Merge branch 'main' into add-numguard-tool

Author: ipezygj

.github/security.md

@@ -12,4 +12,4 @@ Please submit reports through one of the following channels:
 
 - **Please do not** disclose vulnerabilities via public GitHub issues, pull requests,
   or social media
-- Reports submitted via channels other than this Bugcrowd submission email will not be reviewed and will be dismissed
+- Reports submitted via channels other than the methods above will not be reviewed and will be dismissed

.github/workflows/docs-broken-links.yml

@@ -4,13 +4,11 @@ on:
   pull_request:
     paths:
       - "docs/**"
-      - "docs.json"
   push:
     branches:
       - main
     paths:
       - "docs/**"
-      - "docs.json"
   workflow_dispatch:
 
 permissions:
@@ -28,11 +26,40 @@ jobs:
         with:
           node-version: "22"
 
-      - name: Install Mintlify CLI
-        run: npm i -g mintlify
+      - name: Install Mint CLI
+        run: npm i -g mint@4.2.741
 
-      - name: Run broken link checker
+      # Pruning immutable snapshots keeps the check fast (--files still parses every
+      # page); the default version must stay because unprefixed links resolve to it.
+      - name: Prune frozen doc versions (keep edge and latest)
+        if: github.event_name != 'workflow_dispatch'
         run: |
-          # Auto-answer the prompt with yes command
-          yes "" | mintlify broken-links || test $? -eq 141
+          python3 - <<'EOF'
+          import json
+          import shutil
+          from pathlib import Path
+
+          docs = Path("docs")
+          spec_path = docs / "docs.json"
+          spec = json.loads(spec_path.read_text())
+
+          keep_dirs = {"edge"}
+          for lang in spec["navigation"]["languages"]:
+              kept = [v for v in lang["versions"] if v["version"] == "Edge" or v.get("default")]
+              lang["versions"] = kept
+              keep_dirs.update(v["version"] for v in kept if v["version"] != "Edge")
+
+          missing = [d for d in keep_dirs if not (docs / d).is_dir()]
+          if missing:
+              raise SystemExit(f"docs.json version labels do not match directories: {missing}")
+
+          spec_path.write_text(json.dumps(spec, indent=2))
+
+          for path in docs.glob("v*"):
+              if path.is_dir() and path.name not in keep_dirs:
+                  shutil.rmtree(path)
+          EOF
+
+      - name: Run broken link checker
+        run: mint broken-links
         working-directory: ./docs

.github/workflows/linter.yml

@@ -16,8 +16,13 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
+          # Exclusion-only patterns match every non-excluded file under the
+          # default "some" quantifier. Require all patterns (including "**")
+          # so docs-only / markdown-only PRs correctly set code=false.
+          predicate-quantifier: every
           filters: |
             code:
+              - '**'
               - '!docs/**'
               - '!**/*.md'
 

.github/workflows/tests.yml

@@ -16,8 +16,13 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
+          # Exclusion-only patterns match every non-excluded file under the
+          # default "some" quantifier. Require all patterns (including "**")
+          # so docs-only / markdown-only PRs correctly set code=false.
+          predicate-quantifier: every
           filters: |
             code:
+              - '**'
               - '!docs/**'
               - '!**/*.md'
 

.github/workflows/type-checker.yml

@@ -16,8 +16,13 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
+          # Exclusion-only patterns match every non-excluded file under the
+          # default "some" quantifier. Require all patterns (including "**")
+          # so docs-only / markdown-only PRs correctly set code=false.
+          predicate-quantifier: every
           filters: |
             code:
+              - '**'
               - '!docs/**'
               - '!**/*.md'
 

.github/workflows/vulnerability-scan.yml

@@ -12,8 +12,40 @@ permissions:
   contents: read
 
 jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.set.outputs.code }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        if: github.event_name == 'pull_request'
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
+        id: filter
+        if: github.event_name == 'pull_request'
+        with:
+          # Exclusion-only patterns match every non-excluded file under the
+          # default "some" quantifier. Require all patterns (including "**")
+          # so docs-only / markdown-only PRs correctly set code=false.
+          predicate-quantifier: every
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+      - name: Set code output
+        id: set
+        run: |
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "code=${{ steps.filter.outputs.code }}" >> "$GITHUB_OUTPUT"
+          fi
+
   pip-audit:
     name: pip-audit
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -53,7 +85,6 @@ jobs:
             --skip-editable
             --format json
             --output pip-audit-report.json
-            --ignore-vuln PYSEC-2026-597      # nltk 3.9.4 (CVE-2026-12243): no fix available, transitive through crewai-tools[xml] -> unstructured.
             --ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
             --ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
           )