fix: Dependabot alerts high and critical - #1155
Conversation
Coverage Report •
|
There was a problem hiding this comment.
🟡 Changes recommended
azure-ai-evaluation is still pinned in .github/requirements.txt (used by CI workflows), so the dependency cleanup/security remediation is incomplete as implemented.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This pull request aims to address Dependabot high/critical alerts by cleaning up backend Python dependencies, specifically by removing unused packages from src/backend/pyproject.toml.
Changes:
- Removed
azure-ai-evaluation==1.16.6from backend dependencies. - Removed
nltk==3.10.0from backend dependencies.
File summaries
| File | Description |
|---|---|
| src/backend/pyproject.toml | Removes two pinned dependencies from the backend dependency list to reduce exposure to vulnerable/unused packages. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟢 Approval recommended
The removed packages appear unused in the repository and the dependency cleanup is consistently applied to both the backend pyproject and GitHub requirements list.
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟢 Approval recommended
The removed dependencies have no remaining references in the repository, and CI requirements were updated to avoid keeping the removed package pinned.
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 0 new
- Review effort level: Lite
Reverts commits 9b69b94 and 42ac650. Co-authored-by: Copilot <[email protected]> Copilot-Session: f1b6197b-2b2e-4d4a-8837-53519434aba6
There was a problem hiding this comment.
🔵 Needs a closer look
The PR description claims azure-ai-evaluation was removed, but it remains pinned in .github/requirements.txt, so the dependency cleanup may be incomplete and alerts may persist.
Review details
Suppressed comments (1)
src/backend/pyproject.toml:10
- The PR description says
azure-ai-evaluationwas removed because it’s no longer needed, but it’s still pinned in.github/requirements.txt(line 21). If that file is used by CI or Dependabot, the alert(s) may persist and the dependency removal is incomplete; either remove it there as well (if truly unused) or adjust the PR description/scope accordingly.
dependencies = [
"azure-ai-inference==1.0.0b9",
# OLD (restore to revert): "azure-ai-projects==1.0.0",
"azure-ai-projects==2.1.0",
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Purpose
This pull request makes a couple of dependency cleanup changes to the
src/backend/pyproject.tomlfile. The main updates are the removal of two dependencies that are no longer needed.Dependency removals:
azure-ai-evaluationpackage, likely because it's no longer used in the project.nltkpackage, indicating that natural language processing features depending on it have been removed or replaced.Does this introduce a breaking change?
Other Information
This pull request makes some dependency updates to the
src/backend/pyproject.tomlfile, specifically removing unused or unnecessary packages.Dependency removals:
azure-ai-evaluationpackage, likely because it is no longer needed in the project.nltkpackage, which suggests that natural language processing features relying on this library are no longer required.