Skip to main content

RAG Pipeline Utils v3.0.2: csv-parse 7 and an Evaluation Demo

· 3 min read
Ali Kahwaji
Ali Kahwaji
Creator & Maintainer of RAG Pipeline Utils

v3.0.2 updates csv-parse to 7.x for a security advisory and adds a recorded demo of rag-pipeline eval to the README. There are no API changes.

npm install @devilsdev/rag-pipeline-utils@^3.0.2

csv-parse 7​

The CSV loader that rag-pipeline ingest and DirectoryLoader use for .csv files parsed with csv-parse 5.x. GHSA-8cw4-87c7-c6xx reports prototype replacement through the columns option, which the loader uses, and the fix is only in 7.x.

With the loader's options every value is a string, so a __proto__ header could not replace a prototype. It did make that column disappear from the indexed text; 3.0.2 keeps it. Everything else the loader produces is unchanged, and the first tests for the CSV loader cover quoted fields, a byte order mark, Windows line endings and that header. npm audit --omit=dev on the package now reports no vulnerabilities.

rag-pipeline eval, recorded​

The README now shows the evaluation gate in a terminal recording. A test set passes with a minimum faithfulness and saves its report; then a change makes the answers stop using the documents, and the same command against the saved report lists the metrics and cases that regressed and exits 1, which fails a CI job:

rag-pipeline eval passes and saves main.json, then a worse run against --baseline main.json lists the regressions, prints Evaluation failed and exits 1

npx rag-pipeline eval tests.json --min faithfulness=0.8 --output main.json   # on main
npx rag-pipeline eval tests.json --baseline main.json                        # on a pull request

The recording runs offline, with the local embedder and a stand-in LLM. Its files are in assets/eval-demo, and npm run demo:record:eval records it again. On GitHub, DevilsDev/rag-eval-action runs the same check on every pull request and posts the summary as a comment.

In the repository​

These files are not in the npm package, but they were wrong:

  • The root Dockerfile's default stage is now an image of the rag-pipeline CLI. It used to run --help behind a health check on a port nothing served, and its license label said Apache-2.0; the project is MIT.
  • deployment/kubernetes and deployment/helm now deploy your image of the Fastify example service, with probes on its real /health endpoint, instead of an image this project never published. The Helm chart gained the templates it was missing. deployment/README.md walks through building and deploying it.
  • An unused 2025 dashboard prototype in public/ is gone, and the docs site's build-time dependencies are updated. That closes 15 of the repository's 16 open Dependabot alerts; the last, for deepmerge in the docs build, has no fixed version yet.

The full list of changes is in the CHANGELOG.