feat(huggingface): add qa and ranking tasks - #2
Open
anishshiva7 wants to merge 54 commits into
Open
Conversation
|
👋 Thanks for your first contribution to Texera, @anishshiva7! You can drive common housekeeping tasks just by leaving a comment. Type the command on its own line. On issues
To find unclaimed work, search Linking sub-issues
You can write references as On pull requests (author only)
You can mention teams as
For the full contribution flow, see CONTRIBUTING.md. |
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 15, 2026 05:02
8507ca5 to
cd08b3a
Compare
anishshiva7
force-pushed
the
hf/04-audio-mediagen
branch
from
June 16, 2026 18:20
2fab0ab to
b77eaec
Compare
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 16, 2026 18:23
dc8dbb2 to
d3d7dd3
Compare
anishshiva7
force-pushed
the
hf/04-audio-mediagen
branch
from
June 19, 2026 18:39
b77eaec to
1ca3ce2
Compare
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 19, 2026 18:58
d3d7dd3 to
c354b43
Compare
anishshiva7
force-pushed
the
hf/04-audio-mediagen
branch
from
June 19, 2026 19:11
1ca3ce2 to
57a901c
Compare
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
2 times, most recently
from
June 19, 2026 20:48
cb6cf1e to
b81c325
Compare
<!-- Thanks for sending a pull request (PR)! Here are some tips for you: 1. If this is your first time, please read our contributor guidelines: [Contributing to Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md) 2. Ensure you have added or run the appropriate tests for your PR 3. If the PR is work in progress, mark it a draft on GitHub. 4. Please write your PR title to summarize what this PR proposes, we are following Conventional Commits style for PR titles as well. 5. Be sure to keep the PR description updated to reflect all changes. --> ### What changes were proposed in this PR? <!-- Please clarify what changes you are proposing. The purpose of this section is to outline the changes. Here are some tips for you: 1. If you propose a new API, clarify the use case for a new API. 2. If you fix a bug, you can clarify why it is a bug. 3. If it is a refactoring, clarify what has been changed. 3. It would be helpful to include a before-and-after comparison using screenshots or GIFs. 4. Please consider writing useful notes for better and faster reviews. --> Adds a unit test spec for `TextGenCodegen`. Tests cover: - `task` equals `"text-generation"` - `payloadPython(ctx)` opens with the `if task == "text-generation":` branch - `payloadPython(ctx)` emits the chat-completions shape (`messages`, `max_tokens`, `temperature`) - `payloadPython(ctx)` includes the `else` fallback with `{"inputs": prompt_value}` - `parsePython(ctx)` reads from `choices` / `message` / `content` - No raw-string leakage: snippets reference `self.*` attributes, never literal context values - Context-independence: two different `CodegenContext` inputs produce identical output ### Any related issues, documentation, discussions? <!-- Please use this section to link other resources if not mentioned already. 1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves apache#1234` or `Closes apache#1234`. If it is only related, simply mention the issue number. 2. If there is design documentation, please add the link. 3. If there is a discussion in the mailing list, please add the link. --> Closes apache#5778 ### How was this PR tested? <!-- If tests were added, say they were added here. Or simply mention that if the PR is tested with existing test cases. Make sure to include/update test cases that check the changes thoroughly including negative and positive cases if possible. If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future. If tests were not added, please describe why they were not added and/or why it was difficult to add. --> Spec verified with `sbt "WorkflowOperator/testOnly *TextGenCodegenSpec"`. 7 tests passing. ### Was this PR authored or co-authored using generative AI tooling? <!-- If generative AI tooling has been used in the process of authoring this PR, please include the phrase: 'Generated-by: ' followed by the name of the tool and its version. If no, write 'No'. Please refer to the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) for details. --> Coauthored-by: Claude Code (Anthropic)
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 19, 2026 21:20
b81c325 to
ce76952
Compare
<!-- Thanks for sending a pull request (PR)! Here are some tips for you: 1. If this is your first time, please read our contributor guidelines: [Contributing to Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md) 2. Ensure you have added or run the appropriate tests for your PR 3. If the PR is work in progress, mark it a draft on GitHub. 4. Please write your PR title to summarize what this PR proposes, we are following Conventional Commits style for PR titles as well. 5. Be sure to keep the PR description updated to reflect all changes. --> ### What changes were proposed in this PR? <!-- Please clarify what changes you are proposing. The purpose of this section is to outline the changes. Here are some tips for you: 1. If you propose a new API, clarify the use case for a new API. 2. If you fix a bug, you can clarify why it is a bug. 3. If it is a refactoring, clarify what has been changed. 3. It would be helpful to include a before-and-after comparison using screenshots or GIFs. 4. Please consider writing useful notes for better and faster reviews. --> Adds a behavior-focused unit test spec for `AdminGuardService`. Tests cover: - Admin user: `canActivate()` returns `true`, `Router.navigate` is NOT called - Non-admin user: `canActivate()` returns `false`, `Router.navigate` is called with `[USER_WORKFLOW]` - No signed-in user: `canActivate()` returns `false`, `Router.navigate` is called with `[USER_WORKFLOW]` Mirrors the existing `auth-guard.service.spec.ts` pattern. ### Any related issues, documentation, discussions? <!-- Please use this section to link other resources if not mentioned already. 1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves apache#1234` or `Closes apache#1234`. If it is only related, simply mention the issue number. 2. If there is design documentation, please add the link. 3. If there is a discussion in the mailing list, please add the link. --> closes apache#5780 ### How was this PR tested? <!-- If tests were added, say they were added here. Or simply mention that if the PR is tested with existing test cases. Make sure to include/update test cases that check the changes thoroughly including negative and positive cases if possible. If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future. If tests were not added, please describe why they were not added and/or why it was difficult to add. --> Spec verified with `npx ng test --watch=false --include='**/admin-guard.service.spec.ts'`. 3 tests passing. ### Was this PR authored or co-authored using generative AI tooling? <!-- If generative AI tooling has been used in the process of authoring this PR, please include the phrase: 'Generated-by: ' followed by the name of the tool and its version. If no, write 'No'. Please refer to the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) for details. --> Co-Authored: Claude Code (Anthropic)
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 19, 2026 21:37
ce76952 to
292b800
Compare
… abstractions and small Jackson config bags (apache#5770) ### What changes were proposed in this PR? Pin behavior of four small contract / config classes in `common/workflow-operator/`. Each is too thin to justify its own PR but the bundle stays cohesive (everything sits in the descriptor / metadata surface). No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `SourceOperatorDescriptorSpec` | `SourceOperatorDescriptor` (abstract) | 4 | | `PythonSourceOperatorDescriptorSpec` | `PythonSourceOperatorDescriptor` (abstract) | 5 | | `GaugeChartStepsSpec` | `GaugeChartSteps` (Jackson bag) | 7 | | `DummyPropertiesSpec` | `DummyProperties` (Jackson bag) | 7 | All four spec files follow the `<srcClassName>Spec.scala` one-to-one convention. **Behavior pinned — `SourceOperatorDescriptor`** | Surface | Contract | | --- | --- | | `sourceSchema()` | declared as an abstract member; pinned via a minimal test-only concrete subclass | | `LogicalOp` inheritance | upcast compiles; `case _: LogicalOp` and `case _: SourceOperatorDescriptor` both match a concrete instance | **Behavior pinned — `PythonSourceOperatorDescriptor`** | Surface | Contract | | --- | --- | | Composition | a concrete subclass IS a `SourceOperatorDescriptor` AND a `PythonOperatorDescriptor` (compile-time enforced + four-way `isInstanceOf` check) | | Inherited defaults | `parallelizable() == false` and `asSource() == false` (the documented base defaults) when the subclass does not override | **Behavior pinned — `GaugeChartSteps`** | Surface | Contract | | --- | --- | | Defaults | `start == ""` and `end == ""` on a fresh instance | | Mutability | both fields are `var`-assignable post-construction | | JSON wire-keys | serialize under `start` / `end` (Jackson tree-API verified) | | JSON round-trip | preserves both fields | | Annotations | `@JsonProperty("start")` and `@JsonProperty("end")` on the corresponding fields (verified via reflection) | | Instance independence | no static state shared across `new` | **Behavior pinned — `DummyProperties`** | Surface | Contract | | --- | --- | | Defaults | `dummyProperty == ""` and `dummyValue == ""` | | Mutability | both fields are `var`-assignable | | JSON round-trip | preserves both fields (including the default-empty round-trip) | | Annotations | `@JsonProperty` present on both fields | | Instance independence | no static state shared across `new` | ### Any related issues, documentation, discussions? Closes apache#5767. ### How was this PR tested? Pure unit-test additions; verified locally with: - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.source.SourceOperatorDescriptorSpec org.apache.texera.amber.operator.source.PythonSourceOperatorDescriptorSpec org.apache.texera.amber.operator.visualization.gaugeChart.GaugeChartStepsSpec org.apache.texera.amber.operator.DummyPropertiesSpec"` — 23 tests, all green - `sbt scalafmtCheckAll` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.7 [1M context])
…zOp (descriptor + executor pairs) (apache#5769) ### What changes were proposed in this PR? Pin behavior of two previously-uncovered standalone operators (descriptor + executor pairs). No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `SplitOpDescSpec` | `SplitOpDesc` | 8 | | `SplitOpExecSpec` | `SplitOpExec` | 7 | | `UrlVizOpDescSpec` | `UrlVizOpDesc` | 7 | | `UrlVizOpExecSpec` | `UrlVizOpExec` | 6 | All four spec files follow the `<srcClassName>Spec.scala` one-to-one convention. **Behavior pinned — `SplitOpDesc`** | Surface | Contract | | --- | --- | | `operatorInfo` | name `"Split"`, group `UTILITY_GROUP`, one input, two outputs (PortIdentity 0 = training, PortIdentity 1 = testing) | | Field defaults | `k = 80`, `random = true`, `seed = 1` | | `getPhysicalOp` | wires `OpExecWithClassName("…operator.split.SplitOpExec", <json>)`; non-parallelizable; payload includes the `k` / `random` / `seed` wire-keys | | Schema propagation | propagates the single input schema to every output port; throws `IllegalArgumentException` unless exactly one input is supplied | | Independent instances | `operatorIdentifier` (UUID-seeded) differs across `new` | **Behavior pinned — `SplitOpExec`** | Surface | Contract | | --- | --- | | `k = 100` | every tuple emitted on PortIdentity 0 (training) | | `k = 0` | every tuple emitted on PortIdentity 1 (testing) | | Deterministic seed | two fresh instances with the same `(k, seed)` produce identical port sequences over 200 tuples | | `k = 50` (deterministic seed) | ~50% ratio over 2000 tuples (±150 band — safely outside binomial 3σ ≈ 67) | | `close()` | clears the `random` reference to `null` | | `processTuple` (single-port overload) | throws `NotImplementedError` | | Malformed descriptor JSON | construction throws `JsonProcessingException` | **Behavior pinned — `UrlVizOpDesc`** | Surface | Contract | | --- | --- | | `operatorInfo` | name `"URL Visualizer"`, group `VISUALIZATION_MEDIA_GROUP` | | `getPhysicalOp` | wires `OpExecWithClassName("…operator.visualization.urlviz.UrlVizOpExec", <json>)` | | Output schema | propagation function ignores input and emits a single `html-content` STRING attribute | | `urlContentAttrName` annotations | `@JsonProperty(required = true)` + `@AutofillAttributeName` + `@NotNull` (verified via reflection) | | Class-level `@JsonSchemaInject` | restricts `urlContentAttrName` to STRING attributes | | Independent instances | `operatorIdentifier` (UUID-seeded) differs across `new` | **Behavior pinned — `UrlVizOpExec`** | Surface | Contract | | --- | --- | | `processTuple` | emits a single `TupleLike` whose only value contains the generated HTML | | Generated HTML | `<!DOCTYPE html>` preamble; `<iframe src="…">` interpolates the input URL; `frameborder="0"` and the `height:100vh; width:100%; border:none` sizing style | | Per-tuple cardinality | exactly one emission per `processTuple` call | | Distinct URLs | interpolated into distinct outputs | | Malformed descriptor JSON | construction throws `JsonProcessingException` | **Test-harness note** `UrlVizOpDesc` declares `urlContentAttrName: val = ""`; the production code seeds it via `objectMapper.readValue` and the `jackson-module-no-ctor-deser` module that bypasses immutable vals. To test the executor without touching production code, `UrlVizOpExecSpec` builds the descriptor JSON via Jackson's tree API and injects both the `operatorType` discriminator (`"URLVisualizer"`, per `LogicalOp`'s `@JsonSubTypes` table) and the `urlContentAttrName` field. ### Any related issues, documentation, discussions? Closes apache#5766. ### How was this PR tested? Pure unit-test additions; verified locally with: - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.split.SplitOpDescSpec org.apache.texera.amber.operator.split.SplitOpExecSpec org.apache.texera.amber.operator.visualization.urlviz.UrlVizOpDescSpec org.apache.texera.amber.operator.visualization.urlviz.UrlVizOpExecSpec"` — 30 tests, all green - `sbt scalafmtCheckAll` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.7 [1M context])
…#4962) Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.10.0 to 8.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ajv-validator/ajv/releases">ajv's releases</a>.</em></p> <blockquote> <h2>v8.18.0</h2> <h2>What's Changed</h2> <ul> <li>feat: allow tree-shaking by adding <code>"sideEffects": false</code> to <code>package.json</code> by <a href="https://github.com/josdejong"><code>@josdejong</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2480">ajv-validator/ajv#2480</a></li> <li>fix: <a href="https://redirect.github.com/ajv-validator/ajv/issues/2482">#2482</a> Infinity and NaN serialise to null by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2487">ajv-validator/ajv#2487</a></li> <li>fix: small grammatical error in managing-schemas.md by <a href="https://github.com/monteiro-renato"><code>@monteiro-renato</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2508">ajv-validator/ajv#2508</a></li> <li>fix: typos in schema-language.md by <a href="https://github.com/monteiro-renato"><code>@monteiro-renato</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2507">ajv-validator/ajv#2507</a></li> <li>fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by <a href="https://github.com/epoberezkin"><code>@epoberezkin</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2586">ajv-validator/ajv#2586</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/josdejong"><code>@josdejong</code></a> made their first contribution in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2480">ajv-validator/ajv#2480</a></li> <li><a href="https://github.com/monteiro-renato"><code>@monteiro-renato</code></a> made their first contribution in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2508">ajv-validator/ajv#2508</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0">https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0</a></p> <h2>v8.17.1</h2> <h2>What's Changed</h2> <ul> <li>bump version to 8.17.1 by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2472">ajv-validator/ajv#2472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ajv-validator/ajv/compare/v8.17.0...v8.17.1">https://github.com/ajv-validator/ajv/compare/v8.17.0...v8.17.1</a></p> <h2>Plus everything in 8.17.0 which failed to release</h2> <p>The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.</p> <p>Revert "Revert fast-uri change (<a href="https://redirect.github.com/ajv-validator/ajv/pull/2444">ajv-validator/ajv#2444</a>)" by <a href="https://github.com/gurgunday"><code>@gurgunday</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2448">ajv-validator/ajv#2448</a> fix: ignore new eslint error for <code>@typescript-eslint/no-extraneous-class</code> by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2455">ajv-validator/ajv#2455</a> docs: clarify behaviour of addVocabulary by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2454">ajv-validator/ajv#2454</a> docs: refactor to improve legibility by <a href="https://github.com/blottn"><code>@blottn</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2432">ajv-validator/ajv#2432</a> Fix grammatical typo in managing-schemas.md by <a href="https://github.com/wetneb"><code>@wetneb</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2305">ajv-validator/ajv#2305</a> docs: Fix broken strict-mode link by <a href="https://github.com/alexanderjsx"><code>@alexanderjsx</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2459">ajv-validator/ajv#2459</a> feat: add test for encoded refs and bump fast-uri by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2449">ajv-validator/ajv#2449</a> fix: changes for <code>@typescript-eslint/array-type</code> rule by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2467">ajv-validator/ajv#2467</a> fixes <a href="https://redirect.github.com/ajv-validator/ajv/issues/2217">ajv-validator/ajv#2217</a> - clarify custom keyword naming by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2457">ajv-validator/ajv#2457</a></p> <h2>v8.17.0</h2> <h2>What's Changed</h2> <p>The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.</p> <ul> <li>Revert "Revert fast-uri change (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2444">#2444</a>)" by <a href="https://github.com/gurgunday"><code>@gurgunday</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2448">ajv-validator/ajv#2448</a></li> <li>fix: ignore new eslint error for <code>@typescript-eslint/no-extraneous-class</code> by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2455">ajv-validator/ajv#2455</a></li> <li>docs: clarify behaviour of addVocabulary by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2454">ajv-validator/ajv#2454</a></li> <li>docs: refactor to improve legibility by <a href="https://github.com/blottn"><code>@blottn</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2432">ajv-validator/ajv#2432</a></li> <li>Fix grammatical typo in managing-schemas.md by <a href="https://github.com/wetneb"><code>@wetneb</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2305">ajv-validator/ajv#2305</a></li> <li>docs: Fix broken strict-mode link by <a href="https://github.com/alexanderjsx"><code>@alexanderjsx</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2459">ajv-validator/ajv#2459</a></li> <li>feat: add test for encoded refs and bump fast-uri by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2449">ajv-validator/ajv#2449</a></li> <li>fix: changes for <code>@typescript-eslint/array-type</code> rule by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2467">ajv-validator/ajv#2467</a></li> <li>fixes <a href="https://redirect.github.com/ajv-validator/ajv/issues/2217">#2217</a> - clarify custom keyword naming by <a href="https://github.com/jasoniangreen"><code>@jasoniangreen</code></a> in <a href="https://redirect.github.com/ajv-validator/ajv/pull/2457">ajv-validator/ajv#2457</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ajv-validator/ajv/commit/142ce84b807c4fe66e619c22480a28d0e4bd50fa"><code>142ce84</code></a> 8.18.0</li> <li><a href="https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5"><code>720a23f</code></a> fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...</li> <li><a href="https://github.com/ajv-validator/ajv/commit/82735a15826a30cc51e97a1bbfb59b3d388e4b98"><code>82735a1</code></a> fix: typos in schema-language.md (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2507">#2507</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/b17ec32cd97542e90ae27231d8a8bce88b9e53b6"><code>b17ec32</code></a> fix: small grammatical error in managing-schemas.md (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2508">#2508</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/69568d08564303e2c32a2de61feb833b41075f96"><code>69568d0</code></a> fix: <a href="https://redirect.github.com/ajv-validator/ajv/issues/2482">#2482</a> Infinity and NaN serialise to null (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2487">#2487</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/f06766f33ed7291f84c19f22a1286a34475fbdaf"><code>f06766f</code></a> feat: allow tree-shaking by adding ``"sideEffects": false<code>to</code>package.json` ...</li> <li><a href="https://github.com/ajv-validator/ajv/commit/9050ba1359fb87cd7c143f3c79513ea7624ea443"><code>9050ba1</code></a> bump version to 8.17.1 (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2472">#2472</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/f7831b41c3a27064c6219f51a1e7371ffb582dfe"><code>f7831b4</code></a> fixes <a href="https://redirect.github.com/ajv-validator/ajv/issues/2217">#2217</a> - clarify custom keyword naming (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2457">#2457</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/a523784388a79ce65e42caf4d2731da36a94b386"><code>a523784</code></a> fix: changes for <code>@typescript-eslint/array-type</code> rule (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2467">#2467</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/595fe58e64e8d5fb8a50fd7a58f9e7f3bcca0bac"><code>595fe58</code></a> feat: add test for encoded refs and bump fast-uri (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2449">#2449</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ajv-validator/ajv/compare/v8.10.0...v8.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#4961) Bumps [elysia](https://github.com/elysiajs/elysia) from 1.4.18 to 1.4.27. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/elysiajs/elysia/releases">elysia's releases</a>.</em></p> <blockquote> <h2>1.4.27</h2> <h2>What's changed</h2> <p>Bug fix:</p> <ul> <li>getSchemaValidator: handle TypeBox as sub type</li> <li>handle cookie prototype pollution when parsing cookie</li> </ul> <p>Improvement:</p> <ul> <li>conditional async on getSchemaValidator when schema is Standard Schema</li> <li>use Response.json on Bun</li> <li>export <code>AnySchema</code>, <code>UnwrapSchema</code>, <code>ModelsToTypes</code> from root</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.26...1.4.27">https://github.com/elysiajs/elysia/compare/1.4.26...1.4.27</a></p> <h2>1.4.26</h2> <h2>What's changed</h2> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a> deduplicate local handler from global event</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a> system router with trailing path doesn't match with non-trailing</li> <li>url format redos</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a> parsing request from mount hang</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.25...1.4.26">https://github.com/elysiajs/elysia/compare/1.4.25...1.4.26</a></p> <h2>1.4.25</h2> <h2>What's changed</h2> <p>Feature:</p> <ul> <li>export ElysiaStatus</li> </ul> <p>Bug fix:</p> <ul> <li>macro with conflict literal value per status</li> <li>recursive macro with conflict value per status</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.24...1.4.25">https://github.com/elysiajs/elysia/compare/1.4.24...1.4.25</a></p> <h2>1.4.24</h2> <h2>What's Changed</h2> <p>Feature:</p> <ul> <li>graceful unsigned cookie transition</li> </ul> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1733">#1733</a> preserve multiple set-cookie headers in mounted handlers by <a href="https://github.com/cipher416"><code>@cipher416</code></a></li> <li>object cookie with secret doesn't deserialized after parsed</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cipher416"><code>@cipher416</code></a> made their first contribution in <a href="https://redirect.github.com/elysiajs/elysia/pull/1733">elysiajs/elysia#1733</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.23...1.4.24">https://github.com/elysiajs/elysia/compare/1.4.23...1.4.24</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md">elysia's changelog</a>.</em></p> <blockquote> <h1>1.4.27 - 1 Mar 2026</h1> <p>Bug fix:</p> <ul> <li>getSchemaValidator: handle TypeBox as sub type</li> <li>handle cookie prototype pollution when parsing cookie</li> </ul> <p>Improvement:</p> <ul> <li>conditional async on getSchemaValidator when schema is Standard Schema</li> <li>use Response.json on Bun</li> </ul> <h1>1.4.26 - 25 Feb 2026</h1> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a> deduplicate local handler from global event</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a> system router with trailing path doesn't match with non-trailing</li> <li>url format redos</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a> parsing request from mount hang</li> </ul> <h1>1.4.25 - 12 Feb 2026</h1> <p>Feature:</p> <ul> <li>export ElysiaStatus</li> </ul> <p>Bug fix:</p> <ul> <li>macro with conflict literal value per status</li> <li>recursive macro with conflict value per status</li> </ul> <h1>1.4.24 - 11 Feb 2026</h1> <p>Feature:</p> <ul> <li>graceful unsigned cookie transition</li> </ul> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1733">#1733</a> preserve multiple set-cookie headers in mounted handlers</li> <li>object cookie with secret doesn't deserialized after parsed</li> </ul> <h1>1.4.23 - 9 Feb 2026</h1> <p>Feature:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1719">#1719</a> add t.Union/t.Intersection handling in property enumerations/checks</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1697">#1697</a> extend complex formdata support to StandardSchema</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1675">#1656</a> serialize custom array-like custom class with array sub class</li> </ul> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1721">#1721</a> Promise<!-- raw HTML omitted --> with response schema</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1700">#1700</a> distinct union object</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1683">#1683</a> response validation returns 500 instead of 422 for nested schemas in dynamic mode</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1679">#1679</a> preserve headers when throwing from AsyncGenerator</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1595">#1595</a> stream reference should point to teed value</li> <li>fix can't modify immutable headers error</li> </ul> <p>Change:</p> <ul> <li>update exact-mirror to 0.2.7</li> </ul> <h1>1.4.22 - 14 Jan 2026</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/elysiajs/elysia/commit/cc9159b5c60a8eb16bbac4525005e2b5880d3624"><code>cc9159b</code></a> :tada: feat: 1.4.27</li> <li><a href="https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab"><code>e9d6b17</code></a> :tada: feat: 1.4.27</li> <li><a href="https://github.com/elysiajs/elysia/commit/21dce4c9b84c3151490a9c8c4ef851f1dc676a3f"><code>21dce4c</code></a> :tada: feat: use Response.json on Bun</li> <li><a href="https://github.com/elysiajs/elysia/commit/6b44646f5cb5ae61bb3f2a7bcf269cd90971f4e3"><code>6b44646</code></a> :wrench: fix(getSchemaValidator): handle TypeBox as sub type</li> <li><a href="https://github.com/elysiajs/elysia/commit/bbaf6b7f729b858a7435bf28b97119112177479e"><code>bbaf6b7</code></a> :tada: feat: 1.4.26</li> <li><a href="https://github.com/elysiajs/elysia/commit/e596dab627d54dd194511532faf20d59e2e92f96"><code>e596dab</code></a> :wrench: fix: <a href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a> parsing request from mount hang</li> <li><a href="https://github.com/elysiajs/elysia/commit/6561d614f7f2462a2fe162b99f78a6af58e85565"><code>6561d61</code></a> :wrench: fix: <a href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a> system router with trailing path doesn't match with non-t...</li> <li><a href="https://github.com/elysiajs/elysia/commit/3c9dabc47409c2f104e2a954a459c72aa94e38f5"><code>3c9dabc</code></a> :wrench: fix: <a href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a> system router with trailing path doesn't match with non-t...</li> <li><a href="https://github.com/elysiajs/elysia/commit/d17a7aa204b5feea65d6d8f7651fb7141fb322bd"><code>d17a7aa</code></a> :wrench: fix: <a href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a> deduplicate local handler from global event</li> <li><a href="https://github.com/elysiajs/elysia/commit/e5c9449d4c10dbddd01dda726a80a0b8dc16d68c"><code>e5c9449</code></a> :wrench: fix: recursive macro with conflict value per status</li> <li>Additional commits viewable in <a href="https://github.com/elysiajs/elysia/compare/1.4.18...1.4.27">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for elysia since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.13 to 7.5.16. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a> 7.5.16</li> <li><a href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a> do not apply PAX header fields to meta entries</li> <li><a href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a> update project deps</li> <li><a href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a> fix inconsequential typo in PENDINGLINKS symbol name</li> <li><a href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a> remove some uses of mutate-fs</li> <li><a href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a> 7.5.15</li> <li><a href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a> fix: regression in pending links detection</li> <li><a href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a> 7.5.14</li> <li><a href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a> stricter protection against hardlinks preempting their targets</li> <li><a href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a> update workflows and deps</li> <li>See full diff in <a href="https://github.com/isaacs/node-tar/compare/v7.5.13...v7.5.16">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps torch from 2.8.0 to 2.12.0+cpu. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…pache#5811) Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.13.2 to 2.14.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16"><code>3f97c64</code></a> v2.14.1</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7"><code>0cc9550</code></a> fix: reject UNC paths (<a href="https://redirect.github.com/vitejs/launch-editor/issues/138">#138</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6"><code>afd1ab9</code></a> ci: run tests on mac and windows (<a href="https://redirect.github.com/vitejs/launch-editor/issues/136">#136</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931"><code>0bfa328</code></a> test: add some tests for launch-editor package (<a href="https://redirect.github.com/vitejs/launch-editor/issues/135">#135</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3"><code>1b006ae</code></a> chore: add README (<a href="https://redirect.github.com/vitejs/launch-editor/issues/134">#134</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272"><code>383ef26</code></a> v2.14.0</li> <li><a href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181"><code>6277209</code></a> ci: harden publish settings</li> <li><a href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3"><code>520b2f7</code></a> fix(deps): update all non-major dependencies (<a href="https://redirect.github.com/vitejs/launch-editor/issues/129">#129</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5"><code>475ac66</code></a> chore(deps): update dependency lint-staged to v17 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/130">#130</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0"><code>247bf1d</code></a> chore(deps): update dependency yorkie to v2 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/131">#131</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/launch-editor/compare/v2.13.2...v2.14.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for launch-editor since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[4.2.0] - 2026-06-01</h2> <h3>Added</h3> <ul> <li>Added <code>docs/safety.md</code> with notes about processing untrusted YAML.</li> <li>Added <code>maxDepth</code> (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.</li> <li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a problem after <code>merge</code> fix, but an additional restriction for safety.</li> <li>Added sourcemaps to <code>dist/</code> builds.</li> </ul> <h3>Changed</h3> <ul> <li>Stop resolving numbers with underscores as numeric scalars, <a href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li> <li>Switched dev toolchains to Vite / neostandard.</li> <li>Updated demo.</li> <li>Reorganized tests.</li> <li><code>dist/</code> files are no longer kept in the repository.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix parsing of properties on the first implicit block mapping key, <a href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li> <li>Fix trailing whitespace handling when folding flow scalar lines, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li> <li>Reject top-level block scalars without content indentation, <a href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li> <li>Ensure numbers survive round-trip, <a href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li> <li>Fix test coverage for issue <a href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li> <li>Fix flow scalar trailing whitespace folding, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li> <li>Fix digits in YAML named tag handles.</li> </ul> <h3>Security</h3> <ul> <li>Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).</li> </ul> <h2>[3.14.2] - 2025-11-15</h2> <h3>Security</h3> <ul> <li>Backported v4.1.1 fix to v3</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/arrow/releases">pyarrow's releases</a>.</em></p> <blockquote> <h2>Apache Arrow 23.0.1</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p> <h2>Apache Arrow 23.0.1 RC0</h2> <p>Release Notes: Release Candidate: 23.0.1 RC0</p> <h2>Apache Arrow 23.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p> <h2>Apache Arrow 23.0.0 RC2</h2> <p>Release Notes: Release Candidate: 23.0.0 RC2</p> <h2>Apache Arrow 22.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p> <h2>Apache Arrow 22.0.0 RC1</h2> <p>Release Notes: Release Candidate: 22.0.0 RC1</p> <h2>Apache Arrow 22.0.0 RC0</h2> <p>Release Notes: Release Candidate: 22.0.0 RC0</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a> MINOR: [Release] Update versions for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a> MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a> MINOR: [Release] Update CHANGELOG.md for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>: [C++][Gandiva] Detect overflow in repeat() (<a href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li> <li><a href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a> <a href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a> [R][C++] Bump C++20 in R build infrastructure (<a href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li> <li><a href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>: [CI] Update Debian version in <code>.env</code> (<a href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li> <li><a href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>: [Python] Require GIL for string comparison (<a href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li> <li><a href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>: [Packaging][Python] Remove nightly cython install from manylinux wh...</li> <li><a href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>: [C++] Don't consider <code>out_of_range</code> an error in float parsing (<a href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li> <li><a href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>: [CI][Python] Fix test_download_tzdata_on_windows by adding required...</li> <li>Additional commits viewable in <a href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Xinyuan Lin <xinyual3@uci.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.0 to 9.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.0.3</h2> <h1>pytest 9.0.3 (2026-04-07)</h1> <h2>Bug fixes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12444">#12444</a>: Fixed <code>pytest.approx</code> which now correctly takes into account <code>~collections.abc.Mapping</code> keys order to compare them.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13634">#13634</a>: Blocking a <code>conftest.py</code> file using the <code>-p no:</code> option is now explicitly disallowed.</p> <p>Previously this resulted in an internal assertion failure during plugin loading.</p> <p>Pytest now raises a clear <code>UsageError</code> explaining that conftest files are not plugins and cannot be disabled via <code>-p</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13734">#13734</a>: Fixed crash when a test raises an exceptiongroup with <code>__tracebackhide__ = True</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14195">#14195</a>: Fixed an issue where non-string messages passed to <!-- raw HTML omitted -->unittest.TestCase.subTest()<!-- raw HTML omitted --> were not printed.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14343">#14343</a>: Fixed use of insecure temporary directory (CVE-2025-71176).</p> </li> </ul> <h2>Improved documentation</h2> <ul> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/13388">#13388</a>: Clarified documentation for <code>-p</code> vs <code>PYTEST_PLUGINS</code> plugin loading and fixed an incorrect <code>-p</code> example.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/13731">#13731</a>: Clarified that capture fixtures (e.g. <code>capsys</code> and <code>capfd</code>) take precedence over the <code>-s</code> / <code>--capture=no</code> command-line options in <code>Accessing captured output from a test function <accessing-captured-output></code>.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14088">#14088</a>: Clarified that the default <code>pytest_collection</code> hook sets <code>session.items</code> before it calls <code>pytest_collection_finish</code>, not after.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14255">#14255</a>: TOML integer log levels must be quoted: Updating reference documentation.</li> </ul> <h2>Contributor-facing changes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12689">#12689</a>: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible <a href="https://app.codecov.io/gh/pytest-dev/pytest/tests">on the web interface</a>.</p> <p>-- by <code>aleguy02</code></p> </li> </ul> <h2>9.0.2</h2> <h1>pytest 9.0.2 (2025-12-06)</h1> <h2>Bug fixes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13896">#13896</a>: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.</p> <p>You may enable it again by passing <code>-p terminalprogress</code>. We may enable it by default again once compatibility improves in the future.</p> <p>Additionally, when the environment variable <code>TERM</code> is <code>dumb</code>, the escape codes are no longer emitted, even if the plugin is enabled.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13904">#13904</a>: Fixed the TOML type of the <code>tmp_path_retention_count</code> settings in the API reference from number to string.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>: The private <code>config.inicfg</code> attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytest-dev/pytest/commit/a7d58d7a21b78581e636bbbdea13c66ad1657c1e"><code>a7d58d7</code></a> Prepare release version 9.0.3</li> <li><a href="https://github.com/pytest-dev/pytest/commit/089d98199c253d8f89a040243bc4f2aa6cd5ab22"><code>089d981</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14366">#14366</a> from bluetech/revert-14193-backport</li> <li><a href="https://github.com/pytest-dev/pytest/commit/8127eaf4ab7f6b2fdd0dc1b38343ec97aeef05ac"><code>8127eaf</code></a> Revert "Fix: assertrepr_compare respects dict insertion order (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14050">#14050</a>) (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14193">#14193</a>)"</li> <li><a href="https://github.com/pytest-dev/pytest/commit/99a7e6029e7a6e8d53e5df114b1346e035370241"><code>99a7e60</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14363">#14363</a> from pytest-dev/patchback/backports/9.0.x/95d8423bd...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/ddee02a578da30dd43aedc39c1c1f1aaadfcee95"><code>ddee02a</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14343">#14343</a> from bluetech/cve-2025-71176-simple</li> <li><a href="https://github.com/pytest-dev/pytest/commit/74eac6916fee34726cb194f16c516e96fbd29619"><code>74eac69</code></a> doc: Update training info (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14298">#14298</a>) (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14301">#14301</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/f92dee777cfdb77d1c43633d02766ddf1f07c869"><code>f92dee7</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14267">#14267</a> from pytest-dev/patchback/backports/9.0.x/d6fa26c62...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/7ee58acc8777c31ac6cf388d01addf5a414a7439"><code>7ee58ac</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/12378">#12378</a> from Pierre-Sassoulas/fix-implicit-str-concat-and-d...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/37da870d37e3a2f5177cae075c7b9ae279432bf8"><code>37da870</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14259">#14259</a> from mitre88/patch-4 (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14268">#14268</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/c34bfa3b7acb65b594707c714f1d8461b0304eed"><code>c34bfa3</code></a> Add explanation for string context diffs (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14257">#14257</a>) (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14266">#14266</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pytest-dev/pytest/compare/7.4.0...9.0.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#5820) Bumps [elysia](https://github.com/elysiajs/elysia) from 1.4.27 to 1.4.29. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/elysiajs/elysia/releases">elysia's releases</a>.</em></p> <blockquote> <h2>1.4.29</h2> <h2>What's changed</h2> <p>Improvement:</p> <ul> <li>normalize a multipart/form-data with .get instead of .getAll for faster performance</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.28...1.4.29">https://github.com/elysiajs/elysia/compare/1.4.28...1.4.29</a></p> <h2>1.4.28</h2> <h2>What's new</h2> <p>Feature:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1803">#1803</a> stream response with pull based backpressure</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1802">#1802</a> handle range header for file/blob response</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1772">#1722</a>, <a href="https://redirect.github.com/elysiajs/elysia/issues/1741">#1741</a> direct ReadableStream perf blow-up</li> </ul> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1805">#1805</a> dynamic imports inside .guard not registering routes</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1771">#1771</a> breaks Bun HTML imports</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1797">#1797</a> await mapped error response promise</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1794">#1794</a> merge app cookie config into route cookie validator config</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1796">#1796</a> check custom parser by full name</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1795">#1795</a> write transformed cookie value to cookie entry directly</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1793">#1793</a> use cookie schema for cookie noValidate check</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1792">#1792</a> throw ValidationError instead of boolean in response encode path</li> <li>detect HTML bundle when inline response is Promise</li> </ul> <p>Change:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1613">#1613</a> export <code>ElysiaTypeCustomErrors</code></li> <li>remove Bun specific built</li> <li>export <code>AnySchema</code>, <code>UnwrapSchema</code>, <code>ModelsToTypes</code> from root</li> <li>conditional set headers of String and Object when no set.headers is set</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/MegaManSec"><code>@MegaManSec</code></a> made their first contribution in <a href="https://redirect.github.com/elysiajs/elysia/pull/1797">elysiajs/elysia#1797</a></li> <li><a href="https://github.com/ap0nia"><code>@ap0nia</code></a> made their first contribution in <a href="https://redirect.github.com/elysiajs/elysia/pull/1613">elysiajs/elysia#1613</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elysiajs/elysia/compare/1.4.27...1.4.28">https://github.com/elysiajs/elysia/compare/1.4.27...1.4.28</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md">elysia's changelog</a>.</em></p> <blockquote> <h1>1.4.29 - 17 Jun 2026</h1> <p>Bug fix:</p> <ul> <li>normalize a <code>multipart/form-data</code> with <code>.get</code> instead of <code>.getAll</code> for faster performance</li> </ul> <h1>1.4.28 - 17 Mar 2025</h1> <p>Feature:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1803">#1803</a> stream response with pull based backpressure</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1802">#1802</a> handle range header for file/blob response</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1772">#1722</a>, <a href="https://redirect.github.com/elysiajs/elysia/issues/1741">#1741</a> direct ReadableStream perf blow-up</li> </ul> <p>Bug fix:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1805">#1805</a> dynamic imports inside .guard not registering routes</li> <li><a href="https://redirect.github.com/elysiajs/elysia/issues/1771">#1771</a> breaks Bun HTML imports</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1797">#1797</a> await mapped error response promise</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1794">#1794</a> merge app cookie config into route cookie validator config</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1796">#1796</a> check custom parser by full name</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1795">#1795</a> write transformed cookie value to cookie entry directly</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1793">#1793</a> use cookie schema for cookie noValidate check</li> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1792">#1792</a> throw ValidationError instead of boolean in response encode path</li> <li>detect HTML bundle when inline response is Promise</li> </ul> <p>Change:</p> <ul> <li><a href="https://redirect.github.com/elysiajs/elysia/pull/1613">#1613</a> export <code>ElysiaTypeCustomErrors</code></li> <li>remove Bun specific built</li> <li>export <code>AnySchema</code>, <code>UnwrapSchema</code>, <code>ModelsToTypes</code> from root</li> <li>conditional set headers of String and Object when no set.headers is set</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329"><code>8358ff9</code></a> normalize formdata with get instead of getAll</li> <li><a href="https://github.com/elysiajs/elysia/commit/56310be9617b826f862c985eae95ae823d95f097"><code>56310be</code></a> :blue_book: doc: document changelog</li> <li><a href="https://github.com/elysiajs/elysia/commit/708f8c6fdb618617c40d2c02eb31ca8d2227b8b9"><code>708f8c6</code></a> :blue_book: doc: document changelog</li> <li><a href="https://github.com/elysiajs/elysia/commit/7acc183b5938e336399d825d1418e5b4e19859e8"><code>7acc183</code></a> Merge pull request <a href="https://redirect.github.com/elysiajs/elysia/issues/1613">#1613</a> from ap0nia/feat/extend-errors</li> <li><a href="https://github.com/elysiajs/elysia/commit/c00b9e38b6efe75437155cdfe0a19aad3900c9ef"><code>c00b9e3</code></a> Merge branch 'main' of <a href="https://github.com/elysiajs/elysia">https://github.com/elysiajs/elysia</a></li> <li><a href="https://github.com/elysiajs/elysia/commit/ccbd9e48ae359c8052803a8ffc5f466bacaef4de"><code>ccbd9e4</code></a> :blue_book: fix: <a href="https://redirect.github.com/elysiajs/elysia/issues/1772">#1772</a> resolve merge conflict</li> <li><a href="https://github.com/elysiajs/elysia/commit/01340b72a4c9134927a6af499e79a6eaf41ad3c0"><code>01340b7</code></a> Merge pull request <a href="https://redirect.github.com/elysiajs/elysia/issues/1792">#1792</a> from MegaManSec/j1</li> <li><a href="https://github.com/elysiajs/elysia/commit/0956af9572e9ff7aa3bb3b53e4140bfd950e83ca"><code>0956af9</code></a> Merge pull request <a href="https://redirect.github.com/elysiajs/elysia/issues/1793">#1793</a> from MegaManSec/j2</li> <li><a href="https://github.com/elysiajs/elysia/commit/b48ade6ca35f9fe28e4ed31872b065d818db11d6"><code>b48ade6</code></a> :blue_book: doc: update changelog</li> <li><a href="https://github.com/elysiajs/elysia/commit/b32931459fcdf0d657041b10ad12a9d404b37dee"><code>b329314</code></a> Merge branch 'main' of <a href="https://github.com/elysiajs/elysia">https://github.com/elysiajs/elysia</a></li> <li>Additional commits viewable in <a href="https://github.com/elysiajs/elysia/compare/1.4.27...1.4.29">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
) Bumps [hono](https://github.com/honojs/hono) from 4.12.15 to 4.12.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.26</h2> <h2>What's Changed</h2> <ul> <li>fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5013">honojs/hono#5013</a></li> <li>ci: publish to npm from CI with OIDC trusted publishing by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5028">honojs/hono#5028</a></li> <li>chore: remove unused devcontainer and gitpod configs by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5029">honojs/hono#5029</a></li> <li>chore: replace arg and glob with Bun native APIs in build script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5030">honojs/hono#5030</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p> <h2>v4.12.25</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>CORS Middleware reflects any Origin with credentials when <code>origin</code> defaults to the wildcard</h3> <p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting the request <code>Origin</code> and sending <code>Access-Control-Allow-Credentials: true</code> when <code>credentials: true</code> is set without an explicit <code>origin</code>, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p> <h3>Body Limit Middleware can be bypassed on AWS Lambda by understating <code>Content-Length</code></h3> <p>Affects: <code>hono/body-limit</code> on AWS Lambda (<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the request being built with the client-declared <code>Content-Length</code> while the body is delivered fully buffered, where a client could declare a small <code>Content-Length</code> with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2</p> <h3>Path traversal in <code>serve-static</code> on Windows via encoded backslash (<code>%5C</code>)</h3> <p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (<code>%5C</code>) decoded to <code>\</code> was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44</p> <h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers into one value, dropping cookies on ALB single-header and Lattice</h3> <p>Affects: <code>hono/aws-lambda</code>. Fixes multiple <code>Set-Cookie</code> response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p> <h3>Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest</h3> <p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as <code>X-Forwarded-For</code> reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p</p> <h2>v4.12.24</h2> <h2>What's Changed</h2> <ul> <li>docs(contribution): simplifyAI Usage Policy by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li> <li>chore: remove <code>@types/glob</code> by <a href="https://github.com/rtritto"><code>@rtritto</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li> <li>fix(bearer-auth): mention verifyToken in missing-options error message by <a href="https://github.com/tan7vir"><code>@tan7vir</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li> <li>refactor(language): Test/improve tests on languages middleware by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li> <li>fix(utils/ipaddr): expand "::" to eight zero groups by <a href="https://github.com/youcefzemmar"><code>@youcefzemmar</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li> <li>fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by <a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@Mohammad-Faiz-Cloud-Engineer</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li> <li>refactor(timing): Test/add test for middleware timing by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li> <li>fix(utils/ipaddr): render the unspecified address binary as "::" by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p> <h2>v4.12.23</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/27b7992f821bc10c2f62ad0ad86bd94eea251862"><code>27b7992</code></a> 4.12.26</li> <li><a href="https://github.com/honojs/hono/commit/d29982cc40c3babb417db625ab0671d982398646"><code>d29982c</code></a> chore: replace arg and glob with Bun native APIs in build script</li> <li><a href="https://github.com/honojs/hono/commit/16215d5f509099b81b00d60a2777bc6b5ac06827"><code>16215d5</code></a> chore: remove unused devcontainer and gitpod configs (<a href="https://redirect.github.com/honojs/hono/issues/5029">#5029</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c574cf16403b42a17917506bcba1916d32d3094f"><code>c574cf1</code></a> ci: publish to npm from CI with OIDC trusted publishing (<a href="https://redirect.github.com/honojs/hono/issues/5028">#5028</a>)</li> <li><a href="https://github.com/honojs/hono/commit/e50df01453e71b071c3e6136b161b160b9fdf916"><code>e50df01</code></a> fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (<a href="https://redirect.github.com/honojs/hono/issues/5">#5</a>...</li> <li><a href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a> 4.12.25</li> <li><a href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a> Merge commit from fork</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.15...v4.12.26">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#5819) Bumps [prettier](https://github.com/prettier/prettier) from 3.4.2 to 3.8.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prettier/prettier/releases">prettier's releases</a>.</em></p> <blockquote> <h2>3.8.4</h2> <ul> <li>Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (<a href="https://redirect.github.com/prettier/prettier/pull/17746">prettier/prettier#17746</a> by <a href="https://github.com/byplayer"><code>@byplayer</code></a>)</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/3.8.4/CHANGELOG.md#384">Changelog</a></p> <h2>3.8.3</h2> <ul> <li>SCSS: Prevent trailing comma in <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/pull/18471">prettier/prettier#18471</a> by <a href="https://github.com/kovsu"><code>@kovsu</code></a>)</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/3.8.3/CHANGELOG.md#383">Changelog</a></p> <h2>3.8.2</h2> <ul> <li>Support Angular v21.2</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#382">Changelog</a></p> <h2>3.8.1</h2> <ul> <li>Include available <code>printers</code> in plugin type declarations (<a href="https://redirect.github.com/prettier/prettier/pull/18706">#18706</a> by <a href="https://github.com/porada"><code>@porada</code></a>)</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#381">Changelog</a></p> <h2>3.8.0</h2> <ul> <li>Support Angular v21.1</li> </ul> <p><a href="https://github.com/prettier/prettier/compare/3.7.4...3.8.0">diff</a></p> <p>🔗 <a href="https://prettier.io/blog/2026/01/14/3.8.0">Release note "Prettier 3.8: Support for Angular v21.1"</a></p> <h2>3.7.4</h2> <h2>What's Changed</h2> <ul> <li>Fix comment in union type gets duplicated by <a href="https://github.com/fisker"><code>@fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18393">prettier/prettier#18393</a></li> <li>Fix unstable comment print in union type by <a href="https://github.com/fisker"><code>@fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18395">prettier/prettier#18395</a></li> <li>Avoid quote around LWC interpolations by <a href="https://github.com/kovsu"><code>@kovsu</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18383">prettier/prettier#18383</a></li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#374">Changelog</a></p> <h2>3.7.3</h2> <h2>What's Changed</h2> <ul> <li>Fix <code>prettier.getFileInfo()</code> change that breaks VSCode extension by <a href="https://github.com/fisker"><code>@fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18375">prettier/prettier#18375</a></li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#373">Changelog</a></p> <h2>3.7.2</h2> <h2>What's Changed</h2> <ul> <li>Fix string print when switching quotes by <a href="https://github.com/fisker"><code>@fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18351">prettier/prettier#18351</a></li> <li>Preserve quote for embedded HTML attribute values by <a href="https://github.com/kovsu"><code>@kovsu</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18352">prettier/prettier#18352</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's changelog</a>.</em></p> <blockquote> <h1>3.8.4</h1> <p><a href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">diff</a></p> <h4>Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (<a href="https://redirect.github.com/prettier/prettier/pull/17746">#17746</a> by <a href="https://github.com/byplayer"><code>@byplayer</code></a>)</h4> <p>Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.</p> <!-- raw HTML omitted --> <pre lang="markdown"><code><!-- Input --> - a <ul> <li> <p>b</p> </li> <li> <p>c</p> <ul> <li>d</li> </ul> </li> </ul> <p><!-- Prettier 3.8.3 --></p> <ul> <li>a <ul> <li>b</li> </ul> </li> <li>c <ul> <li>d</li> </ul> </li> </ul> <p><!-- Prettier 3.8.4 --></p> <ul> <li> <p>a</p> <ul> <li>b</li> </ul> </li> <li> <p>c</p> <ul> <li>d<br /> </code></pre></li> </ul> </li> </ul> <h1>3.8.3</h1> <p><a href="https://github.com/prettier/prettier/compare/3.8.2...3.8.3">diff</a></p> <h4>SCSS: Prevent trailing comma in <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/pull/18471">#18471</a> by <a href="https://github.com/kovsu"><code>@kovsu</code></a>)</h4> <!-- raw HTML omitted --> <pre lang="scss"><code>// Input $value: if(sass(false): 1; else: -1); <p>// Prettier 3.8.2<br /> $value: if(<br /> sass(false): 1; else: -1,<br /> </tr></table><br /> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prettier/prettier/commit/1c6ba5539141552e0e8e22d401ea620d8fdff468"><code>1c6ba55</code></a> Release 3.8.4</li> <li><a href="https://github.com/prettier/prettier/commit/4a673dc9b59ddf7296bbab9822093d2971da84a8"><code>4a673dc</code></a> Fix blank lines between list items and nested sub-lists being removed in Mark...</li> <li><a href="https://github.com/prettier/prettier/commit/074aaedbb052a288e89d15eb0a4214de37a08866"><code>074aaed</code></a> Replace <code>main</code> branch in changelog link with tags (<a href="https://redirect.github.com/prettier/prettier/issues/19054">#19054</a>)</li> <li><a href="https://github.com/prettier/prettier/commit/c22a003ae97917c5043e8685b4fdff0f93e978f9"><code>c22a003</code></a> Bump Prettier dependency to 3.8.3</li> <li><a href="https://github.com/prettier/prettier/commit/07bad1f04536e9799927007baf466e67151576f0"><code>07bad1f</code></a> Clean changelog_unreleased</li> <li><a href="https://github.com/prettier/prettier/commit/d7108a79ec745c04292aabf22c4c1adbd690b191"><code>d7108a7</code></a> Release 3.8.3</li> <li><a href="https://github.com/prettier/prettier/commit/177f90898170d363ef64fde663e4d13170688bfe"><code>177f908</code></a> Prevent trailing comma in SCSS <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/issues/18471">#18471</a>)</li> <li><a href="https://github.com/prettier/prettier/commit/1cd40668c3d6f2f4cf9d87bbc9096d92361b2606"><code>1cd4066</code></a> Release <code>@prettier/plugin-oxc</code><a href="https://github.com/0"><code>@0</code></a>.1.4</li> <li><a href="https://github.com/prettier/prettier/commit/a8700e245038cd8cc0cf28ef06ffedbcb3fc2dfc"><code>a8700e2</code></a> Update oxc-parser to v0.125.0</li> <li><a href="https://github.com/prettier/prettier/commit/752157c78eca6f0a30e5d5cb513b682c5ecfa01e"><code>752157c</code></a> Fix tests</li> <li>Additional commits viewable in <a href="https://github.com/prettier/prettier/compare/3.4.2...3.8.4">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for prettier since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [ws](https://github.com/websockets/ws) from 6.2.3 to 6.2.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>6.2.4</h2> <h1>Bug fixes</h1> <ul> <li>Backported 2b2abd45 to the 6.x release line (a76e2111).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"><code>86d3e8a</code></a> [dist] 6.2.4</li> <li><a href="https://github.com/websockets/ws/commit/a76e2111c91d7e031c00148a73db90db059bf989"><code>a76e211</code></a> [security] Limit retained message parts</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/6.2.3...6.2.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…pache#5817) Bumps [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) from 1.3.3 to 1.3.14. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
… types (OperatorInfo, PortDescription, PortDescriptor) (apache#5832) ### What changes were proposed in this PR? Pin behavior of three core operator-metadata types in `common/workflow-operator/` — the data/trait types every `LogicalOp` relies on for port wiring and metadata. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `OperatorInfoSpec` | `OperatorInfo` (case class) | 4 | | `PortDescriptionSpec` | `PortDescription` (case class) | 5 | | `PortDescriptorSpec` | `PortDescriptor` (trait) | 2 | **Behavior pinned** | Surface | Contract | | --- | --- | | `OperatorInfo` fields | constructor field exposure; the four boolean flags default to `false` and round-trip `true` when set; value equality | | `OperatorInfo.forVisualization` | `inputPorts == List(InputPort(disallowMultiLinks = true))`, `outputPorts == List(OutputPort(mode = SINGLE_SNAPSHOT))` | | `PortDescription` | field exposure; `dependencies` defaults `List.empty` + accepts explicit deps; value equality + `copy`; `@JsonIgnoreProperties("allowMultiInputs")` backward-compat marker (verified via reflection) | | `PortDescriptor` (trait) | `inputPorts`/`outputPorts` default to `null` (not empty) and are reassignable | **Note for reviewers:** scoped to the pure case-class/trait types only. The `OperatorMetadataGenerator` object in the same file is deliberately **not** tested — it eagerly reflects over the entire `LogicalOp` registry at init (instantiating every descriptor), which is not pure-unit-testable. ### Any related issues, documentation, discussions? Closes apache#5829. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.metadata.OperatorInfoSpec org.apache.texera.amber.operator.PortDescriptionSpec org.apache.texera.amber.operator.PortDescriptorSpec"` — 11 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…criptors (ContourPlot, PolarChart, StripChart) (apache#5831) ### What changes were proposed in this PR? Pin behavior of three previously-untested visualization `PythonOperatorDescriptor`s in `common/workflow-operator/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `ContourPlotOpDescSpec` | `ContourPlotOpDesc` | 4 | | `PolarChartOpDescSpec` | `PolarChartOpDesc` | 5 | | `StripChartOpDescSpec` | `StripChartOpDesc` | 5 | **Behavior pinned** | Surface | Contract | | --- | --- | | `operatorInfo` | exact name + visualization group (Scientific / Scientific / Statistical); one input / one output | | `getOutputSchemas` | single `html-content` STRING column, asserted as the **full map keyed by `operatorInfo.outputPorts.head.id`** (input map ignored — `Map.empty` proves it) | | Field defaults | ContourPlot `x/y/z/gridSize == ""`, `connectGaps == false`; Polar `r/theta == ""`; Strip `x/y/colorBy/facetColumn == ""` | | `generatePythonCode` | Polar emits `go.Scatterpolargl(`; Strip emits `px.strip(` (structural Python only) | | Round-trip | all column fields preserved through the polymorphic base | **Notes for reviewers** - `ContourPlotOpDesc.generatePythonCode` is intentionally **not** exercised: a freshly-constructed instance has a `null` `coloringMethod` var, so codegen throws an NPE (the `@NotNull` is validation-layer only, not enforced at codegen). The spec pins the clean, deterministic contracts instead. - Codegen assertions check only structural Python (class def / import / plotly call) — never the interpolated `EncodableString` column values, which are base64-encoded at `.encode` time and do not appear literally. ### Any related issues, documentation, discussions? Closes apache#5828. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.visualization.contourPlot.ContourPlotOpDescSpec org.apache.texera.amber.operator.visualization.polarChart.PolarChartOpDescSpec org.apache.texera.amber.operator.visualization.stripChart.StripChartOpDescSpec"` — 14 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…rator descriptors (apache#5827) ### What changes were proposed in this PR? Pin behavior of three previously-untested visualization descriptors in `common/workflow-operator/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `HtmlVizOpDescSpec` | `HtmlVizOpDesc` | 4 | | `CandlestickChartOpDescSpec` | `CandlestickChartOpDesc` | 5 | | `Histogram2DOpDescSpec` | `Histogram2DOpDesc` | 6 | All three spec files follow the `<srcClassName>Spec.scala` one-to-one convention. **Behavior pinned** | Surface | Contract | | --- | --- | | `operatorInfo` | exact name + visualization group (`MEDIA` / `FINANCIAL` / `STATISTICAL`); one input / one output | | Output schema | all three emit a single `html-content` STRING column (`HtmlViz` via `getExternalOutputSchemas`; charts via `getOutputSchemas`) | | `getPhysicalOp` wiring (`HtmlViz`) | `OpExecWithClassName("…htmlviz.HtmlVizOpExec")`; port **identities** carried forward | | Field defaults | `Candlestick` OHLC columns default `""`; `Histogram2D` `xBins`/`yBins == 10`, `normalize == DENSITY` | | `generatePythonCode` | `Candlestick` emits a Plotly `go.Candlestick(` figure; `Histogram2D` emits `px.density_heatmap(` and **rejects a non-positive bin count** (`AssertionError`) | | Round-trip | all config fields preserved through the polymorphic base | The specs pin the stable contract (operatorInfo + output schema + codegen guards) rather than the full Plotly template, and never assert on interpolated `EncodableString` values (which are decoded at runtime, not embedded raw). ### Any related issues, documentation, discussions? Closes apache#5824. ### How was this PR tested? Pure unit-test additions; verified locally with: - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.visualization.htmlviz.HtmlVizOpDescSpec org.apache.texera.amber.operator.visualization.candlestickChart.CandlestickChartOpDescSpec org.apache.texera.amber.operator.visualization.histogram2d.Histogram2DOpDescSpec"` — 15 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…nUtils, and OperatorGroupConstants (apache#5845) ### What changes were proposed in this PR? Pin behavior of three join/utility classes in `common/workflow-operator/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `IntervalJoinOpDescSpec` | `IntervalJoinOpDesc` | 5 | | `JoinUtilsSpec` | `JoinUtils` (object) | 3 | | `OperatorGroupConstantsSpec` | `OperatorGroupConstants` (object) | 4 | **Behavior pinned — `IntervalJoinOpDesc`** | Surface | Contract | | --- | --- | | `operatorInfo` | `Interval Join`, JOIN_GROUP; two ordered inputs (`left table` at `PortIdentity()`, `right table` at `PortIdentity(1)` depending on the left); one output | | Field defaults | join-key attrs `null`; `constant == 10`; `includeLeftBound`/`includeRightBound == true` | | `getPhysicalOp` | wires `IntervalJoinOpExec`; port identities carried; `HashPartition` requirement on each join key | | Schema propagation | merges left ⧺ right schemas, suffixing a conflicting attribute with `#@1` | **Behavior pinned — `JoinUtils.joinTuples`** | Surface | Contract | | --- | --- | | Concatenation | left + right fields merged | | Skip | the named join-key attribute is dropped from the right side | | Conflict rename | a right-side name collision is renamed with a `#@1` suffix | **Behavior pinned — `OperatorGroupConstants`** | Surface | Contract | | --- | --- | | Constant values | the canonical group-name strings (`Data Input`, `Join`, `Set`, … `Control Block`) | | `OperatorGroupOrderList` | starts at `Data Input`, ends at `Control Block`; relational subgroups (Join/Set/Aggregate/Sort) nested under `Data Cleaning`; visualization subgroups nested under `Visualization` in panel order | ### Any related issues, documentation, discussions? Closes apache#5840. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.intervalJoin.IntervalJoinOpDescSpec org.apache.texera.amber.operator.hashJoin.JoinUtilsSpec org.apache.texera.amber.operator.metadata.OperatorGroupConstantsSpec"` — 12 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…pache#5667) ### What changes were proposed in this PR? - Route `DatasetFileDocument`'s presigned-URL fetch and file download through a `requests.Session` configured with a `(5s connect, 10s read)` timeout, so a hung or unreachable file-service fails in bounded time instead of blocking the worker thread forever. The read timeout bounds inactivity *between bytes*, not the total download time, so large dataset files that stream steadily are unaffected; it only trips when the connection stalls for 10s with no data. - Mount a `urllib3` `Retry` policy on the session (3 retries, exponential backoff, retrying on connection errors and 5xx). Both calls are idempotent GETs, so the retry set is restricted to `GET`. - Translate network failures (connect/read timeouts and connection errors, including those surfaced after retries are exhausted) into `RuntimeError`, consistent with the module's existing failure handling, so callers get a uniform error contract instead of a raw `requests`/`urllib3` exception. ### Any related issues, documentation, discussions? Closes: apache#5666 ### How was this PR tested? - Added `pytest` coverage in `test_dataset_file_document.py` (26 tests): - asserts the `(connect, read)` timeout tuple is passed on both the presigned-URL request and the file download; - asserts the retry adapter is mounted for `http://` and `https://` with the expected policy (`total=3`, `connect=3`, `read=3`, `backoff_factor=0.5`, `status_forcelist={500,502,503,504}`, GET-only); - asserts a `ReadTimeout` / `ConnectionError` is wrapped in `RuntimeError` on both code paths. - `ruff check` and `ruff format --check` pass on the modified files. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF
…git blame (apache#5651) <!-- Thanks for sending a pull request (PR)! Here are some tips for you: 1. If this is your first time, please read our contributor guidelines: [Contributing to Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md) 2. Ensure you have added or run the appropriate tests for your PR 3. If the PR is work in progress, mark it a draft on GitHub. 4. Please write your PR title to summarize what this PR proposes, we are following Conventional Commits style for PR titles as well. 5. Be sure to keep the PR description updated to reflect all changes. --> ### What changes were proposed in this PR? This PR adds an automatic reviewer suggestion CI job to `.github/workflows/comment-commands.yml`. When a PR is opened or updated (pull_request: opened, synchronize, reopened), the CI automatically runs `git blame -p` at the base commit on each changed file to identify who most recently touched that code. Candidates are split into two groups: - Committers — collaborators who can be formally review-requested via GitHub's API - Non-committer contributors — have context but cannot be review-requested; the author can @-mention them to notify The CI posts a comment in this format: `Suggested reviewers (based on git blame of changed files):` `Committers — can be formally requested: @ alice, @ bob` `Non-committer contributors — cc to notify: @ carol` `Use /request-review @ alice to request a review, or cc @ carol to notify them.` On every subsequent push, the job finds the existing suggestion comment (via a hidden HTML marker <!-- texera-reviewer-suggestion -->) and edits it in place, keeping the PR timeline clean. The CI never sends a review request on its own as the author must explicitly use /request-review @ user. Files with status added are skipped before git blame is attempted since they did not exist at the base commit. <!-- Please clarify what changes you are proposing. The purpose of this section is to outline the changes. Here are some tips for you: 1. If you propose a new API, clarify the use case for a new API. 2. If you fix a bug, you can clarify why it is a bug. 3. If it is a refactoring, clarify what has been changed. 3. It would be helpful to include a before-and-after comparison using screenshots or GIFs. 4. Please consider writing useful notes for better and faster reviews. --> ### Any related issues, documentation, discussions? Closes apache#5611 <!-- Please use this section to link other resources if not mentioned already. 1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves apache#1234` or `Closes apache#1234`. If it is only related, simply mention the issue number. 2. If there is design documentation, please add the link. 3. If there is a discussion in the mailing list, please add the link. --> ### How was this PR tested? **Unit tests**: 83 tests across 9 suites were written locally (https://github.com/juliethecao/texera/tree/cc-test) to cover the core JavaScript logic extracted from the workflow: `git blame -p` output parsing, candidate ranking, comment body generation, find-or-update marker logic, author/bot exclusion, @ mention parsing, file status filtering, candidate accumulation, and MARKER integrity. Tests were not checked in as the logic lives inside a GitHub Actions script rather than a standalone module. **Manual CI test**: A test PR was opened on a personal fork (juliethecao#9) against the feature branch as the base. The suggest-reviewers job triggered on open, ran git blame on the changed files, and posted the suggestion comment. Closing and reopening the PR confirmed the comment was updated in place rather than duplicated. <!-- If tests were added, say they were added here. Or simply mention that if the PR is tested with existing test cases. Make sure to include/update test cases that check the changes thoroughly including negative and positive cases if possible. If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future. If tests were not added, please describe why they were not added and/or why it was difficult to add. --> ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Sonnet 4.6 in compliance with ASF guidelines <!-- If generative AI tooling has been used in the process of authoring this PR, please include the phrase: 'Generated-by: ' followed by the name of the tool and its version. If no, write 'No'. Please refer to the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) for details. --> --------- Signed-off-by: oplaws <juucceey@gmail.com> Signed-off-by: Julie Cao <116243642+juliethecao@users.noreply.github.com> Co-authored-by: oplaws <juucceey@gmail.com> Co-authored-by: Matthew B. <mgball@uci.edu>
### What changes were proposed in this PR? - Remove the unused `fs-extra` (10.0.1) devDependency from `frontend/package.json`; it is never imported or referenced in `src/`, `build-version.js`, `custom-webpack.config.js`, any config, or any npm script. It was introduced by apache#899 and we have replaced it in apache#3613 ### Any related issues, documentation, discussions? Closes: apache#5841 ### How was this PR tested? - Run `yarn install` in `frontend/`, expect the only `yarn.lock` change to be removal of the direct `fs-extra@npm:10.0.1` block plus the project's reference (verify with `git diff frontend/yarn.lock`). - Run `yarn build` in `frontend/` (production `ng build`), expect exit code 0 with no new errors; this confirms nothing in the source or build pipeline depends on the direct `fs-extra` dependency. - Run `grep -rn "fs-extra" frontend/src frontend/build-version.js frontend/custom-webpack.config.js`, expect no matches. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF
…criptors (CarpetPlot, DumbbellPlot, ParallelCoordinatesPlot) (apache#5844) ### What changes were proposed in this PR? Pin behavior of three more previously-untested visualization `PythonOperatorDescriptor`s in `common/workflow-operator/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `CarpetPlotOpDescSpec` | `CarpetPlotOpDesc` | 5 | | `DumbbellPlotOpDescSpec` | `DumbbellPlotOpDesc` | 5 | | `ParallelCoordinatesPlotOpDescSpec` | `ParallelCoordinatesPlotOpDesc` | 5 | **Behavior pinned (each descriptor)** | Surface | Contract | | --- | --- | | `operatorInfo` | exact name + visualization group (`Scientific` / `Basic` / `Scientific`); one input / one output | | `getOutputSchemas` | single `html-content` STRING column, asserted as the full map keyed by `operatorInfo.outputPorts.head.id` | | Field defaults | Carpet `a`/`b`/`y == ""`; Dumbbell column fields `== ""` + `showLegends == false`; ParallelCoordinates `dimensions` empty | | `generatePythonCode` | Carpet `go.Carpet(`; Dumbbell `go.Scatter(`; ParallelCoordinates `px.parallel_coordinates(` (structural Python only) | | Round-trip | config fields preserved through the polymorphic base | **Note for reviewers:** `ParallelCoordinatesPlotOpDesc.color` defaults to `null` and `dimensions` to empty — both are null/empty-guarded in `generatePythonCode`, so codegen on a fresh instance is exercised safely. Codegen assertions pin only structural Python, never the base64-encoded `EncodableString` values. ### Any related issues, documentation, discussions? Closes apache#5839. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.visualization.carpetPlot.CarpetPlotOpDescSpec org.apache.texera.amber.operator.visualization.dumbbellPlot.DumbbellPlotOpDescSpec org.apache.texera.amber.operator.visualization.parallelCoordinatesPlot.ParallelCoordinatesPlotOpDescSpec"` — 15 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…criptors (GaugeChart, RangeSlider, SankeyDiagram) (apache#5843) ### What changes were proposed in this PR? Pin behavior of three previously-untested visualization `PythonOperatorDescriptor`s in `common/workflow-operator/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `GaugeChartOpDescSpec` | `GaugeChartOpDesc` | 5 | | `RangeSliderOpDescSpec` | `RangeSliderOpDesc` | 5 | | `SankeyDiagramOpDescSpec` | `SankeyDiagramOpDesc` | 5 | **Behavior pinned (each descriptor)** | Surface | Contract | | --- | --- | | `operatorInfo` | exact name + visualization group (`Financial` / `Basic` / `Basic`); one input / one output | | `getOutputSchemas` | single `html-content` STRING column, asserted as the **full map keyed by `operatorInfo.outputPorts.head.id`** (input ignored — `Map.empty` proves it) | | Field defaults | Gauge `value`/`delta`/`threshold == ""` + empty `steps`; RangeSlider `xAxis`/`yAxis == ""`; Sankey `source`/`target`/`value == ""` | | `generatePythonCode` | Gauge `go.Indicator(`; RangeSlider `go.Scatter(`; Sankey `go.Sankey(` (structural Python only) | | Round-trip | config fields preserved through the polymorphic base | Codegen assertions check only structural Python (class def / import / plotly call) — never the interpolated `EncodableString` values, which are base64-encoded at `.encode` time and do not appear literally. ### Any related issues, documentation, discussions? Closes apache#5838. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.visualization.gaugeChart.GaugeChartOpDescSpec org.apache.texera.amber.operator.visualization.rangeSlider.RangeSliderOpDescSpec org.apache.texera.amber.operator.visualization.sankeyDiagram.SankeyDiagramOpDescSpec"` — 15 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…fig key (apache#5545) ### What changes were proposed in this PR? The default data-transfer batch size was controlled by **two** separate config keys, each with its own env var, both defaulting to `400`: - `network-buffering.default-data-transfer-batch-size` (`NETWORK_BUFFERING_DEFAULT_DATA_TRANSFER_BATCH_SIZE`), read by the backend (`ApplicationConfig.defaultDataTransferBatchSize`). - `gui.workflow-workspace.default-data-transfer-batch-size` (`GUI_WORKFLOW_WORKSPACE_DEFAULT_DATA_TRANSFER_BATCH_SIZE`), read by `GuiConfig` and sent to the frontend via `ConfigResource`. Having two keys for one value meant an operator could set one env var and forget the other, leaving the backend and GUI out of sync. This PR makes the `network-buffering` key the single source of truth: - `ConfigResource` now surfaces `ApplicationConfig.defaultDataTransferBatchSize` directly. - Removed the duplicate `guiWorkflowWorkspaceDefaultDataTransferBatchSize` field from `GuiConfig`. - Removed the duplicate key (and its env override) from `gui.conf`. The frontend is unchanged: the JSON field name (`defaultDataTransferBatchSize`) it consumes stays the same. ### Any related issues, documentation, discussions? Closes apache#5544 ### How was this PR tested? - `sbt Config/compile ConfigService/compile` both succeed. - Repo-wide grep confirms no remaining references to the old key or `GUI_WORKFLOW_WORKSPACE_DEFAULT_DATA_TRANSFER_BATCH_SIZE` (outside generated `dist/` artifacts). - The backend reader of the canonical key is untouched, so existing tests (e.g. `NetworkOutputBufferSpec`) are unaffected. - Also tested that the application performs as normal on all services (e.g., running workflows, uploading data, creating workflows, etc..) ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8)
…ache#5847) ### What changes were proposed in this PR? - Add GlobalErrorHandler (implements Angular ErrorHandler), registered as the global ErrorHandler in app.module.ts. - handleError reloads the page once on a chunk-load failure (ChunkLoadError, "Loading chunk ... failed", or a failed dynamic import), guarded by a sessionStorage timestamp (10s window) so a genuinely missing chunk cannot cause a reload loop; all other errors delegate to Angular's default handler. - Chunk detection lives in a pure exported isChunkLoadError(error) function so it is unit-testable in isolation. ### Any related issues, documentation, discussions? Closes: apache#5837 ### How was this PR tested? - Run `yarn test --include='**/global-error-handler.service.spec.ts'` from frontend/, expect 5 passing cases: isChunkLoadError true for chunk errors and false for generic/TypeError/null; handleError reloads once and records the guard, does not reload again within the window, and does not reload on a non-chunk error. - Manual: load the app, in DevTools block a chunk request URL (Network, Block request URL) and trigger a navigation that loads it, expect a single automatic reload rather than a broken view; trigger it again immediately and expect no reload loop. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF
…ed by the scheduler (apache#5720) ### What changes were proposed in this PR? Lets an operator declare it can only run under a fully-materialized schedule, and has the scheduler honor it: - `PhysicalOp` gains `requiresMaterializedExecution: Boolean = false` (+ a `withRequiresMaterializedExecution` builder). It is a physical-execution property, so it lives on the physical op. - `CostBasedScheduleGenerator` consumes it: when any physical op requires materialized execution it forces a fully-materialized schedule regardless of the requested execution mode; otherwise the existing PIPELINED/MATERIALIZED logic runs unchanged. Default `false` ⇒ dormant and behavior-preserving: no operator requires it yet, so the scheduler's effective mode is unchanged today. The loop operators set the flag on their physical op. ### Any related issues, documentation, discussions? Resolves apache#5719 (sub-issue of apache#4442 "Introduce for loop"). Split out of apache#5700. Reflects the review discussion with @Yicong-Huang: the property belongs on `PhysicalOp`, and it is consumed by the scheduler. ### How was this PR tested? `WorkflowCoreTypesSpec` covers the `PhysicalOp.requiresMaterializedExecution` default + builder. `WorkflowExecutionService/Test/compile`, `scalafixAll --check`, and `scalafmtCheckAll` pass locally. The scheduler consumer is exercised end-to-end by the loop integration tests once the loop operators (which set the flag) land. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF.
…che#5783) ### What changes were proposed in this PR? `DataProcessor` built the operator-facing ERROR console message for an uncaught UDF exception inline (`_report_exception`). This moves that construction into a small factory — `core.util.console_message.error_message.create_error_console_message(worker_id, exc_info) -> ConsoleMessage`. `DataProcessor` builds the message via the factory and queues it through the existing `ConsoleMessageManager.put_message`. Per review, `ConsoleMessageManager` stays purely about **message management** (its interfaces are all at the `msg: ConsoleMessage` level); message *construction* lives in the util. Behavior-preserving: the same ERROR `ConsoleMessage` is produced — | field | value | |---|---| | `msg_type` | `ConsoleMessageType.ERROR` | | `title` | the exception's final line (e.g. `ValueError: ...`) | | `message` | the full formatted traceback | | `source` | `module:func:line` of the raising frame | Centralizing the factory lets other uncaught-exception paths report identically (the loop operators' main-loop condition evaluation reuses it in a follow-up). ### Any related issues, documentation, discussions? Split out of apache#5700 (loop operators) to keep that PR focused; the refactor is independent and behavior-preserving on `main`. ### How was this PR tested? - New `test_error_message.py::test_builds_error_console_message_from_exc_info` pins the factory output (worker id, ERROR type, title, traceback body, `module:func:line` source) — written test-first. - The existing `test_data_processor.py` (asserts console messages after a UDF raises) still passes unchanged, confirming the delegation preserves behavior. - `cd amber && pytest -m "not integration"` on the affected files: 12 passed; `black --check` clean. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF.
…or descriptors (apache#5876) ### What changes were proposed in this PR? Pin behavior of three previously-untested Python-UDF descriptors in `common/workflow-operator/udf/python/`. No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `PythonUDFOpDescV2Spec` | `PythonUDFOpDescV2` | 7 | | `PythonUDFSourceOpDescV2Spec` | `PythonUDFSourceOpDescV2` | 5 | | `PythonTableReducerOpDescSpec` | `PythonTableReducerOpDesc` | 6 | **Behavior pinned** | Surface | Contract | | --- | --- | | `operatorInfo` | exact name + `PYTHON_GROUP`; `PythonUDFOpDescV2` dynamic 1-in/1-out; `PythonUDFSourceOpDescV2` zero inputs / one output + `supportReconfiguration` | | `getPhysicalOp` | wires `OpExecWithCode(code, "python")`; port identities carried; rejects `workers <= 0` (`IllegalArgumentException`) | | Schema propagation | `PythonUDFOpDescV2`: `retainInputColumns=false` → only the output columns, `true` → input + output columns (full map keyed by the declared output port); `PythonUDFSourceOpDescV2`: `sourceSchema()` from the `columns` field; `PythonTableReducerOpDesc`: `getOutputSchemas` folds the lambda units and rejects the empty default | | Round-trip | config fields preserved through the polymorphic base | ### Any related issues, documentation, discussions? Closes apache#5873. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.udf.python.PythonUDFOpDescV2Spec org.apache.texera.amber.operator.udf.python.source.PythonUDFSourceOpDescV2Spec org.apache.texera.amber.operator.udf.python.PythonTableReducerOpDescSpec"` — 18 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
…ants (apache#5739) ### What changes were proposed in this PR? Adds a unit-test spec for `PropertyNameConstants` (the `@JsonProperty` wire-key constants shared across `LogicalOp` serialization). No production-code changes. | Spec | Source class | Tests | | --- | --- | --- | | `PropertyNameConstantsSpec` | `PropertyNameConstants` | 5 | > **Scope note:** this PR originally also bundled `OperatorDescriptorUtils` and `PortDescriptor`/`PortDescription` specs. Both have since been covered on `main` / by other open PRs: > - `OperatorDescriptorUtilsSpec` already merged via apache#5798 — dropped here (it was the merge conflict). > - `PortDescriptor` + `PortDescription` are covered by apache#5832 with one spec file per source class (the repo convention) — dropped here to avoid a duplicate `PortDescriptorSpec.scala`. > > This PR is now scoped to its unique contribution, `PropertyNameConstants`, and is rebased on current `main`. ### Any related issues, documentation, discussions? Follow-up test coverage; see apache#5798 and apache#5832 for the de-duplicated specs. ### How was this PR tested? - `sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.metadata.PropertyNameConstantsSpec"` — 5 tests, all green - `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt "WorkflowOperator/Test/scalafix --check"` — clean - CI to confirm ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8 [1M context])
) ### What changes were proposed in this PR? - Add `awaitDependency` to `FileService`, an exponential-backoff retry (6 attempts from 200ms, ~6s total) with an injectable sleep, mirroring `LakeFSStorageClient.retryWithBackoff`. - Wrap the two `S3StorageClient.createBucketIfNotExist` calls in `FileService.run` with it, so a slow-to-start MinIO/S3 no longer aborts file-service startup. - Handle `InterruptedException` consistently: an interrupt arriving during the backoff `sleep` (not just during the bucket operation) now restores the thread's interrupt status and fails fast, instead of escaping as a raw `InterruptedException` with the interrupt flag lost. - Leave `LakeFSStorageClient.healthCheck()` on its existing inner retry (unchanged). - Add `FileServiceSpec` (8 tests) covering immediate success, default-argument success, retry-then-success, the full backoff progression to give-up, give-up preserving the cause, `maxAttempts == 1`, and interrupt-fails-fast for both interrupt points. ### Any related issues, documentation, discussions? Closes: apache#5852 Note: `awaitDependency` is a near-duplicate of `LakeFSStorageClient.retryWithBackoff` in `common/workflow-core`. Extracting a single shared helper that both delegate to is the cleaner end state, but it would refactor a stable, separately-tested class in another module, so it is deferred to a follow-up rather than widening the scope of this startup-race fix. ### How was this PR tested? - Run `sbt "FileService/testOnly org.apache.texera.service.FileServiceSpec"` and expect 8 passing tests: - immediate success runs the operation once and never sleeps; - default-argument success returns on the first try without invoking the default `Thread.sleep` backoff; - retry-then-success records delays `List(200, 400)` before succeeding on the 3rd try; - exhausting all 6 attempts records the full progression `List(200, 400, 800, 1600, 3200)` before giving up; - give-up rethrows after `maxAttempts` with the original exception as `getCause` and the dependency name in the message; - `maxAttempts == 1` gives up after a single attempt without sleeping; - an interrupt while running the operation restores the interrupt flag and fails fast; - an interrupt while sleeping between attempts likewise restores the interrupt flag and fails fast. - This environment hits a pre-existing JaCoCo instrumentation error (`Unsupported class file major version 69`) because JaCoCo 0.8.11 cannot instrument JDK 25 class files; this is unrelated to the change. The spec was verified locally against a JDK 17 toolchain (`sbt -java-home <jdk17>`, 8/8 pass) and relies on CI's JDK/JaCoCo combo for the standard instrumented run. `scalafmtCheck` is clean for both main and test sources. ### Was this PR authored or co-authored using generative AI tooling? Co-authored with Claude Opus 4.8 in compliance with ASF
## What changes were proposed in this PR?
Adds the audio and media-generation task families — 5 HF pipeline tasks
— as new `TaskCodegen`s plugged into the dispatcher established by the
text-generation PR:
audio tasks: `automatic-speech-recognition`, `audio-classification`,
`text-to-speech`
media-generation tasks: `text-to-image`, `text-to-video`
`codegen/AudioTaskCodegen.scala` supplies the per-task payload + parse
Python branches for the 3 audio tasks.
`codegen/MediaGenCodegen.scala` supplies the per-task payload + parse
Python branches for the 2 media-generation tasks.
`CodegenContext` is extended with `audioInput` + `inputAudioColumn`
(`EncodableString`).
`HuggingFaceInferenceOpDesc.scala` gains 2 new `@JsonProperty` fields
and registers `AudioTaskCodegen` + `MediaGenCodegen` in the dispatcher.
`PythonCodegenBase.scala` grows to host the shared audio/media
infrastructure:
- Audio task-family tuple (`audio_only_tasks`) in `process_table`.
- Per-row audio-byte resolution from upload or column input.
- Raw binary request handling for `automatic-speech-recognition` and
`audio-classification`.
- JSON payload handling for `text-to-speech`.
- Provider-specific routing for media generation and audio generation
through `_call_provider`, including OpenAI-compatible image/audio
endpoints where supported.
- Response parsing for audio/media outputs, including data-URL
conversion for generated media URLs.
- Media helper support for converting remote URLs into `data:image/...`,
`data:audio/...`, or `data:video/...` URLs where needed.
- Hardened audio input loading to match the image-input path: uploaded
audio is accepted as a data URL, remote audio is fetched through the
existing HTTPS-only `_fetch_remote_url` helper, and arbitrary
worker-local file paths are no longer read.
User-input strings continue to flow through `pyb"..."` +
`EncodableString` so they reach Python as
`self.decode_python_template('<base64>')` rather than raw literals.
`PythonCodeRawInvalidTextSpec` still passes with 117/117 descriptors
py_compile cleanly.
## Any related issues, documentation, or discussions?
Tracking issue: Add audio and media-generation task families to
HuggingFace operator apache#5288
Closes apache#5288
Stacked on: Add image task family (`ImageTaskCodegen`) to HuggingFace
operator / `hf/03-image-tasks`
Parent issue: Add Hugging Face inference operator apache#5041
Closed sibling issue: Add HuggingFaceModelResource REST endpoints for HF
operator UI apache#5134
## How was this PR tested?
`sbt "WorkflowOperator/compile; WorkflowOperator/Test/compile"` clean.
`sbt scalafmtCheck` clean.
`sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.huggingFace.HuggingFaceInferenceOpDescSpec
org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec"` — 26 focused
tests pass, including HuggingFace audio/media task coverage and the raw
Python descriptor scan.
`sbt "WorkflowOperator/testOnly
org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec"` — 117/117
descriptors py_compile cleanly with the new operator code paths, no
marker leaks.
- Added regression coverage that audio remote input routes through
`_fetch_remote_url(audio_input)` and no longer uses raw
`requests.get(audio_input)` or local file reads.
## Was this PR authored or co-authored using generative AI tooling?
Yes, co-authored with generative AI tooling (Codex).
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 23, 2026 04:48
269088f to
7322e1f
Compare
anishshiva7
force-pushed
the
hf/05-qa-ranking
branch
from
June 23, 2026 05:00
7322e1f to
cb2bd44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
hf/04-audio-mediagen. Until that lands, the diff below may also include earlier HuggingFace task-family changes depending on which base GitHub is showing. The new code in this PR iscodegen/QaRankingCodegen.scala, the QA/ranking-related additions tocodegen/PythonCodegenBase.scala, the new QA/ranking fields onHuggingFaceInferenceOpDesc.scala, and the QA/ranking task tests inHuggingFaceInferenceOpDescSpec.scala. Once PR 4 merges and this PR is retargeted tomain, the diff should auto-clean to the PR 5 QA/ranking changes only.What changes were proposed in this PR?
Adds the QA/ranking/classification task family — 5 HF pipeline tasks — as a new
TaskCodegenplugged into the dispatcher established by the text-generation PR:QA tasks:
question-answering,table-question-answeringclassification/ranking tasks:
zero-shot-classification,sentence-similarity,text-rankingcodegen/QaRankingCodegen.scalasupplies the per-task payload + parse Python branches for all 5 tasks.CodegenContextis extended withcontextColumn,candidateLabels, andsentencesColumn(EncodableString).HuggingFaceInferenceOpDesc.scalagains 3 new@JsonPropertyfields and registersQaRankingCodegenin the dispatcher.PythonCodegenBase.scalagrows to host the shared QA/ranking infrastructure:question-answeringpayload handling with prompt + context.table-question-answeringpayload handling with table data.zero-shot-classificationpayload handling with candidate labels.sentence-similarityandtext-rankingpayload handling with sentence inputs.User-input strings continue to flow through
pyb"..."+EncodableStringso they reach Python asself.decode_python_template('<base64>')rather than raw literals.PythonCodeRawInvalidTextSpecstill passes with 117/117 descriptors py_compile cleanly.Any related issues, documentation, or discussions?
Tracking issue: Add HuggingFace question answering and ranking tasks apache#5292
Closes Add HuggingFace question answering and ranking tasks apache#5292
Stacked on: PR 4 audio/media generation tasks /
hf/04-audio-mediagenParent issue: Add Hugging Face inference operator apache#5041
Closed sibling issue: Add HuggingFaceModelResource REST endpoints for HF operator UI apache#5134
How was this PR tested?
sbt "WorkflowOperator/compile; WorkflowOperator/Test/compile"clean.sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.huggingFace.HuggingFaceInferenceOpDescSpec org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec"— 31 focused tests pass, including HuggingFace QA/ranking task coverage and the raw Python descriptor scan.sbt "WorkflowOperator / scalafmtCheck"clean.sbt "WorkflowOperator / Test / scalafmtCheck"clean.PythonCodeRawInvalidTextSpec— 117/117 descriptors py_compile cleanly with the new operator code paths, no marker leaks.Was this PR authored or co-authored using generative AI tooling?
Yes, co-authored with generative AI tooling (Codex).