zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-08 08:28:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: migrate mistralai to 2.x and remediate CVE-2025-67221 (orjson) (#17810)

Browse Source 
## Summary
  
Migrates `mistralai` from `==0.4.2` to `>=2.7.2,<3.0.0` to unblock the
orjson CVE fix. The old SDK pinned `orjson>=3.9.10,<3.11`, preventing
upgrade to the patched version.
  
  | CVE | Severity | Package | Installed | Fixed in |
  |---|---|---|---|---|
  | CVE-2025-67221 | HIGH | orjson | 3.10.18 | 3.11.6 |

`mistralai` 2.x (the current maintained version) drops the orjson
dependency entirely. Added `orjson>=3.11.6` to `constraint-dependencies`
to pin the floor for remaining parent packages (`langgraph-sdk`,
`langsmith`, `ranx`).
This commit is contained in:
rayhan
2026-08-05 02:52:30 +01:00
committed by GitHub
parent 07d1c89e5e
commit 166758cb0f
5 changed files with 68 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
test/unit_test/rag/llm/test_embedding_model.py
View File

@@ -223,15 +223,15 @@ class TestTruncationBoundary:
embed.model_name = "mistral-embed"
captured = {}
def _embeddings(input, model):
captured["input"] = input
def _embeddings_create(inputs, model):
captured["inputs"] = inputs
return _OpenAIResp([[0.0, 0.0]], total_tokens=1)
embed.client = MagicMock()
embed.client.embeddings = MagicMock(side_effect=_embeddings)
embed.client.embeddings.create = MagicMock(side_effect=_embeddings_create)
huge = "word " * 12000
embed.encode([huge])
assert num_tokens_from_string(captured["input"][0]) <= DEFAULT_MAX_TOKENS
assert num_tokens_from_string(captured["inputs"][0]) <= DEFAULT_MAX_TOKENS
# --------------------------------------------------------------------------- #