Conversation
📝 WalkthroughWalkthroughDependency constraints in pyproject.toml were refactored from multi-range, cross-Python blocks into per-Python-version specifiers. onnxruntime entries were restructured with explicit Python-version-aware blocks and narrower upper bounds/exclusions; pillow constraints were consolidated into Python-version-specific ranges with updated upper bounds; onnx dev dependencies were adjusted similarly and a 3.14+ line was added. No source code, public APIs, or exported symbols were changed. Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pyproject.toml`:
- Around line 22-26: The onnxruntime dependency block has overlapping python
markers: update the three entries for onnxruntime so the python ranges are
non-overlapping (follow the numpy pattern) — keep the first entry as python =
">=3.14", change the second entry to python = ">=3.13,<3.14", and ensure the
third remains python = ">=3.10,<3.13" so that Python 3.14+ will select the
>=1.24.2 spec and not the looser >1.20.0 spec.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 287d22c7-a173-4f13-940a-177fc5e44cfb
⛔ Files ignored due to path filters (1)
poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
pyproject.toml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pyproject.toml`:
- Line 25: The onnxruntime version constraint currently uses
">1.21.0,!=1.24.0,!=1.24.1" which incorrectly excludes 1.21.0; update the
constraint in the onnxruntime dependency entry to ">=1.21.0,!=1.24.0,!=1.24.1"
so cp313 wheels are allowed while still excluding the known-bad 1.24.0/1.24.1
releases.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 34893a28-a0dd-4f83-ae2d-f88761fa4aea
⛔ Files ignored due to path filters (1)
poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
pyproject.toml
| { version = ">=1.17.0,!=1.20.0", python = ">=3.10,<3.13" }, | ||
| { version = ">=1.17.0,!=1.20.0,<1.24", python = "3.10" }, | ||
| { version = ">=1.17.0,!=1.20.0,!=1.24.0,!=1.24.1", python = ">=3.11,<3.13" }, | ||
| { version = ">1.21.0,!=1.24.0,!=1.24.1", python = "3.13" }, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify that onnxruntime 1.21.0 already publishes Python 3.13 wheels on PyPI.
python - <<'PY'
import json
import urllib.request
with urllib.request.urlopen("https://pypi.org/pypi/onnxruntime/1.21.0/json") as resp:
data = json.load(resp)
cp313 = sorted(f["filename"] for f in data["urls"] if "cp313" in f["filename"])
print("\n".join(cp313))
print(f"cp313_wheel_count={len(cp313)}")
PYRepository: qdrant/fastembed
Length of output: 2641
🌐 Web query:
onnxruntime 1.21.0 python 3.13 cp313 wheel pypi
💡 Result:
PyPI does have ONNX Runtime 1.21.0 wheels for Python 3.13 (cp313), including:
- Windows x86_64:
onnxruntime-1.21.0-cp313-cp313-win_amd64.whl[1] - Linux manylinux (x86_64, aarch64):
...-cp313-cp313-manylinux_2_27_...whl[1] - macOS universal2:
...-cp313-cp313-macosx_13_0_universal2.whl[1] - Also free-threaded Python 3.13t Linux wheels:
...-cp313-cp313t-manylinux_...whl[1]
Install (will pick the right wheel for your platform):
python -m pip install onnxruntime==1.21.0Source: ONNX Runtime 1.21.0 files on PyPI [1].
Use >=1.21.0 for the Python 3.13 onnxruntime floor.
Line 25 currently excludes onnxruntime 1.21.0, but this version already publishes cp313 wheels on PyPI, so there's no reason to narrow the install range beyond the documented bad releases (1.24.0 and 1.24.1). Change this to >=1.21.0.
Proposed fix
- { version = ">1.21.0,!=1.24.0,!=1.24.1", python = "3.13" },
+ { version = ">=1.21.0,!=1.24.0,!=1.24.1", python = "3.13" },📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| { version = ">1.21.0,!=1.24.0,!=1.24.1", python = "3.13" }, | |
| { version = ">=1.21.0,!=1.24.0,!=1.24.1", python = "3.13" }, |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pyproject.toml` at line 25, The onnxruntime version constraint currently uses
">1.21.0,!=1.24.0,!=1.24.1" which incorrectly excludes 1.21.0; update the
constraint in the onnxruntime dependency entry to ">=1.21.0,!=1.24.0,!=1.24.1"
so cp313 wheels are allowed while still excluding the known-bad 1.24.0/1.24.1
releases.
## Description Upgrade Pillow from 11.3.0 to 12.1.1 to resolve CVE-2026-25990 (GHSA-cfh3-3jmp-rvhc), a high-severity out-of-bounds write when loading PSD images. fastembed 0.7.4 caps `pillow<12.0`, but the fix has already merged upstream ([qdrant/fastembed#611](qdrant/fastembed#611)) — just no release yet. Added a `[tool.uv] override-dependencies` entry to force `pillow>=12.1.1` past the cap. The override should be removed once fastembed >= 0.7.5 ships. ## Type of Change - [x] 🐛 Bug fix (fixes an issue) - [x] 🔧 Maintenance (refactor, chore, CI, etc.) ## Testing - [x] Tests pass locally (`pytest`) — 769 passed - [x] Manually verified `uv sync` resolves Pillow 12.1.1 ## Checklist - [x] Code follows project style (`ruff check` and `ruff format` pass) - [x] Self-review completed - [x] No new warnings introduced Fixes https://github.com/kunickiaj/codemem/security/dependabot/5
2 participants
No description provided.