[VforVitorio]

Promotes the current development changes and compatible dependency updates to main. The parent lock updates certifi, aiohttp, pypdf, Black, nbconvert, msgpack, LangGraph, and its SDK. The telemetry pointer now targets commit 69a5207, which includes the critical OSV dependency fixes from PR #234 and the bounded Parquet RLE fix from PR #235.

Compatibility and OSV scan

The root project retains Python 3.10 and stable Arcade 3.3.3. After this promotion, 40 Pillow, 2 filelock, 3 Tornado, and 1 setuptools Dependabot alerts remain open because the patched versions conflict with those constraints or the CUDA-pinned Torch requirement.

The full OSV scan remains blocking on pushes and schedules. This branch adds 46 advisory-specific waivers with a December 2 review date, extends 19 dated waivers, and adds a review date to the existing Torch waiver. Unknown advisories still fail the scan. These entries filter OSV-Scanner results and do not dismiss Dependabot alerts.

The setuptools GHSA is separate from the older macOS sdist advisory. Setuptools 84.1.0 fixes its Windows path escape, but the current Torch 2.11.0+cu128 constraint requires setuptools below 82. This repository installs dependencies with uv and does not invoke the vulnerable legacy Wheel.install_as_egg path. The Torch waiver records that 2.13.0 is patched and that the current Windows CUDA 12.8 pin has no matching 2.13.0 wheel in the official index.

Validation

• Root suite: 1,710 passed. uv sync --frozen --all-extras passed.
• Telemetry: 246 Python tests passed; webapp: 201 tests, typecheck, lint, and production build passed.
• Docker webapp image build passed on the Telemetry PR.
• Headless Chromium loaded a baseline CSV, rejected the 391-byte Parquet RLE bomb, and retained the prior selected dataset with no page errors.
• Manual checks covered Authlib, PyJWT, AnyIO TLS hostname validation, cryptography buffers, Pillow image decoding, Seroval serialization, and the updated certifi trust bundle.
• Official OSV-Scanner v2.7.0 scanned the candidate root uv.lock and Pitwall package-lock.json: no issues found.
• Telemetry has zero open critical OSV alerts. Its remaining noncritical findings were outside this batch.

Issues and release

This promotion closes no issues. #227 and #228 remain open; #1340 was already closed. The Release Please PR remains open and no release is published by this change.

Summary by CodeRabbit

• Security

  • FIA regulation downloads now accept only HTTPS links from FIA domains, validate redirects, and reject unsupported document types or seasons.
  • Retrieved regulation passages are labeled as untrusted evidence, while their text remains intact.
  • Download failure logs no longer expose titles or URLs.

• Documentation

  • Added guidance on regulation sources, passage handling, and dependency advisories.

• Maintenance

  • Updated security advisory review notes and scanner waiver timelines.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

This change adds FIA URL and redirect checks to regulation PDF retrieval, labels retrieved RAG passages as untrusted evidence, narrows an OpenF1 exception handler, updates OSV waiver records and dependency rationale, and advances the telemetry submodule reference. It also adds an adversarial security review record.

Changes: Security hardening and promotion record

Layer / File(s)	Summary
Adversarial review findings and status documents/audits/reviews/*	The review records probe findings, required fixes, follow-up checks, promotion gates, and remaining gaps.
FIA URL and download validation scripts/download_fia_pdfs.py, tests/test_fia_pdf_source_policy.py	The downloader validates FIA URLs and redirect targets, restricts document types and years, and filters invalid scraped or known URLs. Tests cover these checks and rejected downloads.
RAG untrusted-evidence framing src/rag/retriever.py, src/rag/README.md, docs/pages/agents-api.md, tests/rag/test_season_scope.py	The RAG tool prefixes retrieved passages with an untrusted-evidence warning. Documentation describes the boundary, and a test checks the warning and passage preservation.
OpenF1 exception propagation src/data_extraction/openf1/intervals_extractor.py, tests/test_openf1_intervals_extractor.py	The conversion fallback catches selected exceptions. A test checks that KeyboardInterrupt propagates.
Advisory waivers and telemetry reference osv-scanner.toml, pyproject.toml, src/telemetry, tests/infra/test_install_provider_table.py	The scanner waiver records and dependency comments are updated. The telemetry submodule reference and provider-source test are also updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Possibly related PRs

• VforVitorio/F1-StratLab#1365: It contains matching FIA URL validation, RAG warning, exception handling, and tests. The telemetry reference and OSV waiver scope differ.

Merge Risk: Low · up to 3d476

The changes harden FIA downloads, RAG prompts and dependency waivers. A small gap remains in the FIA host check, and the audit report and RAG docs claim more than the evidence shows. Fix the host check and correct the documentation claims before or shortly after merge.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn