Skip to content

fix(anthropic): drop top_p when both temperature and top_p are set + flatten response#99

Merged
doronkopit5 merged 7 commits into
mainfrom
dk/fix-anthropic-top-p-temp
Apr 15, 2026
Merged

fix(anthropic): drop top_p when both temperature and top_p are set + flatten response#99
doronkopit5 merged 7 commits into
mainfrom
dk/fix-anthropic-top-p-temp

Conversation

@doronkopit5

@doronkopit5 doronkopit5 commented Apr 9, 2026

Copy link
Copy Markdown
Member

Summary

  • Anthropic's API rejects requests that include both temperature and top_p ("temperature and top_p cannot both be specified for this model")
  • When both are provided, we now keep temperature (Anthropic's recommended primary knob) and drop top_p, logging a warning
  • This also covers the Bedrock Anthropic path which shares the same AnthropicChatCompletionRequest::from() conversion

Research

Investigated how competitor gateways (LiteLLM, Portkey, OpenRouter) handle this — none of them do. Projects that fix it (OpenHands, n8n, LobeHub) all converge on the same approach: drop top_p, keep temperature.

Test plan

  • cargo build passes
  • cargo test passes (79 unit tests)
  • Manual test: request with both temperature and top_p → succeeds, top_p dropped, warning logged
  • Manual test: request with only top_p → preserved
  • Manual test: request with only temperature → works as before

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Conflicting Anthropic request parameters now log a warning and omit top-p when both temperature and top-p are set.
  • Refactor

    • Anthropic message content handling now consolidates text blocks into a single string or omits empty content.
  • Tests

    • Added comprehensive Anthropic test suite (unit and integration), plus cassette-based JSON fixtures for basic completions, tool calls, and conversion checks.

Anthropic's API rejects requests that include both parameters. When both
are provided, we now keep temperature (Anthropic's recommended primary
knob) and drop top_p with a warning log. This also covers the Bedrock
Anthropic path which shares the same request conversion.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
@coderabbitai

coderabbitai Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Anthropic provider conversions updated: when both temperature and top_p are set, top_p is dropped with a warning; message content conversion now concatenates text blocks into a single string content. Added a test module and two cassette fixtures for chat completions (with and without tool calls).

Changes

Cohort / File(s) Summary
Model mapping & message serialization
src/providers/anthropic/models.rs
Changed From<ChatCompletionRequest> for AnthropicChatCompletionRequest to warn and set top_p = None when both temperature and top_p are Some; updated From<Vec<ContentBlock>> for ChatCompletionMessage to join text blocks into a single content string and removed typed content-part construction.
Test module registration
src/providers/anthropic/mod.rs
Added #[cfg(test)] mod test; to include the Anthropic test submodule only during tests.
Integration & unit tests
src/providers/anthropic/test.rs
Added cassette-based integration tests, unit tests for content/request/response conversions, helpers for saving cassettes and creating test providers/configs, and record/playback logic gated by RECORD_MODE.
Test cassettes
tests/cassettes/anthropic/chat_completions_basic.json, tests/cassettes/anthropic/chat_completions_with_tool_calls.json
Added two JSON cassette fixtures: a basic assistant text response and an assistant response including a tool_calls entry (function get_weather).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through code with careful cheer,
If temp and top_p both show, one disappears.
Text bits now nest as one gentle thread,
Tests record and replay the paths we've tread,
A carrot-coded chorus: all tests run clear.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly and accurately reflects the main change in the pull request: fixing the Anthropic provider to drop top_p when both temperature and top_p are set, and flattening the response content structure.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dk/fix-anthropic-top-p-temp

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:2279a1d14f60358e75a98d03d6f27c93b8efa059-amd64 (debian 13.4)
===========================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub-migrations - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:2279a1d14f60358e75a98d03d6f27c93b8efa059-arm64 (debian 13.4)
===========================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:2279a1d14f60358e75a98d03d6f27c93b8efa059-amd64 (debian 13.4)
================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions

github-actions Bot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Vulnerability Scan (hub - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:2279a1d14f60358e75a98d03d6f27c93b8efa059-arm64 (debian 13.4)
================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │    Status    │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-4046    │ MEDIUM   │ fix_deferred │ 2.41-12+deb13u2             │               │ glibc: glibc: Denial of Service via iconv() function with    │
│         │                  │          │              │                             │               │ specific character sets...                                   │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4046                    │
│         ├──────────────────┤          ├──────────────┤                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4437    │          │ affected     │                             │               │ glibc: glibc: Incorrect DNS response parsing via crafted DNS │
│         │                  │          │              │                             │               │ server response                                              │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4437                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-4438    │          │              │                             │               │ glibc: glibc: Invalid DNS hostname returned via              │
│         │                  │          │              │                             │               │ gethostbyaddr functions                                      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-4438                    │
│         ├──────────────────┼──────────┤              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │              │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │              │                             │               │ memory consumption due to...                                 │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │              │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │              │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │              │                             │               │ because of...                                                │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │              │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │              │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │              │                             │               │ pthread_created thread                                       │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │              │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │              │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │              │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤              ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │              │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │              │                             │               │ combine functions...                                         │
│         │                  │          │              │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

doronkopit5 and others added 3 commits April 12, 2026 12:20
Adds 6 tests for the Anthropic provider: 2 cassette-based integration
tests (basic chat + tool calls) and 4 unit tests for content block
conversion and response translation.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
…mpatibility

Anthropic returns content as a list of content blocks, but OpenAI-compatible
clients expect a plain string. This broke RAGAS, DeepEval, Instructor, and
any library that calls .find() or json.loads() on message.content.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (2)
src/providers/anthropic/test.rs (2)

148-177: Add a regression test for the actual top_p fix.

Both request builders here set top_p: None, so the new AnthropicChatCompletionRequest::from() branch from this PR never gets exercised. A small unit test should cover both (temperature, top_p) and top_p-only requests so we lock in “drop top_p only when both are set”.

Also applies to: 278-308

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 148 - 177, The test currently
constructs ChatCompletionRequest with top_p: None so the new
AnthropicChatCompletionRequest::from() branch isn't exercised; add unit tests
that create requests covering both cases — one with (temperature: Some(...),
top_p: Some(...)) and one with temperature: None and top_p: Some(...) — then
call AnthropicChatCompletionRequest::from() (and the equivalent test at the
other location around lines 278-308) and assert the resulting Anthropic request
drops top_p only when both temperature and top_p are set, and preserves top_p
when temperature is absent.

370-379: Tighten these content-shape assertions.

Both tests pass for multiple incompatible content serializations (string, array, and sometimes null), so they won't catch regressions in the OpenAI-compatible wire format. If this is intentional characterization coverage, rename the tests/comments accordingly; otherwise assert the single supported shape.

Also applies to: 424-433

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 370 - 379, The test currently
accepts multiple shapes for the response body (string, array, null) which hides
regressions — update the assertions in src/providers/anthropic/test.rs so they
only accept the single supported shape (a string). Replace the conditional
branch that checks content.is_string() / content.is_array() with a strict
assertion that content.is_string() and then assert content.as_str().unwrap() ==
"Hello world!"; make the same change in the analogous block referenced around
lines 424-433 to ensure both tests validate the OpenAI-compatible wire format
only. Ensure you only modify the test assertions (the content variable and its
checks) and not other test scaffolding.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/providers/anthropic/test.rs`:
- Around line 300-301: The test uses a non-deterministic tool selection
(ToolChoice::Simple(SimpleToolChoice::Auto)) which allows the model to answer
without invoking the tool; change the configuration to force a tool call (e.g.,
use the forced/simple explicit variant instead of Auto) for the tool created by
create_weather_tool_definition(), or alternatively update the test prompt to
explicitly require calling get_weather so the cassette is deterministic; apply
the same fix to the other occurrence around the block that spans the second
instance (lines referencing the same
create_weather_tool_definition()/ToolChoice::Simple usage).
- Around line 23-34: The cassette writer is appending to any existing array
which breaks tests that expect exactly one interaction; change save_to_cassette
so it overwrites instead of appending: stop reading and merging existing entries
(or clear interactions) and write only the current response as a single-element
array (e.g., serialize vec![response.clone()]) to cassette_path, using the
existing interactions/response/cassette_path symbols to locate and update the
logic.

---

Nitpick comments:
In `@src/providers/anthropic/test.rs`:
- Around line 148-177: The test currently constructs ChatCompletionRequest with
top_p: None so the new AnthropicChatCompletionRequest::from() branch isn't
exercised; add unit tests that create requests covering both cases — one with
(temperature: Some(...), top_p: Some(...)) and one with temperature: None and
top_p: Some(...) — then call AnthropicChatCompletionRequest::from() (and the
equivalent test at the other location around lines 278-308) and assert the
resulting Anthropic request drops top_p only when both temperature and top_p are
set, and preserves top_p when temperature is absent.
- Around line 370-379: The test currently accepts multiple shapes for the
response body (string, array, null) which hides regressions — update the
assertions in src/providers/anthropic/test.rs so they only accept the single
supported shape (a string). Replace the conditional branch that checks
content.is_string() / content.is_array() with a strict assertion that
content.is_string() and then assert content.as_str().unwrap() == "Hello world!";
make the same change in the analogous block referenced around lines 424-433 to
ensure both tests validate the OpenAI-compatible wire format only. Ensure you
only modify the test assertions (the content variable and its checks) and not
other test scaffolding.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5ae37d03-bd5d-46f9-ab9e-cba95a2a7952

📥 Commits

Reviewing files that changed from the base of the PR and between f6f095c and cc0e42a.

📒 Files selected for processing (4)
  • src/providers/anthropic/mod.rs
  • src/providers/anthropic/test.rs
  • tests/cassettes/anthropic/chat_completions_basic.json
  • tests/cassettes/anthropic/chat_completions_with_tool_calls.json
✅ Files skipped from review due to trivial changes (3)
  • src/providers/anthropic/mod.rs
  • tests/cassettes/anthropic/chat_completions_basic.json
  • tests/cassettes/anthropic/chat_completions_with_tool_calls.json

Comment thread src/providers/anthropic/test.rs Outdated
Comment thread src/providers/anthropic/test.rs Outdated
- Overwrite cassettes on re-record instead of appending
- Force tool call with ToolChoice::Required for deterministic cassettes
- Strict assertions: content must be string, null when tool-only
- Add unit tests for temperature/top_p interaction

Co-Authored-By: Claude Opus 4.6 <[email protected]>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
src/providers/anthropic/test.rs (2)

122-123: Add an explicit non-empty choices assertion before indexing.

Both cassette-validation paths index choices[0] after checking only that choices is an array. A direct non-empty assertion gives clearer failures when cassette shape regresses.

Suggested patch
-        let message = &response["choices"][0]["message"];
+        let choices = response["choices"].as_array().expect("Choices must be an array");
+        assert!(!choices.is_empty(), "Choices array should not be empty");
+        let message = &choices[0]["message"];

Apply similarly in the tool-calls validation block.

Also applies to: 227-228

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 122 - 123, Add an explicit
non-empty assertion for "choices" before any indexing into choices[0] in the
Anthropics tests: ensure you assert that response["choices"].as_array().map(|a|
!a.is_empty()).unwrap_or(false) (or equivalent) is true immediately before the
lines that set let message = &response["choices"][0]["message"]; and the
analogous tool-calls validation block; update both occurrences (the
cassette-validation path and the tool-calls path) so failures clearly report an
empty choices array instead of an out‑of‑bounds panic.

21-33: Fail fast when cassette persistence fails.

save_to_cassette currently swallows directory creation and serialization failures, which can hide recording issues and make later validation failures harder to diagnose.

Suggested patch
 async fn save_to_cassette(test_name: &str, response: &Value) {
     let cassettes_dir = PathBuf::from("tests/cassettes/anthropic");
-    std::fs::create_dir_all(&cassettes_dir).ok();
+    fs::create_dir_all(&cassettes_dir).expect("Failed to create cassette directory");

     let cassette_path = cassettes_dir.join(format!("{}.json", test_name));

     let interactions = vec![response.clone()];

-    if let Ok(content) = serde_json::to_string_pretty(&interactions) {
-        fs::write(&cassette_path, content).expect("Failed to write cassette");
-        debug!(
-            "Successfully saved interaction to cassette: {:?}",
-            cassette_path
-        );
-    }
+    let content =
+        serde_json::to_string_pretty(&interactions).expect("Failed to serialize cassette");
+    fs::write(&cassette_path, content).expect("Failed to write cassette");
+    debug!(
+        "Successfully saved interaction to cassette: {:?}",
+        cassette_path
+    );
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 21 - 33, The cassette
persistence code currently swallows failures
(std::fs::create_dir_all(&cassettes_dir).ok() and the if let Ok(...) branch), so
update the save_to_cassette flow to fail fast: propagate or return errors from
std::fs::create_dir_all(&cassettes_dir) and from
serde_json::to_string_pretty(&interactions) (or replace .ok() / if let with
?/expect with clear messages) instead of ignoring them; ensure cassette_path and
interactions logic remains but that create_dir_all,
serde_json::to_string_pretty, and fs::write failures are surfaced from the
function (e.g., by making save_to_cassette return Result and using ? on those
calls) so persistence problems are not swallowed.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/providers/anthropic/test.rs`:
- Around line 122-123: Add an explicit non-empty assertion for "choices" before
any indexing into choices[0] in the Anthropics tests: ensure you assert that
response["choices"].as_array().map(|a| !a.is_empty()).unwrap_or(false) (or
equivalent) is true immediately before the lines that set let message =
&response["choices"][0]["message"]; and the analogous tool-calls validation
block; update both occurrences (the cassette-validation path and the tool-calls
path) so failures clearly report an empty choices array instead of an
out‑of‑bounds panic.
- Around line 21-33: The cassette persistence code currently swallows failures
(std::fs::create_dir_all(&cassettes_dir).ok() and the if let Ok(...) branch), so
update the save_to_cassette flow to fail fast: propagate or return errors from
std::fs::create_dir_all(&cassettes_dir) and from
serde_json::to_string_pretty(&interactions) (or replace .ok() / if let with
?/expect with clear messages) instead of ignoring them; ensure cassette_path and
interactions logic remains but that create_dir_all,
serde_json::to_string_pretty, and fs::write failures are surfaced from the
function (e.g., by making save_to_cassette return Result and using ? on those
calls) so persistence problems are not swallowed.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 822fc859-b1a3-42e6-9d56-bb4c27fc45c5

📥 Commits

Reviewing files that changed from the base of the PR and between b18f8a1 and 9fd3785.

📒 Files selected for processing (1)
  • src/providers/anthropic/test.rs

- save_to_cassette now uses expect() instead of silently swallowing errors
- Add explicit non-empty choices assertion before indexing choices[0]

Co-Authored-By: Claude Opus 4.6 <[email protected]>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (3)
src/providers/anthropic/test.rs (3)

146-176: Consider a request builder/helper for test setup clarity.

ChatCompletionRequest initialization is repeated with many identical fields across integration/unit tests. Centralizing defaults in a helper (then overriding only relevant fields) will make intent clearer and avoid accidental divergence.

Also applies to: 274-304, 436-464, 476-504

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 146 - 176, Tests repeatedly
construct ChatCompletionRequest/ChatCompletionMessage with many identical
fields; factor out a test helper or builder (e.g., a function like
default_chat_request() or ChatCompletionRequestBuilder) that returns a prefilled
ChatCompletionRequest using default values for fields such as temperature,
stream, max_tokens, and nested ChatCompletionMessage with
ChatMessageContent::String, then update the tests to call that helper and only
override fields relevant to each test (refer to ChatCompletionRequest,
ChatCompletionMessage, and ChatMessageContent to locate the constructors to
replace).

435-472: Add an assertion for warning emission on the drop path.

The conversion behavior (top_p dropped when temperature is set) is covered well; adding a log assertion would fully lock in the contract described by this PR.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 435 - 472, Update the test
function test_request_drops_top_p_when_both_temperature_and_top_p_set to also
assert that a warning is emitted when AnthropicChatCompletionRequest::from drops
top_p: enable/log-capture for the test (using the project's logging/tracing test
helper), perform the conversion into anthropic_request, and assert that a
warning-level record containing "top_p" (or another clear message emitted by the
conversion code) was logged in addition to the existing assertions about
anthropic_request.temperature and anthropic_request.top_p.

94-139: Extract shared cassette validation helper to reduce drift.

The two validation branches duplicate path resolution, file loading, JSON parsing, and singleton interaction checks. A small helper (e.g., load_single_interaction(test_name) -> Value) will keep assertions consistent and reduce maintenance cost.

♻️ Suggested refactor sketch
+fn load_single_interaction(test_name: &str) -> Value {
+    let cassette_path = PathBuf::from("tests/cassettes/anthropic")
+        .join(format!("{}.json", test_name));
+    assert!(
+        cassette_path.exists(),
+        "Cassette file does not exist. Run with RECORD_MODE=1 ANTHROPIC_API_KEY=sk-ant-... to create it"
+    );
+    let cassette_content = fs::read_to_string(&cassette_path)
+        .expect("Failed to read cassette file");
+    let interactions: Vec<Value> = serde_json::from_str(&cassette_content)
+        .expect("Failed to parse cassette JSON");
+    assert_eq!(interactions.len(), 1, "Cassette should have exactly 1 interaction");
+    interactions.into_iter().next().unwrap()
+}

Also applies to: 204-267

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/providers/anthropic/test.rs` around lines 94 - 139, Extract the
duplicated cassette-loading and singleton-interaction checks into a helper like
load_single_interaction(test_name: &str) -> Value that performs
PathBuf::from("tests/cassettes/anthropic").join(format!("{}.json", test_name)),
asserts the file exists, reads it (fs::read_to_string), parses JSON into
Vec<Value>, asserts interactions.len() == 1, and returns interactions.remove(0)
(the single Value); then replace the duplicated blocks in both branches with a
call to load_single_interaction(test_name) and keep the remaining per-test
assertions (id/choices/usage/message content) as-is.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/providers/anthropic/test.rs`:
- Around line 146-176: Tests repeatedly construct
ChatCompletionRequest/ChatCompletionMessage with many identical fields; factor
out a test helper or builder (e.g., a function like default_chat_request() or
ChatCompletionRequestBuilder) that returns a prefilled ChatCompletionRequest
using default values for fields such as temperature, stream, max_tokens, and
nested ChatCompletionMessage with ChatMessageContent::String, then update the
tests to call that helper and only override fields relevant to each test (refer
to ChatCompletionRequest, ChatCompletionMessage, and ChatMessageContent to
locate the constructors to replace).
- Around line 435-472: Update the test function
test_request_drops_top_p_when_both_temperature_and_top_p_set to also assert that
a warning is emitted when AnthropicChatCompletionRequest::from drops top_p:
enable/log-capture for the test (using the project's logging/tracing test
helper), perform the conversion into anthropic_request, and assert that a
warning-level record containing "top_p" (or another clear message emitted by the
conversion code) was logged in addition to the existing assertions about
anthropic_request.temperature and anthropic_request.top_p.
- Around line 94-139: Extract the duplicated cassette-loading and
singleton-interaction checks into a helper like
load_single_interaction(test_name: &str) -> Value that performs
PathBuf::from("tests/cassettes/anthropic").join(format!("{}.json", test_name)),
asserts the file exists, reads it (fs::read_to_string), parses JSON into
Vec<Value>, asserts interactions.len() == 1, and returns interactions.remove(0)
(the single Value); then replace the duplicated blocks in both branches with a
call to load_single_interaction(test_name) and keep the remaining per-test
assertions (id/choices/usage/message content) as-is.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b9bb1c99-57b3-4424-b1a0-798b39738f0c

📥 Commits

Reviewing files that changed from the base of the PR and between 9fd3785 and fdcfab7.

📒 Files selected for processing (1)
  • src/providers/anthropic/test.rs

@doronkopit5 doronkopit5 changed the title fix: drop top_p when both temperature and top_p are set for Anthropic fix(anthropic): drop top_p when both temperature and top_p are set for Anthropic Apr 15, 2026
@doronkopit5 doronkopit5 changed the title fix(anthropic): drop top_p when both temperature and top_p are set for Anthropic fix(anthropic): drop top_p when both temperature and top_p are set + flatten response Apr 15, 2026
@doronkopit5
doronkopit5 merged commit 233b5d3 into main Apr 15, 2026
14 checks passed
@doronkopit5
doronkopit5 deleted the dk/fix-anthropic-top-p-temp branch April 15, 2026 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants