Skip to content

chore(deps): bump the python-deps group across 1 directory with 15 updates#14

Closed
dependabot[bot] wants to merge 186 commits into
mainfrom
dependabot/pip/python-deps-2734e85e74
Closed

chore(deps): bump the python-deps group across 1 directory with 15 updates#14
dependabot[bot] wants to merge 186 commits into
mainfrom
dependabot/pip/python-deps-2734e85e74

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 15, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on uvicorn[standard], pydantic, tomli, httpx, click, rich, typer, pyyaml, numpy, prometheus-client, psutil, huggingface-hub, pypdf, pytest-asyncio and pytest-cov to permit the latest version.
Updates uvicorn[standard] from 0.34.3 to 0.39.0

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.39.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.38.0...0.39.0

Version 0.38.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.37.0...0.38.0

Version 0.37.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.36.1...0.37.0

Version 0.36.1

What's Changed

Full Changelog: Kludex/uvicorn@0.36.0...0.36.1

Version 0.36.0

Added

New Contributors

... (truncated)

Changelog

Sourced from uvicorn[standard]'s changelog.

0.39.0 (December 21, 2025)

Fixed

  • Send close frame on ASGI return for WebSockets (#2769)
  • Explicitly start ASGI run with empty context (#2742)

0.38.0 (October 18, 2025)

Added

  • Support Python 3.14 (#2723)

0.37.0 (September 23, 2025)

Added

  • Add --timeout-worker-healthcheck option (#2711)
  • Add os.PathLike[str] type to ssl_ca_certs (#2676)

0.36.1 (September 23, 2025)

Fixed

  • Raise an exception when calling removed Config.setup_event_loop() (#2709)

0.36.0 (September 20, 2025)

Added

  • Support custom IOLOOPs (#2435)
  • Allow to provide importable string in --http, --ws and --loop (#2658)

0.35.0 (June 28, 2025)

Added

  • Add WebSocketsSansIOProtocol (#2540)

Changed

  • Refine help message for option --proxy-headers (#2653)
Commits

Updates pydantic from 2.10.6 to 2.12.5

Release notes

Sourced from pydantic's releases.

v2.12.5 2025-11-26

v2.12.5 (2025-11-26)

This is the fifth 2.12 patch release, addressing an issue with the MISSING sentinel and providing several documentation improvements.

The next 2.13 minor release will be published in a couple weeks, and will include a new polymorphic serialization feature addressing the remaining unexpected changes to the serialize as any behavior.

  • Fix pickle error when using model_construct() on a model with MISSING as a default value by @​ornariece in #12522.
  • Several updates to the documentation by @​Viicos.

Full Changelog: pydantic/pydantic@v2.12.4...v2.12.5

v2.12.4 2025-11-05

v2.12.4 (2025-11-05)

This is the fourth 2.12 patch release, fixing more regressions, and reverting a change in the build() method of the AnyUrl and Dsn types.

This patch release also fixes an issue with the serialization of IP address types, when serialize_as_any is used. The next patch release will try to address the remaining issues with serialize as any behavior by introducing a new polymorphic serialization feature, that should be used in most cases in place of serialize as any.

Full Changelog: pydantic/pydantic@v2.12.3...v2.12.4

v2.12.3 2025-10-17

v2.12.3 (2025-10-17)

What's Changed

This is the third 2.13 patch release, fixing issues related to the FieldInfo class, and reverting a change to the supported after model validator function signatures.

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.12.5 (2025-11-26)

GitHub release

This is the fifth 2.12 patch release, addressing an issue with the MISSING sentinel and providing several documentation improvements.

The next 2.13 minor release will be published in a couple weeks, and will include a new polymorphic serialization feature addressing the remaining unexpected changes to the serialize as any behavior.

  • Fix pickle error when using model_construct() on a model with MISSING as a default value by @​ornariece in #12522.
  • Several updates to the documentation by @​Viicos.

v2.12.4 (2025-11-05)

GitHub release

This is the fourth 2.12 patch release, fixing more regressions, and reverting a change in the build() method of the AnyUrl and Dsn types.

This patch release also fixes an issue with the serialization of IP address types, when serialize_as_any is used. The next patch release will try to address the remaining issues with serialize as any behavior by introducing a new polymorphic serialization feature, that should be used in most cases in place of serialize as any.

v2.12.3 (2025-10-17)

GitHub release

... (truncated)

Commits
  • bd2d0dd Prepare release v2.12.5
  • 7d0302e Document security implications when using create_model()
  • e9ef980 Fix typo in Standard Library Types documentation
  • f2c20c0 Add pydantic-docs dev dependency, make use of versioning blocks
  • a76c1aa Update documentation about JSON Schema
  • 8cbc72c Add documentation about custom __init__()
  • 99eba59 Add additional test for FieldInfo.get_default()
  • c710769 Special case MISSING sentinel in smart_deepcopy()
  • 20a9d77 Do not delete mock validator/serializer in rebuild_dataclass()
  • c86515a Update parts of the model and revalidate_instances documentation
  • Additional commits viewable in compare view

Updates tomli from 2.0.1 to 2.4.0

Changelog

Sourced from tomli's changelog.

2.4.0

  • Added
    • TOML v1.1.0 compatibility
    • Binary wheels for Windows arm64

2.3.0

  • Added
    • Binary wheels for Python 3.14 (also free-threaded)
  • Performance
    • Reduced import time

2.2.1

  • Fixed
    • Don't attempt to compile binary wheels for Python 3.8, 3.9 and 3.10 where cibuildwheel depends on a conflicting Tomli version

2.2.0

  • Added
    • mypyc generated binary wheels for common platforms

2.1.0

  • Deprecated
    • Instantiating TOMLDecodeError with free-form arguments. msg, doc and pos arguments should be given.
  • Added
    • msg, doc, pos, lineno and colno attributes to TOMLDecodeError

2.0.2

  • Removed
    • Python 3.7 support
  • Improved
    • Make loads raise TypeError not AttributeError on bad input types that do not have the replace attribute. Improve error message when bytes is received.
  • Type annotations
    • Type annotate load input as typing.IO[bytes] (previously typing.BinaryIO).
Commits
  • a678e6f Bump version: 2.3.0 → 2.4.0
  • b8a1358 Tests: remove now needless "TOML compliance"->"burntsushi" format conversion
  • 4979375 Update GitHub actions
  • f890dd1 Update pre-commit hooks
  • d9c65c3 Add 2.4.0 change log
  • 0efe49d Update README for v2.4.0
  • 9eb2125 TOML 1.1: Make seconds optional in Date-Time and Time (#203)
  • 12314bd TOML 1.1: Add \xHH Unicode escape code to basic strings (#202)
  • 2a2aa62 TOML 1.1: Allow newlines and trailing comma in inline tables (#200)
  • 38297f8 Xfail on tests for TOML 1.1 features not yet supported
  • Additional commits viewable in compare view

Updates httpx from 0.27.2 to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.

Version 0.28.0

0.28.0 (28th November, 2024)

The 0.28 release includes a limited set of deprecations.

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

  • The verify argument as a string argument is now deprecated and will raise warnings.
  • The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

  • The deprecated proxies argument has now been removed.
  • The deprecated app argument has now been removed.
  • JSON request bodies use a compact representation. (#3363)
  • Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
  • Ensure certifi and httpcore are only imported if required. (#3377)
  • Treat socks5h as a valid proxy scheme. (#3178)
  • Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
  • Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)
Commits

Updates click from 8.1.7 to 8.1.8

Release notes

Sourced from click's releases.

8.1.8

This is the Click 8.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.1.8/ Changes: https://click.palletsprojects.com/en/stable/changes/#version-8-1-8 Milestone https://github.com/pallets/click/milestones/23?closed=1

  • Fix an issue with type hints for click.open_file(). #2717
  • Fix issue where error message for invalid click.Path displays on multiple lines. #2697
  • Fixed issue that prevented a default value of "" from being displayed in the help for an option. #2500
  • The test runner handles stripping color consistently on Windows. #2705
  • Show correct value for flag default when using default_map. #2632
  • Fix click.echo(color=...) passing color to coloroma so it can be forced on Windows. #2606.
  • More robust bash version check, fixing problem on Windows with git-bash. #2638
  • Cache the help option generated by the help_option_names setting to respect its eagerness. #2811
  • Replace uses of os.system with subprocess.Popen. #1476
  • Exceptions generated during a command will use the context's color setting when being displayed. #2193
  • Error message when defining option with invalid name is more descriptive. #2452
  • Refactor code generating default --help option to deduplicate code. #2563
  • Test CLIRunner resets patched _compat.should_strip_ansi. #2732
Changelog

Sourced from click's changelog.

Version 8.1.8

Released 2024-12-19

  • Fix an issue with type hints for click.open_file(). :issue:2717
  • Fix issue where error message for invalid click.Path displays on multiple lines. :issue:2697
  • Fixed issue that prevented a default value of "" from being displayed in the help for an option. :issue:2500
  • The test runner handles stripping color consistently on Windows. :issue:2705
  • Show correct value for flag default when using default_map. :issue:2632
  • Fix click.echo(color=...) passing color to coloroma so it can be forced on Windows. :issue:2606.
  • More robust bash version check, fixing problem on Windows with git-bash. :issue:2638
  • Cache the help option generated by the help_option_names setting to respect its eagerness. :pr:2811
  • Replace uses of os.system with subprocess.Popen. :issue:1476
  • Exceptions generated during a command will use the context's color setting when being displayed. :issue:2193
  • Error message when defining option with invalid name is more descriptive. :issue:2452
  • Refactor code generating default --help option to deduplicate code. :pr:2563
  • Test CLIRunner resets patched _compat.should_strip_ansi. :issue:2732
Commits

Updates rich from 13.7.0 to 14.3.3

Release notes

Sourced from rich's releases.

The infinite Release

Fixed a infinite loop in split_graphemes

[14.3.3] - 2026-02-19

Fixed

The ZWJy release

A fix for cell_len edge cases

[14.3.2] - 2026-02-01

Fixed

The Nerdy Fix release

Fixed issue with characters outside of unicode range reporting 0 cell size

[14.3.1] - 2026-01-24

Fixed

The more emojis release

Rich now has support for multi-codepoint emojis. There have also been some Markdown improvements, and a number of fixes. See the release notes below for details.

[14.3.0] - 2026-01-24

Fixed

Added

Changed

... (truncated)

Changelog

Sourced from rich's changelog.

[14.3.3] - 2026-02-19

Fixed

[14.3.2] - 2026-02-01

Fixed

[14.3.1] - 2026-01-24

Fixed

[14.3.0] - 2026-01-24

Fixed

Added

Changed

[14.2.0] - 2025-10-09

Changed

... (truncated)

Commits

Updates typer from 0.9.0 to 0.23.2

Release notes

Sourced from typer's releases.

0.23.1

Fixes

  • 🐛 Fix TYPER_USE_RICH parsing to allow disabling Rich completely. PR #1539 by @​bckohan.

Docs

  • 📝 Remove documentation pages that reference using Click directly. PR #1538 by @​svlandeg.

Internal

0.23.0

Breaking Changes

  • ♻️ When printing error tracebacks with Rich, default to not showing locals, which are sometimes verbose. PR #1072 by @​tiangolo.

Docs

  • 📝 Add more explicit deprecation note in shell packages. PR #1534 by @​tiangolo.

Internal

0.22.0

Breaking Changes

  • 💥 Make typer-slim a shallow wrapper around typer, always requiring rich and shellingham. PR #1522 by @​svlandeg.

0.21.2

Fixes

  • 🐛 Fix highlighting of optional variadic argument metavars. PR #1508 by @​BenjyWiener.
  • 🐛 Fix --help text alignment when using typer.style() in option descriptions. PR #1356 by @​mahimairaja.

Refactors

Upgrades

Docs

... (truncated)

Changelog

Sourced from typer's changelog.

0.23.2

Features

  • ✅ Monkeypatch console width to allow running pytest directly. PR #1542 by @​SwaatiR.

Internal

0.23.1

Fixes

  • 🐛 Fix TYPER_USE_RICH parsing to allow disabling Rich completely. PR #1539 by @​bckohan.

Docs

  • 📝 Remove documentation pages that reference using Click directly. PR #1538 by @​svlandeg.

Internal

0.23.0

Breaking Changes

  • ♻️ When printing error tracebacks with Rich, default to not showing locals, which are sometimes verbose. PR #1072 by @​tiangolo.

Docs

  • 📝 Add more explicit deprecation note in shell packages. PR #1534 by @​tiangolo.

Internal

0.22.0

Breaking Changes

  • 💥 Make typer-slim a shallow wrapper around typer, always requiring rich and shellingham. PR #1522 by @​svlandeg.

0.21.2

... (truncated)

Commits
  • 2bf1e4d 🔖 Release version 0.23.2
  • b51b821 📝 Update release notes
  • 459030e 👷 Run tests with lower bound uv sync, update minimum dependencies (#1526)
  • ccd7669 📝 Update release notes
  • 5a13460 ⬆ Bump prek from 0.3.2 to 0.3.3 (#1545)
  • 54b4477 📝 Update release notes
  • 3f25640 ✅ Monkeypatch console width to allow running pytest directly (#1542)
  • fc20e31 📝 Update release notes
  • e5df3a5 ⬆ Bump ruff from 0.15.0 to 0.15.1 (#1541)
  • d2d9f59 🔖 Release version 0.23.1
  • Additional commits viewable in compare view

Updates pyyaml from 6.0.1 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

6.0.2

What's Changed

  • Support for Cython 3.x and Python 3.13.

Full Changelog: yaml/pyyaml@6.0.1...6.0.2

6.0.2rc1

  • Support for extension build with Cython 3.x
  • Support for Python 3.13
  • Added PyPI wheels for musllinux on aarch64
Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

Commits

Updates numpy from 1.26.4 to 2.0.2

Release notes

Sourced from numpy's releases.

NumPy 2.0.2 release (Aug 26, 2024)

NumPy 2.0.2 Release Notes

NumPy 2.0.2 is a maintenance release that fixes bugs and regressions discovered after the 2.0.1 release.

The Python versions supported by this release are 3.9-3.12.

Contributors

A total of 13 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Bruno Oliveira +
  • Charles Harris
  • Chris Sidebottom
  • Christian Heimes +
  • Christopher Sidebottom
  • Mateusz Sokół
  • Matti Picus
  • Nathan Goldbaum
  • Pieter Eendebak
  • Raghuveer Devulapalli
  • Ralf Gommers
  • Sebastian Berg
  • Yair Chuchem +

Pull requests merged

A total of 19 pull requests were merged for this release.

  • #27000: REL: Prepare for the NumPy 2.0.1 release [wheel build]
  • #27001: MAINT: prepare 2.0.x for further development
  • #27021: BUG: cfuncs.py: fix crash when sys.stderr is not available
  • #27022: DOC: Fix migration note for alltrue and sometrue
  • #27061: BUG: use proper input and output descriptor in array_assign_subscript...
  • #27073: BUG: Mirror VQSORT_ENABLED logic in Quicksort
  • #27074: BUG: Bump Highway to latest master
  • #27077: BUG: Off by one in memory overlap check
  • #27122: BUG: Use the new npyv_loadable_stride_ functions for ldexp and...
  • #27126: BUG: Bump Highway to latest
  • #27128: BUG: add missing error handling in public_dtype_api.c
  • #27129: BUG: fix another cast setup in array_assign_subscript
  • #27130: BUG: Fix building NumPy in FIPS mode
  • #27131: BLD: update vendored Meson for cross-compilation patches
  • #27146: MAINT: Scipy openblas 0.3.27.44.4
  • #27151: BUG: Do not accidentally store dtype metadata in np.save
  • #27195: REV: Revert undef I and document it
  • #27213: BUG: Fix NPY_RAVEL_AXIS on backwards compatible NumPy 2 builds
  • #27279: BUG: Fix array_equal for numeric and non-numeric scalar types

... (truncated)

Commits
  • 854252d Merge pull request #27280 from charris/prepare-2.0.2
  • cffa071 REL: Prepare for the NumPy 2.0.2 release [wheel build]
  • 1693029 Merge pull request #27279 from charris/backport-27275
  • da9f9c3 BUG: Fix array_equal for numeric and non-numeric scalar types
  • ee1cf96 Merge pull request #27213 from charris/backport-27202

jgoy-labs and others added 30 commits February 4, 2026 23:07
@jgoy-labs @claude
Actualitzar documentació completa i afegir codi NEXE 0.8
760bd26 
Documentació corregida i actualitzada:
- API.md: Endpoints correctes amb /v1/, dual-key auth, X-API-Key headers
- SECURITY.md: Configuració real (server.toml), paths correctes, MAX_SCAN_LENGTH
- RAG.md: Sistema híbrid embeddings (nomic-embed-text 768d), 3 col·leccions, chunking en caràcters
- USAGE.md: CLI real (memory recall/store/stats/cleanup, knowledge ingest), autenticació obligatòria
- README.md: Stack correcte (Click+Rich), compatibilitat OpenAI parcial, SECURITY.md afegit

Canvis principals documentació:
- Models embeddings: Ollama nomic-embed-text (768 dims) + fallbacks documentats
- Col·leccions Qdrant: nexe_chat_memory, nexe_documentation, user_knowledge
- Thresholds diferenciats: 0.4 (docs), 0.35 (knowledge), 0.3 (memory)
- Chunking: 1500/200 chars (text general), 800/100 (RAG endpoint)
- Autenticació X-API-Key obligatòria a tots els endpoints /v1/*
- CLI real: store|recall|stats|cleanup (no search/list/delete)
- Paths correctes: storage/qdrant/, /v1/memory/*, /api/info

Codi NEXE 0.8 complet afegit:
- Core: FastAPI server, CLI, endpoints, loaders
- Plugins: MLX, llama.cpp, Ollama, security, web UI
- Memory: RAG system, embeddings, Qdrant integration
- Personality: i18n, module management, configuration

Eliminats:
- PRODUCTION_PLAN.md
- REVIEW_SUPERCONSULTOR_2026-01-31.md

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@jgoy-labs
Security hardening: path traversal, session TTL, health info, bare ex…
74acc97 
…cepts

- memory/rag/routers/endpoints.py: ALLOWED_UPLOAD_EXTENSIONS whitelist,
  filename sanitization (Path.name) to prevent path traversal,
  generic 500 error messages (no internal details exposed)
- core/endpoints/root.py: /health/ready returns only {status, timestamp}
  to avoid exposing internal module list without auth
- plugins/web_ui_module/session_manager.py: implement cleanup_inactive()
  with timedelta TTL to prevent session memory leak
- memory/memory/engines/persistence.py: QDRANT_API_KEY env var support
  for authenticated Qdrant deployments
- core/endpoints/chat.py: log JSONDecodeError in Ollama stream,
  handle asyncio.CancelledError on client disconnect
- plugins/web_ui_module/memory_helper.py: replace bare except with
  except Exception + debug logging
- .env.example: document all env vars including QDRANT_API_KEY
- .dockerignore: exclude .env, storage/, venv/, .git/ from Docker image
- .github/workflows/ci.yml: pip-audit CVE scan + unit tests
- core/endpoints/tests/test_security.py: 14 security regression tests

Assisted by AI
@jgoy-labs
deps: actualitzar dependencies — 0 CVEs confirmades per pip-audit
6922401 
- fastapi 0.109.0 → 0.128.8 (starlette 0.49.1+, tanca GHSA-2c2j + GHSA-7f5h)
- uvicorn 0.27.0.post1 → 0.34.3
- pydantic 2.6.0 → 2.10.6
- python-multipart 0.0.6 → 0.0.22 (tanca GHSA-wp53-j4wj-2cfg)
- httpx 0.26.0 → 0.27.2
- qdrant-client 1.12.0 → 1.13.3
- structlog 24.1.0 → 25.5.0
- tenacity 8.2.3 → 9.1.2
- python-dotenv 1.0.1 → 1.2.1
- huggingface_hub 0.20.3 → 0.36.2
- sentence-transformers 2.3.1 → 2.7.0
- pypdf 4.0.1 → 6.7.1 (tanca 7 CVEs GHSA-*)
- numpy 1.26.4 mantingut (numpy 2.x breaking changes)
- rich/typer mantinguts (cadena de compatibilitat)

Verificat: pip-audit 0 vulnerabilitats, 14/14 tests passen

Assisted by AI
@jgoy-labs
refactor: deduplicar find_config_path, lock singleton i18n, tests RAG…
397a309 
… endpoints

M-7: personality/i18n/i18n_manager.py i modular_i18n.py usaven 8 línies
  de codi duplicat per cercar server.toml. Ara deleguen a
  core.config.find_config_path (funció centralitzada ja existent).

M-8: personality/i18n/__init__.py: _global_i18n = None s'inicialitzava
  lazy sense lock. Afegit threading.Lock + double-checked locking
  per evitar race condition en entorns async/multi-thread.

T-3: memory/rag/tests/test_endpoints.py: 14 tests unitaris nous pels
  endpoints RAG (upload, search, add_document, whitelist extensions).
  Cobreixen: validació extensions, path traversal, errors 500 genèrics,
  resultats correctes, metadades invàlides, fitxers massa grans.

Total tests: 28/28 passen.

Assisted by AI
@jgoy-labs @claude
refactor(C-4): eliminar triple DI state — Container → server_state/ap…
5ca8611 
…p.state

- factory_state.py: eliminar 4 crides register_service() (codi mort)
- lifespan.py: sincronitzar app.state.config amb server_state.config en reload
- memory/module.py: substituir get_service() per get_i18n() i get_server_state()
- web_ui/manifest.py: substituir get_service("module_manager") per get_server_state()
- container.py: marcar com a DEPRECATED (mantingut per tests, eliminar en v0.9)

Resultat: font única per a cada objecte; desync config eliminat.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
Security hardening: auditoria final N-1..N-8
8e7c4c0 
N-1: server.toml → production, debug=false, reload=false
N-2: system.py → PID i kill commands eliminats de respostes HTTP
N-3: memory/api/v1.py → str(e) → error genèric + exc_info=True
N-4: manifest.py → path traversal /ui/static/ bloquejat (resolve+startswith)
N-5: session cleanup asyncio periòdic (cada hora, TTL 24h)
N-6: system health → versió llegida de config (no hardcoded "0.7.1")
N-7+N-8: manifest.py → import duplicat + _initialized eliminats

Tests: +35 (test_security_n_series.py), total 49 passed
Docs: SECURITY.md secció N-series afegida

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: unificar nom server-nexe (inconsistències crítiques)
6d7ebe1 
- security_logger/logger.py: hostname nexe-server → server-nexe
- RUNTIME_CONTRACT.md: nexe.core.server_nexe → core.app (mòdul real)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: unificar nom server-nexe (inconsistències mitjanes)
dd25901 
- manifest.toml (×8): server.nexe/ → server-nexe/ (comentaris i paths)
- nexe script: path hardcodat /NatSytem/server-nexe → /NatSytem/Nexe/server-nexe

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: unificar nom server-nexe (inconsistències baixes)
86a988a 
- cli/output.py: banner title server.nexe → server-nexe
- security/manifest.py: comentari server.nexe root → server-nexe root

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: setup.sh — YELLOW no definit
6422363 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: setup.sh Python >=3.10 + traducció logo installer
26d0263 
- setup.sh: comprovació Python >=3.10 amb missatge clar (brew install python@3.11)
  (python-multipart==0.0.22 i altres deps requereixen Python 3.10+)
- install_nexe.py: logo tagline traduït a català

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: i18n installer — traduir strings hardcoded en català
772c4e3 
- 14 strings hardcoded ara passen per t() (ca/es/en)
- Afegides 37 claus noves a les 3 traduccions:
  - Pantalla selecció de models (mida, model, motor)
  - Descàrrega Ollama/GGUF/MLX (progress steps)
  - Metal fallback (opcions, missatges d'error)
  - rec_label ara usa t('size_small/medium/large')
  - "Motors:" ara usa t('engines_label')

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: setup.sh detecta python3.11 de Homebrew automàticament
649c027 
Prova python3.11/3.12/3.10, paths Homebrew (/opt/homebrew),
i /usr/local/bin abans de caure a python3 del sistema.
Usa PYTHON_BIN per llançar install_nexe.py.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
docs: afegir chmod +x a les instruccions d'instal·lació
7f0e097 
ZIP de GitHub no preserva permisos d'execució.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: i18n model catalog — lang/description/Disc multilingüe
9da2158 
- MODEL_CATALOG: lang i description ara dicts {ca/es/en} per a 7 models
- Afegides claus disk_label i fits_tight a les 3 traduccions
- Display: usa model['lang'][LANG], model['description'][LANG]
- "💾 Disc:" → t('disk_label') (Disc/Disco/Disk)
- "Pot anar just" → t('fits_tight')

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: i18n MLX validation strings (ca/es/en)
6228b46 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: i18n embeddings + ingesta knowledge (ca/es/en)
4ac5377 
install_nexe.py:
- Strings embeddings download/validation ara usen t()
- Passa NEXE_LANG com a env var al subprocess d'ingesta
- Afegides claus: embeddings_*, processing_knowledge_*, knowledge_indexed_ok

core/ingest/ingest_knowledge.py:
- Afegit _I18N dict + _t() que llegeix NEXE_LANG
- Tots els missatges ara multilingüe (ca/es/en)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
feat: capçaleres RAG a knowledge/ + OpenAPI summary a tots els endpoints
d829837 
- knowledge/: 9 documents amb capçalera # === METADATA RAG === (id, abstract,
  tags, chunk_size, priority). README.md mogut de l'arrel a knowledge/ i ara
  és ingestable (id: nexe-overview, P1).
- Exclusió README.md eliminada dels 4 punts d'ingestió (lifespan, cli,
  ingest_knowledge, install_nexe).
- header_parser.py: fix _extract_header — blank lines seguides de comentaris
  de secció (# ===) ja no trenquen el parsing.
- OpenAPI: summary= afegit als 33 endpoints; tags= a routers sense etiquetar
  (system, modules); descripció global enriquida a factory_app.py.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
feat: knowledge/ per idioma + filtre lang a cerca RAG
7d891ea 
- Docs moguts a knowledge/ca/ (estructura multi-idioma).
  El glob **/*.md ja era recursiu, cap canvi de codi a ingestió.
- knowledge/en/ pot afegir-se quan calgui.
- chat.py: cerca user_knowledge filtra per lang=NEXE_LANG (default 'ca')
  via filter_metadata — usa FieldCondition Qdrant existent.
  Cada idioma de servidor retorna només docs en el seu idioma.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: filtre lang knowledge usa i18n runtime + carpetes es/ i en/
d3132ef 
- chat.py: llegeix idioma de req.app.state.i18n.current_language en runtime
  (p.ex. "ca-ES" → "ca"). Fallback: NEXE_LANG env → "ca".
  Aix\xed el selector d'idioma del servidor afecta la cerca RAG immediatament.
- Afegides carpetes knowledge/es/ i knowledge/en/ (buides) per docs futurs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
feat: traduccions knowledge/ a espanyol i anglès
219dd6f 
- knowledge/es/: 9 documents traduïts (API, ARCHITECTURE, INSTALLATION,
  LIMITATIONS, PLUGINS, RAG, README, SECURITY, USAGE)
- knowledge/en/: 9 documents traduïts
- Capçaleres RAG actualitzades: lang ca→es/en, abstract i tags traduïts
- Termes tècnics, blocs de codi, paths i URLs preservats intactes
- 27/27 documents passen validació parse_rag_header

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: ingesta knowledge filtra per idioma actiu + qdrant-client>=1.17.0
d8b29c8 
- core/ingest/ingest_knowledge.py: usa knowledge/{NEXE_LANG}/ si existeix
- core/lifespan.py: aplica mateix filtre de llengua a auto-ingest startup
- core/cli/cli.py: aplica filtre de llengua a 'nexe knowledge ingest'
- install_nexe.py: detecta subcarpeta de llengua per comptatge de fitxers
- knowledge/*.md: eliminats de l'arrel (moviment completat a knowledge/ca/)
- requirements.txt: qdrant-client==1.13.3 → >=1.17.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: models per defecte correctes per tier de hardware
e91ff70 
profiles.py:
- CONSUMER: gemma2:2b → phi3.5 (Phi-3.5 Mini 3.8B, millor instruccions)
- PRO: llama3.2:3b → llama3.1:8b (adequat per 16-32GB RAM)
  secondary: gemma2:9b → mistral:7b | embedding: nomic → all-MiniLM-L6-v2
  context_window: 16384 → 32768
- ULTRA: llama3.1:8b → llama3.1:70b (qualitat màxima per >32GB)
  secondary: mistral-nemo:12b → mixtral:8x7b
  embedding: mxbai-embed-large → all-MiniLM-L6-v2
  context_window: 32768 → 65536

registry.py — afegits 4 nous models:
- salamandra2b (BSC/AINA, Ollama, llengües ibèriques)
- salamandra7b (BSC/AINA, Ollama+GGUF, el millor per català)
- mistral7b (MLX+Ollama+GGUF, equilibri qualitat/velocitat)
- llama3.1-70b (MLX+Ollama+GGUF, qualitat professional)
- mixtral (MLX+Ollama+GGUF, MoE 8x7B)

server.toml:
- secondary: "mistral-nemo:12b" → "" (engine-specific, no hardcoded)
- embedding: "mxbai-embed-large" → "all-MiniLM-L6-v2" (model real del sistema)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: NEXE_OLLAMA_MODEL separa la resolució del model Ollama de NEXE_D…
cc59986 
…EFAULT_MODEL

Problema: _forward_to_ollama usava NEXE_DEFAULT_MODEL que pot contenir
una URL HuggingFace (per llama_cpp/mlx), causant fallback silenciós
al primer model disponible d'Ollama sense cap avís.

Solució:
- Prioritat nova: request.model > NEXE_OLLAMA_MODEL > NEXE_DEFAULT_MODEL
  (si no és URL/path) > config > "llama3.2"
- NEXE_DEFAULT_MODEL amb URLs o paths locals s'ignora per Ollama
- install_nexe.py escriu NEXE_OLLAMA_MODEL quan l'engine és ollama
- _update_env_model_config gestiona NEXE_OLLAMA_MODEL en actualitzacions
- Retrocompatible: instal·lacions existents amb NEXE_DEFAULT_MODEL=nom-ollama
  segueixen funcionant

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: llama.cpp chat_format correcte per model + MLX verificat OK
c17333f 
llama_cpp_module/config.py:
- chat_format default: "gemma" → "chatml" (2 llocs: dataclass + from_env)
- valid_formats ampliat: afegits "llama-3" i "phi-3"

install_nexe.py:
- MODEL_CATALOG: camp "chat_format" a cada model GGUF
  · phi35/salamandra2b/salamandra7b: "chatml"
  · mistral7b/mixtral: "mistral"
  · llama31_8b/llama31_70b: "llama-3"
- generate_env_file: escriu NEXE_LLAMA_CPP_CHAT_FORMAT per engine llama_cpp
- _update_env_model_config: actualitza NEXE_LLAMA_CPP_CHAT_FORMAT en reinstal·lació

MLX: no requereix canvis — mlx-lm llegeix el chat template del tokenizer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
feat: system prompts per idioma i mida de model — Nexe com a guia de …
81fb561 
…Server Nexe

server.toml — 6 prompts nous [personality.prompt]:
- ca_small / ca_full: Nexe com a expert de Server Nexe en català
- es_small / es_full: versió castellà
- en_small / en_full: versió anglès
- small (~100 tok): per a models ≤4B (Phi-3.5, Salamandra 2B)
- full (~200 tok): per a models 7B+ (Llama 3.1, Mistral, Salamandra 7B)

core/endpoints/chat.py — _get_system_prompt():
- Selecciona prompt per lang (NEXE_LANG/i18n) + tier (NEXE_PROMPT_TIER)
- Injecta system prompt automàticament si la request no en porta cap
- RAG context sempre s'afegeix al system message (index 0)

plugins/web_ui_module/manifest.py:
- base_system_prompt llegit de server.toml via _get_system_prompt()
- Fallback al mínim hardcoded si config no disponible

install_nexe.py:
- MODEL_CATALOG: camp "prompt_tier" a cada model (small/full)
- generate_env_file + _update_env_model_config: escriuen NEXE_PROMPT_TIER

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: RAG filtra per NEXE_LANG en lloc de i18n.current_language
f1149b5 
El filtre de knowledge docs usava i18n.current_language ("en-US" per
defecte del mòdul i18n) en lloc de NEXE_LANG ("ca"). Aixó feia que
el filtre metadata{"lang":"en"} no coincidís amb els docs indexats
{"lang":"ca"}, retornant 0 resultats de user_knowledge.

Fix: _server_lang es determina amb os.getenv("NEXE_LANG","ca") fora
del bloc use_rag, garantint que sempre estigui disponible per al
system prompt i que el filtre RAG sigui correcte.

- Tokens de prompt: 142 → 621 (context RAG real injectat)
- user_knowledge: 0 → 3 resultats per query de documentació
- .gitignore: COMMANDS.md i personality/.module_cache.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
chore: eliminar README.md de knowledge/ (mai s'indexa al RAG)
a25da2c 
El codi d'ingestió exclou explícitament README.md. Eliminem els 3
fitxers (ca/en/es) per evitar confusió. Les capçaleres RAG als 24
documents (8 per idioma) ja estaven afegides en sessió anterior.

Verificat: 24/24 capçaleres ✓ (parse_rag_header sense errors)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
revert: restaurar README.md de knowledge/ — sí s'indexa al RAG
f72a514 
El codi d'ingestió NO exclou README.md (filtra només fitxers .hidden).
El README conté info valuosa: overview del projecte, backends disponibles,
estat actual i roadmap. Capçalera RAG: id=nexe-overview, P1, vàlida.

Ara tenim 9 documents per idioma (8 docs + README).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jgoy-labs @claude
fix: auto-save memòria i prompts de memòria millorats
9d036f2 
chat.py:
- Auto-save no es disparava mai: buscava choices[] (format OpenAI) però
  Ollama retorna message.content (format natiu). Fix: fallback a
  response.get("message",{}).get("content","") quan choices està buit.
- Verificat: 💾 logs de save apareixen correctament

server.toml prompts (small, ca/es/en):
- Explicita que [CONTEXT MEMÒRIA] conté converses anteriors, no sols docs
- "Usa-la com si fos la teva pròpia memòria" per millorar recall de noms

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jgoy-labs and others added 16 commits March 13, 2026 17:55
@jgoy-labs
fix: app-container marges superiors i laterals respecten el marc animat
f59ab64
@jgoy-labs
fix: logo per alçada (28px), treu margin-left del container
7c638b9
@jgoy-labs
fix: crop logo.png (710x73, sense espai blanc) + logo sidebar 24px
6f1dd8a
@jgoy-labs
fix: logo sidebar 16px
2472168
@jgoy-labs
fix: logo sidebar 13px
47470e5
@jgoy-labs
fix: body margin:0 padding:0 per eliminar gap entre body i marc
3dbad58
@jgoy-labs
fix: app-container respecta marc esquerra i dreta
9aa609c
@jgoy-labs
feat: status indicator dinàmic (ping /status cada 10s)
9767b74
@jgoy-labs @claude
test: cobertura unitària 74% → 95% (+1.483 tests)
b9e603b 
Tests unitaris generats per Claude Opus 4.6 amb sistema multi-agent
paral·lel (10 agents, 5 fases). 3.912 tests passant, 0 failures.

Inclou fixes menors a producció:
- web_ui_module/manifest.py: fix bug data→request (rag_threshold)
- core/lifespan.py: ModuleManager persistent entre cicles lifespan
- core/middleware.py: CSRF exempt per API endpoints autenticats
- dev-tools/conftest.py: web_ui_module als approved modules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@jgoy-labs
feat: selector de backend/model a la UI + badge RAG als missatges
275dbfb 
- Endpoint /ui/backends: llista Ollama, MLX i Llama.cpp amb els seus models
- Endpoint /ui/backend: canvi de backend/model en runtime
- Selector dropdown al sidebar per canviar backend i model
- Badge RAG (lila) a les stats de cada missatge (quantes memòries usades)
- Token [MODEL:...] per mostrar el model realment usat a les stats
- Pre-selecció automàtica del model actiu al carregar la UI
@jgoy-labs
chore: afegir server-nexe.org a les capçaleres de tots els fitxers
af0487c
@jgoy-labs
chore: moure documentació de tests a docs/testing/
6654b9c
@jgoy-labs
docs: afegir knowledge/TESTING.md (ca/en/es) — documentació de la sui…
b3490b6 
…te de tests
@jgoy-labs
feat: separar documentació tècnica i memòria de l'usuari al context RAG
f97d378 
El model ara rep [DOCUMENTACIÓ TÈCNICA] i [MEMÒRIA DE L'USUARI] com a
blocs separats, perquè pugui distingir entre knowledge base i records
personals de l'usuari.
@jgoy-labs
fix: actualitzar sentence-transformers >=4.0 per compatibilitat amb t…
e303951 
…ransformers 5.x
@dependabot
chore(deps): bump the python-deps group across 1 directory with 15 up…
bd02df4 
…dates

Updates the requirements on [uvicorn[standard]](https://github.com/Kludex/uvicorn), [pydantic](https://github.com/pydantic/pydantic), [tomli](https://github.com/hukkin/tomli), [httpx](https://github.com/encode/httpx), [click](https://github.com/pallets/click), [rich](https://github.com/Textualize/rich), [typer](https://github.com/fastapi/typer), [pyyaml](https://github.com/yaml/pyyaml), [numpy](https://github.com/numpy/numpy), [prometheus-client](https://github.com/prometheus/client_python), [psutil](https://github.com/giampaolo/psutil), [huggingface-hub](https://github.com/huggingface/huggingface_hub), [pypdf](https://github.com/py-pdf/pypdf), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) and [pytest-cov](https://github.com/pytest-dev/pytest-cov) to permit the latest version.

Updates `uvicorn[standard]` from 0.34.3 to 0.39.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.34.3...0.39.0)

Updates `pydantic` from 2.10.6 to 2.12.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.10.6...v2.12.5)

Updates `tomli` from 2.0.1 to 2.4.0
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](hukkin/tomli@2.0.1...2.4.0)

Updates `httpx` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.2...0.28.1)

Updates `click` from 8.1.7 to 8.1.8
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst)
- [Commits](pallets/click@8.1.7...8.1.8)

Updates `rich` from 13.7.0 to 14.3.3
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md)
- [Commits](Textualize/rich@v13.7.0...v14.3.3)

Updates `typer` from 0.9.0 to 0.23.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.9.0...0.23.2)

Updates `pyyaml` from 6.0.1 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.1...6.0.3)

Updates `numpy` from 1.26.4 to 2.0.2
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v1.26.4...v2.0.2)

Updates `prometheus-client` from 0.19.0 to 0.24.1
- [Release notes](https://github.com/prometheus/client_python/releases)
- [Commits](prometheus/client_python@v0.19.0...v0.24.1)

Updates `psutil` from 5.9.8 to 7.2.2
- [Changelog](https://github.com/giampaolo/psutil/blob/master/docs/changelog.rst)
- [Commits](giampaolo/psutil@release-5.9.8...release-7.2.2)

Updates `huggingface-hub` from 0.36.2 to 1.7.1
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v0.36.2...v1.7.1)

Updates `pypdf` from 6.7.5 to 6.9.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.7.5...6.9.0)

Updates `pytest-asyncio` to 1.2.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v0.23.0...v1.2.0)

Updates `pytest-cov` to 7.0.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v5.0.0...v7.0.0)

---
updated-dependencies:
- dependency-name: uvicorn[standard]
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pydantic
  dependency-version: 2.12.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: tomli
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: httpx
  dependency-version: 0.28.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: click
  dependency-version: 8.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: rich
  dependency-version: 14.3.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: typer
  dependency-version: 0.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: numpy
  dependency-version: 2.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: prometheus-client
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: psutil
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: huggingface-hub
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: pypdf
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pytest-asyncio
  dependency-version: 1.2.0
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: pytest-cov
  dependency-version: 7.0.0
  dependency-type: direct:production
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 15, 2026
@jgoy-labs jgoy-labs closed this Mar 15, 2026
@jgoy-labs jgoy-labs deleted the dependabot/pip/python-deps-2734e85e74 branch March 15, 2026 22:28
@dependabot @github

dependabot Bot commented on behalf of github Mar 15, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

jgoy-labs added a commit that referenced this pull request Apr 12, 2026
@jgoy-labs
release: v0.9.0 — 69 bugs tancats (42 sprints + 27 HOMAD) + 201 tests…
8baa187 
… nous

Release consolidada v0.9.0 resultant de dues fases de treball:

## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs)
Coordinat per Uatu amb Claude Opus 4.6 en sessions independents:

- **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1)
- **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background)
- **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer
  - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla
    benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray
    link web, #20 SEC-004 MIME validation
  - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX
- **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py,
  tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n
  get_message() complet
- **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) +
  3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock,
  [MEM:N] token mismatch)

Auditoria global final APTE (Claude Opus 4.6 independent, 2026-04-02).

## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI)
3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test):

**Bloc 1 — Critics (5)**
- #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain
- #8 TOCTOU master key (os.open atomic)
- #10 DreamingCycle connection leak (6/6 funcions)
- #29 Phi-3.5 fora del cataleg
- Ollama GUI: ollama serve headless (no open -a Ollama al Dock)

**Bloc 2 — Mitjana (12)**
- #21 validate_string_input API v1
- #22 auth 21 endpoints + docs gated
- #17 MEM_SAVE injection strict (whitelist Unicode, blacklist)
- #32 history_floor context budget
- #15 Ollama breaker semantic (4xx no infra)
- #16 SessionManager RLock reentrant
- #19 MLX cache singleton double-checked locking
- #11 Bootstrap token renewal + retry backoff (1,5,30)
- #13 Qdrant pool flush + logger.warning
- #20 Module cycles consumer + startup summary
- #9 SQL MIN portable (Python min())
- #28 Installer --skip-model-download

**Bloc 3 — Baixa (11)**
- #3 HF_TOKEN warning silenciat
- #4 ANSI constants buides sense TTY
- #5 Qdrant didactic isatty guards
- #6 warnings position_ids + Some weights filtered
- #12 discover_modules early return
- #14 TQDM_DISABLE runtime servidor
- #18 encoding fallback utf-8 → cp1252 → latin-1
- #23 Ollama no silent fallback → HTTPException 404
- #26 _backend_model_exists best-effort + logger mitigant
- #27 _BACKEND_ALIASES backwards-compat
- #30 Info.plist LSUIElement=false verificats

Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents
amb Dev D intermedi per findings. Tot verificat al codi real.

## Pytest consolidat
**4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated,
test_root::test_enabled_modules, test_security::test_long_context_truncated,
4× test_memory_helper_async::TestGetMemoryApi), 0 regressions.

## Fitxers nous
- core/endpoints/chat_engines/ollama_helpers.py (Sprint 4)
- core/lifespan_modules.py (Sprint 4)
- installer/tray_monitor.py (Sprint 4)
- installer/installer_reinstall.py (Bloc 1 Bug 7)

## Stats
- 61 fitxers modificats (57 codi/knowledge/tests/installer/personality +
  README.md + 3 nous)
- +1870 / -674 linies

## Version bump
v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer)

## Post-release pendent
- Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes
- Notaritzacio Apple (re-firma si cal)
- Test manual DMG per Bug 30 (icona Dock) + smoke tests release
- Webs .org i .com ja desplegades per Uatu durant vacances

NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final
i push a GitHub release.
jgoy-labs added a commit that referenced this pull request Apr 12, 2026
@jgoy-labs
release: v0.9.0 — 69 bugs tancats (42 sprints + 27 HOMAD) + 201 tests…
c0b89f8 
… nous

Release consolidada v0.9.0 resultant de dues fases de treball:

## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs)
Coordinat en sessions independents:

- **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1)
- **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background)
- **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer
  - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla
    benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray
    link web, #20 SEC-004 MIME validation
  - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX
- **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py,
  tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n
  get_message() complet
- **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) +
  3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock,
  [MEM:N] token mismatch)

Auditoria global final APTE (2026-04-02).

## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI)
3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test):

**Bloc 1 — Critics (5)**
- #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain
- #8 TOCTOU master key (os.open atomic)
- #10 DreamingCycle connection leak (6/6 funcions)
- #29 Phi-3.5 fora del cataleg
- Ollama GUI: ollama serve headless (no open -a Ollama al Dock)

**Bloc 2 — Mitjana (12)**
- #21 validate_string_input API v1
- #22 auth 21 endpoints + docs gated
- #17 MEM_SAVE injection strict (whitelist Unicode, blacklist)
- #32 history_floor context budget
- #15 Ollama breaker semantic (4xx no infra)
- #16 SessionManager RLock reentrant
- #19 MLX cache singleton double-checked locking
- #11 Bootstrap token renewal + retry backoff (1,5,30)
- #13 Qdrant pool flush + logger.warning
- #20 Module cycles consumer + startup summary
- #9 SQL MIN portable (Python min())
- #28 Installer --skip-model-download

**Bloc 3 — Baixa (11)**
- #3 HF_TOKEN warning silenciat
- #4 ANSI constants buides sense TTY
- #5 Qdrant didactic isatty guards
- #6 warnings position_ids + Some weights filtered
- #12 discover_modules early return
- #14 TQDM_DISABLE runtime servidor
- #18 encoding fallback utf-8 → cp1252 → latin-1
- #23 Ollama no silent fallback → HTTPException 404
- #26 _backend_model_exists best-effort + logger mitigant
- #27 _BACKEND_ALIASES backwards-compat
- #30 Info.plist LSUIElement=false verificats

Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents
amb Dev D intermedi per findings. Tot verificat al codi real.

## Pytest consolidat
**4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated,
test_root::test_enabled_modules, test_security::test_long_context_truncated,
4× test_memory_helper_async::TestGetMemoryApi), 0 regressions.

## Fitxers nous
- core/endpoints/chat_engines/ollama_helpers.py (Sprint 4)
- core/lifespan_modules.py (Sprint 4)
- installer/tray_monitor.py (Sprint 4)
- installer/installer_reinstall.py (Bloc 1 Bug 7)

## Stats
- 61 fitxers modificats (57 codi/knowledge/tests/installer/personality +
  README.md + 3 nous)
- +1870 / -674 linies

## Version bump
v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer)

## Post-release pendent
- Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes
- Notaritzacio Apple (re-firma si cal)
- Test manual DMG per Bug 30 (icona Dock) + smoke tests release
- Webs .org i .com ja desplegades durant vacances

NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final
i push a GitHub release.
jgoy-labs added a commit that referenced this pull request May 14, 2026
@jgoy-labs
fix(core+installer): apply pointwise assignment annotations (Onada 4.…
2ba150d 
…1 Cluster 7)

9 independent assignment/arg-type findings closed via minimal annotations
or casts (no behavioural change):

- installer/installer_catalog_data.py:450 — cast(str, value) after
  truthy guard (#1)
- core/config.py:115 — pre-declare found_path: Optional[Path] before
  if/else branch (#4)
- core/cli/client.py:46 — declare self._ssl_context: Optional[
  ssl.SSLContext] = None before populating in if-branch (#13)
- core/cli/output.py:33 — annotate module-level console: Any to bridge
  the dual-decl Console / FallbackConsole (#14)
- core/resources.py:110 — cast(Any, resource_path) so Path() accepts
  the importlib.resources Traversable that exposes __fspath__ (#17)
- core/resilience/circuit_breaker.py:76 — annotate __lock_loop:
  Optional[asyncio.AbstractEventLoop] = None (#18)
- core/dependencies.py:43-44 — annotate rate_limit_tracker /
  start_rate_limit_cleanup_task as Optional[Any] = None in the import
  fallback (#29, #30)
- core/cli/cli.py:215 — annotate found: list[tuple[str, Optional[str],
  list[int]]] = [] (#62)
jgoy-labs added a commit that referenced this pull request May 16, 2026
@jgoy-labs
release: v0.9.0 — 69 bugs tancats (42 sprints + 27 HOMAD) + 201 tests…
f4f1428 
… nous

Release consolidada v0.9.0 resultant de dues fases de treball:

## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs)
Coordinat en sessions independents:

- **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1)
- **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background)
- **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer
  - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla
    benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray
    link web, #20 SEC-004 MIME validation
  - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX
- **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py,
  tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n
  get_message() complet
- **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) +
  3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock,
  [MEM:N] token mismatch)

Auditoria global final APTE (2026-04-02).

## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI)
3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test):

**Bloc 1 — Critics (5)**
- #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain
- #8 TOCTOU master key (os.open atomic)
- #10 DreamingCycle connection leak (6/6 funcions)
- #29 Phi-3.5 fora del cataleg
- Ollama GUI: ollama serve headless (no open -a Ollama al Dock)

**Bloc 2 — Mitjana (12)**
- #21 validate_string_input API v1
- #22 auth 21 endpoints + docs gated
- #17 MEM_SAVE injection strict (whitelist Unicode, blacklist)
- #32 history_floor context budget
- #15 Ollama breaker semantic (4xx no infra)
- #16 SessionManager RLock reentrant
- #19 MLX cache singleton double-checked locking
- #11 Bootstrap token renewal + retry backoff (1,5,30)
- #13 Qdrant pool flush + logger.warning
- #20 Module cycles consumer + startup summary
- #9 SQL MIN portable (Python min())
- #28 Installer --skip-model-download

**Bloc 3 — Baixa (11)**
- #3 HF_TOKEN warning silenciat
- #4 ANSI constants buides sense TTY
- #5 Qdrant didactic isatty guards
- #6 warnings position_ids + Some weights filtered
- #12 discover_modules early return
- #14 TQDM_DISABLE runtime servidor
- #18 encoding fallback utf-8 → cp1252 → latin-1
- #23 Ollama no silent fallback → HTTPException 404
- #26 _backend_model_exists best-effort + logger mitigant
- #27 _BACKEND_ALIASES backwards-compat
- #30 Info.plist LSUIElement=false verificats

Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents
amb Dev D intermedi per findings. Tot verificat al codi real.

## Pytest consolidat
**4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated,
test_root::test_enabled_modules, test_security::test_long_context_truncated,
4× test_memory_helper_async::TestGetMemoryApi), 0 regressions.

## Fitxers nous
- core/endpoints/chat_engines/ollama_helpers.py (Sprint 4)
- core/lifespan_modules.py (Sprint 4)
- installer/tray_monitor.py (Sprint 4)
- installer/installer_reinstall.py (Bloc 1 Bug 7)

## Stats
- 61 fitxers modificats (57 codi/knowledge/tests/installer/personality +
  README.md + 3 nous)
- +1870 / -674 linies

## Version bump
v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer)

## Post-release pendent
- Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes
- Notaritzacio Apple (re-firma si cal)
- Test manual DMG per Bug 30 (icona Dock) + smoke tests release
- Webs .org i .com ja desplegades durant vacances

NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final
i push a GitHub release.
jgoy-labs added a commit that referenced this pull request May 16, 2026
@jgoy-labs
fix(core+installer): apply pointwise assignment annotations (Onada 4.…
771a7d1 
…1 Cluster 7)

9 independent assignment/arg-type findings closed via minimal annotations
or casts (no behavioural change):

- installer/installer_catalog_data.py:450 — cast(str, value) after
  truthy guard (#1)
- core/config.py:115 — pre-declare found_path: Optional[Path] before
  if/else branch (#4)
- core/cli/client.py:46 — declare self._ssl_context: Optional[
  ssl.SSLContext] = None before populating in if-branch (#13)
- core/cli/output.py:33 — annotate module-level console: Any to bridge
  the dual-decl Console / FallbackConsole (#14)
- core/resources.py:110 — cast(Any, resource_path) so Path() accepts
  the importlib.resources Traversable that exposes __fspath__ (#17)
- core/resilience/circuit_breaker.py:76 — annotate __lock_loop:
  Optional[asyncio.AbstractEventLoop] = None (#18)
- core/dependencies.py:43-44 — annotate rate_limit_tracker /
  start_rate_limit_cleanup_task as Optional[Any] = None in the import
  fallback (#29, #30)
- core/cli/cli.py:215 — annotate found: list[tuple[str, Optional[str],
  list[int]]] = [] (#62)
jgoy-labs added a commit that referenced this pull request May 16, 2026
@jgoy-labs
fix(core+installer): apply pointwise assignment annotations (Onada 4.…
c086507 
…1 Cluster 7)

9 independent assignment/arg-type findings closed via minimal annotations
or casts (no behavioural change):

- installer/installer_catalog_data.py:450 — cast(str, value) after
  truthy guard (#1)
- core/config.py:115 — pre-declare found_path: Optional[Path] before
  if/else branch (#4)
- core/cli/client.py:46 — declare self._ssl_context: Optional[
  ssl.SSLContext] = None before populating in if-branch (#13)
- core/cli/output.py:33 — annotate module-level console: Any to bridge
  the dual-decl Console / FallbackConsole (#14)
- core/resources.py:110 — cast(Any, resource_path) so Path() accepts
  the importlib.resources Traversable that exposes __fspath__ (#17)
- core/resilience/circuit_breaker.py:76 — annotate __lock_loop:
  Optional[asyncio.AbstractEventLoop] = None (#18)
- core/dependencies.py:43-44 — annotate rate_limit_tracker /
  start_rate_limit_cleanup_task as Optional[Any] = None in the import
  fallback (#29, #30)
- core/cli/cli.py:215 — annotate found: list[tuple[str, Optional[str],
  list[int]]] = [] (#62)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jgoy-labs