Skip to content

fix(deps): resolve Dependabot alerts, add docs site improvements #1433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeremyeder wants to merge 1 commit into
base: main
Choose a base branch
from
+1,285 −1,417
Open

fix(deps): resolve Dependabot alerts, add docs site improvements #1433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .claude/skills/scaffold/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,15 @@ Based on the established integration pattern (Jira, CodeRabbit, Google Drive), g
|------|---------|
| `components/manifests/base/core/flags.json` | Add `integration.{provider}.enabled` |

### Documentation

| File | Purpose | Template |
|------|---------|----------|
| `docs/src/content/docs/concepts/integrations.md` | Add setup section | Follow Jira or CodeRabbit sections |
| `docs/astro.config.mjs` | Add sidebar entry if new page | Only for complex integrations |

Add a section to the integrations page with: what the integration enables, numbered setup steps, and prerequisites. Complex integrations (like CodeRabbit) get their own page under `docs/src/content/docs/features/`.

### Checklist

After scaffolding, verify:
Expand All @@ -80,6 +89,8 @@ After scaffolding, verify:
- [ ] Feature flag gates the integration card
- [ ] Tests mock the feature flag hook
- [ ] Runner credential fetch is added to `populate_runtime_credentials()`
- [ ] Integration documented on the integrations page
- [ ] Troubleshooting table updated with common failure modes

## Endpoint Scaffold

Expand Down
10 changes: 9 additions & 1 deletion components/runners/ambient-runner/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ dependencies = [
"pydantic>=2.12.5",
"aiohttp>=3.13.4",
"requests>=2.33.0",
"pyjwt>=2.11.0",
"pyjwt>=2.12.0",
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Declared floors in components/runners/ambient-runner/pyproject.toml:"
rg -n 'pyjwt>=|fastmcp>=' components/runners/ambient-runner/pyproject.toml

echo
echo "Resolved versions in uv.lock (if present):"
LOCK_FILE="$(fd -HI '^uv\.lock$' | head -n1 || true)"
if [ -n "$LOCK_FILE" ]; then
  rg -n -C2 'name = "(pyjwt|fastmcp|pygments)"|version = "' "$LOCK_FILE"
else
  echo "uv.lock not found"
fi

Repository: ambient-code/platform

Length of output: 50377

Specify patched minimum versions to prevent vulnerable patch regression.

pyjwt>=2.12.0 and fastmcp>=3.2.0 allow earlier patch releases than the target remediation versions (2.12.1 and 3.2.4). Fresh dependency resolution could select pre-patch versions. Tighten the constraints:

Proposed patch 
 dependencies = [
@@
-  "pyjwt>=2.12.0",
+  "pyjwt>=2.12.1",
 ]
@@
 override-dependencies = [
-  "fastmcp>=3.2.0",
+  "fastmcp>=3.2.4",
 ]
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@components/runners/ambient-runner/pyproject.toml` at line 18, The dependency
constraint "pyjwt>=2.12.0" is too loose and can resolve to pre-patch vulnerable
releases; update the minimum patched versions in pyproject.toml (and similarly
tighten the "fastmcp" requirement if present) to the remediation minima (e.g.,
"pyjwt>=2.12.1" and "fastmcp>=3.2.4") so fresh dependency resolution cannot pick
older patched-vulnerable patch releases; modify the dependency lines where
"pyjwt>=2.12.0" and "fastmcp>=3.2.0" appear to use the tightened >= versions.

]

[project.optional-dependencies]
Expand Down Expand Up @@ -55,6 +55,14 @@ asyncio_mode = "auto"
py-modules = ["main"]
packages = ["ag_ui_claude_sdk", "ag_ui_gemini_cli", "ambient_runner", "ambient_runner.endpoints", "ambient_runner.middleware", "ambient_runner.platform", "ambient_runner.bridges", "ambient_runner.bridges.claude", "ambient_runner.bridges.langgraph", "ambient_runner.bridges.gemini_cli"]

[tool.uv]
constraint-dependencies = [
"pygments>=2.20.0",
]
override-dependencies = [
"fastmcp>=3.2.0",
]

[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"
282 changes: 89 additions & 193 deletions components/runners/ambient-runner/uv.lock
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 6 additions & 0 deletions docs/astro.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import { defineConfig } from 'astro/config';
import starlight from '@astrojs/starlight';
import rehypeMermaid from 'rehype-mermaid';
import starlightLlmsTxt from 'starlight-llms-txt';

const isNetlify = !!process.env.NETLIFY;

Expand All @@ -11,6 +12,9 @@ export default defineConfig({
base: isNetlify ? '/' : '/platform/',
integrations: [
starlight({
plugins: [
starlightLlmsTxt({ projectName: 'Ambient Code Platform' }),
],
title: 'Ambient Code Platform',
favicon: '/favicon.ico',
description:
Expand Down Expand Up @@ -89,6 +93,8 @@ export default defineConfig({
label: 'Development',
items: [
{ slug: 'development' },
{ slug: 'development/harness' },
{ slug: 'development/review-gate' },
],
},
],
Expand Down
Loading
Loading