cotlab 0.8.0__tar.gz → 0.8.2__tar.gz

cotlab-0.8.2/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

cotlab-0.8.2/.github/workflows/container.yml

@@ -0,0 +1,53 @@
+name: Container
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+
+      - name: Log in to GHCR
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        continue-on-error: true
+
+      - name: Build and push to GHCR
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
+        with:
+          context: .
+          file: ./Containerfile
+          push: true
+          tags: ghcr.io/huseyincavusbi/cotlab:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Push to Docker Hub
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
+        with:
+          context: .
+          file: ./Containerfile
+          push: true
+          tags: docker.io/huseyincavus/cotlab:latest
+          cache-from: type=gha
+        continue-on-error: true

cotlab-0.8.2/.github/workflows/docs.yml

@@ -0,0 +1,38 @@
+name: Deploy Documentation
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra docs
+
+      - name: Deploy to GitHub Pages
+        run: uv run mkdocs gh-deploy --force

{cotlab-0.8.0 → cotlab-0.8.2}/.github/workflows/lint.yml

@@ -8,28 +8,31 @@ on:
   schedule:
     - cron: "0 6 * * 1"  # Every Monday at 06:00 UTC
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
 
       - name: Install dependencies
-        run: uv pip install --system -e ".[dev]"
+        run: uv sync --frozen --all-extras
 
       - name: Check formatting
-        run: ruff format --check src/ tests/
+        run: uv run ruff format --check src/ tests/
 
       - name: Lint
-        run: ruff check src/ tests/
+        run: uv run ruff check src/ tests/

cotlab-0.8.2/.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5
+
+      - name: Build
+        run: uv build
+
+      - name: Publish to PyPI
+        run: uv publish
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
+        with:
+          generate_release_notes: true
+          files: dist/*

{cotlab-0.8.0 → cotlab-0.8.2}/.github/workflows/tests.yml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: "0 6 * * 1"  # Every Monday at 06:00 UTC
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ${{ matrix.os }}
@@ -17,7 +20,7 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Free disk space (Linux)
         if: runner.os == 'Linux'
@@ -25,48 +28,50 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
 
       - name: Install dependencies
-        run: uv pip install --system -e ".[dev]"
+        run: uv sync --frozen --all-extras
 
       - name: Run unit tests
-        run: python -m pytest tests/ -v --tb=short
+        run: uv run python -m pytest tests/ -v --tb=short
 
   vllm-metal:
     runs-on: macos-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Print Apple Silicon info
         run: |
           sysctl -n machdep.cpu.brand_string
           uname -m
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Setup micromamba
+        uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0
         with:
-          python-version: "3.12"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          cache-dependency-glob: "pyproject.toml"
+          micromamba-version: "2.0.5-0"
+          environment-name: cotlab
+          create-args: >-
+            python=3.12
+            pip
+          init-shell: bash
 
       - name: Install CoTLab
-        run: uv pip install --system -e ".[dev]"
+        shell: bash -el {0}
+        run: |
+          pip install -e ".[dev]"
 
       - name: Install vLLM 0.13.0 from source
+        shell: bash -el {0}
         run: |
           cd /tmp
           curl -OL https://github.com/vllm-project/vllm/releases/download/v0.13.0/vllm-0.13.0.tar.gz
@@ -75,15 +80,19 @@ jobs:
           pip install .
 
       - name: Pin transformers for vLLM
+        shell: bash -el {0}
         run: pip install "transformers>=4.56.0,<5"
 
       - name: Install vllm-metal plugin
+        shell: bash -el {0}
         run: pip install vllm-metal
 
       - name: Re-pin transformers (final)
+        shell: bash -el {0}
         run: pip install "transformers>=4.56.0,<5"
 
       - name: Show versions
+        shell: bash -el {0}
         run: |
           python - <<'PY'
           import transformers, vllm
@@ -92,6 +101,7 @@ jobs:
           PY
 
       - name: Test vllm-metal installation
+        shell: bash -el {0}
         run: |
           python -c "
           from vllm import LLM
@@ -101,6 +111,7 @@ jobs:
           "
 
       - name: Test VLLMBackend platform detection
+        shell: bash -el {0}
         run: |
           python -c "
           from cotlab.backends.vllm_backend import VLLMBackend, _detect_platform, _is_apple_silicon
@@ -120,7 +131,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Free disk space (Linux)
         if: runner.os == 'Linux'
@@ -128,18 +139,18 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
 
       - name: Install dependencies
-        run: uv pip install --system -e ".[dev]"
+        run: uv sync --frozen --all-extras
 
       - name: Check Hugging Face token
         run: |
@@ -150,7 +161,7 @@ jobs:
 
       - name: Authenticate Hugging Face
         run: |
-          python - <<'PY'
+          uv run python - <<'PY'
           import os
           from huggingface_hub import login
 
@@ -160,7 +171,7 @@ jobs:
 
       - name: Test framework imports
         run: |
-          python -c "
+          uv run python -c "
           from cotlab import __version__
           from cotlab.backends import TransformersBackend
           from cotlab.experiments import (
@@ -189,7 +200,7 @@ jobs:
 
       - name: Test prompt strategies
         run: |
-          python -c "
+          uv run python -c "
           from cotlab.prompts import create_prompt_strategy
 
           strategies = [
@@ -207,7 +218,7 @@ jobs:
 
       - name: Test dataset loading
         run: |
-          python -c "
+          uv run python -c "
           from cotlab.datasets import SyntheticMedicalDataset, RadiologyDataset, CardiologyDataset, NeurologyDataset, OncologyDataset, PubHealthBenchDataset, MARCDataset, MedBulletsDataset, PLABDataset
 
           for Dataset in [SyntheticMedicalDataset, RadiologyDataset, CardiologyDataset, NeurologyDataset, OncologyDataset, PubHealthBenchDataset, MARCDataset, MedBulletsDataset, PLABDataset]:
@@ -219,7 +230,7 @@ jobs:
 
       - name: Test CoT parser
         run: |
-          python -c "
+          uv run python -c "
           from cotlab.analysis import CoTParser
 
           parser = CoTParser()
@@ -237,7 +248,7 @@ jobs:
 
       - name: Test new prompt features (answer_first, few_shot, contrarian)
         run: |
-          python -c "
+          uv run python -c "
           from cotlab.prompts import RadiologyPromptStrategy, CardiologyPromptStrategy
 
           answer_first = RadiologyPromptStrategy(answer_first=True)
@@ -270,7 +281,7 @@ jobs:
 
       - name: Test histopathology dataset and prompt
         run: |
-          python -c "
+          uv run python -c "
           from cotlab.datasets import HistopathologyDataset
           from cotlab.prompts import HistopathologyPromptStrategy
 
@@ -315,7 +326,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Free disk space (Linux)
         if: runner.os == 'Linux'
@@ -323,21 +334,21 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
 
       - name: Install dependencies
         run: |
-          uv pip install --system -e ".[dev]"
-          pip install papermill ipykernel
-          python -m ipykernel install --user --name cotlab --display-name "CoTLab"
+          uv sync --frozen --all-extras
+          uv pip install --system papermill ipykernel
+          uv run python -m ipykernel install --user --name cotlab --display-name "CoTLab"
 
       - name: Check Hugging Face token
         run: |
@@ -348,17 +359,17 @@ jobs:
 
       - name: Authenticate Hugging Face
         run: |
-          python - <<'PY'
+          uv run python - <<'PY'
           import os
           from huggingface_hub import login
 
           login(token=os.environ["HF_TOKEN"], add_to_git_credential=False)
-          print("Authenticated to Hugging Face Hub.")
+          print("Authenticated to Hugging Hub.")
           PY
 
       - name: Execute tutorial notebook
         run: |
           echo "Running notebook: cotlab_tutorial.ipynb (CI mode: 5 samples, 64 max_tokens)"
           cd notebooks
-          papermill cotlab_tutorial.ipynb cotlab_tutorial_executed.ipynb -k cotlab --progress-bar -p NUM_SAMPLES 5 -p MAX_TOKENS 64
+          uv run papermill cotlab_tutorial.ipynb cotlab_tutorial_executed.ipynb -k cotlab --progress-bar -p NUM_SAMPLES 5 -p MAX_TOKENS 64
           echo "Notebook executed successfully on ${{ matrix.os }}!"

{cotlab-0.8.0 → cotlab-0.8.2}/.gitignore

@@ -61,4 +61,3 @@ Thumbs.db
 
 # Logs
 *.log
-uv.lock

cotlab-0.8.2/Containerfile

@@ -0,0 +1,27 @@
+FROM nvidia/cuda:12.8.0-runtime-ubuntu24.04
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PYTHONUNBUFFERED=1 \
+    PATH="/opt/venv/bin:$PATH"
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends python3 python3-venv && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN uv venv /opt/venv
+
+# Install torch with CUDA 12 support explicitly to avoid version detection bugs
+RUN uv pip install torch==2.6.0 torchvision torchaudio --index-url https://download.pytorch.org/whl/cu126
+
+WORKDIR /app
+COPY . .
+
+# Install local package
+RUN uv pip install .
+
+RUN mkdir /data /results
+WORKDIR /workspace
+
+ENTRYPOINT ["cotlab"]

{cotlab-0.8.0 → cotlab-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cotlab
-Version: 0.8.0
+Version: 0.8.2
 Summary: CoTLab - Chain of Thought Research Toolkit for LLMs
 Project-URL: Repository, https://github.com/huseyincavusbi/CoTLab
 Project-URL: Documentation, https://huseyincavusbi.github.io/CoTLab
@@ -21,6 +21,7 @@ Requires-Python: >=3.10
 Requires-Dist: accelerate>=0.27.0
 Requires-Dist: bitsandbytes>=0.46.1
 Requires-Dist: click>=8.1.0
+Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: huggingface-hub>=0.20.0
 Requires-Dist: hydra-core>=1.3.0
 Requires-Dist: numpy>=1.24.0
@@ -33,7 +34,7 @@ Requires-Dist: safetensors>=0.4.0
 Requires-Dist: scikit-learn>=1.3.0
 Requires-Dist: torch>=2.1.0
 Requires-Dist: tqdm>=4.65.0
-Requires-Dist: transformers<5,>=4.56.0
+Requires-Dist: transformers<6,>=4.56.0
 Requires-Dist: xmltodict>=0.13.0
 Provides-Extra: dev
 Requires-Dist: ipython>=8.0.0; extra == 'dev'
@@ -43,6 +44,10 @@ Requires-Dist: pre-commit>=3.0.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
 Requires-Dist: pytest>=7.0.0; extra == 'dev'
 Requires-Dist: ruff>=0.4.4; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9.4.0; extra == 'docs'
+Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
+Requires-Dist: mkdocstrings[python]>=0.23.0; extra == 'docs'
 Provides-Extra: vllm
 Requires-Dist: vllm>=0.6.0; extra == 'vllm'
 Description-Content-Type: text/markdown
@@ -161,6 +166,18 @@ python -m cotlab.main \
     experiment.top_k=10
 ```
 
+## Acknowledgements
+
+This research is conducted in collaboration with the
+[Great Ormond Street Hospital DRIVE Unit](https://www.gosh.nhs.uk/our-research/drive-unit-for-digital-innovation/).
+
+## Contributors
+
+- **Huseyin Cavus** — Core Contributor
+- **Dr. Pavithra Rajendran** — Machine Learning Lead, GOSH DRIVE
+- **Sebin Sabu** — Senior AI Scientist, GOSH DRIVE
+- **Jaskaran Singh Kawatra** — ML Engineer, GOSH DRIVE
+
 ## License
 
 MIT

{cotlab-0.8.0 → cotlab-0.8.2}/README.md

@@ -112,6 +112,18 @@ python -m cotlab.main \
     experiment.top_k=10
 ```
 
+## Acknowledgements
+
+This research is conducted in collaboration with the
+[Great Ormond Street Hospital DRIVE Unit](https://www.gosh.nhs.uk/our-research/drive-unit-for-digital-innovation/).
+
+## Contributors
+
+- **Huseyin Cavus** — Core Contributor
+- **Dr. Pavithra Rajendran** — Machine Learning Lead, GOSH DRIVE
+- **Sebin Sabu** — Senior AI Scientist, GOSH DRIVE
+- **Jaskaran Singh Kawatra** — ML Engineer, GOSH DRIVE
+
 ## License
 
 MIT

cotlab-0.8.2/conf/experiment/confabulation_analysis.yaml

@@ -0,0 +1,14 @@
+# Confabulation Analysis — Test if H-Neurons encode confident errors vs uncertainty
+_target_: cotlab.experiments.ConfabulationAnalysisExperiment
+
+name: confabulation_analysis
+description: "Test if H-Neurons encode confabulation vs uncertainty"
+
+probe_path: sweep_C_1.json
+ood_dataset_path: CoTLab/data/movie_ood.jsonl
+num_samples: 50
+conf_high: 13.0
+conf_low: 10.0
+seed: 42
+max_input_tokens: 1024
+answer_cue: "\n\nAnswer:"

cotlab-0.8.2/conf/experiment/entropy_neuron_overlap.yaml

@@ -0,0 +1,8 @@
+# Entropy Neuron Overlap — Test overlap between H-Neurons and entropy neurons
+_target_: cotlab.experiments.EntropyNeuronOverlapExperiment
+
+name: entropy_neuron_overlap
+description: "Test overlap between H-Neurons and entropy neurons"
+
+probe_path: sweep_C_1.json
+percentile: 99.0

{cotlab-0.8.0 → cotlab-0.8.2}/conf/experiment/h_neuron_analysis.yaml

@@ -16,4 +16,3 @@ layer_stride: 1                # 1 = all layers; 2 = even layers only (faster)
 seed: 42
 max_input_tokens: 1024
 answer_cue: "\n\nAnswer:"
-contrastive_labeling: false    # true: CETT at generated answer token, hallucination=1 (3-vs-1)

cotlab-0.8.2/conf/experiment/sae_feature_neuron_overlap.yaml

@@ -0,0 +1,12 @@
+# SAE Feature to H-Neuron Overlap — Test if SAE features overlap with H-Neurons
+_target_: cotlab.experiments.SAEFeatureNeuronOverlapExperiment
+
+name: sae_feature_neuron_overlap
+description: "Test if SAE features overlap with H-Neurons"
+
+sae_repo_id: "google/gemma-scope-2-1b-it"
+sae_layer: 9
+sae_feature_id: 1000
+sae_width: "16k"
+probe_path: sweep_C_1.json
+top_k_neurons: 50

{cotlab-0.8.0 → cotlab-0.8.2}/pyproject.toml

@@ -26,7 +26,7 @@ classifiers = [
 dependencies = [
     "click>=8.1.0",
     "torch>=2.1.0",
-    "transformers>=4.56.0,<5",
+    "transformers>=4.56.0,<6",
     "hydra-core>=1.3.0",
     "omegaconf>=2.3.0",
     "accelerate>=0.27.0",
@@ -37,6 +37,7 @@ dependencies = [
     "python-dotenv>=1.0.0",
     "scikit-learn>=1.3.0",
     "xmltodict>=0.13.0",
+    "defusedxml>=0.7.1",
     "bitsandbytes>=0.46.1",
     "pyarrow>=14.0.0",
     "pandas>=2.0.0",
@@ -59,6 +60,11 @@ dev = [
     "jupyter>=1.0.0",
     "pre-commit>=3.0.0",
 ]
+docs = [
+    "mkdocs>=1.5.0",
+    "mkdocs-material>=9.4.0",
+    "mkdocstrings[python]>=0.23.0",
+]
 
 [project.urls]
 Repository = "https://github.com/huseyincavusbi/CoTLab"
@@ -94,3 +100,10 @@ check_untyped_defs = false
 warn_return_any = false
 warn_unused_ignores = false
 no_implicit_optional = false
+
+[tool.uv]
+environments = [
+    "sys_platform == 'darwin' and platform_machine == 'arm64'",
+    "sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "sys_platform == 'linux' and platform_machine == 'aarch64'"
+]

{cotlab-0.8.0 → cotlab-0.8.2}/src/cotlab/__init__.py

@@ -1,3 +1,3 @@
 """CoTLab - Chain of Thought Research Toolkit."""
 
-__version__ = "0.8.0"
+__version__ = "0.8.2"

{cotlab-0.8.0 → cotlab-0.8.2}/src/cotlab/backends/transformers_backend.py

@@ -38,7 +38,7 @@ class TransformersBackend(InferenceBackend):
         device: str = "cuda",
         dtype: str = "bfloat16",
         enable_hooks: bool = True,
-        trust_remote_code: bool = True,
+        trust_remote_code: bool = False,
         **kwargs,
     ):
         self._device_map = device  # Used for model loading (supports "auto")
@@ -47,6 +47,15 @@ class TransformersBackend(InferenceBackend):
         self.enable_hooks = enable_hooks
         self.trust_remote_code = trust_remote_code
 
+        if self.trust_remote_code:
+            import warnings
+
+            warnings.warn(
+                "trust_remote_code is set to True. This will execute code downloaded from the "
+                "Hugging Face Hub. Ensure you trust the repository before proceeding!",
+                UserWarning,
+            )
+
         self._model = None
         self._tokenizer = None
         self._model_name: Optional[str] = None

{cotlab-0.8.0 → cotlab-0.8.2}/src/cotlab/core/base.py

@@ -586,7 +586,7 @@ class StructuredOutputMixin:
         except Exception:
             # Fallback to ElementTree with recursive parsing
             try:
-                import xml.etree.ElementTree as ET
+                import defusedxml.ElementTree as ET
 
                 def elem_to_dict(elem):
                     text = elem.text.strip() if elem.text else None