chore: use --uploaded-prior-to guard for pip installs in docs script and fuzzing script#11891
Open
julian-risch wants to merge 4 commits into
Open
chore: use --uploaded-prior-to guard for pip installs in docs script and fuzzing script#11891julian-risch wants to merge 4 commits into
julian-risch wants to merge 4 commits into
Conversation
Add --uploaded-prior-to=P1D to the pip installs in the docs-website dev setup script to guard against freshly-uploaded (potentially malicious) package versions, matching the pattern already used across CI workflows. Upgrade pip first so the flag is available on older local pip versions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Add --uploaded-prior-to=P1D to the pip install in the ClusterFuzzLite build script so transitive dependencies resolved during the fuzz build skip freshly-uploaded (potentially malicious) versions. Upgrade pip first since the OSS-Fuzz base-builder image may ship an older pip. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
julian-risch
changed the title
Removed comments about pip upgrade and supply-chain flag.
Removed comment about upgrading pip for supply-chain flag.
julian-risch
changed the title
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
bogdankostic
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Proposed Changes:
Add
--uploaded-prior-to=P1Dto thepip installcommands that were still unpinned, and upgrade pip first so the flag is available on older pip versions:docs-website/scripts/setup-dev.sh— bothpip installcommands..clusterfuzzlite/build.sh—pip3 install ..How did you test it?
Notes for the reviewer
In
build.sh,pip3 install .builds Haystack from the local checkout, so the flag intentionally doesn't affect the package itself but it guards the transitive dependencies resolved from PyPIChecklist
security:maps tochore:/ci:hardening.