Skip to content

Prometheus v0.9.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 17:10
· 288 commits to main since this release
v0.9.3
b2603ad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security and dependency updates. Upgrading is recommended.

Security note

On 0.9.0 and 0.9.1, if the installed starlette was older than 1.0.1 (CVE-2026-48710), a request with a crafted Host header could reach the API without the token. Anyone who could reach the API port could send one, and the daemon listens on all network interfaces by default.

  • 0.9.2 required a fixed starlette.
  • 0.9.3 no longer depends on it. The token check now uses the path the server actually routes, not the URL rebuilt from the Host header.

We tested this on the old, affected starlette: the earlier check let the crafted request through, and 0.9.3's check refuses it.

Dependency security updates

  • The lock is updated past every known advisory in the packages the extras bring in: mcp 1.30.0, pydantic-settings 2.15.0, aiohttp 3.14.3, arize-phoenix 16.4.0 (with strawberry-graphql 0.316.0), pydantic-ai-slim 1.106.0, pyasn1 0.6.4, joserfc 1.7.5 and setuptools 84.0.0.
  • New minimum versions make pip install -U replace an older copy you already have:
    • mcp>=1.28.1 and pydantic-settings>=2.14.2 in [mcp] and [full]
    • aiohttp>=3.14.3 in [discord] and [full]
    • arize-phoenix>=16.4.0 in [evals]
  • A fresh pip install 'oara-prometheus[full]' audited with pip-audit reports no known vulnerabilities.

CI audits every extra

The dependency audit used to cover only the base install, so advisories in packages that only the extras bring in went unseen. It now audits every extra.

Known issue

  • On Intel Macs, pip builds cryptography from source, because its releases since 49.0 ship no Intel-Mac wheel. That needs Rust and OpenSSL; with Homebrew's OpenSSL, set OPENSSL_DIR=$(brew --prefix openssl@3). On Python 3.14, watchdog also builds from source, which needs Xcode's command-line tools.

Install

pip install -U oara-prometheus           # the daemon, its web API, the CLI and Telegram
pip install -U 'oara-prometheus[full]'   # adds Slack, Discord, MCP, the browser tool, Anthropic and voice output

Python 3.11 or later. On PyPI: oara-prometheus 0.9.3.

Assets 4
Loading