From 466960b12f61f171bc2c728ae638c87aa5f7e99c Mon Sep 17 00:00:00 2001 From: Dominik Jain Date: Wed, 29 Jul 2026 13:13:06 +0200 Subject: [PATCH] Remove unmaintainable parts of security documentation --- docs/02-usage/070_security.md | 68 +---------------------------------- 1 file changed, 1 insertion(+), 67 deletions(-) diff --git a/docs/02-usage/070_security.md b/docs/02-usage/070_security.md index d240ef08..2f87a5ad 100644 --- a/docs/02-usage/070_security.md +++ b/docs/02-usage/070_security.md @@ -119,70 +119,4 @@ Some parts of Serena rely on `uv` / `uvx`. One important detail is that `uvx` ignores the lockfile when installing directly from a Git repository. Because of that, we pin Serena's Python dependencies exactly in `pyproject.toml` so that installations from Git still resolve to exact dependency versions rather than floating ranges. -For the Pyright, BasedPyright, and `ty` Python language servers, Serena uses exact pinned versions when -invoking them through `uvx` / `uv tool run`. Pyright and BasedPyright default to `1.1.403` and `1.39.9`, -respectively; `ls_specific_settings.python.pyright_version` and -`ls_specific_settings.python_basedpyright.basedpyright_version` can override those pins. - -```{dropdown} What Serena Downloads by Default for Language Servers -:open: - -Only the language servers listed below download or install additional dependencies automatically by default when the required dependency is missing. Everything else either relies on a system-installed server or on tooling you install separately. - -### Release Artifacts, Archives, or VSIX Packages - -- **AL**: the pinned Microsoft AL VS Code extension (`ms-dynamics-smb.al`) from the VS Code Marketplace. -- **C/C++ (`clangd`)**: pinned `clangd` release archives on supported platforms. -- **C# (Roslyn LS)**: pinned Roslyn language-server NuGet package for the current platform. -- **Clojure**: pinned `clojure-lsp` release artifact. -- **Dart**: pinned Dart SDK archive that contains the language server. -- **Elixir (`expert`)**: pinned Expert release binary, if not already available locally. -- **Groovy**: pinned `vscode-java` runtime bundle used to provide Java for the Groovy LS setup. -- **HLSL / shader-language-server**: pinned GitHub release artifacts on supported prebuilt platforms. -- **Java (`eclipse.jdt.ls`)**: pinned Gradle distribution, pinned `vscode-java` extension bundle, and pinned IntelliCode VSIX. -- **Kotlin**: pinned Kotlin LSP archive. -- **Lua**: pinned `lua-language-server` release archive. -- **Luau**: pinned `luau-lsp` release archive. In Roblox or standard-doc modes it may also download Luau/Roblox docs and type-definition files. -- **Markdown (`marksman`)**: pinned Marksman release binary. -- **MATLAB**: the pinned MathWorks MATLAB VS Code extension from the VS Code Marketplace. -- **OmniSharp (legacy C# backend)**: pinned OmniSharp and Razor plugin archives. -- **Pascal**: pinned Pascal language-server release artifact. -- **PHP (`phpactor`)**: pinned `phpactor.phar`. -- **PowerShell**: pinned PowerShell Editor Services archive. -- **SystemVerilog (`verible`)**: pinned Verible release archive on supported platforms. -- **TOML (`taplo`)**: pinned Taplo release artifact. -- **Terraform**: pinned `terraform-ls` release archive. The Terraform CLI itself must still already be installed. - -### npm Package Installs - -- **Angular**: `@angular/language-server`, `@angular/language-service`, plus `typescript` and `typescript-language-server` -- **Ansible**: `@ansible/ansible-language-server` -- **Bash**: `bash-language-server` -- **Elm**: `@elm-tooling/elm-language-server` -- **HTML**: `vscode-langservers-extracted` (provides `vscode-html-language-server`) -- **PHP (`intelephense`)**: `intelephense` -- **SCSS / Sass / CSS**: `some-sass-language-server` -- **Solidity**: `@nomicfoundation/solidity-language-server` -- **Svelte**: `svelte-language-server` -- **TypeScript**: `typescript` and `typescript-language-server` -- **Vue**: `@vue/language-server`, plus `typescript` and `typescript-language-server` -- **VTSLS**: `@vtsls/language-server` -- **YAML**: `yaml-language-server` - -All of the above are installed with exact pinned package versions by default, into Serena-managed directories. - -### Other Package-Manager Based Installs - -- **F#**: installs pinned `fsautocomplete` via `dotnet tool install`. -- **Ruby (`ruby-lsp`)**: if not already available through Bundler or as a global executable, Serena installs a pinned `ruby-lsp` gem. -- **Python (`python`)**: Pyright is launched through `uvx` / `uv tool run` using an exact pinned version. - Supplying `ls_path` bypasses this managed invocation. -- **Python (`python_basedpyright`)**: BasedPyright is launched through `uvx` / `uv tool run` using an exact - pinned version. Supplying `ls_path` bypasses this managed invocation. -- **Python (`python_ty`)**: launched through `uvx` / `uv tool run` using an exact pinned `ty` version. -- **HLSL on macOS**: if no prebuilt binary is used, Serena builds `shader_language_server` from a pinned version using Cargo. - -### No Automatic Download by Serena - -- **Go (`gopls`)**, **Rust (`rust-analyzer`)**, and several other system-tool based integrations expect the language server to be available locally and do not download it automatically. -``` +Some language servers also use exact pinned versions when invoking them through `uvx` / `uv tool run`.