‹ Reports
The Dispatch

OSS Report: stitionai/devika


Devika Project Faces Critical Security Vulnerability Amidst Active Development

Devika, an open-source AI software engineer project, aims to automate software development by interpreting human instructions and generating code. Despite its ambitious goals, the project is currently grappling with a critical security vulnerability that allows arbitrary code execution, as well as ongoing challenges in model integration and user interface stability.

Recent Activity

Recent issues and pull requests highlight a focus on bug fixes and feature enhancements. Notably, issue #639 reports a critical security flaw allowing arbitrary code execution, which demands immediate attention. Concurrently, PR #619 addresses security updates, indicating a proactive approach to mitigating vulnerabilities. The development team shows high engagement, with Ayush Rajgor leading efforts in bug fixes and feature additions. Recent activities include:

Of Note

  1. Security Vulnerability (#639): A critical issue allowing arbitrary code execution poses significant risks to users and requires urgent resolution.
  2. Model Integration Challenges: Users report difficulties with the Ollama model, suggesting instability in this integration.
  3. UI Responsiveness Issues: Persistent problems with the user interface's responsiveness hinder user experience.
  4. High Community Engagement: The project benefits from active contributions, reflecting strong community interest.
  5. Collaborative Efforts: Notable collaboration between Ayush Rajgor and Alan Sunny on UI enhancements indicates effective teamwork within the development team.

Quantified Reports

Quantify commits



Quantified Commit Activity Over 30 Days

Developer Avatar Branches PRs Commits Files Changes
Injae Ryou (sts07142) 0 1/0/0 0 0 0
Jivesh Kalra (jiveshkalra) 0 0/0/1 0 0 0
Athulkrishna S (Athulkrishna-S) 0 1/0/0 0 0 0

PRs: created by that dev and opened/merged/closed-unmerged during the period

Quantify Issues



Recent GitHub Issues Activity

Timespan Opened Closed Comments Labeled Milestones
7 Days 4 0 3 4 1
30 Days 11 0 12 11 1
90 Days 40 4 59 40 1
All Time 379 257 - - -

Like all software activity quantification, these numbers are imperfect but sometimes useful. Comments, Labels, and Milestones refer to those issues opened in the timespan in question.

Detailed Reports

Report On: Fetch issues



Recent Activity Analysis

The recent activity on the Devika GitHub repository indicates a high level of engagement, with 122 open issues reflecting various challenges and feature requests. Notably, there are several recurring themes such as installation issues, model integration problems, and user interface bugs. A significant number of users report difficulties with the Ollama model not being recognized or failing to respond, which suggests potential instability in this integration. Additionally, there are concerns about the UI's responsiveness and functionality, particularly regarding project creation and model selection.

Issue Details

Most Recently Created Issues

  1. Issue #640: There is a Bug in the MistralAi Library

    • Priority: High
    • Status: Open
    • Created: 4 days ago
    • Update: N/A
    • Description: A bug related to module imports in the MistralAi library is causing failures in execution.
  2. Issue #639: [Bug] Security bug: Arbitrary code execution

    • Priority: Critical
    • Status: Open
    • Created: 4 days ago
    • Update: N/A
    • Description: A security vulnerability allowing arbitrary code execution through user-provided input was reported.
  3. Issue #638: [Bug] devika modulenotfounderror

    • Priority: Medium
    • Status: Open
    • Created: 6 days ago
    • Update: Edited 3 days ago
    • Description: Users are encountering a ModuleNotFoundError related to the devika package.
  4. Issue #637: [FEATURE] How to use GPT-4o-Mini

    • Priority: Low
    • Status: Open
    • Created: 7 days ago
    • Update: Edited 6 days ago
    • Description: Feature request for guidance on integrating GPT-4o-Mini into Devika.
  5. Issue #636: [FEATURE] Real terminal integration

    • Priority: Low
    • Status: Open
    • Created: 8 days ago
    • Update: N/A
    • Description: Request for full terminal integration capabilities within Devika.

Most Recently Updated Issues

  1. Issue #607: [Bug] postinstall script from "@sveltejs/kit" exited with 1

    • Priority: Medium
    • Status: Open
    • Created: 58 days ago
    • Update: Edited 1 day ago
  2. Issue #589: Devika UI is not responding [ISSUE]

    • Priority: High
    • Status: Open
    • Created: 69 days ago
    • Update: Edited 7 days ago
  3. Issue #499: [ISSUE] failed to connect to server

    • Priority: Medium
    • Status: Open
    • Created: 113 days ago
    • Update: Edited 4 days ago

Themes and Commonalities

Several themes emerge from the issues:

  • Many users report problems with model recognition and response generation, particularly concerning the Ollama integration.
  • Security vulnerabilities have been highlighted, indicating a need for improved safeguards against arbitrary code execution.
  • The user interface has been criticized for its lack of responsiveness and functionality, especially regarding project management features.
  • There is a strong demand for additional features and better documentation to assist users in navigating the complexities of setting up and using Devika effectively.

Overall, these issues suggest that while there is significant interest in the project, substantial work remains to stabilize integrations and enhance user experience.

Report On: Fetch pull requests



Overview

The dataset contains a comprehensive list of pull requests (PRs) from the Devika project, which is an open-source AI software engineer. The repository currently has 41 open PRs and 162 closed PRs, reflecting ongoing development and community engagement. The PRs cover a wide range of features, bug fixes, and enhancements aimed at improving the functionality and usability of the Devika platform.

Summary of Pull Requests

Open Pull Requests

  1. PR #633: Update mistral_client.py
    Created 9 days ago, this PR refactors the MistralAi class to be compatible with the latest version of the Mistral Python library. It addresses deprecated classes and methods, ensuring continued functionality.

  2. PR #603: This PR fix devika
    Created 63 days ago, this PR includes various bug fixes related to file handling and compatibility across different operating systems. It also suggests adding sandbox functionality for better code execution visualization.

  3. PR #630: Add: gpt-4o-mini
    Created 20 days ago, this PR introduces support for the "gpt-4o-mini" model into the existing LLM framework.

  4. PR #619: Security Updates & Patches
    Created 45 days ago, this PR implements security updates to address vulnerabilities in the application, particularly focusing on path traversal prevention.

  5. PR #618: fix: cors error
    Created 49 days ago, this PR resolves CORS issues by adding necessary origins for the frontend URL.

  6. PR #597: Update requirements.txt with curl_cffi
    Created 66 days ago, this PR adds the curl_cffi module to the requirements file to resolve a ModuleNotFoundError encountered during DuckDuckGo searches.

  7. PR #583: Rename README.md to MRG_README.md
    Created 80 days ago, this PR renames the README file without significant changes to content.

  8. PR #567: Fix: Strip backquote from generated filenames
    Created 93 days ago, this PR addresses an issue where generated filenames contained backquotes.

  9. PR #563: Adding Litellm client and some models/providers
    Created 94 days ago, this PR introduces a new client for LiteLLM along with updates to documentation and configuration files.

  10. PR #562: adding a missing sample.config.toml file
    Created 94 days ago, this PR adds a missing configuration file necessary for proper application setup.

Closed Pull Requests

  1. PR #602: Fix : Groq TPM Limit Handling
    Closed 65 days ago without merging; it aimed to handle token per minute limits for Groq models but was not accepted.

  2. PR #617: Create SECURITY.md
    Closed 50 days ago without merging; it proposed adding a security policy document but was not accepted.

  3. PR #600: Fix: Issue #599, DuckDuckGo Search Module Not Found
    Closed 65 days ago without merging; it addressed a missing module issue but was not merged into the main branch.

  4. PR #596: updated playwright installation command
    Closed 66 days ago without merging; it suggested updating installation commands but was not accepted.

  5. PR #593: fix: CORS issue and yaml issue
    Closed 66 days ago after being merged; it resolved CORS issues and improved YAML handling in Docker setups.

Analysis of Pull Requests

The pull requests submitted to the Devika project reveal several key themes and areas of focus that are critical for understanding its development trajectory:

Compatibility and Upgrades

A significant number of open pull requests focus on ensuring compatibility with updated libraries and frameworks, such as PR #633 which updates the Mistral client to align with recent changes in its library structure. This reflects a proactive approach to maintain compatibility with evolving dependencies, which is essential for long-term project sustainability.

Bug Fixes and Stability

Many contributions aim at fixing bugs that affect user experience or system stability (e.g., PR #603 addressing various bugs across different modules). The presence of multiple bug fix PRs indicates that while the project is ambitious in scope, it may still be encountering typical growing pains associated with complex software development.

Security Enhancements

Security is a recurring theme in recent submissions (e.g., PR #619), highlighting an awareness of potential vulnerabilities within the application. The addition of security measures is crucial for building trust among users and ensuring safe deployment in production environments.

Feature Expansion

Several pull requests introduce new features or enhance existing functionalities (e.g., support for new AI models in PR #630). This aligns with Devika's goal of being a competitive alternative in AI-driven software engineering tools, suggesting that contributors are actively working towards expanding its capabilities.

Community Engagement

The volume of contributions—both open and closed—suggests an engaged community around Devika. However, there are also indications of disputes or differing opinions on certain implementations (as seen in discussions around PR #491), which is common in collaborative projects but can lead to delays or unresolved issues if not managed effectively.

Documentation Improvements

Several pull requests focus on improving documentation (e.g., README updates), which is critical for onboarding new users and contributors. Clear documentation can significantly reduce barriers to entry for potential users and foster a more inclusive community around the project.

Conclusion

Overall, the analysis of pull requests in the Devika project indicates a vibrant development environment characterized by active contributions aimed at enhancing compatibility, fixing bugs, improving security, and expanding features. While challenges remain—particularly concerning stability and community consensus—the project's trajectory appears positive as it seeks to establish itself as a leading tool in AI-driven software engineering solutions. Continued focus on user feedback and robust testing practices will be essential as development progresses.

Report On: Fetch commits



Repo Commits Analysis

Development Team and Recent Activity

Team Members and Their Recent Activities

  1. Ayush Rajgor (ARajgor)

    • Recent commits include fixing various issues such as CORS misconfiguration, infinite retries, and sanitizing HTML inputs.
    • Collaborated with others on features like frontend Dockerfile and enhancements to the response parser.
    • Involved in multiple bug fixes and feature additions, indicating a high level of activity.
  2. Vijay Raju (vijayraju111222333)

    • Recently added the latest Gemini 1.5 configuration.
    • No significant collaborative efforts noted in the recent commits.
  3. Meltingscales

    • Fixed a CORS issue and a YAML issue, contributing to the stability of the application.
    • No additional collaborative activities reported.
  4. Chisun Joung

    • Closed bug #550 related to model names and contributed to ensuring proper functionality in that area.
    • No recent collaborations noted.
  5. Kgott

    • Resolved an issue regarding list index errors, contributing to code reliability.
    • Limited collaboration noted.
  6. Alan Sunny (nalaso)

    • Contributed to several features including a new UI and updates to README files.
    • Worked on integrating various AI models and improving project documentation.
    • Notable collaborations with Ayush Rajgor on UI improvements.
  7. FroDK

    • Fixed issues related to file operations, indicating a focus on backend stability.
    • Limited collaborative efforts noted.
  8. Ahmet0691

    • Engaged in updating documentation and fixing log warnings, contributing to overall project clarity.
    • Minimal collaboration reported.
  9. Mufeed VH (mufeedvh)

    • Actively merged pull requests related to UI improvements, error handling, and configuration updates.
    • Demonstrated significant involvement in project management and integration of community contributions.
  10. Others (e.g., Leandro de Souza, Parth Jain)

    • Various contributions focused on specific features like PDF downloads and implementing libraries in the frontend.
    • Limited collaborative activities noted.

Patterns, Themes, and Conclusions

  • High Activity Level: Ayush Rajgor stands out as the most active contributor, addressing numerous bugs and implementing features, which suggests a strong commitment to project development.
  • Collaborative Environment: There is evidence of collaboration among team members, particularly between Ayush Rajgor and Alan Sunny, indicating a teamwork-oriented approach to feature development.
  • Focus on Bug Fixes: A significant number of recent commits are dedicated to fixing bugs, which is crucial for stabilizing the early development stage of the project.
  • Feature Development: The team is actively working on enhancing features such as AI model integration and user interface improvements, reflecting an ongoing effort to expand the project's capabilities.
  • Community Engagement: The presence of multiple contributors indicates a healthy community interest in the project, which is essential for its growth and sustainability.

Overall, the development team is actively engaged in both fixing issues and adding new features, which bodes well for the project's progress as it moves towards maturity.