Skip to content

chore: update dependency lockfiles - #557

Merged
mergify[bot] merged 2 commits into
mainfrom
automated/update-lockfiles-main
Aug 10, 2026
Merged

chore: update dependency lockfiles#557
mergify[bot] merged 2 commits into
mainfrom
automated/update-lockfiles-main

Conversation

@eoinfennessy

@eoinfennessy eoinfennessy commented Aug 7, 2026

Copy link
Copy Markdown
Member

Automated lockfile update

Warning

This PR is auto-generated. Do not request changes from the author - push
changes directly if necessary.

This PR regenerates the pinned dependency lockfiles to pick up upstream package changes.

Updated files

  • distribution/requirements-lock.txt

This PR was auto-generated by the update-lockfiles workflow.
Review the dependency changes and merge when ready.

Summary by CodeRabbit

  • Chores
    • Updated bundled dependencies to newer versions.
    • Refreshed dependency integrity information for improved installation reliability.
    • Added dependency provenance details for sentence-transformers.

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a9e9669-8f1a-4ec1-9c62-55e441ee549a

📥 Commits

Reviewing files that changed from the base of the PR and between 7080c90 and d588f86.

📒 Files selected for processing (1)
  • distribution/requirements-lock.txt
🚧 Files skipped from review as they are similar to previous changes (1)
  • distribution/requirements-lock.txt

📝 Walkthrough

Walkthrough

The dependency lockfile updates package versions and hashes for Anthropic, Docling, AWS, Google authentication, Hugging Face, Milvus Lite, pydantic-settings, pypdf, sentence-transformers, setuptools, soupsieve, and Starlette. It adds sentence-transformers to the tokenizers dependency provenance. No public declarations changed.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 10
✅ Passed checks (10 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the lockfile dependency updates, which match the primary change in the pull request.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection ✅ Passed The bot-authored commit matches the repository lockfile workflow and changes only pinned versions, hashes, and one provenance comment; no security-theater or code-quality signal is present.
No Hardcoded Secrets ✅ Passed Only the lockfile changed; scans found no credential URLs, private-key markers, secret assignments, or non-hash base64 strings. CWE-798 is not triggered.
No Weak Cryptography ✅ Passed The PR changes only the dependency lockfile; added and removed lines contain no MD5, SHA1, DES, RC4, Blowfish, or ECB usage. Lock hashes are SHA-256.
No Injection Vectors ✅ Passed Only the lockfile changed; additions are package pins, SHA-256 hashes, and provenance. No CWE-78, CWE-89, CWE-94, CWE-502, or CWE-79 pattern was introduced.
No Privileged Containers ✅ Passed The PR changes only distribution/requirements-lock.txt. Scans found no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-user declarations.
No Sensitive Data In Logs ✅ Passed The commit changes only distribution/requirements-lock.txt; added content contains package pins and SHA-256 hashes, with no logging statements or sensitive values (CWE-532 not triggered).

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@distribution/requirements-lock.txt`:
- Around line 1565-1567: Before pinning milvus-lite==3.2.0 in the dependency
lock, define and document the upgrade behavior for the persisted database used
by build/build.yaml: provide an export/import migration path for pre-3.0 files
or require users to create a fresh database. Ensure the upgrade guidance
explicitly addresses incompatibility with legacy .db files and prevents existing
databases from being used silently with Milvus Lite 3.2.0.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 25365f1d-3386-4e9b-829b-299ae7bfb53a

📥 Commits

Reviewing files that changed from the base of the PR and between aeebf1a and 35fc6e2.

📒 Files selected for processing (1)
  • distribution/requirements-lock.txt

Comment on lines +1565 to +1567
milvus-lite==3.2.0 \
--hash=sha256:d6735d7a5bcb14fed2cc9a42da84d7396fef0040a0f7c2d1cace9f2134925571 \
--hash=sha256:f0f5656b033b1b5cbcfdfb8a9d676e52236338f102c8011d7bbf611afe512bb4

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C4 --hidden -S \
  'milvus|Milvus|milvus_lite|\.db' \
  --glob '*.py' \
  --glob '*.yaml' \
  --glob '*.yml' \
  --glob '*.toml' \
  .

Repository: opendatahub-io/ogx-distribution

Length of output: 4189


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- requirements-lock around milvus-lite ---\n'
sed -n '1545,1580p' distribution/requirements-lock.txt

printf '\n--- pyproject/requirements references to milvus-lite ---\n'
rg -n --hidden -S 'milvus-lite|milvuslite|milvus_lite|inline::milvus' --glob '*.txt' --glob '*.toml' --glob '*.py' --glob '*.yaml' --glob '*.yml' .

Repository: opendatahub-io/ogx-distribution

Length of output: 260


🌐 Web query:

PyPI milvus-lite 3.2.0 rebuilt storage engine local db files migration database compatibility

💡 Result:

Database files (.db) created by versions of milvus-lite prior to 3.0.0 (the original C++/CGo-based storage format) are not compatible with milvus-lite version 3.0.0 and later, including version 3.2.0 [1][2][3]. The architecture was entirely rebuilt in pure Python, moving from the previous implementation to an LSM-style storage engine [2][4]. There is no automated migration path or tool for these legacy database files [1][5][2]. To migrate data to milvus-lite 3.2.0, you must: 1. Maintain access to the environment where the original milvus-lite (v2.x or earlier) is installed. 2. Use the compatibility dump command available in the older version to export your collections into a format such as Milvus BulkWriter JSON [1][2][6]. 3. Import that data into a new database created with the current milvus-lite 3.2.0 [1][2][3]. The dump command (milvus-lite dump) is designed to facilitate this process by exporting data that can then be ingested into Milvus servers or re-imported [5][6]. Always ensure you are working in a clean environment when upgrading or transitioning between these versions to avoid conflicts between the incompatible storage engines [1][7].

Citations:


🌐 Web query:

milvus-lite 3.2.0 release notes storage engine local .db files

💡 Result:

As of August 7, 2026, Milvus Lite has not released a version 3.2.0. The most recent versions available are v3.1.0 and v3.1.1 [1][2]. Regarding the storage engine and local.db files, there is a notable distinction in how Milvus Lite handles storage depending on the version and implementation architecture: 1. Current Pure-Python Architecture (v3.0.0 and later): The current generation of Milvus Lite, which was rewritten in pure Python, uses an LSM-style (Log-Structured Merge-tree) storage engine [3][4]. In this architecture, data is written to a Write-Ahead Log (WAL) and in-memory memtables, and flushed as immutable Parquet segments [3][4]. Vector indexes are persisted as separate.idx files, and the database state is managed by an atomic manifest [4]. 2. SQLite-Based Architecture: Some documentation describes a version of Milvus Lite that utilizes SQLite as its embedded storage backend for both collection metadata and vector/scalar data [5][6][7]. In this model, the.db file functions as a single persistent store [6]. Compatibility Note: Because the current pure-Python engine and older versions differ significantly in their storage formats,.db files created by earlier versions of Milvus Lite are generally not compatible with the newer pure-Python engine [4]. Users cannot perform an in-place migration; data must be re-imported into a new database [4]. For local usage, you can initialize the database using the MilvusClient: client = MilvusClient("./demo.db") [3][8] The.db file specified serves as the local database path [8]. While the API remains consistent across different Milvus deployments (Standalone, Distributed, and Zilliz Cloud), the underlying local storage implementation is optimized for lightweight, single-node prototyping and testing [3][4][8].

Citations:


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '1545,1580p' distribution/requirements-lock.txt

printf '\n--- pyproject/requirements references to milvus-lite ---\n'
rg -n --hidden -S 'milvus-lite|milvuslite|milvus_lite|inline::milvus' --glob '*.txt' --glob '*.toml' --glob '*.py' --glob '*.yaml' --glob '*.yml' .

printf '\n--- tracked files mentioning milvus in names ---\n'
git ls-files | rg -i 'milvus'

Repository: opendatahub-io/ogx-distribution

Length of output: 2800


Define the Milvus Lite storage upgrade path before pinning 3.2.0.

build/build.yaml persists the inline Milvus database at /opt/app-root/src/.ogx/distributions/rh/milvus.db. Milvus Lite 3.0 uses a rebuilt pure-Python storage engine, and .db files from pre-3.0 versions are incompatible; document migration via export/import or require a fresh database for upgrades. CWE-829 controls this dependency change; if legacy databases persist, this can cause data-access failures or corrupted read behavior.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@distribution/requirements-lock.txt` around lines 1565 - 1567, Before pinning
milvus-lite==3.2.0 in the dependency lock, define and document the upgrade
behavior for the persisted database used by build/build.yaml: provide an
export/import migration path for pre-3.0 files or require users to create a
fresh database. Ensure the upgrade guidance explicitly addresses incompatibility
with legacy .db files and prevents existing databases from being used silently
with Milvus Lite 3.2.0.

Sources: Path instructions, MCP tools

@eoinfennessy
eoinfennessy force-pushed the automated/update-lockfiles-main branch 2 times, most recently from 3d5ef7d to 7080c90 Compare August 9, 2026 04:33
@eoinfennessy
eoinfennessy force-pushed the automated/update-lockfiles-main branch from 7080c90 to d588f86 Compare August 10, 2026 04:37
@mergify

mergify Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@mergify
mergify Bot merged commit 1526185 into main Aug 10, 2026
9 checks passed
@mergify
mergify Bot deleted the automated/update-lockfiles-main branch August 10, 2026 22:38
@rhods-ci-bot

Copy link
Copy Markdown

@eoinfennessy: The following test has Succeeded:

OCI Artifact Browser URL

View in Artifact Browser

Inspecting Test Artifacts Manually

To inspect your test artifacts manually, follow these steps:

  1. Install ORAS (see the ORAS installation guide).
  2. Download artifacts with the following commands:
mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/opendatahub/odh-ci-artifacts:ogx-core-functional-its-bzfp6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants