chore(deps): update all non-major dependencies #1588

renovate-bot · 2025-01-01T00:09:12Z

This PR contains the following updates:

Package	Change	Type	Update
@angular-devkit/build-angular	`17.3.9` -> `17.3.11`	devDependencies	patch
@angular/cli	`17.3.9` -> `17.3.11`	devDependencies	patch
@angular/cli	`18.2.4` -> `18.2.12`	dependencies	patch
@emotion/cache (source)	`11.13.1` -> `11.14.0`	dependencies	minor
@emotion/react (source)	`11.13.3` -> `11.14.0`	dependencies	minor
@emotion/styled (source)	`11.13.0` -> `11.14.0`	dependencies	minor
@eslint/compat	`1.1.1` -> `1.2.4`	devDependencies	minor
@genkit-ai/ai (source)	`^0.5.13` -> `^0.9.0`	dependencies	minor
@genkit-ai/ai (source)	`^0.5.0` -> `^0.9.0`	dependencies	minor
@genkit-ai/core (source)	`^0.5.13` -> `^0.9.0`	dependencies	minor
@genkit-ai/core (source)	`^0.5.0` -> `^0.9.0`	dependencies	minor
@genkit-ai/dotprompt (source)	`^0.5.13` -> `^0.9.0`	dependencies	minor
@genkit-ai/dotprompt (source)	`^0.5.0` -> `^0.9.0`	dependencies	minor
@genkit-ai/firebase (source)	`^0.5.0` -> `^0.9.0`	dependencies	minor
@genkit-ai/flow (source)	`0.5.13` -> `0.5.17`	dependencies	patch
@genkit-ai/google-cloud (source)	`^0.5.13` -> `^0.9.0`	dependencies	minor
@genkit-ai/vertexai (source)	`^0.5.13` -> `^0.9.0`	dependencies	minor
@genkit-ai/vertexai (source)	`^0.5.0` -> `^0.9.0`	dependencies	minor
@google-cloud/discoveryengine (source)	`1.13.0` -> `1.14.0`	dependencies	minor
@google-cloud/storage	`7.12.1` -> `7.14.0`	dependencies	minor
@google-cloud/vertexai	`1.9.0` -> `1.9.2`	devDependencies	patch
@google-cloud/vertexai	`1.7.0` -> `1.9.2`	dependencies	minor
@googlemaps/extended-component-library	`0.6.11` -> `0.6.13`	dependencies	patch
@mui/icons-material (source)	`6.1.0` -> `6.3.0`	dependencies	minor
@mui/lab (source)	`6.0.0-beta.9` -> `6.0.0-beta.21`	dependencies	patch
@mui/material (source)	`6.1.0` -> `6.3.0`	dependencies	minor
@mui/material-nextjs (source)	`6.1.0` -> `6.3.0`	dependencies	minor
@openapitools/openapi-generator-cli	`2.13.5` -> `2.15.3`	dependencies	minor
@opentelemetry/sdk-trace-base (source)	`1.26.0` -> `1.30.0`	dependencies	minor
@radix-ui/react-accordion (source)	`1.2.1` -> `1.2.2`	dependencies	patch
@radix-ui/react-avatar (source)	`1.1.0` -> `1.1.2`	dependencies	patch
@radix-ui/react-icons	`1.3.0` -> `1.3.2`	dependencies	patch
@radix-ui/react-label (source)	`2.1.0` -> `2.1.1`	dependencies	patch
@radix-ui/react-scroll-area (source)	`1.1.0` -> `1.2.2`	dependencies	minor
@radix-ui/react-select (source)	`2.1.1` -> `2.1.4`	dependencies	patch
@radix-ui/react-slider (source)	`1.2.0` -> `1.2.2`	dependencies	patch
@radix-ui/react-slot (source)	`1.1.0` -> `1.1.1`	dependencies	patch
@radix-ui/react-switch (source)	`1.1.0` -> `1.1.2`	dependencies	patch
@radix-ui/react-tabs (source)	`1.1.0` -> `1.1.2`	dependencies	patch
@radix-ui/react-tooltip (source)	`1.1.2` -> `1.1.6`	dependencies	patch
@stylistic/eslint-plugin (source)	`2.8.0` -> `2.12.1`	devDependencies	minor
@sveltejs/adapter-static (source)	`3.0.6` -> `3.0.8`	devDependencies	patch
@sveltejs/kit (source)	`2.9.0` -> `2.15.1`	devDependencies	minor
@testing-library/jest-dom	`6.5.0` -> `6.6.3`	devDependencies	minor
@testing-library/react	`16.0.1` -> `16.1.0`	devDependencies	minor
@types/google-apps-script (source)	`1.0.84` -> `1.0.91`	devDependencies	patch
@types/google.maps (source)	`3.58.0` -> `3.58.1`	devDependencies	patch
@types/jasmine (source)	`5.1.4` -> `5.1.5`	devDependencies	patch
@types/lodash (source)	`4.17.7` -> `4.17.13`	devDependencies	patch
@types/node (source)	`22.7.5` -> `22.10.5`	devDependencies	minor
@types/node (source)	`22.7.9` -> `22.10.5`	devDependencies	minor
@types/node-fetch (source)	`2.6.11` -> `2.6.12`	devDependencies	patch
@types/pg (source)	`8.11.8` -> `8.11.10`	devDependencies	patch
@types/react (source)	`18.3.5` -> `18.3.18`	devDependencies	patch
@types/react (source)	`18.3.7` -> `18.3.18`	devDependencies	patch
@types/react-dom (source)	`18.3.0` -> `18.3.5`	devDependencies	patch
@typescript-eslint/eslint-plugin (source)	`8.5.0` -> `8.19.0`	devDependencies	minor
@typescript-eslint/parser (source)	`8.5.0` -> `8.19.0`	devDependencies	minor
Flask (changelog)	`==3.0.3` -> `==3.1.0`		minor
Flask (changelog)	`==3.0.0` -> `==3.1.0`		minor
SQLAlchemy (changelog)	`==2.0.34` -> `==2.0.36`		patch
Werkzeug (changelog)	`==3.0.6` -> `==3.1.3`		minor
aiohttp	`3.10.11` -> `3.11.11`	dependencies	minor
aiosignal	`1.3.1` -> `1.3.2`	dependencies	patch
altair	`5.4.1` -> `5.5.0`	dependencies	minor
anthropic	`^0.34.0` -> `^0.42.0`	dependencies	minor
anyio (changelog)	`4.6.0` -> `4.7.0`	dependencies	minor
attrs (changelog)	`24.2.0` -> `24.3.0`	dependencies	minor
axios ([source](https://redirect.

forking-renovate · 2025-01-01T00:09:14Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gemini/sample-apps/e2e-gen-ai-app-starter-pack/poetry.lock

Updating dependencies
Resolving dependencies...

Creating virtualenv starter-app-sample-KheTiW1y-py3.13 in /home/ubuntu/.cache/pypoetry/virtualenvs

list index out of range

File name: gemini/sample-apps/genwealth/ui/package-lock.json

npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @angular/core@17.3.12
npm error Found: zone.js@0.15.0
npm error node_modules/zone.js
npm error   zone.js@"~0.15.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer zone.js@"~0.14.0" from @angular/core@17.3.12
npm error node_modules/@angular/core
npm error   @angular/core@"^17.3.0" from the root project
npm error   peer @angular/core@"17.3.12" from @angular/animations@17.3.12
npm error   node_modules/@angular/animations
npm error     @angular/animations@"^17.3.0" from the root project
npm error     2 more (@angular/material, @angular/platform-browser)
npm error   8 more (@angular/cdk, @angular/common, @angular/compiler, ...)
npm error
npm error Conflicting peer dependency: zone.js@0.14.10
npm error node_modules/zone.js
npm error   peer zone.js@"~0.14.0" from @angular/core@17.3.12
npm error   node_modules/@angular/core
npm error     @angular/core@"^17.3.0" from the root project
npm error     peer @angular/core@"17.3.12" from @angular/animations@17.3.12
npm error     node_modules/@angular/animations
npm error       @angular/animations@"^17.3.0" from the root project
npm error       2 more (@angular/material, @angular/platform-browser)
npm error     8 more (@angular/cdk, @angular/common, @angular/compiler, ...)
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/renovate/cache/others/npm/_logs/2025-01-03T12_37_22_131Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2025-01-03T12_37_22_131Z-debug-0.log

code-review-assist

Hi team,

I'm currently reviewing this pull request and will post my full review in a few minutes. In the meantime, here's a quick summary of the changes for you and other reviewers:

This pull request, submitted by renovate-bot, updates all non-major dependencies across the generative-ai repository. The goal is to keep the project up-to-date with the latest security patches and bug fixes, improving stability and reducing potential vulnerabilities.

Here's a breakdown of the changes:

Dependency Updates: A large number of dependencies have been updated. The table below summarizes the key changes:

Package	Old Version	New Version	Type	Notes
`@angular-devkit/build-angular`	17.3.9	17.3.11	devDependencies	Patch update
`@angular/cli`	17.3.9	17.3.11	devDependencies	Patch update
`@angular/cli`	18.2.4	18.2.12	dependencies	Patch update
`@emotion/cache`	11.13.1	11.14.0	dependencies	Minor update
`@emotion/react`	11.13.3	11.14.0	dependencies	Minor update
`@emotion/styled`	11.13.0	11.14.0	dependencies	Minor update
...and many more...	...	...	...	...

package-lock.json Changes: The package-lock.json file in the conversation/chat-app directory has been updated to reflect the new dependency versions. This includes changes to the @esbuild packages and the addition of the clsx package. The versions of @esbuild packages have been updated to 0.24.2 across the board. svelte has been updated to 5.16.0 and svelte-check to 4.1.1.
Python Requirements Updates: Several Python requirements files have been updated to newer versions, including Flask, SQLAlchemy, google-cloud-aiplatform, and others. These updates are mostly minor or patch releases.
pyproject.toml Changes: The pyproject.toml file in the gemini/sample-apps/e2e-gen-ai-app-starter-pack directory has been updated to reflect the newer versions of several Python packages, including fastapi, pydantic, and uvicorn.
Dockerfile Changes: Some Dockerfiles have been updated to use newer base images (e.g., python:3.13-slim instead of python:3.12-slim).

Please review the detailed changes in each file. I'll provide more specific comments in my full review.

And now, a little haiku to lighten the mood:

Dependencies flow,
Updates bring fresh, clean new code,
Bugs flee in the night.

code-review-assist

This pull request updates numerous non-major dependencies across several projects. Regularly updating dependencies is crucial for incorporating bug fixes, performance enhancements, and new features. Overall, the updates seem appropriate, but I have a few minor suggestions and recommendations for consideration.

I've taken into account the implicit style guide observed within the provided codebase and referred to common style guides such as PEP 8 for Python.

.github/workflows/notebook_linter/requirements.txt

code-review-assist · 2025-01-01T00:11:22Z

gemini/function-calling/function_calling_service/templates/index.html

+      href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.1/styles/default.min.css"
    />
    <script
-      src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.10.0/highlight.min.js"
-      integrity="sha512-6yoqbrcLAHDWAdQmiRlHG4+m0g/CT/V9AGyxabG8j7Jk8j3r3K6due7oqpiRMZqcYe9WM2gPcaNNxnl2ux+3tA=="
+      src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.1/highlight.min.js"
+      integrity="sha512-EBLzUL8XLl+va/zAsmXwS7Z2B1F9HUHkZwyS/VKwh3S7T/U0nF4BaU29EP/ZSf6zgiIxYAnKLu6bJ8dqpmX5uw=="


The highlight.js resources are being loaded over HTTP, while the main page uses HTTPS. This mixed content can trigger browser warnings and pose a potential security vulnerability, as it opens a pathway for malicious code injection. Consider serving highlight.js locally or using a CDN that supports HTTPS. Alternatively, you could update the URLs to use HTTPS if the resource is available over HTTPS.

code-review-assist · 2025-01-01T00:11:22Z

gemini/sample-apps/e2e-gen-ai-app-starter-pack/pyproject.toml

-fastapi = "0.110.3"
-pydantic = "2.9.2"
-uvicorn = {extras = ["standard"], version = "^0.30.5"}
+python = ">=3.13,<3.14"


The Python version specifier (>=3.13,<3.14) restricts the project to a very specific Python version. While this ensures compatibility with the currently used dependencies, it might limit flexibility in the future. Unless there's a strong reason for this tight constraint, consider broadening the range to allow for minor version updates (e.g., ^3.13 or >=3.13,<3.15).

Suggested change

python = ">=3.13,<3.14"

python = "^3.13"

code-review-assist · 2025-01-01T00:11:22Z

gemini/sample-apps/e2e-gen-ai-app-starter-pack/pyproject.toml

 langchain-google-vertexai = "^2.0.7"
 langchain = "^0.3.0"
 langgraph = "^0.2.21"
 langchain-core = "^0.3.9"
 langchain-google-community = {extras = ["vertexaisearch"], version = "^2.0.2"}
-traceloop-sdk = "^0.33.12"
+traceloop-sdk = "^0.34.0"
 opentelemetry-exporter-gcp-trace = "^1.6.0"
 opentelemetry-sdk = "^1.25.0"
 google-cloud-logging = "^3.10.0"
 google-cloud-aiplatform = {extras = ["evaluation"], version = "^1.73.0"}


The version specifier for google-cloud-aiplatform (^1.73.0) is quite broad. Narrowing it down to a specific version or a smaller range (e.g., ==1.73.0 or >=1.73.0,<1.74.0) provides better control over updates and helps prevent unexpected issues from potentially breaking changes in future releases. This aligns with best practices for dependency management.

Suggested change

google-cloud-aiplatform = {extras = ["evaluation"], version = "^1.73.0"}

google-cloud-aiplatform = {extras = ["evaluation"], version = "==1.73.0"}

code-review-assist · 2025-01-01T00:11:22Z

...rns/agentic_rag_vertex_ai_search/pattern_setup/resources_to_copy/data_processing/poetry.lock

@@ -273,17 +273,17 @@ endpoint = ["requests (>=2.28.1)"]
 evaluation = ["pandas (>=1.0.0)", "tqdm (>=4.23.0)"]
 full = ["docker (>=5.0.3)", "explainable-ai-sdk (>=1.0.0)", "fastapi (>=0.71.0,<=0.114.0)", "google-cloud-bigquery", "google-cloud-bigquery-storage", "google-vizier (>=0.1.6)", "httpx (>=0.23.0,<0.25.0)", "immutabledict", "lit-nlp (==0.4.0)", "mlflow (>=1.27.0,<=2.16.0)", "numpy (>=1.15.0)", "pandas (>=1.0.0)", "pyarrow (>=10.0.1)", "pyarrow (>=14.0.0)", "pyarrow (>=3.0.0,<8.0dev)", "pyarrow (>=6.0.1)", "pyyaml (>=5.3.1,<7)", "ray[default] (>=2.4,<2.5.dev0 || >2.9.0,!=2.9.1,!=2.9.2,<2.10.dev0 || >=2.33.dev0,<=2.33.0)", "ray[default] (>=2.5,<=2.33.0)", "requests (>=2.28.1)", "setuptools (<70.0.0)", "starlette (>=0.17.1)", "tensorboard-plugin-profile (>=2.4.0,<2.18.0)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.4.0,<3.0.0dev)", "tqdm (>=4.23.0)", "urllib3 (>=1.21.1,<1.27)", "uvicorn[standard] (>=0.16.0)", "werkzeug (>=2.0.0,<2.1.0dev)"]
 langchain = ["langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)"]
-langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<3)", "pytest-xdist"]
+langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)", "pytest-xdist"]


The pydantic dependency in the langchain-testing group is specified as >=2.6.3,<3, which is a very broad range. This could lead to inconsistencies between development and production environments or unexpected behavior if a major pydantic update introduces breaking changes. Consider narrowing the version range to a more specific version or a smaller compatible range (e.g., ==2.6.3 or >=2.6.3,<2.7).

Suggested change

langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)", "pytest-xdist"]

langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (==2.6.3)", "pytest-xdist"]

code-review-assist · 2025-01-01T00:11:22Z

...rns/agentic_rag_vertex_ai_search/pattern_setup/resources_to_copy/data_processing/poetry.lock

-ray-testing = ["google-cloud-bigquery", "google-cloud-bigquery-storage", "immutabledict", "pandas (>=1.0.0)", "pyarrow (>=6.0.1)", "pytest-xdist", "ray[default] (>=2.4,<2.5.dev0 || >2.9.0,!=2.9.1,!=2.9.2,<2.10.dev0 || >=2.33.dev0,<=2.33.0)", "ray[default] (>=2.5,<=2.33.0)", "ray[train]", "scikit-learn", "setuptools (<70.0.0)", "tensorflow", "torch (>=2.0.0,<2.1.0)", "xgboost", "xgboost-ray"]
-reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<3)"]
+ray-testing = ["google-cloud-bigquery", "google-cloud-bigquery-storage", "immutabledict", "pandas (>=1.0.0)", "pyarrow (>=6.0.1)", "pytest-xdist", "ray[default] (>=2.4,<2.5.dev0 || >2.9.0,!=2.9.1,!=2.9.2,<2.10.dev0 || >=2.33.dev0,<=2.33.0)", "ray[default] (>=2.5,<=2.33.0)", "ray[train]", "scikit-learn (<1.6.0)", "setuptools (<70.0.0)", "tensorflow", "torch (>=2.0.0,<2.1.0)", "xgboost", "xgboost-ray"]
+reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)"]


The pydantic dependency in the reasoningengine group is specified with a broad version range (>=2.6.3,<3). This can introduce instability as new major versions of pydantic might have breaking changes. It's generally recommended to pin dependencies to a specific version or a smaller, well-tested range. Consider using pydantic==2.6.3 or a similar more restrictive specifier.

Suggested change

reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)"]

reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (==2.6.3)"]

code-review-assist · 2025-01-01T00:11:22Z

gemini/sample-apps/llamaindex-rag/pyproject.toml

 google-cloud-logging = "^3.11.0"
-anthropic = {extras = ["vertex"], version = "^0.34.0"}
+anthropic = {extras = ["vertex"], version = "^0.42.0"}
 weave = "^0.51.0"
 black = "^24.8.0"


The version specifier for black is too broad (^24.8.0). Pinning it to a specific version, such as black==24.8.0, is recommended for better reproducibility and to avoid potential issues with future releases that might introduce breaking changes to formatting. This practice ensures consistency across different environments and builds.

Suggested change

black = "^24.8.0"

black = "==24.8.0"

code-review-assist

Hi team,

I'm currently reviewing this pull request and will post my full review in a few minutes. In the meantime, here's a quick summary for you and other reviewers to get up to speed:

This pull request, submitted by renovate-bot, updates various dependencies across the generative-ai repository. The goal is to keep our project's dependencies current and benefit from bug fixes and improvements in the updated versions. The changes include updates to both dependencies and devDependencies across multiple packages. Specific changes are detailed below:

Summary of Changes:

Dependency Updates: Numerous packages have been updated, including @angular/cli, @emotion/styled, @genkit-ai/ai, @google-cloud/storage, @mui/material, @radix-ui/react-accordion, Flask, Werkzeug, and many more. The table below summarizes the changes:

Package	Previous Version	New Version	Type	Change Type
`@angular/cli`	`17.3.9`, `18.2.4`	`17.3.11`, `18.2.12`	`dependencies`, `devDependencies`	patch, minor
`@emotion/styled`	`11.13.0`	`11.14.0`	`dependencies`	minor
`@genkit-ai/ai`	`^0.5.13`, `^0.5.0`	`^0.9.0`	`dependencies`	minor
`@google-cloud/storage`	`7.12.1`	`7.14.0`	`dependencies`	minor
`@mui/material`	`6.1.0`	`6.3.0`	`dependencies`	minor
`@radix-ui/react-accordion`	`1.2.1`	`1.2.2`	`dependencies`	patch
`Flask`	`==3.0.3`, `==3.0.0`	`==3.1.0`		minor
`Werkzeug`	`==3.0.6`	`==3.1.3`		minor
...and many more...	...	...	...	...

package-lock.json Updates: The package-lock.json file in the conversation/chat-app directory has been extensively updated to reflect the new dependency versions and their transitive dependencies. Most notably, @esbuild packages have been updated from 0.24.0 to 0.24.2, and flowbite-svelte has been updated from 0.46.0 to 0.47.0. Additionally, clsx and esrap have been added to the dependencies. svelte and svelte-check have also been updated to newer versions.
requirements.txt Updates: Several requirements.txt files across different directories have been updated to reflect the newer versions of Python packages.
Dockerfile Updates: The Dockerfile in gemini/sample-apps/e2e-gen-ai-app-starter-pack has been updated to use python:3.13-slim instead of python:3.11-slim. The Dockerfile in gemini/sample-apps/finance-advisor-spanner has been updated to use python:3.13 instead of python:3.12. The Dockerfile in gemini/sample-apps/photo-discovery/ag-web/app has been updated to use python:3.13-slim instead of python:3.12-slim. The Dockerfile in gemini/sample-apps/llamaindex-rag/ui has been updated to use python:3.13-slim instead of python:3.12-slim. The Dockerfile in gemini/sample-apps/llamaindex-rag has been updated to use python:3.13-slim instead of python:3.12-slim. The Dockerfile in gemini/sample-apps/gemini-mesop-cloudrun has been updated to use python:3.13 instead of python:3.12. The Dockerfile in gemini/sample-apps/gemini-streamlit-cloudrun has been updated to use python:3.13 instead of python:3.12. The Dockerfile in language/sample-apps/chat-flask-cloudrun has been updated to use python:3.13 instead of python:3.12. The Dockerfile in language/sample-apps/chat-gradio has been updated to use python:3.13 instead of python:3.12. The Dockerfile in language/sample-apps/chat-streamlit has been updated to use python:3.13 instead of python:3.12. The Dockerfile in gemini/sample-apps/llamadeploy-on-cloud-run has been updated to use python:3.13 instead of python:3.9. The Dockerfile in gemini/sample-apps/swot-agent has been updated to use python:3.13-slim instead of python:3.10-slim.
Minor changes in pom.xml: The Spring Boot starter parent version has been updated from 3.3.4 to 3.4.1, and the Google Cloud libraries BOM version has been updated from 26.47.0 to 26.52.0. The log4j version has been updated from 2.24.1 to 2.24.3.
package.json updates: Several package.json files have been updated to reflect the newer versions of npm packages.

Please let me know if you have any questions.

Small updates, big impact,
Code flows like a river's grant,
New features will bloom.

code-review-assist

This pull request updates a number of dependencies across various projects. It's generated by Renovate Bot, so I'll assume the versions were chosen automatically based on some criteria (e.g., latest non-breaking versions). While automated dependency updates are helpful, it's essential to review the changelog for each updated package to understand the changes introduced and assess potential impacts on your projects.

Given the scope of changes across multiple languages and project types, thorough testing is highly recommended after merging. Pay particular attention to the projects where minor or major version bumps occurred, as these have a higher likelihood of introducing breaking changes, even if Renovate Bot deems them non-major. Consider adding integration tests that exercise the interactions with these updated libraries to catch any unexpected behavior early.

Here's a summary of the style guide elements I referenced during this review:

Python: PEP 8
JavaScript/TypeScript: No specific style guide provided, so I defaulted to common practices and consistency with the existing code.
Java: No specific style guide provided, so I defaulted to common practices and consistency with the existing code.
HTML: No specific style guide provided, so I defaulted to common practices and consistency with the existing code.
General: Encouraged clear commit messages and PR descriptions.

code-review-assist · 2025-01-01T00:13:52Z

gemini/function-calling/function_calling_service/templates/index.html

    <script
-      src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.10.0/highlight.min.js"
-      integrity="sha512-6yoqbrcLAHDWAdQmiRlHG4+m0g/CT/V9AGyxabG8j7Jk8j3r3K6due7oqpiRMZqcYe9WM2gPcaNNxnl2ux+3tA=="
+      src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.1/highlight.min.js"
+      integrity="sha512-EBLzUL8XLl+va/zAsmXwS7Z2B1F9HUHkZwyS/VKwh3S7T/U0nF4BaU29EP/ZSf6zgiIxYAnKLu6bJ8dqpmX5uw=="


It's a good security practice to include the integrity attribute with a subresource integrity (SRI) hash for the highlight.js script. This ensures that the browser fetches only the intended version of the script, protecting against potential CDN compromises or man-in-the-middle attacks. You've already done this for the stylesheet, which is excellent! Adding crossorigin="anonymous" is also recommended when using SRI.

code-review-assist · 2025-01-01T00:13:52Z

...rns/agentic_rag_vertex_ai_search/pattern_setup/resources_to_copy/data_processing/poetry.lock

@@ -273,17 +273,17 @@ endpoint = ["requests (>=2.28.1)"]
 evaluation = ["pandas (>=1.0.0)", "tqdm (>=4.23.0)"]
 full = ["docker (>=5.0.3)", "explainable-ai-sdk (>=1.0.0)", "fastapi (>=0.71.0,<=0.114.0)", "google-cloud-bigquery", "google-cloud-bigquery-storage", "google-vizier (>=0.1.6)", "httpx (>=0.23.0,<0.25.0)", "immutabledict", "lit-nlp (==0.4.0)", "mlflow (>=1.27.0,<=2.16.0)", "numpy (>=1.15.0)", "pandas (>=1.0.0)", "pyarrow (>=10.0.1)", "pyarrow (>=14.0.0)", "pyarrow (>=3.0.0,<8.0dev)", "pyarrow (>=6.0.1)", "pyyaml (>=5.3.1,<7)", "ray[default] (>=2.4,<2.5.dev0 || >2.9.0,!=2.9.1,!=2.9.2,<2.10.dev0 || >=2.33.dev0,<=2.33.0)", "ray[default] (>=2.5,<=2.33.0)", "requests (>=2.28.1)", "setuptools (<70.0.0)", "starlette (>=0.17.1)", "tensorboard-plugin-profile (>=2.4.0,<2.18.0)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.4.0,<3.0.0dev)", "tqdm (>=4.23.0)", "urllib3 (>=1.21.1,<1.27)", "uvicorn[standard] (>=0.16.0)", "werkzeug (>=2.0.0,<2.1.0dev)"]
 langchain = ["langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)"]
-langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<3)", "pytest-xdist"]
+langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)", "pytest-xdist"]


The testing extras group lists scikit-learn twice, once without a version specifier and once with <1.6.0. This redundancy can lead to confusion and potential conflicts. Unless both versions are intentionally required for testing (which is unusual), remove the duplicate entry. PEP 8 recommends keeping dependency specifications concise and unambiguous.

Suggested change

langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)", "pytest-xdist"]

testing = ["aiohttp", "bigframes", "docker (>=5.0.3)", "explainable-ai-sdk (>=1.0.0)", "fastapi (>=0.71.0,<=0.114.0)", "google-api-core (>=2.11,<3.0.0)", "google-cloud-bigquery", "google-cloud-bigquery-storage", "google-vizier (>=0.1.6)", "grpcio-testing", "httpx (>=0.23.0,<0.25.0)", "immutabledict", "ipython", "kfp (>=2.6.0,<3.0.0)", "lit-nlp (==0.4.0)", "mlflow (>=1.27.0,<=2.16.0)", "nltk", "numpy (>=1.15.0)", "pandas (>=1.0.0)", "pyarrow (>=10.0.1)", "pyarrow (>=14.0.0)", "pyarrow (>=3.0.0,<8.0dev)", "pyarrow (>=6.0.1)", "pytest-asyncio", "pytest-xdist", "pyyaml (>=5.3.1,<7)", "ray[default] (>=2.4,<2.5.dev0 || >2.9.0,!=2.9.1,!=2.9.2,<2.10.dev0 || >=2.33.dev0,<=2.33.0)", "ray[default] (>=2.5,<=2.33.0)", "requests (>=2.28.1)", "requests-toolbelt (<1.0.0)", "scikit-learn (<1.6.0)", "sentencepiece (>=0.2.0)", "setuptools (<70.0.0)", "starlette (>=0.17.1)", "tensorboard-plugin-profile (>=2.4.0,<2.18.0)", "tensorflow (==2.13.0)", "tensorflow (==2.16.1)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.3.0,<3.0.0dev)", "tensorflow (>=2.4.0,<3.0.0dev)", "torch (>=2.0.0,<2.1.0)", "torch (>=2.2.0)", "tqdm (>=4.23.0)", "urllib3 (>=1.21.1,<1.27)", "uvicorn[standard] (>=0.16.0)", "werkzeug (>=2.0.0,<2.1.0dev)", "xgboost"]

code-review-assist · 2025-01-01T00:13:52Z

gemini/sample-apps/e2e-gen-ai-app-starter-pack/pyproject.toml

-fastapi = "0.110.3"
-pydantic = "2.9.2"
-uvicorn = {extras = ["standard"], version = "^0.30.5"}
+python = ">=3.13,<3.14"


The Python version constraint >=3.10,<3.13 might be too restrictive, especially since the base Docker image is now python:3.13-slim. Consider broadening the range to include 3.13, or at least ensure the specified range is compatible with your testing and deployment environments. Refer to PEP 8 for guidance on version specifiers.

Suggested change

python = ">=3.13,<3.14"

python = ">=3.10,<3.14"

Co-authored-by: code-review-assist[bot] <182814678+code-review-assist[bot]@users.noreply.github.com>

renovate-bot requested a review from a team as a code owner January 1, 2025 00:09

code-review-assist bot reviewed Jan 1, 2025

View reviewed changes

renovate-bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 3a735b6 to ce3cc8a Compare January 3, 2025 06:54

chore(deps): update all non-major dependencies

fb46a27

renovate-bot force-pushed the renovate/all-minor-patch branch from ce3cc8a to fb46a27 Compare January 3, 2025 12:38

Update .github/workflows/notebook_linter/requirements.txt

adc6b56

Co-authored-by: code-review-assist[bot] <182814678+code-review-assist[bot]@users.noreply.github.com>

GoogleCloudPlatform deleted a comment from code-review-assist bot Jan 3, 2025

holtskinner closed this Jan 3, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major dependencies #1588

chore(deps): update all non-major dependencies #1588

renovate-bot commented Jan 1, 2025 •

edited

Loading

forking-renovate bot commented Jan 1, 2025 •

edited

Loading

code-review-assist bot left a comment

code-review-assist bot left a comment

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot left a comment

code-review-assist bot left a comment

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

code-review-assist bot Jan 1, 2025

	google-cloud-aiplatform = {extras = ["evaluation"], version = "^1.73.0"}
	google-cloud-aiplatform = {extras = ["evaluation"], version = "==1.73.0"}

	langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)", "pytest-xdist"]
	langchain-testing = ["absl-py", "cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "langchain (>=0.1.16,<0.4)", "langchain-core (<0.4)", "langchain-google-vertexai (<3)", "openinference-instrumentation-langchain (>=0.1.19,<0.2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (==2.6.3)", "pytest-xdist"]

	reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (>=2.6.3,<2.10)"]
	reasoningengine = ["cloudpickle (>=3.0,<4.0)", "google-cloud-trace (<2)", "opentelemetry-exporter-gcp-trace (<2)", "opentelemetry-sdk (<2)", "pydantic (==2.6.3)"]

chore(deps): update all non-major dependencies #1588

chore(deps): update all non-major dependencies #1588

Conversation

renovate-bot commented Jan 1, 2025 • edited Loading

forking-renovate bot commented Jan 1, 2025 • edited Loading

⚠️ Artifact update problem

File name: gemini/sample-apps/e2e-gen-ai-app-starter-pack/poetry.lock

File name: gemini/sample-apps/genwealth/ui/package-lock.json

code-review-assist bot left a comment

Choose a reason for hiding this comment

code-review-assist bot left a comment

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot left a comment

Choose a reason for hiding this comment

code-review-assist bot left a comment

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

code-review-assist bot Jan 1, 2025

Choose a reason for hiding this comment

renovate-bot commented Jan 1, 2025 •

edited

Loading

forking-renovate bot commented Jan 1, 2025 •

edited

Loading