Merge branch 'main' to reconcile with the out-of-range guard from deepset-ai#12061

Author: otiscuilei

.clusterfuzzlite/Dockerfile

@@ -6,7 +6,7 @@
 # Pinned by digest for supply-chain integrity. Bump periodically (the OSS-Fuzz
 # base-builder is updated frequently with toolchain fixes); resolve a fresh digest with:
 #   docker buildx imagetools inspect gcr.io/oss-fuzz-base/base-builder-python:latest --format '{{.Manifest.Digest}}'
-FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:6768b69b56e3c6e654742e5109559fc37601b45d0cfe2e15ecb8e14f0e941a57
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:662ca248430ff29e82f3505caa17e3b75f118243a41cfa42ae64fd24ef6365f0
 
 COPY . $SRC/haystack
 WORKDIR $SRC/haystack

.clusterfuzzlite/build.sh

@@ -6,7 +6,8 @@
 # Builds the Atheris fuzz targets for ClusterFuzzLite / OSS-Fuzz.
 # `compile_python_fuzzer` is provided by the base-builder-python image.
 
-pip3 install .
+python3 -m pip install --upgrade pip
+pip3 install . --uploaded-prior-to=P1D
 
 for harness in "$SRC"/haystack/test/fuzz/fuzz_*.py; do
   name=$(basename "$harness" .py)

.gitattributes

@@ -0,0 +1,5 @@
+# Exclude the Docusaurus documentation site from GitHub's language statistics
+# (github-linguist). Otherwise the ~5,700 .mdx files there dominate the count
+# and the repo is misclassified as MDX instead of Python.
+# See: https://github.com/github-linguist/linguist/blob/main/docs/troubleshooting.md
+docs-website/** linguist-documentation

.github/dependabot.yml

@@ -6,6 +6,10 @@ updates:
       interval: 'daily'
     cooldown:
       default-days: 1
+    groups:
+      codeql:
+        patterns:
+          - 'github/codeql-action/*'
 
   - package-ecosystem: 'pip'
     directory: '/'

.github/utils/promote_unstable_docs_docusaurus.py

@@ -23,10 +23,8 @@
         sys.exit("Version must be formatted like so <major>.<minor>")
 
     target_version = f"{args.version}"  # e.g., "2.20" - the target release version
-    major, minor = args.version.split(".")
 
     target_unstable = f"{target_version}-unstable"  # e.g., "2.20-unstable"
-    previous_stable = f"{major}.{int(minor) - 1}"  # e.g., "2.19" - previous stable release
 
     versions = [
         folder.replace("version-", "")
@@ -83,9 +81,15 @@
     with open("docs-website/reference_versions.json", "w") as f:
         json.dump(reference_versions_list, f)
 
-    # in docusaurus.config.js, replace previous stable version with the target version
+    # in docusaurus.config.js, replace the current stable version (lastVersion) with the target version
     with open("docs-website/docusaurus.config.js") as f:
         config = f.read()
+    last_version_matches = set(re.findall(r"lastVersion: '([^']+)'", config))
+    if not last_version_matches:
+        sys.exit("Could not find any lastVersion entry in docusaurus.config.js")
+    if len(last_version_matches) > 1:
+        sys.exit(f"Found inconsistent lastVersion entries in docusaurus.config.js: {last_version_matches}")
+    previous_stable = last_version_matches.pop()  # e.g., "2.19" - previous stable release
     config = config.replace(f"lastVersion: '{previous_stable}'", f"lastVersion: '{target_version}'")  # "2.19" -> "2.20"
     with open("docs-website/docusaurus.config.js", "w") as f:
         f.write(config)

.github/workflows/branch_off.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           # Persist the bot token so the branch/tag pushes below authenticate as
@@ -58,11 +58,11 @@ jobs:
           git tag "v${{ steps.versions.outputs.next_version_rc0 }}" -m "v${{ steps.versions.outputs.next_version_rc0 }}"
           git push --tags
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 

.github/workflows/check_api_ref.yml

@@ -13,13 +13,13 @@ jobs:
   test-api-reference-build:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
@@ -79,7 +79,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.changed.outputs.needs_check == 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"