chore: merge staging into fix/dependabot-security-alerts to resolve conflicts

- Resolved pyproject.toml conflict: took staging versions (fastmcp>=3.2.4,
  aiohttp>=3.13.5) plus new deps (snowflake-connector-python~=4.4.0,
  python-dotenv~=1.2.2)
- Resolved uv.lock conflict: took staging's updated specifiers
  (authlib ~=1.7.0, fastapi ~=0.136.0, fastmcp >=3.2.4, aiohttp >=3.13.5)
- All security fixes preserved

Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

Author: Copilot

.github/wordlist.txt

@@ -1,6 +1,8 @@
 QueryWeaver
 FalkorDB
 OAuth
+DDL
+DML
 AGPL
 Affero
 nullability

.github/workflows/playwright.yml

@@ -37,7 +37,7 @@ jobs:
 
     # Install uv
     - name: Install uv
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
         version: "0.7.12"
 
@@ -62,7 +62,7 @@ jobs:
     # Cache Playwright browsers
     - name: Cache Playwright browsers
       id: playwright-cache
-      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ~/.cache/ms-playwright
         key: playwright-browsers-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
@@ -180,15 +180,15 @@ jobs:
         CI: true
 
     # Upload test results on failure
-    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       if: failure()
       with:
         name: playwright-report
         path: playwright-report/
         retention-days: 30
 
     # Upload test screenshots on failure
-    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       if: failure()
       with:
         name: test-results

.github/workflows/publish-docker.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -27,7 +27,7 @@ jobs:
           images: falkordb/queryweaver
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         with:
           context: .
           push: true

.github/workflows/pylint.yml

@@ -17,7 +17,7 @@ jobs:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
         version: "latest"
 

.github/workflows/tests.yml

@@ -37,7 +37,7 @@ jobs:
         python-version: '3.12'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
         version: "0.7.12"
 

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build: Start with Python 3.12 base
-FROM python:3.12-bookworm AS python-base
+FROM python:3.12-trixie AS python-base
 
 # Main stage: Use FalkorDB base and copy Python 3.12
 FROM falkordb/falkordb:latest
@@ -15,7 +15,9 @@ COPY --from=python-base /usr/local /usr/local
 
 # Install netcat for wait loop in start.sh and system build tools needed for
 # compiling Python wheels (g++, make, libc-dev)
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get install -y --no-install-recommends libtinfo6 \
+    && apt-get install -y --no-install-recommends \
+    bash \
     netcat-openbsd \
     git \
     build-essential \

api/app_factory.py

@@ -5,7 +5,6 @@
 import os
 import secrets
 
-from dotenv import load_dotenv
 from fastapi import FastAPI, Request, HTTPException
 from fastapi.responses import RedirectResponse, JSONResponse, FileResponse
 from fastapi.staticfiles import StaticFiles
@@ -24,8 +23,6 @@
 from api.routes.tokens import tokens_router
 from api.routes.settings import settings_router
 
-# Load environment variables from .env file
-load_dotenv()
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
 )
@@ -147,7 +144,7 @@ def create_app():  # pylint: disable=too-many-statements
     app.include_router(graphs_router, prefix="/graphs")
     app.include_router(database_router)
     app.include_router(tokens_router, prefix="/tokens")
-    app.include_router(settings_router, prefix="/api")
+    app.include_router(settings_router, prefix="/settings")
 
 
 

api/config.py

@@ -7,8 +7,13 @@
 import logging
 import dataclasses
 from typing import Union
+
+from dotenv import load_dotenv
 from litellm import embedding
 
+# Ensure .env is loaded before Config reads os.getenv() at class definition time
+load_dotenv()
+
 # Configure litellm logging to prevent sensitive data leakage
 def configure_litellm_logging():
     """Configure litellm to suppress completion logs."""
@@ -64,6 +69,9 @@ def _with_prefix(model: str, provider: str) -> str:
     return prefix + model.removeprefix(prefix)
 
 
+SUPPORTED_VENDORS = ("openai", "anthropic", "gemini", "azure", "ollama", "cohere")
+
+
 @dataclasses.dataclass
 class Config:
     """
@@ -103,7 +111,7 @@ class Config:
             EMBEDDING_MODEL_NAME = "voyage/voyage-3"
         else:
             raise ValueError(
-                "Anthropic has no native embeddings. "
+                "ANTHROPIC_API_KEY is set, but Anthropic has no native embeddings. "
                 "Set EMBEDDING_MODEL or VOYAGE_API_KEY for embeddings."
             )
     elif os.getenv("COHERE_API_KEY"):

api/core/schema_loader.py

@@ -13,6 +13,7 @@
 from api.loaders.base_loader import BaseLoader
 from api.loaders.postgres_loader import PostgresLoader
 from api.loaders.mysql_loader import MySQLLoader
+from api.loaders.snowflake_loader import SnowflakeLoader
 
 # Use the same delimiter as in the JavaScript frontend for streaming chunks
 MESSAGE_DELIMITER = "|||FALKORDB_MESSAGE_BOUNDARY|||"
@@ -44,6 +45,9 @@ def _step_detect_db_type(steps_counter: int, url: str) -> tuple[type[BaseLoader]
     elif url.startswith("mysql://"):
         db_type = "mysql"
         loader = MySQLLoader
+    elif url.startswith("snowflake://"):
+        db_type = "snowflake"
+        loader = SnowflakeLoader
     else:
         raise InvalidArgumentError("Invalid database URL format")
 

api/core/text2sql.py

@@ -15,10 +15,12 @@
 from api.agents import AnalysisAgent, RelevancyAgent, ResponseFormatterAgent, FollowUpAgent
 from api.agents.healer_agent import HealerAgent
 from api.config import Config
+from api.config import SUPPORTED_VENDORS
 from api.extensions import db
 from api.graph import find, get_db_description, get_user_rules
 from api.loaders.postgres_loader import PostgresLoader
 from api.loaders.mysql_loader import MySQLLoader
+from api.loaders.snowflake_loader import SnowflakeLoader
 from api.memory.graphiti_tool import MemoryTool
 from api.sql_utils import SQLIdentifierQuoter, DatabaseSpecificQuoter
 
@@ -83,6 +85,8 @@ def get_database_type_and_loader(db_url: str):
         return 'postgresql', PostgresLoader
     if db_url_lower.startswith('mysql://'):
         return 'mysql', MySQLLoader
+    if db_url_lower.startswith('snowflake://'):
+        return 'snowflake', SnowflakeLoader
 
     # Default to PostgresLoader for backward compatibility
     return 'postgresql', PostgresLoader
@@ -257,21 +261,17 @@ async def generate():  # pylint: disable=too-many-locals,too-many-branches,too-m
         custom_model = chat_data.custom_model
 
         # Validate custom model format (vendor/model)
-        supported_vendors = ("openai", "anthropic", "gemini", "azure", "ollama", "cohere")
         if custom_model:
             parts = custom_model.split("/", 1)
             if len(parts) != 2 or not parts[0] or not parts[1]:
                 raise InvalidArgumentError(
                     "Invalid model format. Expected 'vendor/model' (e.g. 'openai/gpt-4.1')"
                 )
-            if parts[0] not in supported_vendors:
+            if parts[0] not in SUPPORTED_VENDORS:
                 raise InvalidArgumentError(
-                    f"Unsupported vendor '{parts[0]}'. Supported: {', '.join(supported_vendors)}"
+                    f"Unsupported vendor '{parts[0]}'. Supported: {', '.join(SUPPORTED_VENDORS)}"
                 )
 
-        if custom_api_key is not None and len(custom_api_key.strip()) < 10:
-            raise InvalidArgumentError("API key is too short")
-
         agent_rel = RelevancyAgent(queries_history, result_history, custom_api_key, custom_model)
         agent_an = AnalysisAgent(queries_history, result_history, custom_api_key, custom_model)
         follow_up_agent = FollowUpAgent(queries_history, result_history, custom_api_key, custom_model)