Skip to content

fix: update imports and dependencies to address vulnerabilities#1241

Merged
chakravarthik27 merged 14 commits into
release/2.8.0from
fix/cve-2026-34070
Jul 21, 2026
Merged

fix: update imports and dependencies to address vulnerabilities#1241
chakravarthik27 merged 14 commits into
release/2.8.0from
fix/cve-2026-34070

Conversation

@chakravarthik27

Copy link
Copy Markdown
Collaborator
  • Changed imports from langchain.prompts to langchain_core.prompts in prompts.py.
  • Updated import from langchain.evaluation.qa to langchain_classic.evaluation.qa in helpers.py.
  • Updated poetry.lock to reflect new versions of langchain and langchain-core to mitigate security issues.
  • Updated pyproject.toml to require langchain version 1.3.13.

- Changed imports from `langchain.prompts` to `langchain_core.prompts` in `prompts.py`.
- Updated import from `langchain.evaluation.qa` to `langchain_classic.evaluation.qa` in `helpers.py`.
- Updated `poetry.lock` to reflect new versions of `langchain` and `langchain-core` to mitigate security issues.
- Updated `pyproject.toml` to require `langchain` version `1.3.13`.
@chakravarthik27 chakravarthik27 self-assigned this Jul 14, 2026

@blidiselalin blidiselalin left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • langchain_classic is not declared as a dependency in pyproject.toml (or poetry.lock). helpers.py imports from langchain_classic.evaluation.qa import QAEvalChain
    PretrainedModelForTranslation
  • uses a hardcoded T5-style prompt for every model (translate {source} to {target}: {text}). This is incorrect for non-T5 encoder-decoder models and likely degrades quality or produces garbage for mBART, MarianMT, etc. It is also a silent behavioural change from the previous pipeline-based implementation.
  • no longer validates its inputs. The constructor previously asserted isinstance(model, Pipeline); it now accepts model: Any and can be constructed with incompatible objects.

@chakravarthik27

chakravarthik27 commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator Author
  • langchain_classic is not declared as a dependency in pyproject.toml (or poetry.lock). helpers.py imports from langchain_classic.evaluation.qa import QAEvalChain
    PretrainedModelForTranslation

langchain_classic is from langchain package.

@pratacosmin

Copy link
Copy Markdown
Collaborator

Looks good to me. If this prompt format has been tested with the model, I think it's fine.

@blidiselalin blidiselalin left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to go.

@chakravarthik27

Copy link
Copy Markdown
Collaborator Author
  • uses a hardcoded T5-style prompt for every model (translate {source} to {target}: {text}). This is incorrect for non-T5 encoder-decoder models and likely degrades quality or produces garbage for mBART, MarianMT, etc. It is also a silent behavioural change from the previous pipeline-based implementation.

I'll make the prompt customizable so users can refine it, with T5 remaining as the default.

… translation test to use 'German' as target language
…d enhance translation handling in PretrainedModelForTranslation
@chakravarthik27
chakravarthik27 merged commit c06c3dd into release/2.8.0 Jul 21, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants