chore: remove superseded Python Cloud Functions from functions/ - #72
chore: remove superseded Python Cloud Functions from functions/#72chenyuan99 wants to merge 1 commit into
Conversation
functions/ contained a complete Python codebase alongside the live TypeScript one: main.py plus requirements.txt. Every entry point in it has a TypeScript equivalent in src/index.ts, which also adds the two agent functions the Python version never had: create_user_profile -> createUserProfile get_tax_documents -> getTaxDocuments get_tax_summary -> getTaxSummary process_new_tax_document -> processNewTaxDocument (none) -> runAccountant, runAuditor Beyond dead code, this was a deployment hazard. firebase.json declares `source: "functions"` with no explicit runtime, and the Firebase CLI infers the runtime from the manifest it finds. With package.json and requirements.txt both present, that inference had two valid answers. It was also the last remaining pip vulnerability after #71: pytest 7.4.0, CVE-2025-71176. CONTRIBUTING.md still told contributors to `pip install -r requirements.txt` and run `pytest`; updated to the npm workspaces that actually exist. Verified: functions typechecks, builds to lib/index.js, and passes 60/60. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
This PR does exactly what it claims; the two red checks are expected.
Security Analysis stays red only because FOSSA's gate is binary and 5 > 0. Where the remaining 5 come fromAll OpenTelemetry, all transitive under
They cannot be fixed by moving forward: Arc across #70, #71, #7264 → 5 vulnerabilities, 7 → 0 license issues. The 8 remaining Dependabot alerts are the same OTel cluster plus Unrelated finding worth a separate issueWhile reading the current Genkit docs I found that That is relevant to the 🤖 Addressed by Claude Code |
1 participant
Summary
functions/contained a complete Python codebase sitting alongside the live TypeScript one —main.py(184 lines) plusrequirements.txt. #71 removed the Flaskbackend/; this removes the Python leftovers inside the Cloud Functions directory itself.Every Python entry point is already superseded, and the TypeScript version adds the two agent functions Python never had:
functions/main.pyfunctions/src/index.tscreate_user_profilecreateUserProfileget_tax_documentsgetTaxDocumentsget_tax_summarygetTaxSummaryprocess_new_tax_documentprocessNewTaxDocumentrunAccountant,runAuditorWhy this is more than dead code
firebase.jsondeclaressource: "functions"with no explicit runtime. The Firebase CLI infers the runtime from the manifest it finds in that directory —package.jsonmeans Node,requirements.txtmeans Python. With both present and a validmain.pynext to them, that inference had two defensible answers.Removing the Python side makes the runtime unambiguous.
Vulnerability
This clears the last remaining pip finding after #71 —
pytest 7.4.0, CVE-2025-71176 (Creation of Temporary File in Directory with Insecure Permissions, Medium 6.8). It came fromfunctions/requirements.txt, which was never used by anything: the Cloud Functions tests run under Vitest infunctions/test/.Also updated
CONTRIBUTING.mdstill instructed contributors topip install -r requirements.txtand runpytest. Replaced with the npm workspaces that actually exist, plus the typecheck step.Verification
npx tsc --noEmitcleannpm run buildproducesfunctions/lib/index.jsRemaining after this
Five OpenTelemetry findings, all transitive under
genkit@1.41.0and all covered in #70: the latest genkit still pins the OTel 1.x line while the patches are on 2.x, and the advisories require a Jaeger propagator, a Prometheus exporter, or Baggage propagation — none of which this app enables. They are best left until genkit ships an OTel bump.That would take the repository from 64 vulnerabilities to 5, none reachable.
🤖 Generated with Claude Code