Skip to content

LCORE-4534: updating sentence transformers to 5.6 - #2900

Open
snuryyeva wants to merge 1 commit into
lightspeed-core:mainfrom
snuryyeva:snuryyeva/sentence_transformers_cve_fix
Open

snuryyeva wants to merge 1 commit into
lightspeed-core:mainfrom
snuryyeva:snuryyeva/sentence_transformers_cve_fix

Conversation

@snuryyeva

@snuryyeva snuryyeva commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Description

  • Bump sentence-transformers from >=5.0.0 to >=5.6.0
  • Regenerate konflux requirements files (cpu profile)

Thanks @jrobertboos for your help on this!

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up service version
  • Bump-up dependent library [pyproject.toml + uv.lock]
  • Bump-up dependent library [requirements.*.txt for Konflux]
  • Bump-up library or tool used for development (does not change the final image)
  • CI configuration change
  • Konflux configuration change
  • Unit tests improvement
  • Integration tests improvement
  • End to end tests improvement
  • Benchmarks improvement

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

  • Assisted-by: (e.g., Claude, CodeRabbit, Ollama, etc., N/A if not used)
  • Generated by: (e.g., tool name and version; N/A if not used)

Related Tickets & Documents

  • Related Issue #
  • Closes #

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

Summary by CodeRabbit

  • Chores
    • Updated several underlying libraries used for cloud services, language processing, and AI features.
    • Added and refreshed supporting components for application packaging and installation, including AWS-related tools.
    • Updated the build-time versioning component and raised the minimum supported version of the sentence-transformers library.

@coderabbitai

coderabbitai Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: lightspeed-core/lightspeed-stack/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 9430ba27-2dc3-4704-81be-bd6dc57ddc16

📥 Commits

Reviewing files that changed from the base of the PR and between 055e1a5 and b77482e.


⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)
  • .konflux/requirements-build.txt
  • .konflux/requirements.hashes.source.txt
  • .konflux/requirements.hashes.wheel.txt
  • .tekton/lightspeed-stack-0-8-pull-request.yaml
  • .tekton/lightspeed-stack-0-8-push.yaml
  • pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.


📜 Recent review details
⏰ Context from checks skipped due to timeout. (27)
  • GitHub Check: E2E: library / ci / shields
  • GitHub Check: E2E: library / ci / skills
  • GitHub Check: E2E: server / ci / other
  • GitHub Check: E2E: server / ci / tls
  • GitHub Check: E2E: library / ci / authorized
  • GitHub Check: E2E: library / ci / mcp
  • GitHub Check: E2E: server / ci / default
  • GitHub Check: E2E: library / ci / other
  • GitHub Check: E2E: server / ci / mcp
  • GitHub Check: E2E: library / ci / rbac
  • GitHub Check: E2E: server / ci / shields
  • GitHub Check: E2E: library / ci / default
  • GitHub Check: E2E: server / ci / authorized
  • GitHub Check: E2E: server / ci / skills
  • GitHub Check: E2E: server / ci / rbac
  • GitHub Check: integration_tests (3.13)
  • GitHub Check: unit_tests (3.14)
  • GitHub Check: unit_tests (3.13)
  • GitHub Check: integration_tests (3.14)
  • GitHub Check: Pylinter
  • GitHub Check: integration_tests (3.12)
  • GitHub Check: unit_tests (3.12)
  • GitHub Check: build-pr
  • GitHub Check: Red Hat Konflux / rag-content-0-8-e2e-tests / lightspeed-stack-0-8
  • GitHub Check: Red Hat Konflux / lightspeed-core-0-8-enterprise-contract / lightspeed-stack-0-8
  • GitHub Check: Red Hat Konflux / lightspeed-stack-0-8-e2e-tests / lightspeed-stack-0-8
  • GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-0-8-on-pull-request

🔇 Additional comments (3)
pyproject.toml (1)

181-181: LGTM!


.tekton/lightspeed-stack-0-8-pull-request.yaml (1)

53-53: LGTM!


.tekton/lightspeed-stack-0-8-push.yaml (1)

54-54: LGTM!



Walkthrough

The pull request updates pinned build and runtime dependencies, their SHA-256 hashes, the sentence-transformers development minimum, and the package lists used by two Tekton pipelines.

Changes

Dependency and Build Package Updates

Layer / File(s) Summary
Dependency pins and hashes
.konflux/requirements-build.txt, .konflux/requirements.hashes.source.txt, .konflux/requirements.hashes.wheel.txt
Updates the vcs-versioning build pin and several source and wheel dependencies. Adds and removes package entries, including adding sentence-transformers to source requirements and removing its older wheel pin. Updates the associated hashes.
Development and prefetch declarations
pyproject.toml, .tekton/lightspeed-stack-0-8-pull-request.yaml, .tekton/lightspeed-stack-0-8-push.yaml
Raises the sentence-transformers minimum in ogxlibdev. Updates both Tekton binary-prefetch lists, including removing sentence-transformers and adding packages.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: jrobertboos

Merge Risk: ⚪ Minimal · up to b7748

The dependency declarations and CPU prefetch inputs are consistent with the repository’s resolver and install workflow. No concrete merge-blocking behavior is established.

Pre-merge checks | Passed 7
✅ Passed checks (7 passed)
Check name Status Explanation
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Performance And Algorithmic Complexity Passed PASS. The pull request changes dependency versions, lock metadata, and Tekton package allowlists only. It adds no handlers, loops, API list operations, queries, caches, watchers, buffers, or endpoint …
Security And Secret Handling Passed PASSED. The pull request changes only dependency versions and hashes, uv.lock, and Tekton package allowlists. It adds no application source, API endpoint, logging, secret, or authentication code. Th…
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly identifies the issue and the primary change: updating sentence-transformers to version 5.6.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR

✨ Simplify code
  • Create a new PR

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants