LCORE-1108: Updated Konflux references #1072
Conversation
WalkthroughUpdates three Python package versions in requirements.hashes.source.txt: cachetools (6.2.5→6.2.6), litellm (1.81.3→1.81.4), and openai (2.15.0→2.16.0) with corresponding hash values. Adds cryptography==46.0.3 override to requirements.overrides.txt. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.tekton/lightspeed-stack-pull-request.yaml (1)
58-62: OpenSSL development headers missing from build tooling.Removing
cryptographyfrom binary packages forces source builds requiring Rust/cargo (present) AND OpenSSL development headers. The Containerfile installs cargo but does not explicitly includeopenssl-develor equivalent. Verify the base image (UBI 9 python-312) provides libssl-devel, or add it explicitly to the dnf install command on line 21 to prevent build failures.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@requirements.overrides.txt`:
- Line 8: The change adds a cryptography pin (cryptography==46.0.3) but the PR
title ("Updated Konflux references") and commit message ("Fixed cffi") do not
match this edit; clarify intent by either (A) if you intended to pin
cryptography, update the PR title and commit message to mention the cryptography
override and consider using the newer 46.0.4 release, or (B) if you intended to
fix cffi/Konflux, revert this cryptography line and make the correct change to
the cffi/Konflux dependency instead; reference the exact token
"cryptography==46.0.3" when making or reverting the edit so reviewers can verify
the intended change.
| scipy==1.16.3 | ||
| aiohttp==3.13.3 | ||
| aiosqlite==0.22.0 | ||
| cryptography==46.0.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify cryptography version 46.0.3 details
echo "=== Checking cryptography versions on PyPI ==="
curl -s https://pypi.org/pypi/cryptography/json | jq -r '.info | "Latest: \(.version)\nLicense: \(.license)\nHome Page: \(.home_page)"'
echo -e "\n=== Checking if version 46.0.3 exists ==="
curl -s https://pypi.org/pypi/cryptography/46.0.3/json | jq -r 'if .info then "Version exists - Released: \(.info.release_date)\nSummary: \(.info.summary)" else "Version not found" end'
echo -e "\n=== All 46.x versions available ==="
curl -s https://pypi.org/pypi/cryptography/json | jq -r '.releases | keys[] | select(startswith("46."))' | sort -V
echo -e "\n=== Recent 46.0.x versions ==="
curl -s https://pypi.org/pypi/cryptography/json | jq -r '.releases | keys[] | select(startswith("46.0."))' | sort -V | tail -5Repository: lightspeed-core/lightspeed-stack
Length of output: 490
🏁 Script executed:
#!/bin/bash
# Get detailed info about cryptography 46.0.3 and check for security issues
echo "=== Detailed info for cryptography 46.0.3 ==="
curl -s https://pypi.org/pypi/cryptography/46.0.3/json | jq -r '.info | "Release: \(.release_date)\nAuthor: \(.author)\nRequires Python: \(.requires_python)\nClassifiers: \(.classifiers | length) items"'
echo -e "\n=== Release history for 46.0.x versions ==="
curl -s https://pypi.org/pypi/cryptography/json | jq -r '.releases | to_entries[] | select(.key | startswith("46.0.")) | .value[0] | "Version: \(.filename | split("-")[1])\n Upload time: \(.upload_time)"' 2>/dev/null | head -40
echo -e "\n=== Checking Python version requirement ==="
curl -s https://pypi.org/pypi/cryptography/46.0.3/json | jq -r '.info.requires_python'
echo -e "\n=== Known security issues (checking changelog) ==="
curl -s https://raw.githubusercontent.com/pyca/cryptography/main/CHANGELOG.rst 2>/dev/null | head -100 || echo "Cannot fetch changelog"Repository: lightspeed-core/lightspeed-stack
Length of output: 5891
Version 46.0.3 is valid and published. The cryptography version exists on PyPI (released 2025-10-15) and appears stable. Note that version 46.0.4 was recently released (2026-01-28) and may be worth considering.
However, there's an inconsistency in the PR metadata: the title mentions "Updated Konflux references", the commit message says "Fixed cffi", but the actual change adds a cryptography version override. Please clarify the intent of this change.
🤖 Prompt for AI Agents
In `@requirements.overrides.txt` at line 8, The change adds a cryptography pin
(cryptography==46.0.3) but the PR title ("Updated Konflux references") and
commit message ("Fixed cffi") do not match this edit; clarify intent by either
(A) if you intended to pin cryptography, update the PR title and commit message
to mention the cryptography override and consider using the newer 46.0.4
release, or (B) if you intended to fix cffi/Konflux, revert this cryptography
line and make the correct change to the cffi/Konflux dependency instead;
reference the exact token "cryptography==46.0.3" when making or reverting the
edit so reviewers can verify the intended change.
1 participant
Description
LCORE-1108: Updated Konflux references
Type of change
Tools used to create PR
Related Tickets & Documents
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.