zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-10 09:21:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: migrate mistralai to 2.x and remediate CVE-2025-67221 (orjson) (#17810)

Browse Source 
## Summary
  
Migrates `mistralai` from `==0.4.2` to `>=2.7.2,<3.0.0` to unblock the
orjson CVE fix. The old SDK pinned `orjson>=3.9.10,<3.11`, preventing
upgrade to the patched version.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2025-67221 | HIGH | orjson | 3.10.18 | 3.11.6 |

`mistralai` 2.x (the current maintained version) drops the orjson
dependency entirely. Added `orjson>=3.11.6` to `constraint-dependencies`
to pin the floor for remaining parent packages (`langgraph-sdk`,
`langsmith`, `ranx`).
This commit is contained in:
rayhan
2026-08-05 02:52:30 +01:00
committed by GitHub
parent 07d1c89e5e
commit 166758cb0f
5 changed files with 68 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
rag/llm/embedding_model.py
View File

@@ -611,9 +611,9 @@ class MistralEmbed(Base):
_FACTORY_NAME = "Mistral"
def __init__(self, key, model_name="mistral-embed", base_url=None):
from mistralai.client import MistralClient
from mistralai.client import Mistral
self.client = MistralClient(api_key=key)
self.client = Mistral(api_key=key)
self.model_name = model_name
def encode(self, texts: list):
@@ -628,7 +628,7 @@ class MistralEmbed(Base):
retry_max = 5
while retry_max > 0:
try:
res = self.client.embeddings(input=texts[i : i + batch_size], model=self.model_name)
res = self.client.embeddings.create(inputs=texts[i : i + batch_size], model=self.model_name)
ress.extend([d.embedding for d in res.data])
token_count += total_token_count_from_response(res)
break
@@ -648,7 +648,7 @@ class MistralEmbed(Base):
retry_max = 5
while retry_max > 0:
try:
res = self.client.embeddings(input=[truncate(text, DEFAULT_MAX_TOKENS)], model=self.model_name)
res = self.client.embeddings.create(inputs=[truncate(text, DEFAULT_MAX_TOKENS)], model=self.model_name)
return np.array(res.data[0].embedding), total_token_count_from_response(res)
except Exception as _e:
if retry_max == 1: