akadmin/headroom
1
0
Fork 0
mirror of https://github.com/headroomlabs-ai/headroom.git synced 2026-08-27 14:17:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
headroom/sbom/headroom-python-licenses.csv
Tejas Chopra 5771a8020e
fix(deps): remediate dependency CVEs and publish SBOM (#1509) 
## Description

Supply-chain hardening: takes the **shipped** dependency surface from
**26 known CVEs to 0**. `pip install headroom-ai[all]` now resolves with
no known vulnerabilities (verified with Anchore syft + grype). Also
publishes a checked-in SBOM package (`sbom/`) so any user — especially
pilots running their own security review — can verify what's inside and
that we track it.

This addresses the Dependabot alerts on `main` (9 high / 4 moderate / 7
low at time of writing).

Closes #

## Type of Change

- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)

## Changes Made

**Rust**
- `pyo3` 0.24 → 0.29 (GHSA-36hh-v3qg-5jq4 High, GHSA-chgr-c6px-7xpp
Med). Migrated `Python::allow_threads` → `Python::detach` (10 sites) and
added `from_py_object` to the `Clone`-deriving `#[pyclass]` types (both
required by the 0.25+ API).
- `pyo3-log` 0.12 → 0.13; `lru` 0.12 → 0.18 (GHSA-rhfx-m35p-ff5j).

**Python**
- `torch` → 2.12.1, `mem0ai` → 2.x.
- Floor-pinned transitive CVE deps via `[tool.uv]
constraint-dependencies`: `pygments>=2.20.0`,
`pydantic-settings>=2.14.2`, `gitpython>=3.1.50`, `langsmith>=0.9.0`.
- **Removed `benchmark` from the `[all]` aggregate** so the default
install is CVE-free. `lm-eval` is invoked as an external subprocess
(`python -m lm_eval`) and never imported, so it is not a true runtime
dep — it remains available via the opt-in `[benchmark]` extra. See
[Accepted Risks](#additional-notes).

**npm (build/test tooling — never shipped in the
wheel/container/published SDK)**
- `esbuild` override `>=0.28.1` in `sdk/typescript` + `plugins/openclaw`
(GHSA-g7r4-m6w7-qqqr).
- `docs/`: `@anthropic-ai/sdk` → `^0.106.0` (GHSA-p7fg-763f-g4gf),
`postcss` override to force Next.js's bundled copy ≥8.5.10
(GHSA-qx2v-qp2m-jg93); regenerated a stale `bun.lock` that carried a
**Critical** vitest/vite.

**CI**
- Pinned `pypa/gh-action-pypi-publish` `@release/v1` → `@v1.13.0`
(GHSA-vxmw-7h4f-hqxh) in `release.yml` + `publish.yml`.

**SBOM**
- New `sbom/` directory: CycloneDX 1.7 + SPDX 2.3 SBOMs, grype scan
evidence, 330-package license inventory, and a regeneration guide.

## Testing

- [ ] Unit tests pass (`pytest`) — N/A, no Python source changed
(deps/config only)
- [x] Linting passes — `cargo fmt --check` + `cargo clippy` clean on the
changed crate; 0 `.py` files changed so `ruff`/`mypy` scope is
unaffected
- [x] Type checking passes — `cargo check --workspace` (0 errors)
- [ ] New tests added — N/A (dependency bumps; covered by existing
suites)
- [x] Manual testing performed — see Real Behavior Proof

### Test Output

```text
# headroom-ai[all] product surface — the number that matters
$ grype sbom:sbom/headroom-sbom-all-extra.cdx.json
No vulnerabilities found

# full repo scan (universal lock incl. opt-in [benchmark] + dev)
$ grype sbom:sbom/headroom-sbom.cdx.json
NAME        INSTALLED  TYPE    VULNERABILITY        SEVERITY
sqlitedict  2.1.0      python  GHSA-g4r7-86gm-pgqc  High      # [benchmark]-only, unpatchable, accepted
nltk        3.9.4      python  GHSA-p4gq-832x-fm9v  High      # [benchmark]-only, unpatchable, accepted

# pyo3 0.29 migration — extension builds + imports + runs
$ cargo check --workspace
    Finished `dev` profile [unoptimized + debuginfo] target(s)
$ maturin develop && python -c "from headroom._core import DiffCompressor, SmartCrusher; ..."
extension OK — detach + from_py_object paths exercised

# lru 0.18 — eviction path
$ cargo test -p headroom-proxy --lib drift
14 passed, 213 filtered out

# per-ecosystem npm audits
$ (cd sdk/typescript && npm audit)         -> found 0 vulnerabilities
$ (cd plugins/openclaw && npm audit)       -> found 0 vulnerabilities
$ (cd docs && npm audit && bun audit)      -> found 0 vulnerabilities / No vulnerabilities found
```

## Real Behavior Proof

- Environment: macOS (darwin 25.4.0, arm64), Python 3.12 `.venv`, Rust
1.95 toolchain, syft 1.46.0, grype 0.115.0, bun 1.3.14, maturin 1.13.3.
- Exact command / steps: (1) `uv export --extra all --no-dev
--no-emit-project | syft → grype` for the product surface; (2) `cargo
check --workspace` + `maturin develop` + extension import/compress smoke
test; (3) `cargo test -p headroom-proxy --lib drift`; (4) `cargo fmt
--check` + `cargo clippy -p headroom-py`; (5) `npm audit` in
sdk/openclaw/docs + `bun audit` in docs.
- Observed result: `headroom-ai[all]` resolution scans clean — "No
vulnerabilities found" (179 pkgs); full/prod SBOM shows only the 2
documented accepted CVEs; pyo3 0.29 extension imports and runs (detach +
from_py_object paths exercised); drift tests 14/14 pass; cargo fmt +
clippy clean; all npm/bun audits report 0.
- Not tested: full `pytest` suite (no Python source changed);
release-profile wheel build (used dev-profile `maturin develop` for the
import proof — the extension is semantically identical).

## Review Readiness

- [x] I have performed a self-review
- [x] This PR is ready for human review

## Checklist

- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
(`sbom/README.md`)
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective — N/A
(dependency bumps; existing suites + scans cover it)
- [x] New and existing unit tests pass locally with my changes
- [ ] I have updated the CHANGELOG.md — N/A (Release Please
auto-generates from the conventional commit)

## Additional Notes

**Accepted risks (the 2 residual CVEs).** Both originate solely from the
EleutherAI `lm-evaluation-harness` under the **opt-in `[benchmark]`
extra**, which Headroom invokes as a subprocess (never imports):
- `sqlitedict` CVE-2024-35515 (High) — pickle deserialization; package
abandoned (last release 2021), **no upstream fix exists**.
- `nltk` CVE-2026-54293 (High) — path traversal in `nltk.data.load()`;
affects ≤3.9.4 (current latest), **no patched release**.

Neither is in `[all]`, the published wheel, or the container. They are
documented in `sbom/README.md` and will be picked up automatically once
upstream ships fixes.

**Release/CHANGELOG:** N/A items above are because this is a
dependency/security PR with no Python source changes; CHANGELOG is
Release-Please-managed via the conventional commit message.
2026-06-27 15:28:12 -07:00

25 KiB
Raw Blame History

1NameVersionLicenseURL
2DataProperty1.1.0MIT Licensehttps://github.com/thombashi/DataProperty
3GitPython3.1.46BSD-3-Clausehttps://github.com/gitpython-developers/GitPython
4Jinja23.1.6BSD Licensehttps://github.com/pallets/jinja/
5MarkupSafe3.0.3BSD-3-Clausehttps://github.com/pallets/markupsafe/
6PyJWT2.11.0MIThttps://github.com/jpadilla/pyjwt
7PyYAML6.0.3MIT Licensehttps://pyyaml.org/
8Pygments2.20.0BSD-2-Clausehttps://pygments.org
9SQLAlchemy2.0.48MIThttps://www.sqlalchemy.org
10absl-py2.4.0Apache-2.0https://github.com/abseil/abseil-py
11accelerate1.12.0Apache Software Licensehttps://github.com/huggingface/accelerate
12aiofiles24.1.0Apache Software Licensehttps://github.com/Tinche/aiofiles
13aiohappyeyeballs2.6.1Python Software Foundation Licensehttps://github.com/aio-libs/aiohappyeyeballs
14aiohttp3.13.3Apache-2.0 AND MIThttps://github.com/aio-libs/aiohttp
15aiosignal1.4.0Apache Software Licensehttps://github.com/aio-libs/aiosignal
16aiosqlite0.22.1MIT Licensehttps://aiosqlite.omnilib.dev
17annotated-doc0.0.4MIThttps://github.com/fastapi/annotated-doc
18annotated-types0.7.0MIT Licensehttps://github.com/annotated-types/annotated-types
19anthropic0.76.0MIT Licensehttps://github.com/anthropics/anthropic-sdk-python
20anyio4.12.1MIThttps://anyio.readthedocs.io/en/stable/versionhistory.html
21ast-grep-cli0.42.1MIT Licensehttps://ast-grep.github.io/
22asyncpg0.31.0Apache-2.0UNKNOWN
23attrs25.4.0MIThttps://www.attrs.org/en/stable/changelog.html
24aurelio-sdk0.0.19UNKNOWNUNKNOWN
25babel2.18.0BSD Licensehttps://babel.pocoo.org/
26backoff2.2.1MIT Licensehttps://github.com/litl/backoff
27blis1.3.3BSD Licensehttps://github.com/explosion/cython-blis
28boto31.43.20Apache-2.0https://github.com/boto/boto3
29botocore1.43.20Apache-2.0https://github.com/boto/botocore
30build1.4.0MIThttps://build.pypa.io
31catalogue2.0.10MIT Licensehttps://github.com/explosion/catalogue
32cbor26.1.2MIThttps://cbor2.readthedocs.io/en/latest/versionhistory.html
33certifi2026.1.4Mozilla Public License 2.0 (MPL 2.0)https://github.com/certifi/python-certifi
34cffi2.0.0MIThttps://cffi.readthedocs.io/en/latest/whatsnew.html
35cfgv3.5.0MIThttps://github.com/asottile/cfgv
36chardet5.2.0GNU Lesser General Public License v2 or later (LGPLv2+)https://github.com/chardet/chardet
37charset-normalizer3.4.4MIThttps://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md
38click8.3.1BSD-3-Clausehttps://github.com/pallets/click/
39cloudpathlib0.23.0MIT Licensehttps://github.com/drivendataorg/cloudpathlib
40colorama0.4.6BSD Licensehttps://github.com/tartley/colorama
41coloredlogs15.0.1MIT Licensehttps://coloredlogs.readthedocs.io
42colorlog6.10.1MIT Licensehttps://github.com/borntyping/python-colorlog
43confection1.3.3MIT Licensehttps://github.com/explosion/confection
44courlan1.3.2Apache Software Licensehttps://github.com/adbar/courlan
45coverage7.13.2Apache-2.0https://github.com/coveragepy/coveragepy
46cryptography49.0.0Apache-2.0 OR BSD-3-Clausehttps://github.com/pyca/cryptography
47cymem2.0.13MIT Licensehttps://github.com/explosion/cymem
48datasets4.5.0Apache Software Licensehttps://github.com/huggingface/datasets
49dateparser1.3.0BSD Licensehttps://github.com/scrapinghub/dateparser
50dill0.4.0BSD Licensehttps://github.com/uqfoundation/dill
51distlib0.4.0Python Software Foundation Licensehttps://github.com/pypa/distlib
52distro1.9.0Apache Software Licensehttps://github.com/python-distro/distro
53docstring_parser0.17.0MIT Licensehttps://github.com/rr-/docstring_parser
54docutils0.22.4BSD License; GNU General Public License (GPL); Public Domainhttps://docutils.sourceforge.io
55en_core_web_lg3.8.0MIThttps://explosion.ai
56evaluate0.4.6Apache Software Licensehttps://github.com/huggingface/evaluate
57fakeredis2.34.1BSD-3-Clausehttps://github.com/cunla/fakeredis-py
58fastapi0.128.0MIThttps://github.com/fastapi/fastapi
59fastembed0.8.0Other/Proprietary Licensehttps://github.com/qdrant/fastembed
60fastuuid0.14.0BSD Licensehttps://github.com/thedrow/fastuuid/
61filelock3.20.3Unlicensehttps://github.com/tox-dev/py-filelock
62flatbuffers25.12.19Apache Software Licensehttps://google.github.io/flatbuffers/
63frozenlist1.8.0Apache-2.0https://github.com/aio-libs/frozenlist
64fsspec2025.10.0BSD-3-Clausehttps://github.com/fsspec/filesystem_spec
65gh0.0.4MIT Licensehttps://github.com/danielwhatmuff/gh
66gitdb4.0.12BSD Licensehttps://github.com/gitpython-developers/gitdb
67gliner0.2.26Apache-2.0https://github.com/urchade/GLiNER
68google-api-core2.31.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-api-core
69google-auth2.55.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
70google-cloud-aiplatform1.158.0Apache 2.0https://github.com/googleapis/python-aiplatform
71google-cloud-bigquery3.42.0Apache 2.0https://github.com/googleapis/python-bigquery
72google-cloud-core2.6.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-core
73google-cloud-resource-manager1.17.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-resource-manager
74google-cloud-storage3.12.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-storage
75google-crc32c1.8.0UNKNOWNhttps://github.com/googleapis/python-crc32c
76google-genai2.9.0Apache-2.0https://github.com/googleapis/python-genai
77google-resumable-media2.10.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-resumable-media
78googleapis-common-protos1.74.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/googleapis-common-protos
79greenlet3.3.2MIT AND PSF-2.0https://greenlet.readthedocs.io
80grpc-google-iam-v10.14.4Apache Software Licensehttps://github.com/googleapis/google-cloud-python
81grpcio1.81.1Apache-2.0https://grpc.io
82grpcio-status1.81.1Apache-2.0https://grpc.io
83grpclib0.4.9BSD Licensehttps://github.com/vmagamedov/grpclib
84h110.16.0MIT Licensehttps://github.com/python-hyper/h11
85h24.3.0MIT Licensehttps://github.com/python-hyper/h2/
86headroom-ai0.27.0Apache-2.0https://headroom-docs.vercel.app
87headroom-security0.1.0ProprietaryUNKNOWN
88hf-xet1.2.0Apache-2.0https://github.com/huggingface/xet-core
89hnswlib0.8.0UNKNOWNhttps://github.com/yurymalkov/hnsw
90hpack4.1.0MIT Licensehttps://github.com/python-hyper/hpack/
91htmldate1.9.4Apache Software Licensehttps://htmldate.readthedocs.io
92httpcore1.0.9BSD-3-Clausehttps://www.encode.io/httpcore/
93httpx0.28.1BSD Licensehttps://github.com/encode/httpx
94httpx-sse0.4.3MIThttps://github.com/florimondmanca/httpx-sse
95huggingface_hub1.3.4Apache Software Licensehttps://github.com/huggingface/huggingface_hub
96humanfriendly10.0MIT Licensehttps://humanfriendly.readthedocs.io
97hyperframe6.1.0MIT Licensehttps://github.com/python-hyper/hyperframe/
98id1.5.0Apache Software Licensehttps://pypi.org/project/id/
99identify2.6.16MIThttps://github.com/pre-commit/identify
100idna3.11BSD-3-Clausehttps://github.com/kjd/idna
101importlib_metadata8.7.1Apache-2.0https://github.com/python/importlib_metadata
102iniconfig2.3.0MIThttps://github.com/pytest-dev/iniconfig
103jaraco.classes3.4.0MIT Licensehttps://github.com/jaraco/jaraco.classes
104jaraco.context6.1.0MIThttps://github.com/jaraco/jaraco.context
105jaraco.functools4.4.0MIThttps://github.com/jaraco/jaraco.functools
106jiter0.12.0MIT Licensehttps://github.com/pydantic/jiter/
107jmespath1.1.0MIT Licensehttps://github.com/jmespath/jmespath.py
108joblib1.5.3BSD-3-Clausehttps://joblib.readthedocs.io
109jsonlines4.0.0BSD Licensehttps://github.com/wbolster/jsonlines
110jsonpatch1.33BSD Licensehttps://github.com/stefankoegl/python-json-patch
111jsonpointer3.0.0BSD Licensehttps://github.com/stefankoegl/python-json-pointer
112jsonschema4.26.0MIThttps://github.com/python-jsonschema/jsonschema
113jsonschema-specifications2025.9.1MIThttps://github.com/python-jsonschema/jsonschema-specifications
114jusText3.0.2BSD Licensehttps://github.com/miso-belica/jusText
115keyring25.7.0MIThttps://github.com/jaraco/keyring
116langchain-core1.2.26MIT Licensehttps://docs.langchain.com/
117langchain-ollama1.0.1MIThttps://docs.langchain.com/oss/python/integrations/providers/ollama
118langchain-protocol0.0.15MIT Licensehttps://github.com/langchain-ai/agent-protocol/tree/main/streaming
119langfuse4.6.1MITUNKNOWN
120langgraph1.2.0MIThttps://docs.langchain.com/oss/python/langgraph/overview
121langgraph-checkpoint4.1.0MIThttps://github.com/langchain-ai/langgraph/tree/main/libs/checkpoint
122langgraph-prebuilt1.1.0MIThttps://github.com/langchain-ai/langgraph/tree/main/libs/prebuilt
123langgraph-sdk0.3.14MIThttps://github.com/langchain-ai/langgraph/tree/main/libs/sdk-py
124langsmith0.6.5MIThttps://smith.langchain.com/
125librt0.7.8MIT Licensehttps://github.com/mypyc/librt
126litellm1.88.1MIThttps://litellm.ai
127llmlingua0.2.2MIT Licensehttps://github.com/microsoft/LLMLingua
128lm_eval0.4.11MIThttps://github.com/EleutherAI/lm-evaluation-harness
129loguru0.7.3MIT Licensehttps://github.com/Delgan/loguru
130lxml6.0.2BSD-3-Clausehttps://lxml.de/
131lxml_html_clean0.4.4BSD-3-Clausehttps://github.com/fedora-python/lxml_html_clean/
132magika0.6.2Apache Software Licensehttps://github.com/google/magika
133markdown-it-py4.0.0MIT Licensehttps://github.com/executablebooks/markdown-it-py
134maturin1.13.3MIT OR Apache-2.0https://github.com/pyo3/maturin
135mbstrdecoder1.1.4MIT Licensehttps://github.com/thombashi/mbstrdecoder
136mcp1.26.0MIT Licensehttps://modelcontextprotocol.io
137mdurl0.1.2MIT Licensehttps://github.com/executablebooks/mdurl
138ml_dtypes0.5.4Apache-2.0https://github.com/jax-ml/ml_dtypes
139mmh35.2.1MIT Licensehttps://pypi.org/project/mmh3/
140modal1.5.0Apache-2.0https://modal.com
141more-itertools10.8.0MIThttps://github.com/more-itertools/more-itertools
142mpmath1.3.0BSD Licensehttp://mpmath.org/
143multidict6.7.1Apache License 2.0https://github.com/aio-libs/multidict
144multiprocess0.70.18BSD Licensehttps://github.com/uqfoundation/multiprocess
145murmurhash1.0.15MIT Licensehttps://github.com/explosion/murmurhash
146mypy1.19.1MIT Licensehttps://www.mypy-lang.org/
147mypy_extensions1.1.0MIThttps://github.com/python/mypy_extensions
148networkx3.6.1BSD-3-Clausehttps://networkx.org/
149nh30.3.2MITUNKNOWN
150nltk3.9.3Apache Software Licensehttps://www.nltk.org/
151nodeenv1.10.0BSD Licensehttps://github.com/ekalinin/nodeenv
152numpy2.4.1BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0https://numpy.org
153ollama0.6.1MIThttps://ollama.com
154onnx1.21.0Apache-2.0https://onnx.ai/
155onnxconverter-common1.16.0MIT Licensehttps://github.com/microsoft/onnxconverter-common
156onnxruntime1.23.2MIT Licensehttps://onnxruntime.ai
157openai2.41.0Apache Software Licensehttps://github.com/openai/openai-python
158opencv-python4.13.0.92Apache Software Licensehttps://github.com/opencv/opencv-python
159opentelemetry-api1.39.1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/opentelemetry-api
160opentelemetry-exporter-otlp-proto-common1.39.1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/exporter/opentelemetry-exporter-otlp-proto-common
161opentelemetry-exporter-otlp-proto-http1.39.1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/exporter/opentelemetry-exporter-otlp-proto-http
162opentelemetry-instrumentation0.63b1Apache-2.0https://github.com/open-telemetry/opentelemetry-python-contrib/tree/main/opentelemetry-instrumentation
163opentelemetry-instrumentation-threading0.63b1Apache-2.0https://github.com/open-telemetry/opentelemetry-python-contrib/instrumentation/opentelemetry-instrumentation-threading
164opentelemetry-proto1.39.1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/opentelemetry-proto
165opentelemetry-sdk1.39.1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/opentelemetry-sdk
166opentelemetry-semantic-conventions0.60b1Apache-2.0https://github.com/open-telemetry/opentelemetry-python/tree/main/opentelemetry-semantic-conventions
167orjson3.11.5Apache-2.0 OR MIThttps://github.com/ijl/orjson
168ormsgpack1.12.2Apache-2.0 OR MIThttps://github.com/ormsgpack/ormsgpack
169packaging25.0Apache Software License; BSD Licensehttps://github.com/pypa/packaging
170pandas3.0.0BSD Licensehttps://pandas.pydata.org
171pathspec1.0.4Mozilla Public License 2.0 (MPL 2.0)https://python-path-specification.readthedocs.io/en/latest/index.html
172pathvalidate3.3.1MIT Licensehttps://github.com/thombashi/pathvalidate
173phonenumbers9.0.27Apache-2.0https://github.com/daviddrysdale/python-phonenumbers
174pillow12.1.0MIT-CMUhttps://python-pillow.github.io
175platformdirs4.5.1MIThttps://github.com/tox-dev/platformdirs
176pluggy1.6.0MIT LicenseUNKNOWN
177portalocker3.2.0BSD-3-Clausehttps://github.com/wolph/portalocker/
178pre_commit4.5.1MIThttps://github.com/pre-commit/pre-commit
179preshed3.0.13MIT Licensehttps://github.com/explosion/preshed
180presidio_analyzer2.2.362MIThttps://github.com/Microsoft/presidio
181presidio_anonymizer2.2.362MIThttps://github.com/Microsoft/presidio
182propcache0.4.1Apache Software Licensehttps://github.com/aio-libs/propcache
183proto-plus1.28.0Apache Software Licensehttps://github.com/googleapis/google-cloud-python/tree/main/packages/proto-plus
184protobuf6.33.63-Clause BSD Licensehttps://developers.google.com/protocol-buffers/
185psutil7.2.1BSD-3-Clausehttps://github.com/giampaolo/psutil
186pyOpenSSL26.3.0Apache Software Licensehttps://pyopenssl.org/
187py_rust_stemmers0.1.5UNKNOWNUNKNOWN
188pyarrow23.0.0Apache-2.0https://arrow.apache.org/
189pyasn10.6.3BSD-2-Clausehttps://github.com/pyasn1/pyasn1
190pyasn1_modules0.4.2BSD Licensehttps://github.com/pyasn1/pyasn1-modules
191pyclipper1.4.0MIT Licensehttps://github.com/fonttools/pyclipper
192pycparser3.0BSD-3-Clausehttps://github.com/eliben/pycparser
193pydantic2.12.5MIThttps://github.com/pydantic/pydantic
194pydantic-settings2.12.0MIThttps://github.com/pydantic/pydantic-settings
195pydantic_core2.41.5MIThttps://github.com/pydantic/pydantic-core
196pyproject_hooks1.2.0MIT Licensehttps://github.com/pypa/pyproject-hooks
197pytablewriter1.2.1MIT Licensehttps://github.com/thombashi/pytablewriter
198pytest9.0.2MIThttps://docs.pytest.org/en/latest/
199pytest-asyncio1.3.0Apache-2.0https://github.com/pytest-dev/pytest-asyncio
200pytest-cov7.0.0MIThttps://pytest-cov.readthedocs.io/en/latest/changelog.html
201pytest-split0.11.0MIT Licensehttps://jerry-git.github.io/pytest-split
202python-dateutil2.9.0.post0Apache Software License; BSD Licensehttps://github.com/dateutil/dateutil
203python-dotenv1.2.1BSD-3-Clausehttps://github.com/theskumar/python-dotenv
204python-multipart0.0.22Apache-2.0https://github.com/Kludex/python-multipart
205pytz2026.1.post1MIT Licensehttp://pythonhosted.org/pytz
206rapidocr-onnxruntime1.4.4Apache-2.0https://github.com/RapidAI/RapidOCR
207readme_renderer44.0Apache Software LicenseUNKNOWN
208redis7.3.0MIThttps://github.com/redis/redis-py
209referencing0.37.0MIThttps://github.com/python-jsonschema/referencing
210regex2026.1.15Apache-2.0 AND CNRI-Pythonhttps://github.com/mrabarnett/mrab-regex
211requests2.34.2Apache Software Licensehttps://github.com/psf/requests
212requests-file3.0.1Apache Software Licensehttps://codeberg.org/dashea/requests-file
213requests-toolbelt1.0.0Apache Software Licensehttps://toolbelt.readthedocs.io/
214rfc39862.0.0Apache Software Licensehttp://rfc3986.readthedocs.io
215rich14.3.1MIT Licensehttps://github.com/Textualize/rich
216rouge_score0.1.2Apache Software Licensehttps://github.com/google-research/google-research/tree/master/rouge
217rpds-py0.30.0MIThttps://github.com/crate-py/rpds
218ruff0.14.14MIT Licensehttps://docs.astral.sh/ruff
219s3transfer0.18.0Apache Software Licensehttps://github.com/boto/s3transfer
220sacrebleu2.6.0Apache-2.0https://github.com/mjpost/sacrebleu
221safetensors0.7.0Apache Software Licensehttps://github.com/huggingface/safetensors
222scikit-learn1.8.0BSD-3-Clausehttps://scikit-learn.org
223scipy1.17.0BSD Licensehttps://scipy.org/
224semantic-router0.1.12MITUNKNOWN
225sentence-transformers5.2.1Apache Software Licensehttps://www.SBERT.net
226sentencepiece0.2.1UNKNOWNhttps://github.com/google/sentencepiece
227shapely2.1.2BSD Licensehttps://github.com/shapely/shapely
228shellingham1.5.4ISC License (ISCL)https://github.com/sarugaku/shellingham
229six1.17.0MIT Licensehttps://github.com/benjaminp/six
230smart_open7.5.1MIT Licensehttps://github.com/piskvorky/smart_open
231smmap5.0.2BSD Licensehttps://github.com/gitpython-developers/smmap
232sniffio1.3.1Apache Software License; MIT Licensehttps://github.com/python-trio/sniffio
233sortedcontainers2.4.0Apache Software Licensehttp://www.grantjenks.com/docs/sortedcontainers/
234spacy3.8.14MIT Licensehttps://spacy.io
235spacy-legacy3.0.12MIT Licensehttps://spacy.io
236spacy-loggers1.0.5MIThttps://github.com/explosion/spacy-loggers
237sqlite-vec0.1.6MIT License, Apache License, Version 2.0https://TODO.com
238sqlitedict2.1.0Apache Software Licensehttps://github.com/piskvorky/sqlitedict
239srsly2.5.3MIT Licensehttps://github.com/explosion/srsly
240sse-starlette3.2.0BSD-3-Clausehttps://github.com/sysid/sse-starlette
241starlette0.50.0BSD-3-Clausehttps://github.com/Kludex/starlette
242strands-agents1.42.0Apache Software Licensehttps://github.com/strands-agents/sdk-python
243sympy1.14.0BSD Licensehttps://sympy.org
244synchronicity0.12.3Apache Software LicenseUNKNOWN
245tabledata1.3.4MIT Licensehttps://github.com/thombashi/tabledata
246tabulate0.10.0MIThttps://github.com/astanin/python-tabulate
247tcolorpy0.1.7MIT Licensehttps://github.com/thombashi/tcolorpy
248tenacity9.1.2Apache Software Licensehttps://github.com/jd/tenacity
249thinc8.3.13MIT Licensehttps://github.com/explosion/thinc
250threadpoolctl3.6.0BSD Licensehttps://github.com/joblib/threadpoolctl
251tiktoken0.12.0MIT License Copyright (c) 2022 OpenAI, Shantanu Jain Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. https://github.com/openai/tiktoken
252tld0.13.1MPL-1.1 OR GPL-2.0-only OR LGPL-2.1-or-laterhttps://github.com/barseghyanartur/tld
253tldextract5.3.1BSD-3-Clausehttps://github.com/john-kurkowski/tldextract
254tokenizers0.22.2Apache Software Licensehttps://github.com/huggingface/tokenizers
255toml0.10.2MIT Licensehttps://github.com/uiri/toml
256torch2.10.0BSD-3-Clausehttps://pytorch.org
257tornado6.5.4Apache Software Licensehttp://www.tornadoweb.org/
258tqdm4.67.1MIT License; Mozilla Public License 2.0 (MPL 2.0)https://tqdm.github.io
259trafilatura2.0.0Apache Software Licensehttps://trafilatura.readthedocs.io
260transformers5.0.0Apache 2.0 Licensehttps://github.com/huggingface/transformers
261tree-sitter0.25.2MIT Licensehttps://tree-sitter.github.io/tree-sitter/
262tree-sitter-c-sharp0.23.1MIT Licensehttps://github.com/tree-sitter/tree-sitter-c-sharp
263tree-sitter-embedded-template0.25.0MIThttps://github.com/tree-sitter/tree-sitter-embedded-template
264tree-sitter-language-pack0.13.0MIT OR Apache-2.0https://github.com/Goldziher/tree-sitter-language-pack
265tree-sitter-yaml0.7.2MIThttps://github.com/tree-sitter-grammars/tree-sitter-yaml
266twine6.2.0Apache-2.0https://twine.readthedocs.io/
267typepy1.3.4MIT Licensehttps://github.com/thombashi/typepy
268typer0.25.1MIThttps://github.com/fastapi/typer
269typer-slim0.21.1MIThttps://github.com/fastapi/typer
270types-certifi2021.10.8.3Apache Software Licensehttps://github.com/python/typeshed
271types-toml0.10.8.20260518Apache-2.0https://github.com/python/typeshed
272typing-inspection0.4.2MIThttps://github.com/pydantic/typing-inspection
273typing_extensions4.15.0PSF-2.0https://github.com/python/typing_extensions
274tzlocal5.3.1MIT Licensehttps://github.com/regebro/tzlocal/blob/master/CHANGES.txt
275urllib32.6.3MIThttps://github.com/urllib3/urllib3/blob/main/CHANGES.rst
276uuid_utils0.14.0BSD Licensehttps://github.com/aminalaee/uuid-utils
277uvicorn0.40.0BSD-3-Clausehttps://uvicorn.dev/
278virtualenv20.36.1MIThttps://github.com/pypa/virtualenv
279wasabi1.1.3MIThttps://github.com/explosion/wasabi
280watchdog6.0.0Apache Software Licensehttps://github.com/gorakhargosh/watchdog
281watchfiles1.2.0MIT Licensehttps://github.com/samuelcolvin/watchfiles
282weasel1.0.0MIT Licensehttps://github.com/explosion/weasel/
283websockets16.0BSD-3-Clausehttps://github.com/python-websockets/websockets
284word2number1.1The MIT License (MIT) Copyright (c) 2016 Akshay Nagpal (https://github.com/akshaynagpal) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. https://github.com/akshaynagpal/w2n
285wrapt1.17.3BSD Licensehttps://github.com/GrahamDumpleton/wrapt
286xxhash3.6.0BSD Licensehttps://github.com/ifduyue/python-xxhash
287yarl1.22.0Apache Software Licensehttps://github.com/aio-libs/yarl
288zipp3.23.0MIThttps://github.com/jaraco/zipp
289zstandard0.25.0BSD-3-Clausehttps://github.com/indygreg/python-zstandard