mirror of
https://github.com/open-webui/open-webui.git
synced 2026-08-13 01:02:25 -06:00
chore: bump Python backend dependencies, drop unused peewee (#25786)
* chore: bump Python backend dependencies, drop unused peewee Minor/patch + reviewed major bumps across requirements.txt, requirements-min.txt, pyproject.toml and uv.lock; playwright image bumped in docker-compose.playwright.yaml. peewee/peewee-migrate removed (zero imports). Security-relevant: cryptography 46->48, authlib 1.6.10->1.7.2, PyJWT 2.11->2.13, requests 2.33.1->2.34.2, RestrictedPython 8.1->8.2, pillow 12.1.1->12.2.0. Reviewed majors: redis 7->8, pymilvus ->2.6.14, azure-search-documents 11->12, chardet 5->7, unstructured 0.18->0.22, pycrdt 0.12->0.13. Testing: - Resolution: `uv lock` resolves the full bumped set with no conflicts; uv.lock regenerated to match (peewee dropped, every pin including azure-search-documents==12.0.0 resolves). - Per-dependency contract tests (external tests repo, unit/deps/): 105 files, 2205 passed / 6 skipped, ruff-clean. One file per dependency pins the symbols, signatures and behaviour the backend actually uses, so an API removal/rename in a bumped version fails loudly instead of at runtime. Offline/deterministic. - End-to-end embed->retrieve test driving transformers + sentence-transformers + chromadb together through Open WebUI's real RAG path (cached model, in-memory chroma, semantic retrieval asserted). - Install/startup/health resolution gate added to the dep-bump workflow and the integration suite (uv/pip resolve + uvicorn /health + Playwright dev visibility). - Bugs surfaced while testing each got an isolated fix branch + regression test: Mistral OCR aiohttp FilePayload (#25779), chroma has_collection (#25780), aiocache per-user model-cache key (security), otel semconv deprecation, pydub/audioop <3.13 note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Bump python-multipart 0.0.22 -> 0.0.27 (CVE-2026-42561, CVE-2026-40347) 0.0.22 is affected by two DoS CVEs in the multipart parser that Starlette/FastAPI run for every multipart/form-data request, so any authenticated user hitting an upload endpoint can trigger them: - CVE-2026-42561: unbounded part-header count/size -> CPU exhaustion (fixed 0.0.27) - CVE-2026-40347: large multipart preamble/epilogue DoS (fixed 0.0.26) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Classic298
+50
-52
@@ -6,87 +6,85 @@ authors = [
|
||||
]
|
||||
license = { file = "LICENSE" }
|
||||
dependencies = [
|
||||
"fastapi==0.135.1",
|
||||
"fastapi==0.136.3",
|
||||
"uvicorn[standard]==0.41.0",
|
||||
"pydantic==2.12.5",
|
||||
"python-multipart==0.0.22",
|
||||
"pydantic==2.13.4",
|
||||
"python-multipart==0.0.27",
|
||||
"itsdangerous==2.2.0",
|
||||
|
||||
"python-socketio==5.16.1",
|
||||
"python-socketio==5.16.2",
|
||||
"python-jose==3.5.0",
|
||||
"cryptography==46.0.5",
|
||||
"cryptography==48.0.0",
|
||||
"bcrypt==5.0.0",
|
||||
"argon2-cffi==25.1.0",
|
||||
"PyJWT[crypto]==2.11.0",
|
||||
"authlib==1.6.10",
|
||||
"PyJWT[crypto]==2.13.0",
|
||||
"authlib==1.7.2",
|
||||
|
||||
"requests==2.33.1",
|
||||
"requests==2.34.2",
|
||||
"aiohttp==3.13.5", # do not update to 3.13.3 - broken
|
||||
"async-timeout==5.0.1",
|
||||
"aiocache==0.12.3",
|
||||
"aiofiles==25.1.0",
|
||||
"starlette-compress==1.7.0",
|
||||
"starlette-compress==1.7.1",
|
||||
"Brotli==1.2.0",
|
||||
"brotlicffi==1.2.0.1",
|
||||
"httpx[socks,http2,zstd,cli,brotli]==0.28.1",
|
||||
"starsessions[redis]==2.2.1",
|
||||
"python-mimeparse==2.0.0",
|
||||
|
||||
"sqlalchemy[asyncio]==2.0.48",
|
||||
"aiosqlite==0.21.0",
|
||||
"psycopg[binary]==3.2.9",
|
||||
"sqlalchemy[asyncio]==2.0.50",
|
||||
"aiosqlite==0.22.1",
|
||||
"psycopg[binary]==3.3.4",
|
||||
"alembic==1.18.4",
|
||||
"peewee==3.19.0",
|
||||
"peewee-migrate==1.14.3",
|
||||
|
||||
"pycrdt==0.12.47",
|
||||
"redis==7.4.0",
|
||||
"pycrdt==0.13.1",
|
||||
"redis==8.0.0",
|
||||
# "valkey-glide-sync==2.3.1", # optional: install manually if VECTOR_DB=valkey
|
||||
|
||||
"pytz==2026.1.post1",
|
||||
"pytz==2026.2",
|
||||
"APScheduler==3.11.2",
|
||||
"RestrictedPython==8.1",
|
||||
"RestrictedPython==8.2",
|
||||
|
||||
"loguru==0.7.3",
|
||||
"asgiref==3.11.1",
|
||||
|
||||
"tiktoken==0.12.0",
|
||||
"mcp==1.26.0",
|
||||
"tiktoken==0.13.0",
|
||||
"mcp==1.27.2",
|
||||
|
||||
"openai==2.29.0",
|
||||
"anthropic==0.86.0",
|
||||
"google-genai==1.66.0",
|
||||
|
||||
"langchain==1.2.10",
|
||||
"langchain-community==0.4.1",
|
||||
"langchain-classic==1.0.1",
|
||||
"langchain-text-splitters==1.1.1",
|
||||
"langchain-community==0.4.2",
|
||||
"langchain-classic==1.0.7",
|
||||
"langchain-text-splitters==1.1.2",
|
||||
|
||||
"fake-useragent==2.2.0",
|
||||
"chromadb==1.5.2",
|
||||
"opensearch-py==3.1.0",
|
||||
"PyMySQL==1.1.2",
|
||||
"chromadb==1.5.9",
|
||||
"opensearch-py==3.2.0",
|
||||
"PyMySQL==1.2.0",
|
||||
"boto3==1.42.62",
|
||||
|
||||
"transformers==5.5.4",
|
||||
"sentence-transformers==5.4.0",
|
||||
"sentence-transformers==5.5.1",
|
||||
"accelerate==1.13.0",
|
||||
"pyarrow==20.0.0", # fix: pin pyarrow version to 20 for rpi compatibility #15897
|
||||
"einops==0.8.2",
|
||||
|
||||
"ftfy==6.3.1",
|
||||
"chardet==5.2.0",
|
||||
"chardet==7.4.3",
|
||||
"pypdf==6.7.5",
|
||||
"fpdf2==2.8.7",
|
||||
"pymdown-extensions==10.21",
|
||||
"pymdown-extensions==10.21.3",
|
||||
"docx2txt==0.9",
|
||||
"python-pptx==1.0.2",
|
||||
"msoffcrypto-tool==6.0.0",
|
||||
"nltk==3.9.3",
|
||||
"nltk==3.9.4",
|
||||
"Markdown==3.10.2",
|
||||
"beautifulsoup4==4.14.3",
|
||||
"pypandoc==1.16.2",
|
||||
"pandas==3.0.1",
|
||||
"pypandoc==1.17",
|
||||
"pandas==3.0.3",
|
||||
"openpyxl==3.1.5",
|
||||
"pyxlsb==1.0.10",
|
||||
"xlrd==2.0.2",
|
||||
@@ -96,30 +94,30 @@ dependencies = [
|
||||
"soundfile==0.13.1",
|
||||
"azure-ai-documentintelligence==1.0.2",
|
||||
|
||||
"pillow==12.1.1",
|
||||
"pillow==12.2.0",
|
||||
"opencv-python-headless==4.13.0.92",
|
||||
"rapidocr-onnxruntime==1.4.4",
|
||||
"rank-bm25==0.2.2",
|
||||
|
||||
"onnxruntime==1.24.3",
|
||||
"onnxruntime==1.26.0",
|
||||
"faster-whisper==1.2.1",
|
||||
|
||||
"black==26.3.1",
|
||||
"black==26.5.1",
|
||||
"youtube-transcript-api==1.2.4",
|
||||
"pytube==15.0.0",
|
||||
|
||||
"pydub==0.25.1",
|
||||
"ddgs==9.11.3",
|
||||
"ddgs==9.14.4",
|
||||
|
||||
"google-api-python-client==2.193.0",
|
||||
"google-auth-httplib2==0.3.0",
|
||||
"google-auth-oauthlib==1.3.0",
|
||||
"google-api-python-client==2.197.0",
|
||||
"google-auth-httplib2==0.4.0",
|
||||
"google-auth-oauthlib==1.4.0",
|
||||
|
||||
"googleapis-common-protos==1.72.0",
|
||||
"googleapis-common-protos==1.75.0",
|
||||
"google-cloud-storage==3.9.0",
|
||||
|
||||
"azure-identity==1.25.2",
|
||||
"azure-storage-blob==12.28.0",
|
||||
"azure-identity==1.25.3",
|
||||
"azure-storage-blob==12.29.0",
|
||||
|
||||
"ldap3==2.9.1",
|
||||
]
|
||||
@@ -138,38 +136,38 @@ classifiers = [
|
||||
|
||||
[project.optional-dependencies]
|
||||
postgres = [
|
||||
"psycopg2-binary==2.9.11",
|
||||
"psycopg2-binary==2.9.12",
|
||||
"pgvector==0.4.2",
|
||||
]
|
||||
mariadb = [
|
||||
"mariadb==1.1.14",
|
||||
]
|
||||
unstructured = [
|
||||
"unstructured==0.18.31",
|
||||
"unstructured==0.22.31",
|
||||
]
|
||||
|
||||
all = [
|
||||
"pymongo==4.16.0",
|
||||
"psycopg2-binary==2.9.11",
|
||||
"pymongo==4.17.0",
|
||||
"psycopg2-binary==2.9.12",
|
||||
"pgvector==0.4.2",
|
||||
"moto[s3]>=5.0.26",
|
||||
"gcp-storage-emulator>=2024.8.3",
|
||||
"docker~=7.1.0",
|
||||
"pytest~=8.3.2",
|
||||
"pytest-docker~=3.2.5",
|
||||
"playwright==1.58.0", # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
|
||||
"elasticsearch==9.3.0",
|
||||
"playwright==1.60.0", # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
|
||||
"elasticsearch==9.4.1",
|
||||
|
||||
"qdrant-client==1.17.0",
|
||||
"qdrant-client==1.18.0",
|
||||
|
||||
"weaviate-client==4.20.3",
|
||||
"pymilvus==2.6.9",
|
||||
"pymilvus==2.6.14",
|
||||
"pinecone==6.0.2",
|
||||
"oracledb==3.4.2",
|
||||
"colbert-ai==0.2.22",
|
||||
|
||||
"azure-search-documents==11.6.0",
|
||||
"unstructured==0.18.31",
|
||||
"azure-search-documents==12.0.0",
|
||||
"unstructured==0.22.31",
|
||||
]
|
||||
|
||||
[project.scripts]
|
||||
|
||||
Reference in New Issue
Block a user