Skip to content

chore(deps): update dependency promptfoo to v0.121.15#512

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/promptfoo-0.x-lockfile
Open

chore(deps): update dependency promptfoo to v0.121.15#512
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/promptfoo-0.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Mar 27, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
promptfoo (source) 0.121.20.121.15 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

promptfoo/promptfoo (promptfoo)

v0.121.15

Compare Source

Features
Bug Fixes

v0.121.14

Compare Source

Features
Bug Fixes
  • assertions: don't classify gen_ai.tool.definitions chat spans as tool calls (#​9524) (b59f397)
  • cli: preflight force imports before collision lookup (#​9570) (0b93733)
  • cloud: on-prem API host for guardrails and http-generator, with host-resolution tests (#​9580) (b9a014a)
  • cloud: use on-prem API host in checkEmailStatus (#​9576) (063c62b)
  • db: avoid SQLITE_LOCKED flakiness in shared-cache test database (#​9567) (1fdb59b)
  • db: serialize libsql test database cleanup (#​9540) (f4380c2)
  • deps: keep ModelAudit pydantic-core pinned to compatible 2.46.4 (b2b35b0)
  • deps: update dependency ai to ^6.0.190 (#​9577) (9ec614a)
  • eval: canonicalize retry JSONL output with atomic rewrites (#​9547) (8d7c920)
  • eval: redact credentials from the persisted browser store (#​9396) (4d5bed5)
  • evaluator: preserve and harden programmatic JSONL output (#​9538) (8ddd906)
  • output: redact api-key and legacy transport headers in JSONL/DB (#​9546) (e194c85)
  • providers: handle Codex SDK rate limits (#​9473) (76d3db4)
  • providers: inject n8n sessions into custom bodies (#​9527) (9cc0542)
  • providers: preserve n8n array body templates (#​9544) (6cdf63d)
  • providers: preserve streamed Anthropic refusal guardrails (#​9560) (ff8eafd)
  • providers: serialize persistent browser sessions (#​9414) (097ff9b)
  • redteam: authenticate remote-generation requests against on-prem cloud (#​9584) (7df8fae)
  • util: restore nested SAS tokens after array reorder (#​9528) (9759e5a)
  • webui: render negative-only metric charts (#​9526) (7ccafa4)

v0.121.13

Compare Source

Features
Bug Fixes
Performance Improvements

v0.121.12

Compare Source

Features
Bug Fixes

v0.121.11

Compare Source

Features
  • quiverai: add Arrow 1.1 models, vectorize endpoint, and GPT Image-2 pipeline (#​9139) (ce2c62d)
Bug Fixes

v0.121.10

Compare Source

Features
Bug Fixes
  • api: add DTO validation for core server routes (#​8922) (87f637f)
  • api: correct user-visible response regressions (#​8976) (74e7f95)
  • api: harden node package contracts (#​9055) (be44d4e)
  • api: make modelAudit safeRespond fire-safe under parse failures (#​8977) (524c5e6)
  • api: preserve error details and stack traces in shared helpers (#​8975) (ed0b67b)
  • api: validate eval route DTOs (#​8924) (84d5c8c)
  • api: validate media, blob, user, and trace DTOs ([#&#8203

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • "before 10am on friday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Renovatebot and dependabot updates frontend javascript Pull requests that update javascript code labels Mar 27, 2026
@github-actions

github-actions Bot commented Mar 27, 2026

Copy link
Copy Markdown

Caution

[High Risk] New production API instance will expose an unauthenticated port 9090 endpoint from the public workload subnet

The change creates a new production-api-server EC2 instance in subnet-07b5b1fb2ba02f964 and starts a Python HTTP server bound to 0.0.0.0:9090. That subnet is the existing public workload subnet in vpc-02901bcbb89561298, and the current instance 540044833068.eu-west-2.ec2-instance.i-0fe01bbbca3efdda5 in the same subnet already has a public IP and public DNS, proving instances there can be directly internet-reachable. The plan also attaches the new instance to a target group on port 9090, so this endpoint is intentionally network-accessible.

This bypasses the normal pattern used elsewhere in the environment where API instances only accept traffic from an ALB security group on port 80. No change evidence shows that the new instance's security groups restrict 9090 to an ALB source, and the existing public ALB api-012b9e76-alb is in a different VPC than the new instance anyway. The result is a production EC2 host exposing an unauthenticated health endpoint directly on the public network, violating the org rule that EC2 instances must not be directly reachable from the internet and creating a clear public-exposure and segmentation failure.
View reasoning tree here.

Signals

Routine → Multiple compute and access resources are showing unusual infrequent updates at 1 event/week for the last 3 months, with several related resources changing only 2 events/week for the last 3 months.
Policies → Infrastructure resources showing unusual policy violations that may need review: the S3 bucket is missing required tags and does not have server-side encryption configured, while the security group allows SSH port 22 access from anywhere 0.0.0.0/0.

Additional Change Details: Items 663 Edges 1688 model|risks_v6 ✨Encryption Key State Risk ✨KMS Key Creation

View in Overmind

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Auto-blocked: Routine score (-5) is below minimum (-1)


📊 Signals Summary

Routine 🔴 -5


🔥 Risks Summary

High 0 · Medium 0 · Low 0


💥 Blast Radius

Items 23 · Edges 75


View full analysis in Overmind ↗

@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 514a41c to 58cbaeb Compare March 27, 2026 13:24

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Auto-blocked: Policy signal (-3) is below threshold (-2); Routine score (-5) is below minimum (-1)


📊 Signals Summary

Routine 🔴 -5

Policies 🔴 -3


🔥 Risks Summary

High 0 · Medium 0 · Low 0


💥 Blast Radius

Items 5 · Edges 20


View full analysis in Overmind ↗

@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 58cbaeb to a1c25a9 Compare April 1, 2026 20:12

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Found 2 high risks requiring review


📊 Signals Summary

Routine 🔴 -5

Policies 🔴 -3


🔥 Risks Summary

High 2 · Medium 0 · Low 0


💥 Blast Radius

Items 107 · Edges 219


View full analysis in Overmind ↗

@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from a1c25a9 to f877105 Compare April 8, 2026 21:00

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Found 1 high risk requiring review


📊 Signals Summary

Routine 🔴 -5

Policies 🔴 -3


🔥 Risks Summary

High 1 · Medium 1 · Low 0


💥 Blast Radius

Items 63 · Edges 135


View full analysis in Overmind ↗

@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from f877105 to 4b949a7 Compare April 11, 2026 01:20
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.3 chore(deps): update dependency promptfoo to v0.121.4 Apr 11, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Found 2 high risks requiring review


📊 Signals Summary

Routine 🔴 -5

Policies 🔴 -3


🔥 Risks Summary

High 2 · Medium 0 · Low 0


💥 Blast Radius

Items 93 · Edges 217


View full analysis in Overmind ↗

@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 4b949a7 to 2bb4553 Compare April 15, 2026 03:03
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.4 chore(deps): update dependency promptfoo to v0.121.5 Apr 15, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overmind

⛔ Auto-Blocked


🔴 Decision

Auto-blocked: Policy signal (-3) is below threshold (-2); Routine score (-5) is below minimum (-1)


📊 Signals Summary

Routine 🔴 -5

Policies 🔴 -3


🔥 Risks Summary

High 0 · Medium 0 · Low 0


💥 Blast Radius

Items 79 · Edges 192


View full analysis in Overmind ↗

@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.5 chore(deps): update dependency promptfoo to v0.121.7 Apr 22, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch 2 times, most recently from d4fad61 to 5b7c7a5 Compare April 24, 2026 22:34
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.7 chore(deps): update dependency promptfoo to v0.121.8 Apr 24, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 5b7c7a5 to be239e2 Compare April 27, 2026 19:41
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.8 chore(deps): update dependency promptfoo to v0.121.9 Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from be239e2 to 4766350 Compare April 29, 2026 20:37
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 4766350 to 8464773 Compare May 7, 2026 21:45
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.9 chore(deps): update dependency promptfoo to v0.121.10 May 7, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 8464773 to d192a3c Compare May 8, 2026 06:14
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.10 chore(deps): update dependency promptfoo to v0.121.11 May 8, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch 2 times, most recently from 3392d49 to 02477be Compare May 18, 2026 10:15
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 02477be to ad02ee3 Compare May 21, 2026 10:46
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.11 chore(deps): update dependency promptfoo to v0.121.12 May 21, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch 2 times, most recently from 1561be2 to 0c814e4 Compare May 29, 2026 01:39
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.12 chore(deps): update dependency promptfoo to v0.121.13 May 29, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 0c814e4 to 4c1a70a Compare June 1, 2026 21:28
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.13 chore(deps): update dependency promptfoo to v0.121.14 Jun 2, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch 2 times, most recently from a340c60 to 0846ed2 Compare June 5, 2026 18:55
@renovate renovate Bot changed the title chore(deps): update dependency promptfoo to v0.121.14 chore(deps): update dependency promptfoo to v0.121.15 Jun 5, 2026
@renovate renovate Bot force-pushed the renovate/promptfoo-0.x-lockfile branch from 0846ed2 to b4aacb3 Compare June 11, 2026 10:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Renovatebot and dependabot updates frontend javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants