LCORE-1240: Konflux requirements #1068
Conversation
WalkthroughUpdates three package versions in a requirements hash file: llama-stack and llama-stack-client from 0.4.2 to 0.4.3, and sentence-transformers from 5.2.1 to 5.2.2, with corresponding SHA256 hash updates. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@requirements.hashes.source.txt`:
- Around line 705-707: The pinned dependency sentence-transformers==5.2.2 is
invalid (not on PyPI); change the requirement line that currently reads
"sentence-transformers==5.2.2 \ --hash=sha256:..." to a valid published release
(e.g., "sentence-transformers==5.2.0") and update or remove the associated
--hash entries to match the chosen version, or remove the entire pinned entry
until 5.2.2 is published; if you switch to 5.2.0, ensure any CI or lockfile
hashes are regenerated to reflect the new version and note that when/if moving
to 5.2.2 you may need to add httpx as an explicit dependency because of the
library's internal HTTP client change.
- Around line 199-201: The requirements file pins a non-existent release
"llama-stack==0.4.3" which will fail installs; verify whether you intended
"llama-stack==0.4.2" (latest on PyPI) or a different package (e.g.,
"llama-stack-client==0.4.3"), then update the version pin in
requirements.hashes.source.txt to the correct package/version and regenerate the
corresponding --hash entries for that exact wheel/sdist (remove the invalid
0.4.3 entry if not intended). Ensure the unique token "llama-stack==0.4.3" in
the diff is replaced with the verified version and matching hashes so installers
can succeed.
| llama-stack==0.4.3 \ | ||
| --hash=sha256:423207eae2b640894992a9075ff9dd6300ff904ab06a49fe38cfe0bb809d4669 \ | ||
| --hash=sha256:70d379ae9dbb5b1d0693f14054d9817aba183ffcd805133f0a4442baee132c6d |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Read the requirements.hashes.source.txt file around the mentioned lines
head -210 requirements.hashes.source.txt | tail -25Repository: lightspeed-core/lightspeed-stack
Length of output: 1678
🌐 Web query:
llama-stack 0.4.3 release notes changelog
💡 Result:
I couldn’t find any llama-stack 0.4.3 release notes/changelog—there doesn’t appear to be a 0.4.3 release published.
What I can confirm from official channels:
- PyPI (
llama-stack) latest published version is 0.4.2, uploaded Jan 16, 2026. [1] - The GitHub Releases page for
meta-llama/llama-stackcurrently shows releases up through v0.3.4 (Dec 3, 2025), not 0.4.x. [2]
If you meant a different package/repo (e.g., llama-stack-client-*), tell me which one and I’ll pull the exact 0.4.3 notes (if it exists).
Sources: [1] [2]
🌐 Web query:
llama-stack-client 0.4.3 PyPI release notes
💡 Result:
llama-stack-client 0.4.3 was released on PyPI on Jan 26, 2026, but PyPI does not include any per-version release notes/changelog text for this release (it’s just the package description + files). [1]
On GitHub, the corresponding tag v0.4.3 exists and its tag message is simply “Release version 0.4.3”—no additional release notes are shown there either. [2]
Sources: [1] [2]
🌐 Web query:
llama-stack 0.4.3 security advisory vulnerability
💡 Result:
I couldn’t find any security advisory specifically for llama-stack version 0.4.3, and I also don’t see a published llama-stack 0.4.3 release/tag in the project’s GitHub releases (they show up to v0.3.4) or in third‑party package trackers that list newer 0.4.x versions (e.g., 0.4.1). [4], [3]
What is publicly documented for llama-stack are these advisories/vulnerabilities:
- CVE-2025-55178 / GHSA-x75h-m6jj-6cj2 — “could potentially allow for remote code execution”; affected:
< 0.2.20; patched:0.2.20. [1] - CVE-2024-50050 (Snyk entry) — deserialization of untrusted data via
pickle; upgrade to0.0.41or higher. [2]
If you meant a different package (for example llama-stack-client-*) or meant 0.4.0/0.4.1 instead of 0.4.3, tell me the exact artifact name (PyPI/npm/Maven) and I’ll narrow it down.
Sources: [1] [2] [3] [4]
Resolve version conflict: llama-stack==0.4.3 does not exist on PyPI.
llama-stack latest published version is 0.4.2 (Jan 16, 2026); 0.4.3 has not been released. GitHub releases only show v0.3.4 as the latest. This dependency specification will fail during installation. Verify the intended version and update accordingly.
llama-stack-client==0.4.3 exists (released Jan 26, 2026) but has no available release notes or changelog for impact assessment.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 199 - 201, The requirements file
pins a non-existent release "llama-stack==0.4.3" which will fail installs;
verify whether you intended "llama-stack==0.4.2" (latest on PyPI) or a different
package (e.g., "llama-stack-client==0.4.3"), then update the version pin in
requirements.hashes.source.txt to the correct package/version and regenerate the
corresponding --hash entries for that exact wheel/sdist (remove the invalid
0.4.3 entry if not intended). Ensure the unique token "llama-stack==0.4.3" in
the diff is replaced with the verified version and matching hashes so installers
can succeed.
| sentence-transformers==5.2.2 \ | ||
| --hash=sha256:280ac54bffb84c110726b4d8848ba7b7c60813b9034547f8aea6e9a345cd1c23 \ | ||
| --hash=sha256:7033ee0a24bc04c664fd490abf2ef194d387b3a58a97adcc528783ff505159fa |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
sentence-transformers 5.2.2 release notes breaking changes
💡 Result:
Sentence-Transformers v5.2.2 (Jan 27, 2026) — breaking-change relevant notes
- Dependency change: internal HTTP usage was changed from
requests→httpx, andhttpxis optional (not automatically imported/installed). As a result, you can no longer rely onrequestsbeing present indirectly viasentence-transformers(or it being used by it). If you use the library’s internal download helper(s) (e.g., the legacyhttp_getutility), you may now need to addhttpxexplicitly in your environment. Also, importingsentence-transformersshould no longer crash ifrequestsisn’t installed. [1][2]
Sources: GitHub release notes [1] and the merged PR (#3618) details [2].
🌐 Web query:
sentence-transformers 5.2.2 security advisory vulnerability
💡 Result:
- There is no
sentence-transformers5.2.2 release on PyPI (as of Jan 27, 2026). The PyPI release history shows 5.2.0 uploaded Dec 11, 2025. [1] - The known published security advisory affecting
sentence-transformersis an arbitrary code execution / unsafe deserialization risk when loading PyTorch model files viatorch.load()withoutweights_only=True. It affects versions < 3.1.0 and is fixed by upgrading to >= 3.1.0. [2][3] - Therefore, 5.2.0 is not in the affected range for that advisory (it’s well above 3.1.0). [1][2][3]
Sources: [1] PyPI release history, [2] Snyk advisory SNYK-PYTHON-SENTENCETRANSFORMERS-8161344, [3] Safety DB (PVE-2024-73169)
🏁 Script executed:
# Check context around the sentence-transformers line in the requirements file
rg -B5 -A5 'sentence-transformers==5.2.2' requirements.hashes.source.txt | head -30Repository: lightspeed-core/lightspeed-stack
Length of output: 817
🏁 Script executed:
# Check if there are other versions of sentence-transformers in the file to understand the migration
rg 'sentence-transformers==' requirements.hashes.source.txtRepository: lightspeed-core/lightspeed-stack
Length of output: 106
Remove or update sentence-transformers==5.2.2 — version does not exist on PyPI yet.
Version 5.2.2 has not been released to PyPI (as of Jan 27, 2026). The latest published version is 5.2.0 (Dec 11, 2025). This pin will fail during installation with "No matching distribution found." Either use the current 5.2.0 release or wait for 5.2.2 to be published. Note: 5.2.2 will introduce a breaking change—the internal HTTP client changes from requests to httpx (optional dependency), so existing code relying on the library's download helpers may need to explicitly install httpx.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 705 - 707, The pinned dependency
sentence-transformers==5.2.2 is invalid (not on PyPI); change the requirement
line that currently reads "sentence-transformers==5.2.2 \ --hash=sha256:..." to
a valid published release (e.g., "sentence-transformers==5.2.0") and update or
remove the associated --hash entries to match the chosen version, or remove the
entire pinned entry until 5.2.2 is published; if you switch to 5.2.0, ensure any
CI or lockfile hashes are regenerated to reflect the new version and note that
when/if moving to 5.2.2 you may need to add httpx as an explicit dependency
because of the library's internal HTTP client change.
1 participant
Description
LCORE-1240: Konflux requirements
Type of change
Tools used to create PR
Related Tickets & Documents
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.