe4c1fe29eb007005cde2f86fda2549a5f412e27ee8579a264d27 \ - --hash=sha256:87d818e1fffc39476c7934544f54455ea04c6297fcd983598802e81c746338a0 \ - --hash=sha256:8d31f5725c874a656fa1b7c8feb20b54b01ea70b200a9ff0568672ad3fc80b85 \ - --hash=sha256:92e8df2bc6a33229c105ea90839d98576fcecc5cc86fdb1dd772ab10367b744b \ - --hash=sha256:9700430eb701f18bd995787228c2202a15d9db335e8bf9c583df7eca5487d5ce \ - --hash=sha256:a0a276738fafcfd63e6a0af944ffb8fb86448fe4cedcf574dd7df1ca13259e22 \ - --hash=sha256:a140db8866a45b1ce40d91164ff48d2722ffc3b2a39bfdb412bd770c7ea88be3 \ - --hash=sha256:a3cd9443d0a3b6f631e6352cb9d9c0a9b68d808d71250eb44e7b00265ec382f7 \ - --hash=sha256:a4f6b05598d0d29e8851b7668786b7cf105c98887c7ca36dac94c61321d16cb1 \ - --hash=sha256:a550b3963960012ff3266bdb3079abf4cc3f6363201e63a649d5d3cd44fe52cd \ - --hash=sha256:b1fc79cd8a24bc6c553cd6f708f5ca08c4182914bdcc87192e1e468e9858add3 \ - --hash=sha256:b2735d128a3732e528229fc24295530caa75e79d5ea7fb0f8690ef3114d9b262 \ - --hash=sha256:b4edcb1c9e52805a7619d68f8f673544a3df09425e2426bcdc30d17a2bb152e0 \ - --hash=sha256:b6e71cff84184aa6071fdcc45e288e0f45d663a4cf5608fb9091b68c34bfd959 \ - --hash=sha256:b7db3135ee5c1e9bbfd4d11cb2e3f2b4c26c37cb1f7b7d52407dbe94dddaec7e \ - --hash=sha256:b94f1185f64d1fd2fa99ffc0b8264ee5980a862010daf1edf430412044f2aa53 \ - --hash=sha256:bcf40ae13cf31727b84f00b1a505f1d4d10199bfea946c3554ef327702d2acca \ - --hash=sha256:c3955fc653dc78a93ecbd880bc97a0ef8010a9a748e6307f11ad005d45390ce5 \ - --hash=sha256:c3aae364b97bed00db4549784ab5ba769a7b88d0ceea87adb833501624fe16ed \ - --hash=sha256:cc9da3c0d8208b53c28658340827505af437bff7a52a55fdaa262ccd4c5a5d87 \ - --hash=sha256:cd347022f67f7fbbd6939181ab076cd17a1d856e09a160eb87e245e692cc5742 \ - --hash=sha256:cd8043ac6d81b3f3f0dff22247866292c819e0d5e54a5a3ad2223f86f88dbd97 \ - --hash=sha256:cddf08ed611c2ad1c791d4133dba2c63db4d294b2111e1db687537943cac25ae \ - --hash=sha256:ce2f65e81429fcb145105a10c71bf2c71ac5cc9c8fc6c79ac3c13b9de091b2ef \ - --hash=sha256:ce2fd8f8bc0026c0fc137cf5cce9de546ff9e0b4008be3eb21b5a06249eafec1 \ - --hash=sha256:cf419a23bbeafed0fc8efb4ca5b3e0a8ea4ef4866de41c3393f888bfd5f60e15 \ - --hash=sha256:d030ce5d3cca0f2f55509035bcd33d39494c50dabb9d53dc0419ad212eb0fd7f \ - --hash=sha256:d0d847fb9b46b5c208f3b8d5ca6082a4ac819ec2ffe36de3548c489e8fa551bd \ - --hash=sha256:d365e0c916bd9a4b0b7f67f3305c6704c4ff44ff9da836faf455b8b5dce0399f \ - --hash=sha256:d45f93f362d39f63ba14bbd9e4e1dd89fbed4de9bbef6bb428a379bd86571da2 \ - --hash=sha256:d8abfd2ed04af7df7b586621b11449a061b4b899f8b073e972b7282c89ae8335 \ - --hash=sha256:d9aa5fccd372580d455ab769a60326c789c46027d3d58ff2a895dbc492200b0d \ - --hash=sha256:de996e58b77d3e6eeee1a209ce93f424a5f021aa8b2879df6d35eda601acc831 \ - --hash=sha256:dfd27f383ecf1559cc55b6ec39c850744abee56c0549b15149e20a8aa6b881f3 \ - --hash=sha256:e22cf24db33a123c8e47a86fe766c770c83dedc6d1196c1172cbba0a0959cac0 \ - --hash=sha256:e698d0ffccf167ece87c864667ab69724685af9e171fc51e57038c9711fd4e0a \ - --hash=sha256:e9f5e23998625f6dc005a3a30238b4006424e366cb2966ec465e0287ae2534f0 \ - --hash=sha256:e9ff97bf48606e5d817a01fdd4a4a8855b91382e384f524a960149da00adab5a \ - --hash=sha256:ea207557393ead4084beb08f0e9c0c944ac2050678714b65ba979fae90cf782e \ - --hash=sha256:ed6821646e37f49683b3e977f856421c08eb9d03418423ac1477e09d2fb5cf62 \ - --hash=sha256:ee8dbeb24fa796f091658d5692c0e00f0d524db25e1f7a816933e80b6cd3883c \ - --hash=sha256:eee4a1df744434e10a0d0a679c074e3128b58328b83c99144e363db320e801f4 \ - --hash=sha256:f0cb9661bc0883e9278bc2436514298ace83121d14296cc672b2c44d37441cd0 \ - --hash=sha256:f2e91fef913d654f643ba7e4f92347002aff0debeb84cccaf474912756b43a9c \ - --hash=sha256:f63557d6e9fe10cb25c1d3e73dbf7cd18c1b1620349b6be6b51ea25fcadf3a1e \ - --hash=sha256:f85fddf2e5c4f7a30ebdc2b26ec585b9d814d807bcf285d248ae451ffee16a03 \ - --hash=sha256:f974aa1097b0b8245d8f29550eaac3b431c891ba7c76cc4beaa6ec7bf8cd27b6 \ - --hash=sha256:f9f9f6835ab3163818156022c627eda60c38c874b369642b249b483384021743 \ - --hash=sha256:fa1a1c9a72ef9757176c069f7bd8014b7f4abf5f9930ec62b883dc864ba28092 - # via - # langchain-core - # langsmith -websockets==16.1.1 \ - --hash=sha256:01fbdcbac298efe19360b94bc0039c8f746f0220ba570f327577bfee81059175 \ - --hash=sha256:024193f8551a2b0eafbdd160911012c4e6c228c28430c84433253299a9e42d6a \ - --hash=sha256:04fd29a0e2fe9414a95b00e92c67ae51bf900c50c0f8a4b2dafdad621f49ea1d \ - --hash=sha256:056ae37939ed7e9974f364f5864e76e49182622d8f9751ac1903c0d09b013985 \ - --hash=sha256:0f62863e8a00a6d33c3d6566ec0b89f23787b747ffe0c3bc71ec0e76b82c94b1 \ - --hash=sha256:0ffd3031ea8bda8d61762e84220186105ba3b748b3c8da2ae4f7816fac03e573 \ - --hash=sha256:1214e673c404684b9bf7154f5cf43b45025b1a6160fac3a9e438e9c1a97e22cb \ - --hash=sha256:125f22dbefaf1554fea66fc83851490edb284ce4f501d37ffed2752f418332d9 \ - --hash=sha256:130937b167a52af203c8d58e78d67705874e82759862e3b9671a452fec4abc87 \ - --hash=sha256:1427fb4cf0d72f66333e2cacc3ff5f575bf2d7008166ce991a4a470b21d51a22 \ - --hash=sha256:195c978b065fa40910582464f99d6b15c8b314c68e0546549a55ed83f4735328 \ - --hash=sha256:1d27fa8462ad6a1cb36206a3d0640b2333340def181fae11ed7f9adeaa5c0747 \ - --hash=sha256:1db4de4a0e95673f7545d393c49eeb0c2f18ac1ef93073218c79d5cdb2ee75ab \ - --hash=sha256:1f79c89b5eb034d1722938a891916582f8f7f503f58ca22518a63c3f2cd18499 \ - --hash=sha256:23253dd5bcae3f9aaee0a1d30967a8dbd52e5d3cff93a2e5b84df57b77d4750d \ - --hash=sha256:249116b4a76063d930a46391ad56e135c286e4562a18309029fc2c73f4ed4c62 \ - --hash=sha256:29dfa8114c4a620c69591c5973860f768eac29d3fd6904f37f34266cb219c512 \ - --hash=sha256:2a606d9c24035242a3e256e9d5b77ed9cd6bccfcb7cf993e5ca3c0f6f68fb6a7 \ - --hash=sha256:2a636ff1e7a5c4edf71ef0e79adae7f25dba93b4fcbe3dc958733477ffeb0eaf \ - --hash=sha256:2bb5d041a8307d2e18782e7ce777f6fdb1e8c2f5d09291484b18c294b789d9aa \ - --hash=sha256:2e28e602bb13da44fbe518c1781a88e3b9d4c3d48d02c9bad83e546164336f57 \ - --hash=sha256:30bbe120437b5648a77d3519b7024ea09530e0b5b18d3698c5a0ae536fe0cc2e \ - --hash=sha256:34420aaa64440ebd51ac72ca8a45ef4626429438c9b02e633ae412ed43f925d3 \ - --hash=sha256:38565aca3e01ea8734e578fb2118dade0ecb0250533f29e22b8d1a7a196cf4d0 \ - --hash=sha256:387e8e4aa5df2f90b198fa3cad3478822a89cf905b6a6d6c97dc3664689640cc \ - --hash=sha256:39f2a024af5c345ffe8fcf1ee18c049c024c94df393bb09b044a6917c77bde43 \ - --hash=sha256:3df13f73af9b3b38ab1195eb299ecb67a4330c911c97ae04043ff74085728abe \ - --hash=sha256:414e596c75f74e0994084694189d7dc9229fb278e33064d6784b73ffbba3ca31 \ - --hash=sha256:41c8e77f17294c0ac18008a7309b99b34ee72247ef10b6dff4c3f8b5ac29896b \ - --hash=sha256:42290eb6db4ccaca7012656738214f8514082fb6fa40cdeb61bb9a471b52e383 \ - --hash=sha256:42f599f4d48c7e1a3338fdaac3acd075be3b3cf02d4b274f3bf2767aedd3d217 \ - --hash=sha256:43e3a9fdd7cbf7ba6040c31fae0faf84ca1474fef777c4e37912f1540f854499 \ - --hash=sha256:443aefe96b7fdb132e2a70806cca1f2af49bb3f28e47abcd7c2e9dcf4d8fa1b8 \ - --hash=sha256:46dcaa042cd1de6c59e7d9269fa63ff7572b6df40510600b678f0826b3c7af51 \ - --hash=sha256:496af849a472b531f758dbd4d61338f5000538cb1a7b3d20d9d32a264517f509 \ - --hash=sha256:49ae99bdfcae803a885c926bf14f886196e84925395bb3f568fef5c0f0979d7d \ - --hash=sha256:4b57693728576d84ede0a77987ab16881b783d2cd9f1dc180a8fbbc3f79c4428 \ - --hash=sha256:4e3b680b1e0a27457e727a0d572fd81dffa87b6dbf8b228ab57da64f7d85aead \ - --hash=sha256:4e8d01cc3bcae7bbf8167f944aeafefed590fae5693552bba9794a9df68371cc \ - --hash=sha256:5283810d2646741a0d8da2aa733d6aefa0545809afccb2a5d105a26bc45125f1 \ - --hash=sha256:53260c8930da5771cec89439bff99c20c8cb03ddb9588b980697355a83cd4bd3 \ - --hash=sha256:536676848fc5961aca9d20389951f59169508f765637a172403dc5434d722fa0 \ - --hash=sha256:54509b8e92fee4453e152b7558ddef37ce9705a044922f2095a6105e3f80c96f \ - --hash=sha256:56cd5fc4f10a9ea8aa0804bddb7b42506cf9e136046f3b4c27de8fec9e2ecba5 \ - --hash=sha256:5bfd1ac19b1b9986a9c95a82d5e23a391ebb09e12c34d7be6094b86efcc35731 \ - --hash=sha256:5c31aa7e39ee3e8a358573257f1c0bb5c52430d1b637030dd9c8cc2c282926be \ - --hash=sha256:5e3b7d601f6f84156b08cc4a5e541c2b50ad7b36cfc302b657a12477c904a5df \ - --hash=sha256:61922544a0587a13fd3f53e4c0e5e606510c7b0d9d22c8444e5fae22a06b38cb \ - --hash=sha256:6456ff333092d509127d75a638cb411afae8ff17f092635015d1902efec8a293 \ - --hash=sha256:69159730a823dde3ea8d08783e8d47ef135a6d7e8d44eb127e32b321c9db8e3e \ - --hash=sha256:69e52d175a0a7d1e13b4b67ad41c560b7d98e8c6f6126eb0bda496c784faf8c7 \ - --hash=sha256:6aaface73b9c71974c6497366d8b9628357f6c9749e09c4ea3610176c63f2ae3 \ - --hash=sha256:6abbd3e82c731c8e531714466acd5d87b5e88ac3243465337ba71d68e23ae7e3 \ - --hash=sha256:6ff9417c0ada4d0f7d212f928303e5579bdf3ace4c802fa4afabb30995da58c3 \ - --hash=sha256:7421fad442de870a8cbf2287d1cad7e706ece0dbfeba5e911df132cbdc1cb56a \ - --hash=sha256:7883388947767080f094950b342b30d35a2a06b849cd967c422fa0db72b40ea9 \ - --hash=sha256:79eace538c6a97e96d0d03d4f9d314f9677f5ed85a8a984992ffd90b13cb8a56 \ - --hash=sha256:7b1b19636af86a3c7995d4d028dbe376f39b4bf31541146f9c123582a6c94562 \ - --hash=sha256:7dfcad78ea1492ee3a9ec765cb7f51bbc17d477107aaf6b22abf7b2558d1c5a0 \ - --hash=sha256:8087e82f842609734c9b5a1330464f8e94e346ba0e18c832c08bafa4b0d63c15 \ - --hash=sha256:820fb8450edddae3812fd58cbc08e2bf22812cb248ecb5f06dbb82119a56e869 \ - --hash=sha256:8483c2096363120eea8b07c06ae7304d520f686665fffd4811fad423930a65d7 \ - --hash=sha256:84a2cef8deffbd9ab8ee0ea546a2a6a7030c28f44e6cdd4547dbfeb489eb8999 \ - --hash=sha256:86d7f0f8bdb25d2c632b72527325e4776430fd5bc61b9118de4e2b8ddb5f5b01 \ - --hash=sha256:8fe0b50da2d84535fb4f7b4bfa951280f97ce3d558a0443b541166d609e67b57 \ - --hash=sha256:90001d893bc368e302ef168d82130b4e4fdd27b85fa094682df9b667c2d48838 \ - --hash=sha256:9246a0d063cfcbcc85f2359dd6876d681213f4790832272aa16641b4ed5d64d4 \ - --hash=sha256:92b820d345f7a3fc7b8163949ee92df910f290c3fc517b3d5301c78065adafe1 \ - --hash=sha256:952303a7318d4cbe1011400839bb2051c9f84fa0a35923267f5daba34b15d458 \ - --hash=sha256:97fd3a0e8b53efa41970ac1dff3d8cf0d2884cadeb4caaf95db7ad1526926ee3 \ - --hash=sha256:9c1c5705e314449e3308872fe084b8571ce078ee4fc55a98a769bdefe5917392 \ - --hash=sha256:9c9f23004a3d40e89c01a7955d186a6cc83418d93b749701944ce2de3e95a1f3 \ - --hash=sha256:9f63bcef7f4b02b06b35fc01c93b96c43b5e88e1e8868676caacf493d5a31f3a \ - --hash=sha256:a0eadbbf2c30f01efa58e1f110eb6fa293261f6b0b1aa38f7f48707107690af9 \ - --hash=sha256:a28fcbc9b6baf54a2e23f8655f308e4ccc6afdd7266f8fe7954f320dcda0f785 \ - --hash=sha256:a6a61aff018180c9c50b7b0da33bfd29d378af3497429c95006c589a23a11648 \ - --hash=sha256:aabe464bfd13bd25f4821faf111da6fefdc389f870265a53105580e45b0a2e49 \ - --hash=sha256:ab59169ace05dcb49a1d4118f0bde139557adf45091bd85747e36bf5de984dd1 \ - --hash=sha256:b436f6ec4fc3a6b4237c84d3f83170ed2b40bb584222f0ac47a0c8a5921980c7 \ - --hash=sha256:b6b9dadbef0cccd9f4c4ee96b08898afa73e26803bbe0f6aeb5bb12b0074206d \ - --hash=sha256:b852788aa51764e2d8e4cf5493d559326bcae5e38d16ba25ffa322b034df272a \ - --hash=sha256:bae954c382e013d5ea5b190d2830526bfa45ad121c326da0049b8c769f185db6 \ - --hash=sha256:bcce07e23e5769375158f5efdcdafa8d5cd014b93c6683865b840ed65b96f231 \ - --hash=sha256:cc97814dfb786a83b6e2dc2e79351e1b83e6d715647d6887fcabd83026417a00 \ - --hash=sha256:cd2ca96a082a36964aca83e992f72abeb61b7306c1a6cba4c7d06a7b93750cac \ - --hash=sha256:cfb70b4eb56cac4da0a83588f3ad50d46beb0690391082f3d4e2d488c70b68ea \ - --hash=sha256:d0fcf657e9f13ff4b177960ab2200237b12994232dfb6df16f1cfe1d4339f93c \ - --hash=sha256:d14bfb217eb4701e850f1525c9d29d79c44794cdf1c299ead25f39f8c78dea81 \ - --hash=sha256:d57685547e0060cc6fd90ee6a28405d6bd395e525545f13c8d7cd99c78afd79f \ - --hash=sha256:d6bec75c290fe484a8ba4cacdf838501e17c06ecfbbf31eede81a9e431bd7751 \ - --hash=sha256:d9531d9cbeac99af6f038fb1bc351403531f7d634a2c2e10e2f7c854c6ed5b68 \ - --hash=sha256:da4ca1a9d72f9030b3146b8d7022719a9f3d478f61efe6f7dd51d243f61c51b2 \ - --hash=sha256:dab9eb87869da2d6ed3af3f3adf28414baae6ec9d4df355ffc18889132f3436c \ - --hash=sha256:db234eda965dcce15df96bb9709f587cd87d4d52aaf0e80e2f34ec04c7670c57 \ - --hash=sha256:dc0fad4933f427acd5b1cec210f3ea6dce7089e1724e4b9ec6ef47c6c04d1b3b \ - --hash=sha256:dc385593a42e31cd6fb60c19f0ecb015b386603818fc2c6c274fb42bd2bb4165 \ - --hash=sha256:dcc04fedf83effaeb9cce98abc9469bb1b42ef85f03e01c8c1f4438ef7555737 \ - --hash=sha256:e047dc87ef7ca50f4d309bf775ad4a71711c58556d75d7bd0604b2317f43e94b \ - --hash=sha256:e09f753a169951eb4f28c2c774f71069304f66e7277e0f5a2892423599cfa854 \ - --hash=sha256:ed5bb271084b46530ee2ddc0410537a9961152c5ccba2fc98c5276d992ccba87 \ - --hash=sha256:f0aa4aad3b1b69ad3fd85a0fd0952ec64331c762bd77ec51cc814170873890b2 \ - --hash=sha256:f17dbe07eb3ea7f99e4df9b7e0efefe80fbf30d37a8cc4d561a0aed310bc8847 \ - --hash=sha256:f2769a0344a09e9ccf5b3cce538bc75a51b53eff3275d3896310c8552049195d \ - --hash=sha256:f55f0b01956a094c8587146d9558c91937e78789c333860ffaf35931a6e5dbc4 \ - --hash=sha256:f5d497865f05bb222cab7016c6034542e84e5f29f49c6fd3f4939cda7197b5b8 \ - --hash=sha256:f70541f3104339f59f830522d94ebadb1bf47426287381623443d8bb1cdbf33d \ - --hash=sha256:fb9a0a6dc3d1b3986cb88091b6899f0396651e0f74e2c9766ab8d6ffc3842e29 \ - --hash=sha256:fce6c48559c86d1ac3632ccb1bebc7d5442fbe79bd9bb0e40379ee54be2a4051 \ - --hash=sha256:fd46fff7eb62c24804d234f0051c7a8ea81285ad63e0337d3dcf33ca82aee58a - # via - # langgraph-sdk - # langsmith xxhash==4.0.1 \ --hash=sha256:0163b5d259de23ae9e07b7eabf435ce4704f6f205589a2b154e6af4be985ce1b \ --hash=sha256:03600a8987849b2bef7be795a60a6052b635c63fa98b718b08ca5ee823691cfc \ @@ -3971,10 +3174,7 @@ xxhash==4.0.1 \ --hash=sha256:fc737c05ca2d48e5dcdbbb249314df3fc6c2a0be6da8b0aa28e13d72afaad7cd \ --hash=sha256:ff48915bf1871a1f19f74c11834c6329443d306cedc0c05fe7fe617810422a80 \ --hash=sha256:ffa44b4c7c5d0ffa31356b4428659516c0e47647825c74079a296b3857b6d99d - # via - # datasets - # langgraph - # langsmith + # via datasets yarl==1.25.1 \ --hash=sha256:0136d640dfa9b0523853e411430a99f8a91eca85774c6420285a33b755bc6de3 \ --hash=sha256:03dd38de09bc213e9a8b29761eec33ee1d5318dac0e49d8af36e4d27830e23a7 \ @@ -4119,104 +3319,3 @@ zipp==4.1.1 \ --hash=sha256:7ebb7a44c021b29fd8dbd7cce6812d0d7b5b454521f93cc71af6ccd155aaa70b \ --hash=sha256:8979f52d874162f485ff2981e3891f3a3317b7a3dd43ff1e1775b9304f307a9c # via importlib-metadata -zstandard==0.25.0 \ - --hash=sha256:011d388c76b11a0c165374ce660ce2c8efa8e5d87f34996aa80f9c0816698b64 \ - --hash=sha256:01582723b3ccd6939ab7b3a78622c573799d5d8737b534b86d0e06ac18dbde4a \ - --hash=sha256:05353cef599a7b0b98baca9b068dd36810c3ef0f42bf282583f438caf6ddcee3 \ - --hash=sha256:05df5136bc5a011f33cd25bc9f506e7426c0c9b3f9954f056831ce68f3b6689f \ - --hash=sha256:06acb75eebeedb77b69048031282737717a63e71e4ae3f77cc0c3b9508320df6 \ - --hash=sha256:07b527a69c1e1c8b5ab1ab14e2afe0675614a09182213f21a0717b62027b5936 \ - --hash=sha256:0bbc9a0c65ce0eea3c34a691e3c4b6889f5f3909ba4822ab385fab9057099431 \ - --hash=sha256:0be7622c37c183406f3dbf0cba104118eb16a4ea7359eeb5752f0794882fc250 \ - --hash=sha256:106281ae350e494f4ac8a80470e66d1fe27e497052c8d9c3b95dc4cf1ade81aa \ - --hash=sha256:10ef2a79ab8e2974e2075fb984e5b9806c64134810fac21576f0668e7ea19f8f \ - --hash=sha256:1673b7199bbe763365b81a4f3252b8e80f44c9e323fc42940dc8843bfeaf9851 \ - --hash=sha256:172de1f06947577d3a3005416977cce6168f2261284c02080e7ad0185faeced3 \ - --hash=sha256:181eb40e0b6a29b3cd2849f825e0fa34397f649170673d385f3598ae17cca2e9 \ - --hash=sha256:1869da9571d5e94a85a5e8d57e4e8807b175c9e4a6294e3b66fa4efb074d90f6 \ - --hash=sha256:19796b39075201d51d5f5f790bf849221e58b48a39a5fc74837675d8bafc7362 \ - --hash=sha256:1cd5da4d8e8ee0e88be976c294db744773459d51bb32f707a0f166e5ad5c8649 \ - --hash=sha256:1f3689581a72eaba9131b1d9bdbfe520ccd169999219b41000ede2fca5c1bfdb \ - --hash=sha256:1f830a0dac88719af0ae43b8b2d6aef487d437036468ef3c2ea59c51f9d55fd5 \ - --hash=sha256:223415140608d0f0da010499eaa8ccdb9af210a543fac54bce15babbcfc78439 \ - --hash=sha256:22a06c5df3751bb7dc67406f5374734ccee8ed37fc5981bf1ad7041831fa1137 \ - --hash=sha256:22a086cff1b6ceca18a8dd6096ec631e430e93a8e70a9ca5efa7561a00f826fa \ - --hash=sha256:23ebc8f17a03133b4426bcc04aabd68f8236eb78c3760f12783385171b0fd8bd \ - --hash=sha256:25f8f3cd45087d089aef5ba3848cd9efe3ad41163d3400862fb42f81a3a46701 \ - --hash=sha256:2b6bd67528ee8b5c5f10255735abc21aa106931f0dbaf297c7be0c886353c3d0 \ - --hash=sha256:2e54296a283f3ab5a26fc9b8b5d4978ea0532f37b231644f367aa588930aa043 \ - --hash=sha256:3756b3e9da9b83da1796f8809dd57cb024f838b9eeafde28f3cb472012797ac1 \ - --hash=sha256:37daddd452c0ffb65da00620afb8e17abd4adaae6ce6310702841760c2c26860 \ - --hash=sha256:3a39c94ad7866160a4a46d772e43311a743c316942037671beb264e395bdd611 \ - --hash=sha256:3b870ce5a02d4b22286cf4944c628e0f0881b11b3f14667c1d62185a99e04f53 \ - --hash=sha256:3c83b0188c852a47cd13ef3bf9209fb0a77fa5374958b8c53aaa699398c6bd7b \ - --hash=sha256:4203ce3b31aec23012d3a4cf4a2ed64d12fea5269c49aed5e4c3611b938e4088 \ - --hash=sha256:457ed498fc58cdc12fc48f7950e02740d4f7ae9493dd4ab2168a47c93c31298e \ - --hash=sha256:474d2596a2dbc241a556e965fb76002c1ce655445e4e3bf38e5477d413165ffa \ - --hash=sha256:4b14abacf83dfb5c25eb4e4a79520de9e7e205f72c9ee7702f91233ae57d33a2 \ - --hash=sha256:4b6d83057e713ff235a12e73916b6d356e3084fd3d14ced499d84240f3eecee0 \ - --hash=sha256:4d441506e9b372386a5271c64125f72d5df6d2a8e8a2a45a0ae09b03cb781ef7 \ - --hash=sha256:4f187a0bb61b35119d1926aee039524d1f93aaf38a9916b8c4b78ac8514a0aaf \ - --hash=sha256:51526324f1b23229001eb3735bc8c94f9c578b1bd9e867a0a646a3b17109f388 \ - --hash=sha256:53e08b2445a6bc241261fea89d065536f00a581f02535f8122eba42db9375530 \ - --hash=sha256:53f94448fe5b10ee75d246497168e5825135d54325458c4bfffbaafabcc0a577 \ - --hash=sha256:5a56ba0db2d244117ed744dfa8f6f5b366e14148e00de44723413b2f3938a902 \ - --hash=sha256:5f1ad7bf88535edcf30038f6919abe087f606f62c00a87d7e33e7fc57cb69fcc \ - --hash=sha256:5f5e4c2a23ca271c218ac025bd7d635597048b366d6f31f420aaeb715239fc98 \ - --hash=sha256:6a573a35693e03cf1d67799fd01b50ff578515a8aeadd4595d2a7fa9f3ec002a \ - --hash=sha256:6c0e5a65158a7946e7a7affa6418878ef97ab66636f13353b8502d7ea03c8097 \ - --hash=sha256:6dffecc361d079bb48d7caef5d673c88c8988d3d33fb74ab95b7ee6da42652ea \ - --hash=sha256:7030defa83eef3e51ff26f0b7bfb229f0204b66fe18e04359ce3474ac33cbc09 \ - --hash=sha256:7149623bba7fdf7e7f24312953bcf73cae103db8cae49f8154dd1eadc8a29ecb \ - --hash=sha256:72d35d7aa0bba323965da807a462b0966c91608ef3a48ba761678cb20ce5d8b7 \ - --hash=sha256:75ffc32a569fb049499e63ce68c743155477610532da1eb38e7f24bf7cd29e74 \ - --hash=sha256:7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b \ - --hash=sha256:78228d8a6a1c177a96b94f7e2e8d012c55f9c760761980da16ae7546a15a8e9b \ - --hash=sha256:7b3c3a3ab9daa3eed242d6ecceead93aebbb8f5f84318d82cee643e019c4b73b \ - --hash=sha256:809c5bcb2c67cd0ed81e9229d227d4ca28f82d0f778fc5fea624a9def3963f91 \ - --hash=sha256:81dad8d145d8fd981b2962b686b2241d3a1ea07733e76a2f15435dfb7fb60150 \ - --hash=sha256:85304a43f4d513f5464ceb938aa02c1e78c2943b29f44a750b48b25ac999a049 \ - --hash=sha256:89c4b48479a43f820b749df49cd7ba2dbc2b1b78560ecb5ab52985574fd40b27 \ - --hash=sha256:8e735494da3db08694d26480f1493ad2cf86e99bdd53e8e9771b2752a5c0246a \ - --hash=sha256:913cbd31a400febff93b564a23e17c3ed2d56c064006f54efec210d586171c00 \ - --hash=sha256:9174f4ed06f790a6869b41cba05b43eeb9a35f8993c4422ab853b705e8112bbd \ - --hash=sha256:9300d02ea7c6506f00e627e287e0492a5eb0371ec1670ae852fefffa6164b072 \ - --hash=sha256:933b65d7680ea337180733cf9e87293cc5500cc0eb3fc8769f4d3c88d724ec5c \ - --hash=sha256:9654dbc012d8b06fc3d19cc825af3f7bf8ae242226df5f83936cb39f5fdc846c \ - --hash=sha256:98750a309eb2f020da61e727de7d7ba3c57c97cf6213f6f6277bb7fb42a8e065 \ - --hash=sha256:99c0c846e6e61718715a3c9437ccc625de26593fea60189567f0118dc9db7512 \ - --hash=sha256:a1a4ae2dec3993a32247995bdfe367fc3266da832d82f8438c8570f989753de1 \ - --hash=sha256:a3f79487c687b1fc69f19e487cd949bf3aae653d181dfb5fde3bf6d18894706f \ - --hash=sha256:a4089a10e598eae6393756b036e0f419e8c1d60f44a831520f9af41c14216cf2 \ - --hash=sha256:a51ff14f8017338e2f2e5dab738ce1ec3b5a851f23b18c1ae1359b1eecbee6df \ - --hash=sha256:a5a419712cf88862a45a23def0ae063686db3d324cec7edbe40509d1a79a0aab \ - --hash=sha256:a9ec8c642d1ec73287ae3e726792dd86c96f5681eb8df274a757bf62b750eae7 \ - --hash=sha256:aaf21ba8fb76d102b696781bddaa0954b782536446083ae3fdaa6f16b25a1c4b \ - --hash=sha256:ab85470ab54c2cb96e176f40342d9ed41e58ca5733be6a893b730e7af9c40550 \ - --hash=sha256:b9af1fe743828123e12b41dd8091eca1074d0c1569cc42e6e1eee98027f2bbd0 \ - --hash=sha256:bfc4e20784722098822e3eee42b8e576b379ed72cca4a7cb856ae733e62192ea \ - --hash=sha256:bfd06b1c5584b657a2892a6014c2f4c20e0db0208c159148fa78c65f7e0b0277 \ - --hash=sha256:c19bcdd826e95671065f8692b5a4aa95c52dc7a02a4c5a0cac46deb879a017a2 \ - --hash=sha256:c2ba942c94e0691467ab901fc51b6f2085ff48f2eea77b1a48240f011e8247c7 \ - --hash=sha256:c8e167d5adf59476fa3e37bee730890e389410c354771a62e3c076c86f9f7778 \ - --hash=sha256:ca54090275939dc8ec5dea2d2afb400e0f83444b2fc24e07df7fdef677110859 \ - --hash=sha256:d7541afd73985c630bafcd6338d2518ae96060075f9463d7dc14cfb33514383d \ - --hash=sha256:d8c56bb4e6c795fc77d74d8e8b80846e1fb8292fc0b5060cd8131d522974b751 \ - --hash=sha256:da469dc041701583e34de852d8634703550348d5822e66a0c827d39b05365b12 \ - --hash=sha256:daab68faadb847063d0c56f361a289c4f268706b598afbf9ad113cbe5c38b6b2 \ - --hash=sha256:e05ab82ea7753354bb054b92e2f288afb750e6b439ff6ca78af52939ebbc476d \ - --hash=sha256:e09bb6252b6476d8d56100e8147b803befa9a12cea144bbe629dd508800d1ad0 \ - --hash=sha256:e29f0cf06974c899b2c188ef7f783607dbef36da4c242eb6c82dcd8b512855e3 \ - --hash=sha256:e59fdc271772f6686e01e1b3b74537259800f57e24280be3f29c8a0deb1904dd \ - --hash=sha256:e7360eae90809efd19b886e59a09dad07da4ca9ba096752e61a2e03c8aca188e \ - --hash=sha256:e96594a5537722fdfb79951672a2a63aec5ebfb823e7560586f7484819f2a08f \ - --hash=sha256:ea9d54cc3d8064260114a0bbf3479fc4a98b21dffc89b3459edd506b69262f6e \ - --hash=sha256:ec996f12524f88e151c339688c3897194821d7f03081ab35d31d1e12ec975e94 \ - --hash=sha256:f27662e4f7dbf9f9c12391cb37b4c4c3cb90ffbd3b1fb9284dadbbb8935fa708 \ - --hash=sha256:f373da2c1757bb7f1acaf09369cdc1d51d84131e50d5fa9863982fd626466313 \ - --hash=sha256:f5aeea11ded7320a84dcdd62a3d95b5186834224a9e55b92ccae35d21a8b63d4 \ - --hash=sha256:f604efd28f239cc21b3adb53eb061e2a205dc164be408e553b41ba2ffe0ca15c \ - --hash=sha256:f67e8f1a324a900e75b5e28ffb152bcac9fbed1cc7b43f99cd90f395c4375344 \ - --hash=sha256:fd7a5004eb1980d3cefe26b2685bcb0b17989901a70a1040d1ac86f1d898c551 \ - --hash=sha256:ffef5a74088f1e09947aecf91011136665152e0b4b359c42be3373897fb39b01 - # via langsmith diff --git a/dokimi/requirements.txt b/dokimi/requirements.txt index 1fbabe70d..e22e2b2df 100644 --- a/dokimi/requirements.txt +++ b/dokimi/requirements.txt @@ -1,13 +1,10 @@ # Copyright (C) 2026 Intel Corporation # SPDX-License-Identifier: Apache-2.0 -ragas>=0.3.0,<0.4 -# Every ragas release imports langchain_community.chat_models.vertexai, which 0.4.2 removed. -langchain-community<0.4.2 -# eval ragas wraps the judge in ChatOpenAI or ChatAnthropic, typed as langchain-core's BaseChatModel. -langchain-anthropic>=1.0,<2 -langchain-openai>=1.0,<2 -langchain-core>=1.0,<2 +# This file was autogenerated by uv via the following command: +# uv pip compile requirements.txt requirements-test.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=gitpython=false --exclude-newer-package=certifi=false --exclude-newer-package=pillow=false --generate-hashes --output-file=requirements.lock.txt +# The ragas extra is optional; see pyproject.toml [project.optional-dependencies]. + datasets>=2.20,<6 openai>=1.51,<3 PyYAML>=6.0.1,<7 From 806051da22739f2b62eebf98769329c658990241 Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Mon, 26 Oct 2026 23:49:27 -0700 Subject: [PATCH 02/10] test(deps): declare markdown-it-py for the docs hook tests tests/test_docs_hooks.py imports markdown_it. It reached the lock only through ragas -> rich, so with ragas out of the lock the module's tests would silently skip. Signed-off-by: Alexander Rybkin --- dokimi/requirements-test.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dokimi/requirements-test.txt b/dokimi/requirements-test.txt index 7079f1a1d..ae449e15d 100644 --- a/dokimi/requirements-test.txt +++ b/dokimi/requirements-test.txt @@ -16,3 +16,5 @@ httpx>=0.27.0 numpy>=1.24.0 scipy>=1.11.0 litellm>=1.105.0 +# tests/test_docs_hooks.py imports it; it was only in the lock via ragas -> rich, so its tests would skip. +markdown-it-py>=3 From c4a762051959dd41472352cd094b1efd44d334bd Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Mon, 26 Oct 2026 23:53:17 -0700 Subject: [PATCH 03/10] build(deps): regenerate the locks without ragas Each lock is compiled with the command its header records. The main lock loses ragas, langchain-* and everything only they pulled in (diskcache, gitpython, pillow, instructor, rich, ...); markdown-it-py stays, now from requirements-test.txt. The tools and docs locks keep their headers; the tools lock changes only in its via comments, the docs lock is unchanged from main. gitpython and pillow are no longer in the main lock, so their --exclude-newer-package exemptions go too; certifi's stays. Signed-off-by: Alexander Rybkin --- dokimi/requirements-ci.lock.txt | 10 ++- dokimi/requirements-docs.lock.txt | 123 ++------------------------ dokimi/requirements.lock.txt | 14 ++- dokimi/tests/test_dependency_locks.py | 7 +- 4 files changed, 30 insertions(+), 124 deletions(-) diff --git a/dokimi/requirements-ci.lock.txt b/dokimi/requirements-ci.lock.txt index 127e86ed7..33d463711 100644 --- a/dokimi/requirements-ci.lock.txt +++ b/dokimi/requirements-ci.lock.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile requirements-ci.txt -c requirements.lock.txt --universal --python-version=3.11 --generate-hashes --output-file=requirements-ci.lock.txt +# uv pip compile requirements-ci.txt --constraint=requirements.lock.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --exclude-newer-package=uv=false --exclude-newer-package=virtualenv=false --exclude-newer-package=setuptools=false --generate-hashes --output-file=requirements-ci.lock.txt ast-serialize==0.13.0 \ --hash=sha256:017ddd4f22e727ef93e66df2d53340a6ff809b7e34cc2218f67918ae6239aad0 \ --hash=sha256:12441bc7e41e495db5634c98adc8f8886b619ce2f1e68effe3f792a2adca9f47 \ @@ -757,7 +757,9 @@ license-expression==30.4.4 \ markdown-it-py==4.2.0 \ --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a - # via rich + # via + # -c requirements.lock.txt + # rich markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -916,7 +918,9 @@ markupsafe==3.0.4 \ mdurl==0.1.2 \ --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba - # via markdown-it-py + # via + # -c requirements.lock.txt + # markdown-it-py more-itertools==11.1.0 ; platform_machine != 'ppc64le' and platform_machine != 's390x' \ --hash=sha256:48e8f4d9e7e5878571ecf6f2b4e57634f93cd474cc8cfbd2376f2d11b396e30d \ --hash=sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192 diff --git a/dokimi/requirements-docs.lock.txt b/dokimi/requirements-docs.lock.txt index 67a5ab03b..af55e90e8 100644 --- a/dokimi/requirements-docs.lock.txt +++ b/dokimi/requirements-docs.lock.txt @@ -1,9 +1,14 @@ -# This file was autogenerated by uv via the following command: -# uv pip compile requirements-docs.txt -c requirements.lock.txt --universal --python-version=3.11 --generate-hashes --output-file=requirements-docs.lock.txt +# Locked dependency closure of requirements-docs.txt (the documentation site), +# resolved for every supported Python (3.11+) and constrained to the pins in +# requirements.lock.txt, which it is installed on top of. CI installs from this file. +# Regenerate (uv keeps the pins already in the -o file; add --upgrade to take upgrades): +# uv pip compile requirements-docs.txt -c requirements.lock.txt --universal \ +# --python-version 3.11 --no-header --no-annotate --generate-hashes \ +# -o requirements-docs.lock.txt +# Install with: pip install --require-hashes -r requirements.lock.txt -r requirements-docs.lock.txt babel==2.18.0 \ --hash=sha256:b80b99a14bd085fcacfa15c9165f651fbb3406e66cc603abf11c5750937c992d \ --hash=sha256:e2b422b277c2b9a9630c1d7903c2a00d0830c409c59ac8cae9081c92f1aeba35 - # via mkdocs-material backrefs==8.1 \ --hash=sha256:11f61846e446fa8637af2f5c073f1083aa58dbb7460b019fd51689f564e44f7e \ --hash=sha256:1e857c32e91b8fe46ddb359ac21021a37b090fa4239566a61e9856123e334041 \ @@ -12,13 +17,9 @@ backrefs==8.1 \ --hash=sha256:b472c76082769f86a97ffccfd1f2599b2b706610c6154955664fffe67e909035 \ --hash=sha256:db577dbae1c61187534d35fc9bfbd0c01158fff6239a66fecf7590e5b17879a9 \ --hash=sha256:f86d9312df3ebae1241758af80809a319cafa1d8f32189edfb242c9aa55573b6 - # via mkdocs-material certifi==2026.10.19 \ --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b - # via - # -c requirements.lock.txt - # requests charset-normalizer==3.5.2 \ --hash=sha256:01077390b03f7988f11d700a2194e69b119741a86b1a638b1db88891e3eced8e \ --hash=sha256:01b0c0d2262a9e28e8484a278c7e1b5d650e3ac8cf2683d2967e25899f208bdf \ @@ -192,63 +193,30 @@ charset-normalizer==3.5.2 \ --hash=sha256:fcff63213e8e6e47770541a4607175404f47cbb3ebea7b6058cc82d524a0e424 \ --hash=sha256:fd1fbe0f116b6e55da77aca2c6ddcddcfac2186cbf78bdebf40fc156efca389d \ --hash=sha256:fe9753dfee015c570d73df76f899f18444d41388bffcde097deba51c4fadbb9f - # via - # -c requirements.lock.txt - # requests click==8.5.0 \ --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 \ --hash=sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34 - # via - # -c requirements.lock.txt - # mkdocs - # properdocs colorama==0.4.6 \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 - # via - # -c requirements.lock.txt - # mkdocs - # mkdocs-material - # properdocs ghp-import==2.1.0 \ --hash=sha256:8337dd7b50877f163d4c0289bc1f1c7f127550241988d568c1db512c4324a619 \ --hash=sha256:9c535c4c61193c2df8871222567d7fd7e5014d835f97dc7b7439069e2413d343 - # via - # mkdocs - # properdocs griffelib==2.3.2 \ --hash=sha256:8e710afededd5607f95bf3c8ccc175ee306e7084459faf27b9f9f44ef2a7a274 \ --hash=sha256:df00c7a0dee3d86268d76788997a1859272cb1fb7b865658e043d2c0c3d52e60 - # via mkdocstrings-python idna==3.20 \ --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \ --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c - # via - # -c requirements.lock.txt - # requests jinja2==3.1.6 \ --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \ --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67 - # via - # -c requirements.lock.txt - # mkdocs - # mkdocs-material - # mkdocstrings - # properdocs markdown==3.11.1 \ --hash=sha256:496f4f80f9ebd3395a04c8ec9595c40bbe8ec19e9c67d21fe071a1643e876606 \ --hash=sha256:f1fa378ba5d682900c9ecb55ccceacca936016dda7c3b27097e8ae03ff78feb5 - # via - # mkdocs - # mkdocs-autorefs - # mkdocs-material - # mkdocstrings - # properdocs - # pymdown-extensions markdown-it-py==4.2.0 \ --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a - # via -r requirements-docs.txt markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -401,116 +369,63 @@ markupsafe==3.0.4 \ --hash=sha256:fa95848c929b6a75f6848d3c9793e59db365ee436776e57db835cdbfa79ba977 \ --hash=sha256:fd9f8797427910198f95bced71ddfed61130d7e349213bfb8466c9c99e2c46a8 \ --hash=sha256:fdb4ca07ab75ffadab4a8b135ad59cdbb3156b99310f3d565370da74a15d6bd3 - # via - # -c requirements.lock.txt - # jinja2 - # mkdocs - # mkdocs-autorefs - # mkdocstrings - # properdocs mdurl==0.1.2 \ --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba - # via markdown-it-py mergedeep==1.3.4 \ --hash=sha256:0096d52e9dad9939c3d975a774666af186eda617e6ca84df4c94dec30004f2a8 \ --hash=sha256:70775750742b25c0d8f36c55aed03d24c3384d17c951b3175d898bd778ef0307 - # via - # mkdocs - # mkdocs-get-deps mkdocs==1.6.1 \ --hash=sha256:7b432f01d928c084353ab39c57282f29f92136665bdd6abf7c1ec8d822ef86f2 \ --hash=sha256:db91759624d1647f3f34aa0c3f327dd2601beae39a366d6e064c03468d35c20e - # via - # -r requirements-docs.txt - # mkdocs-autorefs - # mkdocs-gen-files - # mkdocs-literate-nav - # mkdocs-material - # mkdocstrings mkdocs-autorefs==1.4.4 \ --hash=sha256:834ef5408d827071ad1bc69e0f39704fa34c7fc05bc8e1c72b227dfdc5c76089 \ --hash=sha256:d54a284f27a7346b9c38f1f852177940c222da508e66edc816a0fa55fc6da197 - # via - # mkdocstrings - # mkdocstrings-python mkdocs-gen-files==0.6.1 \ --hash=sha256:57d7ff2229e23d077e46d14a33db6d37c8823f6ce1a503c874c1764a71679763 \ --hash=sha256:b3182bfc6219e35b8d26658cb988368659d5d023aac30c2a819247558fc12189 - # via -r requirements-docs.txt mkdocs-get-deps==0.2.2 \ --hash=sha256:8ee8d5f316cdbbb2834bc1df6e69c08fe769a83e040060de26d3c19fad3599a1 \ --hash=sha256:e7878cbeac04860b8b5e0ca31d3abad3df9411a75a32cde82f8e44b6c16ff650 - # via mkdocs mkdocs-literate-nav==0.6.3 \ --hash=sha256:2c421561280fa9184f88cbf399bebbd4cc17ee507e978a31ce11fd6f3aabf233 \ --hash=sha256:edbaca22343f861fe4e34aac47d55a0c9955c640dbf02eea99fe631e914cf9ee - # via -r requirements-docs.txt mkdocs-material==9.7.7 \ --hash=sha256:8ea9bb1737a5b524a5f9dcf2e1b4ebda8274ae3008aa7845720a97083bef708f \ --hash=sha256:c0649c065b1b0512d60aad8c10f947f8e455284475239b364b610f2deb4d0855 - # via -r requirements-docs.txt mkdocs-material-extensions==1.3.1 \ --hash=sha256:10c9511cea88f568257f960358a467d12b970e1f7b2c0e5fb2bb48cab1928443 \ --hash=sha256:adff8b62700b25cb77b53358dad940f3ef973dd6db797907c49e3c2ef3ab4e31 - # via mkdocs-material mkdocstrings==1.0.7 \ --hash=sha256:0951b147f352118a45a3db85f0f3b660833d34cb5120a2751315b8d08dafd159 \ --hash=sha256:9563828667eeb35256f87a6b61fe857676ac628ec1abbce9aea9839a502c9cb1 - # via - # -r requirements-docs.txt - # mkdocstrings-python mkdocstrings-python==2.0.9 \ --hash=sha256:ae945637dc0618c6beedbee169f10c0234b77f322c53db3fc9fb4c29b3013038 \ --hash=sha256:c0233eff3f84d78110df50541918e7ec2bcff8e1614faddea34290a90321a416 - # via mkdocstrings packaging==26.3 \ --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c - # via - # -c requirements.lock.txt - # mkdocs - # properdocs paginate==0.5.7 \ --hash=sha256:22bd083ab41e1a8b4f3690544afb2c60c25e5c9a63a30fa2f483f6c60c8e5945 \ --hash=sha256:b885e2af73abcf01d9559fd5216b57ef722f8c42affbb63942377668e35c7591 - # via mkdocs-material pathspec==1.1.1 \ --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \ --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189 - # via - # mkdocs - # properdocs platformdirs==4.13.0 \ --hash=sha256:1aa0b0d3f224c1f07c295121e312a5a24a180d6ae5a8425ea1784b3e3863e9c0 \ --hash=sha256:3dbcf4cd708f21cf876c4eaa90e58412bc4f033d87143f41b1493ff77c25b7e1 - # via - # mkdocs-get-deps - # properdocs properdocs==1.6.7 \ --hash=sha256:6fa0cfa2e01bf338f684892c8a506cf70ea88ae7f3479c933b6fa20168101cbd \ --hash=sha256:adc7b16e562890af0e098a7e5b02e3a81c20894a87d6a28d345c9300de73c26e - # via - # mkdocs-gen-files - # mkdocs-literate-nav pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \ --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c - # via - # -c requirements.lock.txt - # mkdocs-material pymdown-extensions==12.2 \ --hash=sha256:02da896c362b548d85123e7a377a40024ea6ea938b4e45ca064e408afd994b64 \ --hash=sha256:caea66e916b4cfe987b5dabb0a78558e3506988f6353812b0b0288be8f976c16 - # via - # mkdocs-material - # mkdocstrings python-dateutil==2.9.0.post0 \ --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \ --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427 - # via - # -c requirements.lock.txt - # ghp-import pyyaml==6.0.3 \ --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \ --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \ @@ -585,37 +500,18 @@ pyyaml==6.0.3 \ --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \ --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \ --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0 - # via - # -c requirements.lock.txt - # mkdocs - # mkdocs-get-deps - # properdocs - # pymdown-extensions - # pyyaml-env-tag pyyaml-env-tag==1.1 \ --hash=sha256:17109e1a528561e32f026364712fee1264bc2ea6715120891174ed1b980d2e04 \ --hash=sha256:2eb38b75a2d21ee0475d6d97ec19c63287a7e140231e4214969d0eac923cd7ff - # via - # mkdocs - # properdocs requests==2.34.2 \ --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed - # via - # -c requirements.lock.txt - # mkdocs-material six==1.17.0 \ --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \ --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81 - # via - # -c requirements.lock.txt - # python-dateutil urllib3==2.8.0 \ --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 - # via - # -c requirements.lock.txt - # requests watchdog==6.0.0 \ --hash=sha256:07df1fdd701c5d4c8e55ef6cf55b8f0120fe1aef7ef39a1c6fc6bc2e606d517a \ --hash=sha256:20ffe5b202af80ab4266dcd3e91aae72bf2da48c0d33bdb15c66658e685e94e2 \ @@ -647,6 +543,3 @@ watchdog==6.0.0 \ --hash=sha256:e6f0e77c9417e7cd62af82529b10563db3423625c5fce018430b249bf977f9e8 \ --hash=sha256:e7631a77ffb1f7d2eefa4445ebbee491c720a5661ddf6df3498ebecae5ed375c \ --hash=sha256:ef810fbf7b781a5a593894e4f439773830bdecb885e6880d957d5b9382a960d2 - # via - # mkdocs - # properdocs diff --git a/dokimi/requirements.lock.txt b/dokimi/requirements.lock.txt index d067241d9..24aa39e0b 100644 --- a/dokimi/requirements.lock.txt +++ b/dokimi/requirements.lock.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile requirements.txt requirements-test.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=gitpython=false --exclude-newer-package=certifi=false --exclude-newer-package=pillow=false --generate-hashes --output-file=requirements.lock.txt +# uv pip compile requirements.txt requirements-test.txt --universal --python-version=3.11 --exclude-newer=P7D --exclude-newer-package=certifi=false --generate-hashes --output-file=requirements.lock.txt aiohappyeyeballs==2.7.1 \ --hash=sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d \ --hash=sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472 @@ -1275,6 +1275,10 @@ litellm==1.106.0 \ # via # -r requirements-test.txt # -r requirements.txt +markdown-it-py==4.2.0 \ + --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \ + --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a + # via -r requirements-test.txt markupsafe==3.0.4 \ --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \ --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \ @@ -1428,6 +1432,10 @@ markupsafe==3.0.4 \ --hash=sha256:fd9f8797427910198f95bced71ddfed61130d7e349213bfb8466c9c99e2c46a8 \ --hash=sha256:fdb4ca07ab75ffadab4a8b135ad59cdbb3156b99310f3d565370da74a15d6bd3 # via jinja2 +mdurl==0.1.2 \ + --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \ + --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba + # via markdown-it-py multidict==6.9.1 \ --hash=sha256:006c4478de0a1876f4834e14255776286f09b9846b505fe63f67f9d173a9487c \ --hash=sha256:024123f0ab402ab33828e24eb80fa8f25167d0d3783ba5f287e39ed741e6abf9 \ @@ -2483,7 +2491,9 @@ regex==2026.9.29 \ --hash=sha256:fb99cc9d45f48895d9d67f6a0b8a57f08d39c174d9f25ad97a313e0470267b1c \ --hash=sha256:fdd88ed5e20b1bcdd234421e454962c971aa44b653bdb7f1ea9ef683e90fb649 \ --hash=sha256:fe3fa1dd453ed5c7f5ea23a26218329790ed7197a99b90e94330e313959a7f52 - # via tiktoken + # via + # -r requirements.txt + # tiktoken requests==2.34.2 \ --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed diff --git a/dokimi/tests/test_dependency_locks.py b/dokimi/tests/test_dependency_locks.py index 52b05ec78..86b171a13 100644 --- a/dokimi/tests/test_dependency_locks.py +++ b/dokimi/tests/test_dependency_locks.py @@ -187,12 +187,11 @@ def test_tools_lock_exempts_only_pins_younger_than_the_cooldown() -> None: def test_main_lock_exempts_only_security_bumps_younger_than_the_cooldown() -> None: - """gitpython 3.2.1 fixes CVE-2026-114145, certifi 2026.10.19 fixes GHSA-6q48-6c7w-9gw2, and - pillow 13.0.0 fixes the eight CVEs `pip-audit` reported on 2026-10-20. Drop each exemption once - its release is 7 days old.""" + """certifi 2026.10.19 fixes GHSA-6q48-6c7w-9gw2. Drop the exemption once its release is 7 days + old. gitpython and pillow left the lock with ragas, and their exemptions with them.""" cmd = header_command("requirements.lock.txt") exempt = {a.split("=", 1)[1] for a in cmd if a.startswith("--exclude-newer-package=")} - assert exempt == {"gitpython=false", "certifi=false", "pillow=false"}, exempt + assert exempt == {"certifi=false"}, exempt def test_the_published_package_builds_with_the_locked_backend() -> None: From 91150f14dafceaa3ec12c15aa9d77528c219d6ce Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Mon, 26 Oct 2026 23:53:56 -0700 Subject: [PATCH 04/10] test(ragas): run the ragas tests without the extra installed test_ragas_falls_back_to_the_default_judge_for_an_unsupported_provider stubbed ragas.llms and the langchain chat models but not langchain_core.language_models, so it needed the real package. The real-import guard in test_ragas_runtime skips when ragas is not installed, and fails instead when DOKIMI_REQUIRE_RAGAS=1, so the job that installs the extra cannot lose it silently. Signed-off-by: Alexander Rybkin --- dokimi/tests/test_model_defaults.py | 3 +++ dokimi/tests/test_ragas_runtime.py | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/dokimi/tests/test_model_defaults.py b/dokimi/tests/test_model_defaults.py index f41b04a5e..300644e76 100644 --- a/dokimi/tests/test_model_defaults.py +++ b/dokimi/tests/test_model_defaults.py @@ -132,9 +132,12 @@ def chat(family): openai_mod.ChatOpenAI = chat("openai") anthropic_mod = types.ModuleType("langchain_anthropic") anthropic_mod.ChatAnthropic = chat("anthropic") + core_models = types.ModuleType("langchain_core.language_models") + core_models.BaseChatModel = object monkeypatch.setitem(sys.modules, "ragas.llms", ragas_llms) monkeypatch.setitem(sys.modules, "langchain_openai", openai_mod) monkeypatch.setitem(sys.modules, "langchain_anthropic", anthropic_mod) + monkeypatch.setitem(sys.modules, "langchain_core.language_models", core_models) evaluator = RagasEvaluator.__new__(RagasEvaluator) evaluator.llm_model, evaluator.provider, evaluator.api_key = "gemini-x", "google", None diff --git a/dokimi/tests/test_ragas_runtime.py b/dokimi/tests/test_ragas_runtime.py index ba0eb4d25..717c4c5a0 100644 --- a/dokimi/tests/test_ragas_runtime.py +++ b/dokimi/tests/test_ragas_runtime.py @@ -13,6 +13,7 @@ from __future__ import annotations import argparse +import importlib.util import os import subprocess import sys @@ -36,6 +37,12 @@ def test_ragas_imports_and_evaluator_builds_from_installed_deps(): + # The lock leaves the `[ragas]` extra out; test-latest installs it and sets + # DOKIMI_REQUIRE_RAGAS=1, so there a missing ragas fails instead of skipping. + if importlib.util.find_spec("ragas") is None: + if os.environ.get("DOKIMI_REQUIRE_RAGAS") == "1": + pytest.fail("DOKIMI_REQUIRE_RAGAS=1 but ragas is not installed") + pytest.skip("the [ragas] extra is not installed") proc = subprocess.run( [sys.executable, "-c", _PROBE], cwd=REPO, From d6ed2564991fc69cbc537bd1edc277e00a260971 Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Mon, 26 Oct 2026 23:55:10 -0700 Subject: [PATCH 05/10] ci: install the ragas extra in test-latest and require the real import With ragas out of requirements.txt and the lock, the weekly test-latest job is where eval ragas runs on real packages. It installs the [ragas] extra and sets DOKIMI_REQUIRE_RAGAS=1, so test_ragas_runtime fails there instead of skipping. The job is unpinned, so this adds no manifest Dependabot reads. The 3.13 comment said scikit-network came in through ragas for every install; only the extra pulls it in now. Signed-off-by: Alexander Rybkin --- .github/workflows/ci.yml | 17 +++++++++++------ dokimi/Makefile | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2a55e95d2..e6153a776 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,11 +43,11 @@ defaults: working-directory: dokimi # Single-version jobs (here, in agent-quality.yml, docs.yml and -# stack-health.yml) and `make dev` use Python 3.13, not 3.14: scikit-network -# (pulled in by ragas) has no cp314 wheels yet, so on 3.14 every install builds -# it from source (C++ with OpenMP, unpinned build deps); the pip cache keeps the -# built wheel for the 3.14 test leg. Move them to 3.14 once scikit-network ships -# cp314 wheels. +# stack-health.yml) and `make dev` use Python 3.13, not 3.14. The reason was +# scikit-network, which has no cp314 wheels yet, so on 3.14 an install builds it +# from source (C++ with OpenMP, unpinned build deps). Only the `[ragas]` extra +# pulls it in now, not the locks: test-latest installs the extra and stays on +# 3.13 until scikit-network ships cp314 wheels; the other jobs could move. jobs: # The checks that need no dependency lock, in one job: each takes seconds, and # as separate jobs each waited for a runner of its own. Every step after the @@ -393,9 +393,14 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' + # The `[ragas]` extra is not in requirements.txt or the lock; this job is + # where `eval ragas` runs on real packages, and DOKIMI_REQUIRE_RAGAS=1 makes + # tests/test_ragas_runtime.py fail rather than skip if ragas is missing. - name: Install newest allowed deps - run: pip install --upgrade -r requirements.txt -r requirements-test.txt + run: pip install --upgrade -r requirements.txt -r requirements-test.txt -e '.[ragas]' - name: Run tests + env: + DOKIMI_REQUIRE_RAGAS: '1' run: pytest -q -n auto # Installs the built package with a fresh resolve of its dependency ranges, not diff --git a/dokimi/Makefile b/dokimi/Makefile index 94930f55a..339f70515 100644 --- a/dokimi/Makefile +++ b/dokimi/Makefile @@ -17,7 +17,7 @@ BASE ?= baselines/baseline.json # `make dev` venv: at the repo root, outside this directory, so `bandit -r .` # and the docs benchmark (both run from here) do not scan it. CI's Python: -# 3.13 until scikit-network ships cp314 wheels (see the top of ci.yml). An +# 3.13 (see the top of ci.yml). An # existing venv on another Python is converted in place by re-running `make dev`. VENV ?= ../.venv PYTHON_VERSION ?= 3.13 From 5ef44bafa0f71867aa0b76f6720300f6887c6e16 Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Tue, 27 Oct 2026 00:01:30 -0700 Subject: [PATCH 06/10] docs(security): drop the ragas and diskcache advisories from the lock ignore lists PYSEC-2026-2447 (diskcache) and PYSEC-2026-3046 (ragas) are no longer reported against any lock, so pip-audit.yml and osv-scanner.toml stop ignoring them. SECURITY.md keeps why neither affects the optional [ragas] extra, which installs ragas 0.3.9 and diskcache 5.6.3. Signed-off-by: Alexander Rybkin --- .github/workflows/pip-audit.yml | 2 -- dokimi/SECURITY.md | 35 +++++++++++++++++++-------------- dokimi/osv-scanner.toml | 8 -------- 3 files changed, 20 insertions(+), 25 deletions(-) diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml index 01e2271b5..68ada7023 100644 --- a/.github/workflows/pip-audit.yml +++ b/.github/workflows/pip-audit.yml @@ -64,8 +64,6 @@ jobs: | awk -F'==' '/^[A-Za-z0-9]/ { print > (ENVIRON["RUNNER_TEMP"] "/pins" seen[$1]++ ".txt") }' for f in "$RUNNER_TEMP"/pins*.txt; do pip-audit -r "$f" --no-deps --disable-pip --progress-spinner off \ - --ignore-vuln PYSEC-2026-2447 \ - --ignore-vuln PYSEC-2026-3046 \ --ignore-vuln GHSA-v4x8-3wr5-3wq8 \ --ignore-vuln GHSA-9vhv-jxww-xfm5 \ --ignore-vuln GHSA-567q-5qvw-pf92 diff --git a/dokimi/SECURITY.md b/dokimi/SECURITY.md index 07000b0bc..0898f6713 100644 --- a/dokimi/SECURITY.md +++ b/dokimi/SECURITY.md @@ -48,17 +48,6 @@ The project is pre-1.0; only the latest `main` is supported. Fixes land on `requirements-docs.lock.txt` and `requirements-ci.lock.txt`) reports these advisories with no fix the locks can take: -- **diskcache 5.6.3 — PYSEC-2026-2447** (CVE-2025-69872, GHSA-w8v5-vhqr-4h9v; - pickle deserialization from a cache directory). Pulled in only by ragas, - which imports it inside its opt-in `DiskCacheBackend`; Dokimi never - constructs one, so no diskcache directory is created or read. -- **ragas 0.3.9 — PYSEC-2026-3046** (CVE-2026-6587, GHSA-95ww-475f-pr4f; SSRF - and file read in the multi-modal faithfulness metric's loader). The - advisory's range is 0.2.3–0.4.3, but the vulnerable module - (`ragas/metrics/collections/multi_modal_faithfulness/util.py`) first ships - in 0.4.2, so the pinned 0.3.9 does not contain it. A fixed release would be - 0.4.4 or later, which is outside the `ragas<0.4` cap: taking it means lifting - the cap and migrating, not a bump, and 0.4.2–0.4.3 must be skipped. - **filelock 3.32.7 — GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, GHSA-567q-5qvw-pf92** (CVE-2026-112940, CVE-2026-112913, CVE-2026-112907; fixed in 4.2.1). Every litellm release requires `filelock<4.0`, so 4.2.1 @@ -71,15 +60,31 @@ fix the locks can take: to dataset and model downloads on a shared Windows host. Drop all three when litellm allows `filelock>=4.2.1`. +The locks do not contain ragas: it is the optional `[ragas]` extra (`eval ragas`, +`answers generate --ragas`), which installs ragas 0.3.9 and diskcache 5.6.3. Their +advisories do not affect Dokimi: + +- **diskcache 5.6.3 — PYSEC-2026-2447** (CVE-2025-69872, GHSA-w8v5-vhqr-4h9v; + pickle deserialization from a cache directory). Pulled in only by ragas, + which imports it inside its opt-in `DiskCacheBackend`; Dokimi never + constructs one, so no diskcache directory is created or read. +- **ragas 0.3.9 — PYSEC-2026-3046** (CVE-2026-6587, GHSA-95ww-475f-pr4f; SSRF + and file read in the multi-modal faithfulness metric's loader). The + advisory's range is 0.2.3–0.4.3, but the vulnerable module + (`ragas/metrics/collections/multi_modal_faithfulness/util.py`) first ships + in 0.4.2, so 0.3.9 does not contain it. A fixed release would be + 0.4.4 or later, which is outside the `ragas<0.4` cap: taking it means lifting + the cap and migrating, not a bump, and 0.4.2–0.4.3 must be skipped. + The `ragas>=0.3.0` floor keeps out 0.2.3–0.2.x, which are affected by CVE-2025-45691 (GHSA-v2xr-wvrv-p969, file read through `retrieved_contexts`, fixed in 0.3.0). -`.github/workflows/pip-audit.yml` runs `pip-audit` with exactly these IDs -ignored, on every PR or push that changes a lock or requirements file and daily +`.github/workflows/pip-audit.yml` runs `pip-audit` against the locks with exactly +the three filelock IDs ignored, on every PR or push that changes a lock or requirements file and daily on `main`; a daily run that finds a new advisory opens an issue rather than failing unrelated PRs. The `static` job in `.github/workflows/ci.yml` runs `bandit -ll` with no Medium or High finding allowed. The same IDs are ignored by osv-scanner through `dokimi/osv-scanner.toml`, -which OpenSSF Scorecard runs. A removed advisory comes out of this section, -the `pip-audit` step, and that file together. +which OpenSSF Scorecard runs. A removed advisory comes out of the first list +above, the `pip-audit` step, and that file together. diff --git a/dokimi/osv-scanner.toml b/dokimi/osv-scanner.toml index bc5abd22b..5497b66e0 100644 --- a/dokimi/osv-scanner.toml +++ b/dokimi/osv-scanner.toml @@ -6,14 +6,6 @@ # --ignore-vuln in .github/workflows/pip-audit.yml; SECURITY.md ("Known advisories in # dependencies") explains why each one does not affect Dokimi. -[[IgnoredVulns]] -id = "PYSEC-2026-2447" -reason = "diskcache, via ragas: DiskCacheBackend is never constructed. See SECURITY.md." - -[[IgnoredVulns]] -id = "PYSEC-2026-3046" -reason = "ragas 0.3.9 does not ship the vulnerable module (first in 0.4.2). See SECURITY.md." - [[IgnoredVulns]] id = "GHSA-v4x8-3wr5-3wq8" reason = "filelock ReadWriteLock on POSIX: no dependency of Dokimi uses ReadWriteLock; litellm caps filelock<4. See SECURITY.md." From 1f3df08f5be4ef75a5cd7136a6013be471918b56 Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Tue, 27 Oct 2026 00:02:04 -0700 Subject: [PATCH 07/10] docs(changelog): describe the ragas lock change under Security The fragment named CVE IDs that do not exist and said pip install dokimi stopped installing ragas, which was already true since #126. It now says what this PR changes: the locks lose ragas, langchain and diskcache, and the extra stays covered by test-latest. Signed-off-by: Alexander Rybkin --- .../20261027_000000_cve_ragas_fix.md | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md b/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md index 2abffa4c7..d625223dd 100644 --- a/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md +++ b/dokimi/changelog.d/20261027_000000_cve_ragas_fix.md @@ -1,11 +1,9 @@ -### Fixed +### Security -- **RAGAS dependency**: removed from main `requirements.txt` to fix recurring CVE - reports. ragas is already optional in `pyproject.toml` as the `[ragas]` extra. - `pip install dokimi` no longer installs ragas, langchain-community, - langchain-anthropic, langchain-openai, or langchain-core. Commands that - require the `[ragas]` extra (`eval ragas`, `answers generate --ragas`) now - check for the extra at entry and exit with a helpful install message before - any model call. This fixes CVE-2026-2447 (diskcache) and CVE-2026-3046 (ragas). - The optional filelock CVEs (GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, - GHSA-567q-5qvw-pf92) remain because litellm requires `filelock<4.0`. +- **The CI and development lock no longer contains ragas, the langchain packages or + diskcache**, which clears CVE-2025-69872 (diskcache, PYSEC-2026-2447) and CVE-2026-6587 + (ragas, PYSEC-2026-3046) from the locks (`requirements.lock.txt` was the only one with + them), so `pip-audit` no longer has to ignore them. `pip install dokimi` was already free of both + since ragas became the `[ragas]` extra (#126); `eval ragas` and `answers generate --ragas` + still need `pip install 'dokimi[ragas]'`, and the weekly `test-latest` CI job installs + that extra and runs its import check. The three filelock advisories are unchanged. From 4af9bc85ca29ef69b03de64666a818ac88007932 Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Tue, 27 Oct 2026 00:17:23 -0700 Subject: [PATCH 08/10] test(agent-eval): leave the real ragas import out of the regression run The eval image is built from the lock, which no longer has ragas, and the task workspaces start at commits older than the test's skip, so fix-degrade-pre's regress_pass failed on test_ragas_imports_and_evaluator_builds_from_installed_deps. It is deselected like the timing-sensitive tests; test-latest runs it with the extra installed. Signed-off-by: Alexander Rybkin --- .agent-eval/README.md | 3 ++- .agent-eval/run.py | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.agent-eval/README.md b/.agent-eval/README.md index 2dc64aad4..7c980283f 100644 --- a/.agent-eval/README.md +++ b/.agent-eval/README.md @@ -28,7 +28,8 @@ offline. No grader calls an LLM. Every code task also gets these metrics: - `regress_pass`: the whole suite, except timing- and process-sensitive tests: all of - `test_example_runner_processes.py` (4 tests, 7 cases) and 2 single tests (`REGRESSION` in `run.py`) + `test_example_runner_processes.py` (4 tests, 7 cases) and 2 single tests (`REGRESSION` in `run.py`), + and the real ragas import check, which needs the `[ragas]` extra the image does not install - `ruff_ok`, `mypy_ok`, `config_ok`, `schema_ok` - `compat_ok`: `schema_compat` against the start commit - `diffcov_*`: CI's changed-line coverage gate diff --git a/.agent-eval/run.py b/.agent-eval/run.py index fdc09dd35..b4c4f5441 100644 --- a/.agent-eval/run.py +++ b/.agent-eval/run.py @@ -42,7 +42,10 @@ "regress_pass": ["python", "-m", "pytest", "-q", "-p", "no:cacheprovider", "-x", "--deselect", "tests/test_example_runner_processes.py", "--deselect", "tests/test_container_agent.py::test_probe_finds_a_proxy_that_forwards_plain_http", - "--deselect", "tests/test_benchflow_harness.py::test_run_bench_kills_the_process_group_on_timeout"], + "--deselect", "tests/test_benchflow_harness.py::test_run_bench_kills_the_process_group_on_timeout", + # Needs the [ragas] extra, which the image (built from the lock) leaves out; + # task bases older than its skip-when-missing would fail it. + "--deselect", "tests/test_ragas_runtime.py::test_ragas_imports_and_evaluator_builds_from_installed_deps"], "ruff_ok": ["ruff", "check", "."], "mypy_ok": ["mypy"], "config_ok": ["python", "-m", "dokimi.config_check"], From 0eb6110f88ca229a80a5dbffad63ec3cbf2d9ef1 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Tue, 27 Oct 2026 10:42:38 +0000 Subject: [PATCH 09/10] test(ragas): pin the DOKIMI_REQUIRE_RAGAS fail and skip branches Signed-off-by: Anton Volkov --- dokimi/tests/test_ragas_runtime.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dokimi/tests/test_ragas_runtime.py b/dokimi/tests/test_ragas_runtime.py index 717c4c5a0..e86dbd664 100644 --- a/dokimi/tests/test_ragas_runtime.py +++ b/dokimi/tests/test_ragas_runtime.py @@ -54,6 +54,16 @@ def test_ragas_imports_and_evaluator_builds_from_installed_deps(): assert proc.returncode == 0, proc.stderr[-3000:] +def test_the_real_import_check_fails_instead_of_skipping_when_ragas_is_required(monkeypatch): + monkeypatch.setattr(importlib.util, "find_spec", lambda name: None) + monkeypatch.setenv("DOKIMI_REQUIRE_RAGAS", "1") + with pytest.raises(pytest.fail.Exception, match="DOKIMI_REQUIRE_RAGAS=1"): + test_ragas_imports_and_evaluator_builds_from_installed_deps() + monkeypatch.delenv("DOKIMI_REQUIRE_RAGAS") + with pytest.raises(pytest.skip.Exception): + test_ragas_imports_and_evaluator_builds_from_installed_deps() + + def test_ragas_without_the_extra_exits_with_the_install_command(monkeypatch, tmp_path): from dokimi.commands.evaluate import _run_ragas_eval From bb939846018c6ebbbee179d2fc343180dd14cb5c Mon Sep 17 00:00:00 2001 From: Alexander Rybkin Date: Tue, 27 Oct 2026 11:32:09 -0700 Subject: [PATCH 10/10] test(ragas): a skipped guard fails the guard test instead of skipping it With pytest.fail replaced by pass under DOKIMI_REQUIRE_RAGAS=1, the check went on to pytest.skip; pytest.raises(pytest.fail.Exception) let the Skipped through, so the guard test skipped and the suite stayed green. Both outcomes are caught now and the type is asserted. Signed-off-by: Alexander Rybkin --- dokimi/tests/test_ragas_runtime.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/dokimi/tests/test_ragas_runtime.py b/dokimi/tests/test_ragas_runtime.py index e86dbd664..fac203366 100644 --- a/dokimi/tests/test_ragas_runtime.py +++ b/dokimi/tests/test_ragas_runtime.py @@ -56,12 +56,17 @@ def test_ragas_imports_and_evaluator_builds_from_installed_deps(): def test_the_real_import_check_fails_instead_of_skipping_when_ragas_is_required(monkeypatch): monkeypatch.setattr(importlib.util, "find_spec", lambda name: None) + outcomes = (pytest.fail.Exception, pytest.skip.Exception) + # Catch both: a skip that escapes here would skip this test too, and CI stays green. monkeypatch.setenv("DOKIMI_REQUIRE_RAGAS", "1") - with pytest.raises(pytest.fail.Exception, match="DOKIMI_REQUIRE_RAGAS=1"): + with pytest.raises(outcomes) as required: test_ragas_imports_and_evaluator_builds_from_installed_deps() + assert required.type is pytest.fail.Exception + assert "DOKIMI_REQUIRE_RAGAS=1" in str(required.value) monkeypatch.delenv("DOKIMI_REQUIRE_RAGAS") - with pytest.raises(pytest.skip.Exception): + with pytest.raises(outcomes) as optional: test_ragas_imports_and_evaluator_builds_from_installed_deps() + assert optional.type is pytest.skip.Exception def test_ragas_without_the_extra_exits_with_the_install_command(monkeypatch, tmp_path):