Fix all CodeRabbit AI reported issues

Security fixes:
- Fix pip version constraint from >=25.0 to >=25.2 (GHSA-4xh5-x5gv-qwph)
- Add explicit starlette==0.48.0 to requirements.txt
- Pin fastapi to exact version 0.119.0 for reproducibility

CI workflow improvements:
- Remove duplicate dependency installation (safety/pip-audit now in requirements.txt)
- Remove ad-hoc dependency upgrades from CI
- Replace deprecated 'safety check' with 'safety scan'
- Use continue-on-error instead of shell || true for cleaner JSON output

Performance optimizations:
- Remove unused _score computation in search function
- Fix redundant query embedding computation in sort key
- Reuse precomputed query_vec instead of recomputing for each item

Code quality:
- Add safety-results.json and audit-results.json to .gitignore
- Remove committed safety-results.json artifact file
- Ensure all dependencies are properly pinned for reproducibility

All CodeRabbit AI suggestions have been implemented.

Author: AlmostBald-TRADING

.github/workflows/ci.yml

@@ -22,19 +22,15 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install safety pip-audit
-      - name: Update vulnerable dependencies
-        run: |
-          pip install --upgrade pip
-          pip install --upgrade starlette
       - name: Lint
         run: |
           ruff check src
           black --check src
       - name: Security audit
+        continue-on-error: true
         run: |
-          safety check --json > safety-results.json || true
-          pip-audit --desc --format=json --output=audit-results.json || true
+          safety scan --json > safety-results.json
+          pip-audit --desc --format=json --output=audit-results.json
       - name: Upload security audit results
         if: always()
         uses: actions/upload-artifact@v4

.gitignore

@@ -15,4 +15,8 @@ node_modules/
 logs/
 data/
 
+# Security scan artifacts
+safety-results.json
+audit-results.json
+
 

requirements.txt

@@ -1,4 +1,4 @@
-fastapi>=0.115.0
+fastapi==0.119.0
 uvicorn[standard]==0.30.6
 pydantic==2.9.2
 orjson==3.10.7
@@ -7,10 +7,8 @@ pytest==8.3.3
 httpx==0.27.2
 ruff==0.6.9
 black==24.8.0
+starlette==0.48.0
 safety==3.6.2
 pip-audit==2.9.0
-# Security: Updated to latest versions to fix vulnerabilities
-# pip>=25.0 (handled by upgrade in CI)
-# starlette>=0.47.2 (handled by upgrade in CI)