pyproject.toml

[project]
name = "agentic-ai-evaluation-bootcamp-202602"
version = "0.1.2"
description = "Vector Institute Agentic AI Evaluation Bootcamp 202602"
readme = "README.md"
authors = [ {name = "Vector AI Engineering", email = "ai_engineering@vectorinstitute.ai"} ]
license = "Apache-2.0"
requires-python = ">=3.12,<4.0"
dependencies = [
    "aieng-eval-agents>=0.1.0",
    "aiohttp>=3.14.3", # CVE-2026-34513/34514/34515/34516/34517/34518/34519/34520/34525, CVE-2026-22815: multiple DoS/security fixes in 3.13.4; CVE-2026-54273/54274/54275/54276/54277/54278/54279/54280: multiple DoS/security fixes in 3.14.1; CVE-2026-69244: heap read OOB in C response parser fixed in 3.14.3
    "beautifulsoup4>=4.13.4",
    "datasets>=5.0.1", # PYSEC-2026-3716: path traversal vulnerability in folder-based dataset builders fixed in 5.0.1
    "e2b-code-interpreter>=2.4.1",
    "langfuse>=3.10.3,<4.0.0",
    "lxml>=6.0.0",
    "nest-asyncio>=1.6.0",
    "numpy<2.3.0",
    "plotly>=6.5.0",
    "pydantic>=2.12.4",
    "pydantic-settings>=2.14.2", # GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource symlink traversal and size bypass fixed in 2.14.2
    "pydantic-ai-slim[logfire]>=1.26.0",
    "scikit-learn>=1.7.0",
    "urllib3>=2.8.0", # CVE-2026-44431/44432: sensitive header forwarding and decompression bomb fixed in 2.7.0; CVE-2026-97687/97688/97689: HTTPS proxy TLS confusion, Deflate infinite loop, chunked-response DoS fixed in 2.8.0
    "openpyxl>=3.1.5",
    "authlib>=1.7.1", # CVE-2026-28802: alg:none JWT bypass fixed in 1.6.7; GHSA-jj8c-mmj3-mmgv: CSRF protection bypass fixed in 1.6.11
    "cryptography>=50.0.0", # CVE-2026-34073: DNS name constraint bypass fixed in 46.0.6; CVE-2026-39892: buffer overflow fixed in 46.0.7; GHSA-537c-gmf6-5ccf: fixed in 48.0.1; CVE-2026-69247: Bleichenbacher oracle via PKCS7 decryption fixed in 50.0.0
    "filelock>=3.24.2", # required by virtualenv>=21.7.13 (PYSEC-2026-4011/4013 fixes)
    "pyasn1>=0.6.4", # CVE-2026-30922: DoS via uncontrolled recursion fixed in 0.6.3
    "tenacity>=9.1.2",
    "certifi>=2026.10.19",
    "pypdf>=6.7.5", # CVE-2026-28804: ASCIIHexDecode DoS fixed in 6.7.5
    "PyYAML>=6.0.0",
    "litellm>=1.88.6", # CVE-2026-84377: fixed in 1.88.6
    "google-generativeai>=0.8.6",
    "openai-agents>=0.7.0",
    "pillow>=13.0.0",
    "pypdf>=6.21.1", # CVE-2026-28804: ASCIIHexDecode DoS fixed in 6.7.5; CVE-2026-33123: array-based stream DoS fixed in 6.9.1; CVE-2026-40260: XMP metadata memory DoS fixed in 6.10.0; GHSA-jj6c-8h6c-hppx/GHSA-4pxv-j86v-mhcw/GHSA-7gw9-cf7v-778f/GHSA-x284-j5p8-9c5p: DoS via crafted PDFs fixed in 6.10.2; CVE-2026-54530/54531: fixed in 6.13.0; CVE-2026-59938/59937: memory/perf DoS fixed in 6.14.0; CVE-2026-59936: infinite loop fixed in 6.14.1; CVE-2026-59935: infinite loop via ASCII85/ASCIIHex filters fixed in 6.14.2; CVE-2026-71852/71870: font width/ToUnicode memory DoS fixed in 6.15.0; CVE-2026-84309: infinite loop via TreeObject.insert_child fixed in 6.16.0; CVE-2026-84310/84311: long runtimes and large memory consumption fixed in 6.16.1; PYSEC-2026-4153/4154/4155/4156/4157/4158/4159/4160: multiple DoS via crafted PDFs fixed in 6.19.0
    "python-multipart>=0.0.31", # CVE-2026-40347: multipart parsing DoS fixed in 0.0.26; CVE-2026-42561: part header parsing DoS fixed in 0.0.27
    "matplotlib>=3.10.9",
    "kagglehub>=0.4.1,<1.0.1", # 1.0.1 needs kagglesdk.get_web_endpoint; removed in kagglesdk>=0.1.24
]

[dependency-groups]
dev = [
    "aieng-platform-onboard>=0.7.5",
    "mypy>=1.19.0",
    "codecov>=2.1.13",
    "ipykernel>=7.1.0",
    "ipython>=9.8.0",
    "ipywidgets>=8.1.7",
    "jupyter>=1.1.1",
    "jupyterlab>=4.6.4", # CVE-2026-42266/42557: extension allow-list bypass and command linker XSS fixed in 4.5.7; GHSA-vmhf-c436-hxj4: javascript: URL XSS in Extension Manager fixed in 4.5.9; GHSA-h5v5-8746-g7mm/GHSA-whvh-wf3x-g77j/GHSA-gx64-gj6p-pc4c/GHSA-pppj-hq3g-57pj/GHSA-89vp-jrxv-24w8: plugin manager bypass/XSS/settings code injection fixed in 4.6.2; PYSEC-2026-4055/4056/4057: pip uninstall injection, plural-forms XSS, clipboard cell trust bypass fixed in 4.6.4
    "nbqa>=1.9.1",
    "pip>=26.2", # Pinning version to address vulnerability GHSA-6vgw-5pg2-w6jp, CVE-2026-3219; PYSEC-2026-196: entry point path traversal fixed in 26.1.2; PYSEC-2026-3721: doubly-encoded package URL path traversal fixed in 26.2
    "pip-audit>=2.9.0",
    "pre-commit>=4.2.0",
    "pytest>=9.1.1",
    "pytest-asyncio>=0.26.0",
    "pytest-cov>=6.1.1",
    "pytest-mock>=3.14.0",
    "ruff>=0.17.1",
    "pandas-stubs>=2.3.3.260113",
]
docs = [
    "jinja2>=3.1.6", # Pinning version to address vulnerability GHSA-cpwx-vrp4-4pq7
    "mkdocs>=1.6.0",
    "mkdocs-material>=9.7.7", # Pinning version to address vulnerability CVE-2026-73295
    "mkdocstrings>=1.0.0",
    "mkdocstrings-python>=2.0.1",
    "ipykernel>=7.1.0",
    "ipython>=9.8.0",
]
web-search = [
    "google-cloud-firestore>=2.21.0",
    "fastapi[standard]>=0.116.1",
    "google-genai>=1.46.0",
    "python-multipart>=0.0.31", # CVE-2026-40347: DoS via crafted multipart preamble/epilogue fixed in 0.0.26; CVE-2026-42561: part header parsing DoS fixed in 0.0.27
    "simplejson>=3.20.2",
]

# Default dependency groups to be installed
[tool.uv]
default-groups = ["dev", "docs"]
# Override pinned transitive deps to patched versions (security)
override-dependencies = [
    "authlib>=1.7.1", # GHSA-jj8c-mmj3-mmgv: CSRF protection bypass; aieng-platform-onboard pins 1.6.9
    "starlette>=1.3.1", # PYSEC-2026-161/GHSA-86qp-5c8j-p5mr: missing Host header validation bypasses path-based security checks fixed in 1.0.1; CVE-2026-54282/54283: fixed in 1.3.0/1.3.1
    "urllib3>=2.8.0", # CVE-2026-44431/44432: sensitive header forwarding and decompression issues fixed in 2.7.0; CVE-2026-97687/97688/97689: HTTPS proxy TLS confusion, Deflate infinite loop, chunked-response DoS fixed in 2.8.0; aieng-platform-onboard pins 2.6.3
    "virtualenv>=21.14.9", # PYSEC-2026-4011: unverified wheel downloads fixed in 21.7.12; PYSEC-2026-4013: shell injection in activate script fixed in 21.7.13; aieng-platform-onboard pins 20.36.1
    "filelock>=3.24.2", # required by virtualenv>=21.7.13; aieng-platform-onboard pins 3.20.3
    "tornado>=6.5.9", # GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient credential leak fixed in 6.5.7; GHSA-chx6-46f5-w4vp/c2m8-h5v5-343r/3hv7-mjh2-fv65: fixed in 6.5.9
    "fsspec>=2026.6.0", # CVE-2026-104851: fixed in 2026.6.0
    "multidict>=6.9.1", # CVE-2026-104874: fixed in 6.9.1
    "pillow>=13.0.0", # needed to override gradio's (v6.30.0) pillow dependency
    "packaging>=26.3", # needed by virtualenv>=21.14.9
    "opentelemetry-sdk>=1.45.1", # must match opentelemetry-api (sdk pins api==its own version); google-adk caps at <=1.41.1
    "opentelemetry-exporter-otlp-proto-http>=1.45.1", # pins opentelemetry-sdk~=its own version; keep aligned with api/sdk
    "opentelemetry-api>=1.45.1", # CVE-2026-114603: O(N^2) tracestate parsing DoS fixed in 1.45.1; google-adk caps at <=1.41.1
]

[tool.uv.workspace]
members = [
  "aieng-eval-agents",
]

[tool.uv.sources]
aieng-eval-agents = { workspace = true }

[tool.ruff]
include = ["*.py", "pyproject.toml", "*.ipynb"]
line-length = 120

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
docstring-code-format = true

[tool.ruff.lint]
select = [
    "A", # flake8-builtins
    "B", # flake8-bugbear
    "COM", # flake8-commas
    "C4", # flake8-comprehensions
    "RET", # flake8-return
    "SIM", # flake8-simplify
    "ICN", # flake8-import-conventions
    "Q", # flake8-quotes
    "RSE", # flake8-raise
    "D", # pydocstyle
    "E", # pycodestyle
    "F", # pyflakes
    "I", # isort
    "W", # pycodestyle
    "N", # pep8-naming
    "ERA", # eradicate
    "PL", # pylint
]
fixable = ["A", "B", "COM", "C4", "RET", "SIM", "ICN", "Q", "RSE", "D", "E", "F", "I", "W", "N", "ERA", "PL"]
ignore = [
    "B905", # `zip()` without an explicit `strict=` parameter
    "E501", # line too long
    "D203", # 1 blank line required before class docstring
    "D213", # Multi-line docstring summary should start at the second line
    "PLR2004", # Replace magic number with named constant
    "PLR0913", # Too many arguments
    "PLR0917", # Too many positional arguments
    "COM812", # Missing trailing comma
    "N999", # Number in module names.
    "ERA001", # Commented out lines.
]

# Ignore import violations in all `__init__.py` files.
# Ignore missing docstring in `__init__.py` files
# Ignore E402 in notebooks (imports not at top) as this is expected
[tool.ruff.lint.per-file-ignores]
"__init__.py" = ["E402", "F401", "F403", "F811", "D104"]
"*.ipynb" = ["E402", "D100", "D103"]



[tool.ruff.lint.pep8-naming]
ignore-names = ["X*", "setUp"]

[tool.ruff.lint.isort]
lines-after-imports = 2

[tool.ruff.lint.pydocstyle]
convention = "numpy"

[tool.ruff.lint.pycodestyle]
max-doc-length = 88

[tool.pytest.ini_options]
markers = [
    "integration_test: marks tests as integration tests",
]
asyncio_default_fixture_loop_scope = "function"
filterwarnings = [
    # Ignore deprecation warnings from google-adk/google-genai internal code
    "ignore:deprecated:DeprecationWarning:google.adk.runners",
    "ignore:Inheritance class AiohttpClientSession:DeprecationWarning:google.genai",
    "ignore:[EXPERIMENTAL] BaseAgentState:UserWarning:aieng.agent_evals.aml_investigation.workflow",
]

[tool.coverage]
    [tool.coverage.run]
    source=["aieng-eval-agents/aieng"]
    omit=["aieng-eval-agents/tests/*", "*__init__.py", "scripts/*"]

[tool.mypy]
mypy_path = "aieng-eval-agents"
namespace_packages = true
explicit_package_bases = true
exclude = ["tests/"]