Merge branch 'develop' into dependabot/uv/backend-agent/develop/unstructured-0.18.32

Author: marcorosa

.github/workflows/docker.yml

@@ -94,17 +94,17 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Docker Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ secrets.DOCKER_REGISTRY_URL }}
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
       - name: 🐳 Build and push Backend Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./backend-agent
           file: ./backend-agent/Dockerfile
@@ -147,17 +147,17 @@ jobs:
           ls -la dist/
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Docker Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ secrets.DOCKER_REGISTRY_URL }}
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
       - name: 🐳 Build and push Frontend Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./frontend
           file: ./frontend/Dockerfile
@@ -213,7 +213,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@v5
         with:
           version: 'latest'
 
@@ -246,7 +246,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@v5
         with:
           version: 'latest'
 

.github/workflows/lint-backend.yml

@@ -1,7 +1,7 @@
 name: Lint backend
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - develop
       - main
@@ -13,12 +13,14 @@ on:
 permissions:
   checks: write
   contents: read
-  pull-requests: write
 
 jobs:
   lint-backend:
     name: Run backend linter
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: Check out Git repository

.github/workflows/lint-frontend.yml

@@ -1,7 +1,7 @@
 name: Lint frontend
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - develop
       - main
@@ -14,7 +14,7 @@ on:
 
 permissions:
   checks: write
-  contents: write
+  contents: read
 
 jobs:
   lint-frontend:

.github/workflows/pr-bot.yml

@@ -1,28 +1,35 @@
 name: AI-assisted
 on:
-  pull_request_target:
+  pull_request:
     types: [ready_for_review, opened, reopened]
 
 jobs:
+  approve:
+    name: Approve
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.pull_request.head.repo.fork == true && 'manual-approval' || '' }}
+
   summary:
     name: PR Summary
-    if: github.actor != 'dependabot'
+    needs: approve
+    if: github.actor != 'dependabot[bot]'
     runs-on: [ubuntu-latest]
     steps:
       - uses: SAP/ai-assisted-github-actions/pr-summary@v3
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
-          model: gpt-4o
+          model: gpt-4.1-nano
           exclude-files: package-lock.json, uv.lock
   review:
     name: PR Review
-    if: github.actor != 'dependabot'
+    needs: approve
+    if: github.actor != 'dependabot[bot]'
     runs-on: [ubuntu-latest]
     steps:
       - uses: SAP/ai-assisted-github-actions/pr-review@v3
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
-          model: anthropic--claude-4-sonnet
+          model: anthropic--claude-4.6-sonnet
           exclude-files: package-lock.json, uv.lock
           footer-text: |
             ---

backend-agent/llm.py

@@ -36,14 +36,14 @@
         'amazon--nova-pro',
         'amazon--nova-premier',
         'anthropic--claude-3-haiku',
-        'anthropic--claude-3-opus',
-        'anthropic--claude-3.5-sonnet',
         'anthropic--claude-3.7-sonnet',
-        'anthropic--claude-4-sonnet',
         'anthropic--claude-4-opus',
-        'anthropic--claude-4.5-sonnet',
+        'anthropic--claude-4-sonnet',
         'anthropic--claude-4.5-haiku',
         'anthropic--claude-4.5-opus',
+        'anthropic--claude-4.5-sonnet',
+        'anthropic--claude-4.6-opus',
+        'anthropic--claude-4.6-sonnet',
     ],
     'azure-openai':
     [
@@ -55,13 +55,16 @@
         'gpt-5',
         'gpt-5-mini',
         'gpt-5-nano',
+        'gpt-5.2',
         'o1',
         'o3',
         'o3-mini',
         'o4-mini',
     ],
     'gcp-vertexai':
     [
+        'gemini-2.0-flash',
+        'gemini-2.0-flash-lite',
         'gemini-2.5-flash',
         'gemini-2.5-flash-lite',
         'gemini-2.5-pro',
@@ -70,6 +73,7 @@
     [
         'sonar',
         'sonar-pro',
+        'sonar-deep-research',
     ],
 }
 

backend-agent/pyproject.toml

@@ -14,7 +14,7 @@ maintainers = [
 requires-python = '>=3.10,<3.13'
 dependencies = [
     'sap-ai-sdk-gen[all]==5.10.0',
-    'python-dotenv==1.2.1',
+    'python-dotenv==1.2.2',
     'faiss-cpu==1.13.2',
     'Flask==3.1.2',
     'Flask-Cors==6.0.1',
@@ -25,12 +25,12 @@ dependencies = [
     'langchain-core>=0.3.0,<0.4.0',
     'langchain-text-splitters>=0.3.0,<0.4.0',
     'PyYAML==6.0.3',
-    'requests==2.32.5',
+    'requests==2.33.0',
     'unstructured==0.18.32',
     'art==6.5',
     'pandas==2.3.3',
     'ollama==0.6.1',
-    'weasyprint==68.0',
+    'weasyprint==68.1',
     'pyrit==0.9.0',
     'codeattack @ git+https://github.com/marcorosa/CodeAttack',
     'gptfuzzer @ git+https://github.com/marcorosa/GPTFuzz@no-vllm',