Conversation
(#3842) * [GSoC 2026] chatbot: migrate agent engine to LangChain 1.x create_agent (Refs #3833) Replace the deprecated AgentExecutor + create_tool_calling_agent with create_agent on the LangGraph runtime. External behavior and the chat WebSocket wire protocol are unchanged. - agent.py: build_agent() -> ChatAgent(runnable, tool_names) via create_agent(model, tools, system_prompt); page_context baked into the system prompt; final_answer() helper. - streaming.py: ChatStreamConsumer consumes stream_mode=["messages","values"] and emits the same token/status/action_required events, returning the terminal answer (no callbacks). - tasks.py / views.py: GraphRecursionError -> ITERATION_LIMIT (the AGENT_STOPPED_OUTPUT sentinel no longer exists in 1.x); agent input is a messages list. - RECURSION_LIMIT = 2*rounds + 2 (=14): LangGraph bounds a run by supersteps, not agent rounds. - deps: langchain==1.3.11, langchain-ollama==1.1.0 (core/langgraph stay transitive). - security: remove the dependency-review allow-ghsas for GHSA-gr75-jv2w-4656 (fixed in langchain>=1.3.9, so the allowlist is no longer needed). All 168 chatbot tests pass; a live Ollama smoke confirms token streaming, tool-call visibility and the M-1 pending_id path are unchanged. * [GSoC 2026] chatbot: address DeepSource findings on the LangChain 1.x tests (Refs #3833) - test_agent.py: index the ToolMessage list instead of a bare next() (PTC-W0063). - test_streaming.py / test_query_counts.py: make the self-less test helpers static (_make_consumer, the _FakeRunnable.stream fake) (PYL-R0201). Behavior unchanged; 168 chatbot tests still green.
… + forbid placeholder names (#3881) * [GSoC 2026] chatbot: default analyze_observable to a curated playbook + forbid placeholder names — Refs #3880 A1: when the model names neither a playbook nor analyzers, analyze_observable now resolves the curated FREE_TO_USE_ANALYZERS playbook (when visible, applicable and enabled) instead of dead-ending on 'No Analyzers and Connectors can be run after filtering'. Falls back to an actionable error listing the applicable visible playbooks. The plan carries a 'reason' explaining the choice, the model is told to surface it in the confirmation, and the pending record stores the resolved playbook so confirm re-validates the same plan. A2: a [Rules] line tells the model to copy analyzer/playbook/job names verbatim and never emit bracketed placeholders like [Analyzer 1]. * chatbot: extract analyze_observable input handling to cut cyclomatic complexity (DeepSource PY-R1000)
…free domain/URL analyzers (#3893) * [GSoC 2026] core(datamodel): extract shared classify() from the DataModel visualizer * [GSoC 2026] core(datamodel): populate evaluation for key-free DNS malicious detectors * [GSoC 2026] core(datamodel): Phishtank verdict (verified vs unverified reliability) * [GSoC 2026] core(datamodel): PhishingArmy + Phishstats verdict on a listing hit * [GSoC 2026] core(datamodel): Tranco popularity verdict (trusted, rank-banded reliability) * [GSoC 2026] test(datamodel): anti-rot guard for key-free verdict target configs * [GSoC 2026] core(datamodel): score Tranco top-1000 domains as allowlist evidence * [GSoC 2026] core(datamodel): replace the bucket constants with a shared enum
* [GSoC 2026] chatbot: read the reconciled job verdict from the core * [GSoC 2026] chatbot: fold the verdict into summarize_job * [GSoC 2026] chatbot(frontend): collapse the job summary and evaluate chips * [GSoC 2026] chatbot: address DeepSource findings in the verdict tests
…ool.org (#3903) repo_downloader.sh fetched ExifTool from https://exiftool.org/Image-ExifTool-$version.tar.gz, which now returns 404 - exiftool.org no longer hosts the tarball and links its own Unix downloads to SourceForge instead. That broke the ExifTool analyzer's install step. Point the download at the SourceForge URL. Since it ends in "/download" and redirects to a mirror, added -O so the file is saved as Image-ExifTool-$version.tar.gz for the extraction step that follows (the comment above the line already documented -O as the intent). Verified for 13.59: the SourceForge URL serves a valid gzip tarball that extracts to Image-ExifTool-13.59/ with the exiftool binary intact, and shellcheck passes on the script. Fixes #3861
… support data model enrichment Closes #3890 (#3891) * feat(connectors): add shared CTIConnector base class with data model enrichment * fix(connectors): update file classifcation * test(connectors): add tests for new cti connector base class * fix(core): strictly filter all_subclasses by module base path * chore(connectors): add abstract run method to CTIConnector and make helper methods static in CTIConnectorTestCase
…loses #3912 (#3913) * updated PR automation Slow run to avoid executing all the optional containers * fix(ci): update shellcheck pipeline script URL (closes #3912) --------- Co-authored-by: Daniele Rosetti <55402684+drosetti@users.noreply.github.com> Co-authored-by: Matteo Lodi <30625432+mlodic@users.noreply.github.com>
…QUEUE (#3919) * [GSoC 2026] fix(settings): single, env-driven definition for CHATBOT_QUEUE CHATBOT_QUEUE was assigned twice: in settings/chatbot.py from the environment, and in settings/celery.py as a hardcoded literal. Both modules are wildcard imported by settings/__init__.py, so the literal (imported last) shadowed the env read and CHATBOT_QUEUE in the environment had no effect on settings.CHATBOT_QUEUE. Keep a single definition in settings/celery.py, next to the other queue names and the CELERY_QUEUES loop that registers it. One assignment makes the value independent of the wildcard import order, so re-ordering those lines cannot resurface the bug. settings/celery.py is also the lower-level module (it must run before the others and imports only ._util and .aws), so this adds no new import edge; the reverse direction would have pulled .cache into it. The consumer side was hardcoded too: docker/entrypoints/celery_chatbot.sh pinned "chatbot" in its -Q list, so a custom queue name would have published chat turns to a queue no worker drains. It now reads the same variable, with the same unset/blank fallback, and the variable is documented in env_file_app_template. tests/intel_owl/test_settings.py boots Django in a subprocess with a custom CHATBOT_QUEUE and asserts it reaches settings, CELERY_QUEUES and the Celery route of process_chat_message; plus an AST guard that fails if any setting is ever again assigned in two wildcard-imported settings modules. Refs #3910 * [GSoC 2026] test(settings): guard the producer/consumer coupling of CHATBOT_QUEUE Split tests/intel_owl/test_settings.py into one file per concern, so a settings PR touching the chatbot queue does not collide with one touching the shadowing invariant: test_settings_chatbot_queue.py (the queue reaches settings and the Celery route) and test_settings_shadowing.py (no setting is assigned twice). Add the coupling guard the fix was missing. Django publishes the chat task and the worker entrypoint consumes it, each reading CHATBOT_QUEUE on its own side, so the default queue name now lives in two layers: flipping one of them silently sends turns to a queue nobody drains -- the same failure this setting already had, one layer down. The new test extracts ${CHATBOT_QUEUE:-...} from celery_chatbot.sh, compares it with what the settings fall back to, and fails if either side hardcodes the queue again. Verified by mutation: flipping the shell default to "chat" fails with 'chat' != 'chatbot'. The shadowing guard now also audits __init__.py's own assignments (TEST_RUNNER, INSTALLED_APPS), which are made before the wildcard block and could be shadowed by a submodule -- the same bug in the opposite direction. Verified by mutation on a copy of the settings package. Also: the probe reads the routed task name from process_chat_message.name instead of repeating the dotted path, the subprocess timeout is a named constant with its rationale, and celery.py states why the lookup is environment-only (the worker side is a shell script and cannot resolve an AWS secret). * chore: trigger CI actions * fix(tests): explicitly pass check=False to subprocess.run for DeepSource PYL-W1510
…tails and enhance unit tests for message content (#3933)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.35.1...v4.37.6) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…lder names (#3920) * chatbot: detect fabricated bracketed names in an answer Refs #3909 * chatbot: annotate a flagged answer on both the WebSocket and REST paths Refs #3909 * chatbot: keep the placeholder notice out of the replayed prompt history Refs #3909 * test(chatbot): re-enable logging during placeholder guard assertions * test(chatbot): use mock.patch for placeholder guard logging assertions to avoid CI logging disable issues
Co-authored-by: mlodic <30625432+mlodic@users.noreply.github.com>
Bumps [playwright](https://github.com/microsoft/playwright-python) from 1.50.0 to 1.62.0. - [Release notes](https://github.com/microsoft/playwright-python/releases) - [Commits](microsoft/playwright-python@v1.50.0...v1.62.0) --- updated-dependencies: - dependency-name: playwright dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/stale](https://github.com/actions/stale) from 9 to 11. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v9...v11) --- updated-dependencies: - dependency-name: actions/stale dependency-version: '11' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mlodic <30625432+mlodic@users.noreply.github.com>
Co-authored-by: mlodic <30625432+mlodic@users.noreply.github.com>
…ectors Gsoc 2026/post mid connectors
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist for creating a new release
CHANGELOG.mdfor the new version. Tag another maintainer to review the Changelog and wait for their feedback.docker/.envandfrontend/package.json.developand set it as apre-release. Remember to prepend avto the version number.Write the following statement there (change the version number):
masterbranch. Note: Only use "Merge and commit" as the merge strategy and not "Squash and merge". Using "Squash and merge" makes history between branches misaligned.pre-releasetolatest release.