* fix(security): replace insecure MD5 with SHA-256 and disable debug mode
Replace all 29 instances of hashlib.md5() with hashlib.sha256() across
22 files. MD5 is cryptographically broken (CWE-328) and should not be
used for hashing, even for non-security purposes like cache keys and
content fingerprints.
Also disable debug=True in api.py (CWE-489) to prevent information
leakage in production deployments.
Vulnerabilities fixed:
- 28x CWE-328: Use of Weak Hash (MD5 → SHA-256)
- 1x CWE-489: Active Debug Code (debug=True → debug=False)
Detected by semgrep (p/owasp-top-ten, p/python).
Verified by re-scan: 66 findings → 37 remaining (29 fixed).
Remaining findings (require manual review):
- 14x shell injection (subprocess with user input)
- 10x subprocess shell=True
- 3x wildcard CORS
- 5x tainted env args in subprocess
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* fix: address review feedback on MD5→SHA-256 migration
Fixes raised by Gemini Code Assist, Qodo, and CodeRabbit:
1. templates/security.py: algorithm="md5" now raises ValueError
instead of silently returning SHA-256 digest
2. recipe/security.py: CycloneDX serialNumber now uses uuid5()
for RFC 4122 compliant UUID format (was 64-char hexdigest)
3. agent/agent.py: backward-compatible session ID — checks for
legacy MD5-based session file on disk before using new SHA-256 ID
4. snapshot/snapshot.py: backward-compatible shadow repo path —
adopts legacy MD5-based directory if it exists on disk
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---------
Co-authored-by: Michael Winczuk <[email protected]>
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
- Remove `verbose` parameter from Agents() calls across all examples
- Remove `markdown` parameter from Agent() initialization
- Change `model` to `llm` in observability example
- Remove unused `kind` parameter from obs.span()
- Fix thinking_budget initialization to use property setter instead of constructor
- Add missing `instructions` parameter to routellm_example.py Agent
- Move callback systems to general/
- Move memory examples to memory/
- Move state management to stateful/
- Move hierarchical agents to agents/
- Move guardrails to guardrails/
- Move self-reflection to concepts/
Co-authored-by: Mervin Praison <[email protected]>
- 01_basic_state_management.py: Demonstrates fundamental state operations
- 02_state_in_tool_functions.py: Shows state usage within tool functions
- 03_conditional_task_execution.py: Illustrates conditional task flow based on state
- 04_session_state_persistence.py: Shows how to save/restore workflow state
- 05_loop_control_with_state.py: Demonstrates state-controlled loops and iterations
- 06_advanced_state_operations.py: Covers complex state scenarios and patterns
Each example is fully working with detailed documentation and real-world use cases.
Co-authored-by: Mervin Praison <[email protected]>
- Fix SQLite query compatibility in session state restoration
- Add type safety to increment_state and improve append_to_state
- Change API from session.create_agent() to session.Agent() (backward compatible)
- Clean up code style: remove unused imports, trailing whitespace, fix f-strings
- Fix missing limit parameter in search_knowledge method
- Update examples to use new API
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: MervinPraison <[email protected]>
Add minimal enhancements to PraisonAI's existing stateful capabilities:
- Add Session helper class for unified session management
- Add 9 convenience methods to PraisonAIAgents for enhanced state management
- Add comprehensive stateful agents documentation with examples
- Add 3 practical examples demonstrating session, workflow, and memory capabilities
- Maintain backward compatibility - all existing code continues to work
The implementation leverages existing robust infrastructure (Memory, Agent, Process classes)
rather than duplicating functionality, providing better developer experience through
improved APIs and documentation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <[email protected]>
Dhivya-Bharathy