chore: improve open-source security readiness

.github/workflows/pr-ci.yml

@@ -20,7 +20,7 @@ concurrency:
 
 env:
   PYTHON_VERSION: "3.11"
-  UV_VERSION: "0.10.0"
+  UV_VERSION: "0.11.7"
   UV_LINK_MODE: copy
 
 jobs:
@@ -47,8 +47,6 @@ jobs:
           enable-cache: true
           cache-dependency-glob: |
             uv.lock
-            apps/*/uv.lock
-            packages/*/uv.lock
 
       - name: Install dependencies
         run: uv sync --locked --all-packages --all-groups
@@ -79,8 +77,6 @@ jobs:
           enable-cache: true
           cache-dependency-glob: |
             uv.lock
-            apps/*/uv.lock
-            packages/*/uv.lock
 
       - name: Install dependencies
         run: uv sync --locked --all-packages --all-groups
@@ -111,8 +107,6 @@ jobs:
           enable-cache: true
           cache-dependency-glob: |
             uv.lock
-            apps/*/uv.lock
-            packages/*/uv.lock
 
       - name: Install dependencies
         run: uv sync --locked --all-packages --all-groups

.gitignore

@@ -12,6 +12,7 @@ build/
 __pycache__/
 *.pyc
 *.pyo
+.coverage
 .venv/
 venv/
 venv_pptx2md/
@@ -46,6 +47,7 @@ logs/
 *.log
 
 # Generated files
+.build/
 apps/api/openapi.json
 packages/shared-types/generated/
 

apps/api/pyproject.toml

@@ -2,22 +2,22 @@
 name = "knowhere-api-app"
 version = "0.1.0"
 description = "Knowhere API service"
-requires-python = ">=3.11"
+requires-python = ">=3.11,<3.14"
 dependencies = [
     "knowhere-shared",
-    "fastapi==0.115.14",
+    "fastapi==0.135.1",
     "uvicorn==0.34.3",
-    "starlette==0.46.2",
+    "starlette==0.52.1",
     "sqlalchemy==2.0.42",
     "alembic==1.13.1",
     "redis==5.3.1",
     "celery==5.4.0",
     "stripe==13.0.1",
     "pydantic==2.11.7",
-    "PyJWT==2.10.1",
+    "PyJWT==2.12.0",
     "qstash==3.2.0",
     "httpx==0.28.1",
-    "aiohttp==3.12.15",
+    "aiohttp==3.13.4",
     "loguru==0.7.3",
     "moesifapi==1.5.5",
     "limits>=5.8,<6",
@@ -27,10 +27,10 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "pytest==8.3.4",
-    "pytest-asyncio==0.24.0",
+    "pytest==9.0.3",
+    "pytest-asyncio==1.3.0",
     "pytest-alembic==0.12.1",
-    "pytest-mock==3.14.0",
+    "pytest-mock==3.15.1",
     "pytest-postgresql>=7.0.2",
     "fakeredis[lua]>=2.31.0",
     "pyright>=1.1.396",

apps/worker/pyproject.toml

@@ -2,24 +2,24 @@
 name = "knowhere-worker-app"
 version = "0.1.0"
 description = "Knowhere Worker service"
-requires-python = ">=3.11"
+requires-python = ">=3.11,<3.14"
 dependencies = [
     "knowhere-shared",
     "numpy==2.2.6",
     "pandas==2.3.1",
     "jieba==0.42.1",
     "python-docx==1.2.0",
     "python-pptx==1.0.2",
-    "pypdf==6.6.0",
+    "pypdf==6.10.2",
     "beautifulsoup4==4.13.4",
-    "lxml==5.4.0",
+    "lxml==6.1.0",
     "markitdown==0.1.2",
     "openpyxl==3.1.2",
     "pptx2md==2.0.6",
     "openai==1.93.3",
     "oss2>=2.18.0",
-    "pillow==11.2.1",
-    "cryptography==45.0.5",
+    "pillow==12.2.0",
+    "cryptography==46.0.7",
     "tqdm==4.67.1",
     "logfire[celery,fastapi,httpx,sqlalchemy]>=4.25.0",
     "pymupdf==1.27.2",
@@ -32,9 +32,9 @@ dependencies = [
 [dependency-groups]
 dev = [
     "fakeredis[lua]>=2.31.0",
-    "pytest==8.3.4",
-    "pytest-asyncio==0.24.0",
-    "pytest-mock==3.14.0",
+    "pytest==9.0.3",
+    "pytest-asyncio==1.3.0",
+    "pytest-mock==3.15.1",
     "pytest-postgresql>=7.0.2",
 ]