$ the-wire · showcase
llama_index clears 243 unfixable alerts by raising dependency pins
By RepoJournal · Filed · About AI Agents
11 people shipped this
logan-markewich
@logan-markewich
3 cited
Dominic Cooney
@dominiccooney
2 cited
VascoSch92
@VascoSch92
1 cited
aashikantkumar
@aashikantkumar
1 cited
Saoud Rizwan
@saoudrizwan
1 cited
johnwschoi
@johnwschoi
1 cited
DarRahman
@DarRahman
juanmichelini
@juanmichelini
malhotra5
@malhotra5
hieptl
@hieptl
dependabot
@dependabot
llama_index lifted pins in 30 packages to eliminate 243 Dependabot alerts, and cline fixed a core bug that stripped image input when a model's capability list was empty.
In llama_index, 26 packages pinned to llama-index-llms-openai-like 0.5.3 carried 78 unfixable Dependabot alerts because transformers<5 lacks patches for three advisories; raising the pin to >=0.8.0 drops transformers from lockfiles entirely [1]. Four manifests with requires-python >=3.9 kept forked resolutions pinning vulnerable versions like nltk 3.9.2 and pillow 9/10.x, accounting for 165 more alerts that uv lock --upgrade could not clear; raising the floor to >=3.10,<4.0 removes them [2]. The CI publish job previously aborted on deleted directories, leaving ~450 packages unpublished to PyPI; it now skips deleted dirs and adds a backfill mode [3]. In cline, two readers bypassed modelHasCapability and read capabilities directly, so an empty list failed open and stripped image input; both now use the documented gate [4], and gateway capabilities are translated in one place [5]. A separate cline fix propagates parent aborts to delegated subagents, so aborting a parent no longer leaves child SessionRuntime work running [6]. OpenHands now auto-loads workspace hooks on conversation start from Agent Canvas [7], and its edit-automation modal can edit custom cron expressions like */10 * * * * [8]. Cline's desktop marketplace was redesigned as a two-pane explorer with full catalog metadata [9].
Action items
- → Run uv lock --upgrade in llama_index sub-packages after pulling the pin and requires-python changes run-llama/llama_index [immediate]
- → Verify any llama_index sub-packages published since the CI job failure are now on PyPI run-llama/llama_index [immediate]
- → Upgrade cline to pick up the abort propagation fix before relying on delegated subagent cancellation cline/cline [plan]
References
- [1] chore: raise llama-index-llms-openai-like pin to 0.8.x in 26 consumers ↗ run-llama/llama_index
- [2] chore: raise requires-python floors keeping vulnerable dep forks alive ↗ run-llama/llama_index
- [3] fix(ci): make sub-package publish survive deleted dirs, add backfill mode ↗ run-llama/llama_index
- [4] fix(core): stop an empty capability list from stripping image input (#13583) ↗ cline/cline
- [5] fix(llms): translate gateway capabilities in one place (#13584) ↗ cline/cline
- [6] fix(core): propagate parent aborts to delegated subagents ↗ cline/cline
- [7] fix(api): auto-load workspace hooks on conversation start ↗ OpenHands/OpenHands
- [8] feat: allow editing a custom cron expression from the edit-automation modal ↗ OpenHands/OpenHands
- [9] Desktop marketplace redesign: two-pane explorer with full catalog metadata (#13653) ↗ cline/cline
