[mmabrouk]

Fixes

Dependabot alerts #1944–#1950 (pypdf < 6.21.3 / < 6.21.4, HIGH) in services/runner/images/sandbox/agent-requirements.txt.

Change

pypdf 6.21.2 → 6.21.4 (version and hashes identical to Dependabot PR #7986).

Testing (Hetzner)

• pip install --require-hashes of the pinned pypdf 6.21.4 entry in a clean python:3.12-slim container: installs, hashes verify.
• Smoke: import, write and read back a PDF with pypdf 6.21.4: OK.
• No Python/TS unit tests exercise this file; the full sandbox image build was not run.
• Baseline failures: none observed.

🤖 Generated with Claude Code

[coderabbitai]

Summary

Summary by CodeRabbit

• Chores
  • Updated the component used for PDF processing to a newer patch release and refreshed its integrity checks.
  • No user-facing behavior changes are specified.

The sandbox requirements update the pinned pypdf version from 6.21.2 to 6.21.4 and replace its two SHA-256 hashes.

Changes: Sandbox dependency update

Layer / File(s)	Summary
Update pypdf pin services/runner/images/sandbox/agent-requirements.txt	The pinned pypdf version changes from 6.21.2 to 6.21.4. Both package hashes are updated.

Estimated code review effort: 1 (Trivial) | ~4 minutes

Possibly related PRs

• Agenta-AI/agenta#7845: Updates the same sandbox pypdf pin from 6.19.0 to 6.21.2.

Merge Risk: Moderate · up to 2a1ac

The pypdf security bump does not reach Daytona sandboxes, because the snapshot recipe version and fingerprint were not updated. The fingerprint unit test will fail in CI. Bump the recipe version, regenerate the fingerprint, and build the new snapshot before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the pypdf version update and its location.
Description check		The description accurately describes the dependency update and reported testing.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Actionable comments posted: 1

Review info

Run configuration

• Source mode: Auto
• Repository: Agenta-AI/agenta
• Branch: fix/deps-pypdf-6.21.4
• File: .coderabbit.yaml
• Commit: 2a1ace6
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: f9b4c1ad-fe6b-4eed-bc7e-e65234d755a2

Commits

Reviewing files that changed from the base of the PR and between 8d75125 and 2a1ace6.

Files selected for processing: 1

• services/runner/images/sandbox/agent-requirements.txt

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[coderabbitai]

Major · Stability & Availability · Quick win

Bump the Daytona recipe version and fingerprint.

This lock is a Daytona snapshot input, but the commit leaves the recipe version and fingerprint unchanged. The fingerprint test will fail in CI. An existing v5 snapshot also keeps the old pypdf version unless rebuilt. (github.com)

Bump services/runner/config/sandbox-recipe.json and regenerate sandbox-recipe-fingerprint.json. Build the new snapshot in each Daytona account before deployment.

As per coding guidelines: “Any change to a pinned harness version or to any snapshot build input” requires a version bump and regenerated fingerprint in the same commit.

Source: Coding guidelines

[github-actions]

Railway Preview Environment

Item	Value
Status	stopped
Commit	2a1ace63ed5ef46bd4ad439be09ed41fc86c2d18
Manual expiry (UTC)	Not granted
CI deadline (UTC)	Not granted
Workflow	https://github.com/Agenta-AI/agenta/actions/runs/42178868000

Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting.

Post /preview as a new comment to request a one-hour preview. Repeating it while active does not extend the hour.
Preview data is disposable. Expiry is enforced by the next successful cleanup sweep, not an exact timer.
Environment deletion stops its compute. Provider-retained storage and permanent services may still be billed.