agent-coderag 1.3.0__tar.gz → 1.3.1__tar.gz

{agent_coderag-1.3.0/agent_coderag.egg-info → agent_coderag-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-coderag
-Version: 1.3.0
+Version: 1.3.1
 Summary: Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index.
 Author-email: Igor Boloban <naranor@gmail.com>
 License: MIT

{agent_coderag-1.3.0 → agent_coderag-1.3.1/agent_coderag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-coderag
-Version: 1.3.0
+Version: 1.3.1
 Summary: Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index.
 Author-email: Igor Boloban <naranor@gmail.com>
 License: MIT

{agent_coderag-1.3.0 → agent_coderag-1.3.1}/code_rag/core/manager.py

@@ -106,16 +106,14 @@ class CodeRAGManager:
         """
         Resolves Gradle dependencies using a temporary init script.
         """
-        # 1. Find gradle executable (wrapper preferred)
-        gradle_wrapper = root / ("gradlew.bat" if os.name == "nt" else "gradlew")
-        gradle_bin: Optional[str] = None
-        if gradle_wrapper.exists():
-            gradle_bin = str(gradle_wrapper.resolve())
-        else:
-            gradle_bin = shutil.which("gradle")
+        # GHSA-wg5p-8h9p-3mr7: Arbitrary Code Execution vulnerability via repository-controlled gradlew.
+        # We must ONLY use the system-installed gradle binary.
+        gradle_bin: Optional[str] = shutil.which("gradle")
 
         if not gradle_bin:
-            logger.warning("gradle not found, skipping dependency sync")
+            logger.warning(
+                "System 'gradle' executable not found in PATH. Skipping dependency sync to avoid executing untrusted repository wrappers."
+            )
             return
 
         # Validate path

{agent_coderag-1.3.0 → agent_coderag-1.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-coderag"
-version = "1.3.0"
+version = "1.3.1"
 description = "Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index."
 readme = "README.md"
 requires-python = ">=3.10"