Skip to content

Conversation

@h-albert-lee
Copy link
Collaborator

📋 Summary
Optimized Docker configuration for CLI-based usage of the haerae-evaluation-toolkit, adding missing packages.

🔧 Changes Made
Docker Configuration:

Dependencies:

Added 19 missing packages: immutabledict, jsonlines, html2text, tree-sitter, faiss-cpu, evaluate, tiktoken, mpmath, backoff, tenacity, overrides, psutil, segtok, rank-bm25, etc.
Updated requirements-docker.txt for complete functionality
Documentation:

Updated DOCKER.md for CLI usage patterns
Fixed README.md Docker examples to show CLI execution
✅ Verification Results
✅ Docker build successful (11.2GB)
✅ 74/117 tests passing (63% success rate) -> fail한 케이스는 대부분 api token이 없었음. dependency문제는 x
✅ Core CLI functionality working
✅ All major ML dependencies importing correctly
✅ docker-compose execution confirmed

🚀 Usage

Build and run

docker build -t haerae-evaluation-toolkit .

h-albert-lee and others added 3 commits November 3, 2025 13:16
- Add optimized Dockerfile with multi-stage build
- Create requirements-docker.txt with essential dependencies only
- Update pyproject.toml with latest dependency versions
- Add docker-compose.yml for easy deployment
- Create build and push scripts for automation
- Add comprehensive Docker documentation (DOCKER.md)
- Update README.md with Docker installation option
- Improve .gitignore for Docker and development files

Co-authored-by: openhands <[email protected]>
- Remove unnecessary port exposure and health checks from Dockerfile
- Simplify docker-compose.yml for CLI tool (remove Redis, ports, health checks)
- Update DOCKER.md with CLI-focused usage examples
- Fix README.md Docker example to show proper CLI usage
- Add more API key environment variables (Cohere, Mistral, Google)

Co-authored-by: openhands <[email protected]>
- Add immutabledict, jsonlines, html2text, tree-sitter packages
- Add faiss-cpu, evaluate, tiktoken, mpmath for ML functionality
- Add backoff, tenacity, overrides, psutil for utility functions
- Add segtok, rank-bm25 for text processing
- Ensure all 74 core tests pass in Docker environment
- Support complete CLI functionality in containerized environment

Co-authored-by: openhands <[email protected]>
@h-albert-lee h-albert-lee requested review from baeseongsu and hw-oh and removed request for hw-oh November 3, 2025 13:46
@h-albert-lee
Copy link
Collaborator Author

일단 빌드는 되는데, fail하는 케이스들 조금 더 분석만 해보겠습니다! 별다른 이슈 없으면 dockerhub에 upload해서 링크도 공유드릴게요

@socket-security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy under GPL-3.0

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: LGPL-2.1-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: pypi numpy

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later WITH GCC-exception-3.1 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0 (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/METADATA)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-with-GCC-exception (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0 (numpy-2.3.4.dist-info/LICENSE.txt)

License: GPL-3.0-or-later (numpy-2.3.4.dist-info/LICENSE.txt)

From: ?pypi/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 55 more rows in the dashboard

View full report

@hw-oh hw-oh force-pushed the docker-cli-optimization branch from b9dde4c to 3fd6df7 Compare January 30, 2026 05:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants