chore: sync upstream main

Author: SeCuReDmE-main-dev

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2022-present deepset GmbH <info@deepset.ai>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# ClusterFuzzLite / OSS-Fuzz build environment for the Haystack Atheris fuzz targets.
+# Pinned by digest for supply-chain integrity. Bump periodically (the OSS-Fuzz
+# base-builder is updated frequently with toolchain fixes); resolve a fresh digest with:
+#   docker buildx imagetools inspect gcr.io/oss-fuzz-base/base-builder-python:latest --format '{{.Manifest.Digest}}'
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:bfc9a983c445774ca98639477cc90c15f70a1493875848d62a08769023fc6676
+
+COPY . $SRC/haystack
+WORKDIR $SRC/haystack
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,26 @@
+#!/bin/bash -eu
+# SPDX-FileCopyrightText: 2022-present deepset GmbH <info@deepset.ai>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Builds the Atheris fuzz targets for ClusterFuzzLite / OSS-Fuzz.
+# `compile_python_fuzzer` is provided by the base-builder-python image.
+
+python3 -m pip install --upgrade pip
+pip3 install . --uploaded-prior-to=P1D
+
+for harness in "$SRC"/haystack/test/fuzz/fuzz_*.py; do
+  name=$(basename "$harness" .py)
+  # --collect-submodules numpy: PyInstaller's static analysis misses NumPy's
+  # dynamically-loaded submodules (e.g. numpy._core._exceptions), which makes
+  # the frozen binary crash on startup ("ModuleNotFoundError") and fails the
+  # ClusterFuzzLite bad-build check. Bundling all numpy submodules avoids that.
+  compile_python_fuzzer "$harness" --collect-submodules numpy
+
+  # Ship a seed corpus if one exists for this harness. The runner unpacks
+  # "<fuzzer>_seed_corpus.zip" next to the binary and seeds libFuzzer with it.
+  corpus_dir="$SRC/haystack/test/fuzz/corpus/$name"
+  if [ -d "$corpus_dir" ]; then
+    zip -j "$OUT/${name}_seed_corpus.zip" "$corpus_dir"/*
+  fi
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1,5 @@
+# Project configuration for ClusterFuzzLite (and a starting point for OSS-Fuzz).
+# https://google.github.io/clusterfuzzlite/
+language: python
+sanitizers:
+  - address

.github/ISSUE_TEMPLATE/breaking-change-proposal.md

@@ -27,9 +27,5 @@ Steps to reproduce the behavior
 - [ ] Have you had a look at [our new FAQ page](https://docs.haystack.deepset.ai/docs/faq)?
 
 **System:**
- - OS:
- - GPU/CPU:
- - Haystack version (commit or version number):
- - DocumentStore:
- - Reader:
- - Retriever:
+- OS:
+- Haystack version:

.github/ISSUE_TEMPLATE/bug_report.md

@@ -13,3 +13,32 @@ updates:
       interval: 'daily'
     cooldown:
       default-days: 1
+
+  - package-ecosystem: 'npm'
+    directory: '/docs-website'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 1
+
+  # Tracks the digest-pinned `COPY --from` image (ghcr.io/astral-sh/uv) in
+  # docker/Dockerfile.base. Note: the python:3.12-slim base/builder digests are
+  # carried both as the build_image/base_image ARG defaults in Dockerfile.base
+  # and in docker/docker-bake.hcl (which overrides them at build time).
+  # Dependabot does NOT parse images that reach FROM via an ARG, nor the
+  # `docker run` image strings in workflows, so bump those by hand and keep the
+  # Dockerfile.base ARG defaults and docker-bake.hcl digests in sync.
+  - package-ecosystem: 'docker'
+    directory: '/docker'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 1
+
+  # Keeps the digest-pinned OSS-Fuzz base-builder in .clusterfuzzlite/Dockerfile fresh.
+  - package-ecosystem: 'docker'
+    directory: '/.clusterfuzzlite'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 1

.github/dependabot.yml

@@ -3,8 +3,8 @@
 #
 # Requires: VERSION, RUN_URL, HAS_FAILURE, GH_TOKEN, GITHUB_REPOSITORY
 # Optional: IS_RC, IS_FIRST_RC, MAJOR_MINOR, GITHUB_URL, PYPI_URL, DOCKER_URL,
-#           BUMP_VERSION_PR_URL, DC_PIPELINE_TEMPLATES_PR_URL, CUSTOM_NODES_PR_URL,
-#           DC_PIPELINE_IMAGES_PR_URL, GITHUB_WORKSPACE
+#           BUMP_VERSION_PR_URL, DC_PIPELINE_TEMPLATES_PR_URL, DC_CUSTOM_NODES_PR_URL,
+#           HAYSTACK_RUNTIME_PR_URL, GITHUB_WORKSPACE
 # Output: slack_payload.json
 #
 # This script is used in the release.yml workflow to prepare the notification payload
@@ -64,7 +64,7 @@ if [[ "${IS_RC:-}" == "true" ]]; then
   PLATFORM_PRS=""
   [[ -n "${DC_PIPELINE_TEMPLATES_PR_URL:-}" ]] && PLATFORM_PRS+=$'\n'"- <${DC_PIPELINE_TEMPLATES_PR_URL}|dc-pipeline-templates>"
   [[ -n "${DC_CUSTOM_NODES_PR_URL:-}" ]] && PLATFORM_PRS+=$'\n'"- <${DC_CUSTOM_NODES_PR_URL}|deepset-cloud-custom-nodes>"
-  [[ -n "${DC_PIPELINE_IMAGES_PR_URL:-}" ]] && PLATFORM_PRS+=$'\n'"- <${DC_PIPELINE_IMAGES_PR_URL}|dc-pipeline-images>"
+  [[ -n "${HAYSTACK_RUNTIME_PR_URL:-}" ]] && PLATFORM_PRS+=$'\n'"- <${HAYSTACK_RUNTIME_PR_URL}|haystack-runtime>"
   if [[ -n "${PLATFORM_PRS}" ]]; then
     TXT+=$'\n\n'":factory: *Test PRs opened on Platform:*${PLATFORM_PRS}"
   fi

.github/utils/prepare_release_notification.sh

@@ -23,10 +23,8 @@
         sys.exit("Version must be formatted like so <major>.<minor>")
 
     target_version = f"{args.version}"  # e.g., "2.20" - the target release version
-    major, minor = args.version.split(".")
 
     target_unstable = f"{target_version}-unstable"  # e.g., "2.20-unstable"
-    previous_stable = f"{major}.{int(minor) - 1}"  # e.g., "2.19" - previous stable release
 
     versions = [
         folder.replace("version-", "")
@@ -83,9 +81,15 @@
     with open("docs-website/reference_versions.json", "w") as f:
         json.dump(reference_versions_list, f)
 
-    # in docusaurus.config.js, replace previous stable version with the target version
+    # in docusaurus.config.js, replace the current stable version (lastVersion) with the target version
     with open("docs-website/docusaurus.config.js") as f:
         config = f.read()
+    last_version_matches = set(re.findall(r"lastVersion: '([^']+)'", config))
+    if not last_version_matches:
+        sys.exit("Could not find any lastVersion entry in docusaurus.config.js")
+    if len(last_version_matches) > 1:
+        sys.exit(f"Found inconsistent lastVersion entries in docusaurus.config.js: {last_version_matches}")
+    previous_stable = last_version_matches.pop()  # e.g., "2.19" - previous stable release
     config = config.replace(f"lastVersion: '{previous_stable}'", f"lastVersion: '{target_version}'")  # "2.19" -> "2.20"
     with open("docs-website/docusaurus.config.js", "w") as f:
         f.write(config)

.github/utils/promote_unstable_docs_docusaurus.py

@@ -12,14 +12,16 @@ on:
       - "docs-website/reference_versioned_docs/**"
 
 permissions:
-  pull-requests: write
-  contents: write
+  contents: read
 
 env:
   GH_TOKEN: ${{ github.token }}
 
 jobs:
   auto-approve-and-merge:
+    permissions:
+      contents: write
+      pull-requests: write
     if: |
       github.event.pull_request.user.login == 'HaystackBot' &&
       startsWith(github.event.pull_request.head.ref, 'sync-docusaurus-api-reference') &&

.github/workflows/auto_approve_api_ref_sync.yml

@@ -1,7 +1,6 @@
 name: Branch off
 
 on:
-  workflow_dispatch:
   workflow_call:
     outputs:
       bump_version_pr_url:
@@ -10,6 +9,9 @@ on:
 env:
   PYTHON_VERSION: "3.10"
 
+permissions:
+  contents: read
+
 jobs:
   branch-off:
     runs-on: ubuntu-slim
@@ -18,9 +20,14 @@ jobs:
 
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          # Persist the bot token so the branch/tag pushes below authenticate as
+          # HaystackBot (a ruleset-bypass actor) instead of the default
+          # github-actions[bot], which only has contents:read and is blocked by
+          # the release rulesets.
+          token: ${{ secrets.HAYSTACK_BOT_TOKEN }}
 
       - name: Define all versions
         id: versions
@@ -51,11 +58,11 @@ jobs:
           git tag "v${{ steps.versions.outputs.next_version_rc0 }}" -m "v${{ steps.versions.outputs.next_version_rc0 }}"
           git push --tags
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"