Merge branch 'release-0.4.x' into mergify/bp/release-0.4.x/pr-6330

Signed-off-by: Charlie Doern <cdoern@redhat.com>

Author: cdoern

.github/actions/setup-typescript-client/action.yml

@@ -18,7 +18,10 @@ runs:
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: llamastack/llama-stack-client-typescript
-        ref: main
+        # This is a release branch: pin to the matching release branch of the
+        # client repo, whose package is still named "llama-stack-client".
+        # The client repo's main branch has been renamed to "ogx-client".
+        ref: release-0.4.x
         path: .ts-client-checkout
 
     - name: Set TS_CLIENT_PATH

.github/workflows/pypi.yml

@@ -255,6 +255,11 @@ jobs:
             # Explicit override from workflow_dispatch
             echo "ref=${{ inputs.client_ref }}" >> $GITHUB_OUTPUT
             echo "Using explicit client_ref: ${{ inputs.client_ref }}"
+          elif [[ "$GITHUB_BASE_REF" == release-* ]]; then
+            # Pull request targeting a release branch — GITHUB_REF is refs/pull/N/merge,
+            # so use the PR base branch name to pick the matching client release branch.
+            echo "ref=$GITHUB_BASE_REF" >> $GITHUB_OUTPUT
+            echo "Using PR base release branch: $GITHUB_BASE_REF"
           elif [[ "$GITHUB_REF" == refs/heads/release-* ]]; then
             # Running on a release branch — use the same branch name in client repos
             BRANCH="${GITHUB_REF#refs/heads/}"

containers/Containerfile

@@ -27,6 +27,10 @@ ARG PYPI_VERSION=""
 ARG TEST_PYPI_VERSION=""
 ARG KEEP_WORKSPACE=""
 ARG DISTRO_NAME="starter"
+# Tolerate failures of the OpenTelemetry per-library bootstrap. This release
+# branch is a pre-rename backfill whose pinned deps can conflict with the latest
+# auto-instrumentation packages.
+ARG OTEL_BEST_EFFORT="1"
 ARG RUN_CONFIG_PATH=""
 ARG UV_HTTP_TIMEOUT=500
 ARG UV_EXTRA_INDEX_URL=""
@@ -130,10 +134,20 @@ RUN set -eux; \
         printf '%s\n' "$deps" | xargs -L1 uv pip install --no-cache; \
     fi
 
-# Install OpenTelemetry auto-instrumentation support
+# Install OpenTelemetry auto-instrumentation support.
+# The base distro/exporter install is required. The per-library bootstrap
+# (opentelemetry-bootstrap -a install) selects the latest instrumentation
+# packages, which can conflict with the pinned dependencies of older releases.
 RUN set -eux; \
     pip install --no-cache opentelemetry-distro opentelemetry-exporter-otlp; \
-    opentelemetry-bootstrap -a install
+    if ! opentelemetry-bootstrap -a install; then \
+        if [ "$OTEL_BEST_EFFORT" = "1" ]; then \
+            echo "opentelemetry-bootstrap failed; continuing without full auto-instrumentation (OTEL_BEST_EFFORT=1)" >&2; \
+        else \
+            echo "opentelemetry-bootstrap failed" >&2; \
+            exit 1; \
+        fi; \
+    fi
 
 # Cleanup
 RUN set -eux; \

pyproject.toml

@@ -8,7 +8,7 @@ fallback_version = "0.4.6"
 [tool.uv]
 required-version = ">=0.7.0"
 constraint-dependencies = [
-    "pyasn1>=0.6.4",  # CVE-2026-30922: DoS via unbounded recursion
+    "pyasn1>=0.6.4",  # CVE-2026-30922, CVE-2026-59885: DoS via unbounded recursion
     "starlette>=1.0.1",                # CVE-2026-48710
 ]
 
@@ -32,7 +32,7 @@ classifiers = [
 ]
 dependencies = [
     "PyYAML>=6.0",
-    "aiohttp>=3.13.3",
+    "aiohttp>=3.14.0",                                  # CVE-2026-34993: CookieJar.load() RCE
     "fastapi>=0.115.0,<1.0",                          # server
     "fire",                                           # for MCP in LLS client
     "httpx",
@@ -41,8 +41,8 @@ dependencies = [
     "llama-stack-api",                                # API and provider specifications (local dev via tool.uv.sources)
     "openai>=2.5.0",
     "prompt-toolkit",
-    "python-dotenv",
-    "pyjwt[crypto]>=2.12.0",                          # Pull crypto to support RS256 for jwt. Requires 2.12.0+ to fix CVE-2026-32597.
+    "python-dotenv>=1.2.2",                              # CVE-2026-28684: arbitrary file overwrite via symlink following
+    "pyjwt[crypto]>=2.13.0",                          # Pull crypto to support RS256 for jwt. CVE-2026-48526: auth bypass via forged JWTs.
     "pydantic>=2.11.9",
     "rich",
     "termcolor",
@@ -59,7 +59,7 @@ dependencies = [
     "starlette>=0.49.1",
     "psycopg2-binary",
     "tornado>=6.5.3",
-    "urllib3>=2.6.3",
+    "urllib3>=2.7.0",                                    # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
 ]
 
 [project.optional-dependencies]
@@ -115,12 +115,14 @@ type_checking = [
     "ollama",
     "llama-stack-client==0.4.6",
 ]
-# These are the dependencies required for running unit tests.
+# These are additional dependencies required for running unit tests beyond the
+# shared `test` dependency group.
 unit = [
     "anthropic",
     "databricks-sdk",
     "sqlite-vec",
     "ollama",
+    "llama-stack-client==0.4.6",
     "aiosqlite",
     "aiohttp",
     "psycopg2-binary>=2.9.0",
@@ -129,17 +131,21 @@ unit = [
     "chardet",
     "sqlalchemy",
     "sqlalchemy[asyncio]>=2.0.41",
+    "torch>=2.6.0",
+    "torchvision>=0.21.0",
+    "fairscale",
     "blobfile",
     "faiss-cpu",
     "litellm",
     "together",
     "coverage",
     "moto[s3]>=5.1.10",
 ]
-# These are the core dependencies required for running integration tests. They are shared across all
-# providers. If a provider requires additional dependencies, please add them to your environment
-# separately. If you are using "uv" to execute your tests, you can use the "--group" flag to specify extra
-# dependencies.
+# These are the core dependencies shared across test environments. Integration
+# tests use this group directly, and the unit test wrapper installs it alongside
+# the `unit` group. If a provider requires additional dependencies, please add
+# them to your environment separately. If you are using "uv" to execute your
+# tests, you can use the "--group" flag to specify extra dependencies.
 test = [
     "aiosqlite",
     "aiohttp",

scripts/unit-tests.sh

@@ -25,6 +25,7 @@ if [ $FOUND_PYTHON -ne 0 ]; then
      uv python install "$PYTHON_VERSION"
 fi
 
-# Run unit tests with coverage
-uv run --python "$PYTHON_VERSION" --with-editable . --group unit \
+# Run unit tests with coverage. The shared `test` group provides core provider
+# dependencies, and `unit` layers on unit-only extras.
+uv run --python "$PYTHON_VERSION" --with-editable . --group test --group unit \
     coverage run --source=src/llama_stack -m pytest -s -v tests/unit/ "$@"

tests/README.md

@@ -26,7 +26,7 @@ This gives you:
 
 You can run the unit tests with:
 ```bash
-uv run --group unit pytest -sv tests/unit/
+uv run --group test --group unit pytest -sv tests/unit/
 ```
 
 For running integration tests, you must provide a few things: