From a51da0745faff9256329360682a9490e2c2fde34 Mon Sep 17 00:00:00 2001 From: Simon Strandgaard Date: Thu, 23 Jul 2026 23:59:21 +0200 Subject: [PATCH] chore(deps): bump worker_plan deps to resolve open security alerts Resolves the 18 remaining open Dependabot alerts in worker_plan/pyproject.toml: pillow 12.2.0 -> 12.3.0 (13 alerts), soupsieve 2.8.3 -> 2.8.4 (2 alerts), json_repair 0.58.7 -> 0.60.1 (1 alert), and transformers (2 alerts) removed entirely. transformers was only in the freeze as a hard dependency of llama-index-llms-openai-like < 0.6. From 0.6.0 it is an optional extra, and no PlanExe code imports it or passes a string tokenizer that would need it. Bumping llama-index-llms-openai-like to 0.7.0 and llama-index-llms-openrouter to 0.5.1 (which requires openai-like >= 0.7) lets us drop transformers plus its now-orphaned dependencies tokenizers, safetensors and huggingface-hub. Co-Authored-By: Claude Fable 5 --- worker_plan/pyproject.toml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/worker_plan/pyproject.toml b/worker_plan/pyproject.toml index f2268dd2..e04af8a7 100644 --- a/worker_plan/pyproject.toml +++ b/worker_plan/pyproject.toml @@ -33,12 +33,11 @@ dependencies = [ "h11==0.16.0", "httpcore==1.0.9", "httpx==0.28.1", - "huggingface-hub==0.36.0", "idna==3.15", "Jinja2==3.1.6", "jiter==0.12.0", "joblib==1.5.3", - "json_repair==0.58.7", + "json_repair==0.60.1", "jsonpath-python==1.1.6", # "llama-cloud==0.1.8", # "llama-index-agent-openai==0.4.1", @@ -53,8 +52,8 @@ dependencies = [ # "llama-index-llms-mistralai==0.4.0", "llama-index-llms-ollama==0.10.1", "llama-index-llms-openai==0.6.12", - "llama-index-llms-openai-like==0.5.3", - "llama-index-llms-openrouter==0.5.0", + "llama-index-llms-openai-like==0.7.0", + "llama-index-llms-openrouter==0.5.1", # "llama-index-llms-together==0.3.1", # "llama-index-multi-modal-llms-openai==0.4.2", "llama-index-readers-file==0.6.0", @@ -78,7 +77,7 @@ dependencies = [ "orjson==3.11.9", "packaging==26.2", "pandas==2.3.3", - "pillow==12.2.0", + "pillow==12.3.0", "propcache==0.4.1", "pydantic==2.13.4", "pydantic_core==2.46.4", @@ -94,20 +93,17 @@ dependencies = [ "requests==2.33.1", "rich==15.0.0", "safehttpx==0.1.7", - "safetensors==0.8.0", "semantic-version==2.10.0", "six==1.17.0", "sniffio==1.3.1", - "soupsieve==2.8.3", + "soupsieve==2.8.4", "SQLAlchemy==2.0.49", "starlette==1.3.1", "striprtf==0.0.26", "tenacity==9.1.4", "tiktoken==0.13.0", - "tokenizers==0.22.1", "tornado==6.5.7", "tqdm==4.67.1", - "transformers==4.57.3", "typer==0.24.1", "typing-inspect==0.9.0", "typing_extensions==4.15.0",