chore(deps): migrate pipecat integration to pipecat-ai 1.x (clears 4 high-severity alerts)#2380
Open
dcbouius wants to merge 1 commit into
Open
chore(deps): migrate pipecat integration to pipecat-ai 1.x (clears 4 high-severity alerts)#2380dcbouius wants to merge 1 commit into
dcbouius wants to merge 1 commit into
Conversation
Bumps pipecat-ai from 0.0.x to >=1.4.0,<2.0, clearing four high-severity Dependabot advisories for the file-read CVEs in the older 0.0.x/1.0.x line (telephony /ws + runner /files path traversal; alerts #1006, #1005, #560, #559). pipecat 1.x replaced the per-provider OpenAILLMContext with the universal LLMContext and removed the pipecat.processors.aggregators.openai_llm_context module. The integration already imported the modern LLMContextFrame, so the runtime change is small: - memory.py: drop the now-impossible legacy OpenAILLMContextFrame import branch and match on LLMContextFrame directly. LLMContext.messages is still a live list of OpenAI-format dicts, so the in-place injection logic is unchanged. - tests: build frames from LLMContextFrame; add TestRealLLMContext that exercises a real pipecat LLMContext + LLMContextFrame to pin the live-list mutation contract the integration depends on. - examples: migrate to LLMContext + LLMContextAggregatorPair and the LLMRunFrame kickoff (create_context_aggregator / get_context_frame were removed in 1.x). - pyproject: pipecat 1.x requires Python >=3.11, so bump requires-python and drop the 3.10 classifier (CI already runs 3.11). Tests: 19 passed, 1 skipped (live).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Migrates the pipecat integration from
pipecat-ai>=0.0.100,<1.0to>=1.4.0,<2.0, clearing four high-severity Dependabot alerts that have no fix available within the 0.0.x line:/wsunauthenticated call-control abuse/filesendpoint (arbitrary file read)The fix versions (
1.2.0/1.4.0) are only on the 1.x line, which the integration previously capped out (<1.0, "1.0+ restructured modules; needs migration"). This PR does that migration.Why it's a small change
pipecat 1.x replaced the per-provider
OpenAILLMContextwith the universalLLMContextand removed thepipecat.processors.aggregators.openai_llm_contextmodule. The processor already imported the modernLLMContextFrame, andLLMContext.messagesis still a live list of OpenAI-format dicts — so the recall/retain/inject logic is unchanged. The migration is mostly swapping the removed legacy imports.Changes
memory.py— drop the now-impossible legacyOpenAILLMContextFrameimport branch; match onLLMContextFramedirectly. Runtime injection logic untouched.LLMContextFrame; addTestRealLLMContextthat exercises a real pipecatLLMContext+LLMContextFrame(not mocks) to pin the live-list-mutation contract the integration relies on — the migration's highest-risk assumption.basic_pipeline.pytoLLMContext+LLMContextAggregatorPair+LLMRunFramekickoff (create_context_aggregator/get_context_framewere removed in 1.x); updateinteractive_chat.pymock frame.>=3.11, so bumprequires-pythonand drop the 3.10 classifier (CI's.python-versionis already 3.11).OpenAILLMContextFrame→LLMContextFrame.Testing
uv run ruff check/formatclean;uv lock --checkconsistent; wheel builds.