Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Luke/CVE bump #3928

Merged
merged 8 commits into from
Feb 19, 2025
Merged
Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
## 0.16.22

### Enhancements

### Features

### Fixes

- **Fix open CVES in and bump dependencies

## 0.16.21

### Enhancements
Expand Down
2 changes: 1 addition & 1 deletion requirements/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -27,4 +27,4 @@ clean: clean-base

.PHONY: clean-base
clean-base:
rm $(BASE_REQUIREMENTSTXT)
rm $(BASE_REQUIREMENTSTXT)
73 changes: 38 additions & 35 deletions requirements/base.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,15 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./base.in
# pip-compile base.in
#
anyio==4.8.0
# via httpx
backoff==2.2.1
# via -r ./base.in
beautifulsoup4==4.12.3
# via -r ./base.in
certifi==2024.12.14
# via -r base.in
beautifulsoup4==4.13.3
# via -r base.in
certifi==2025.1.31
# via
# httpcore
# httpx
Expand All @@ -19,7 +19,7 @@ certifi==2024.12.14
cffi==1.17.1
# via cryptography
chardet==5.2.0
# via -r ./base.in
# via -r base.in
charset-normalizer==3.4.1
# via
# requests
Expand All @@ -28,24 +28,24 @@ click==8.1.8
# via
# nltk
# python-oxmsg
cryptography==44.0.0
cryptography==44.0.1
# via unstructured-client
dataclasses-json==0.6.7
# via
# -r ./base.in
# -r base.in
# unstructured-client
deepdiff==8.1.1
deepdiff==8.2.0
# via unstructured-client
emoji==2.14.1
# via -r ./base.in
# via -r base.in
exceptiongroup==1.2.2
# via anyio
filetype==1.2.0
# via -r ./base.in
# via -r base.in
h11==0.14.0
# via httpcore
html5lib==1.1
# via -r ./base.in
# via -r base.in
httpcore==1.0.7
# via httpx
httpx==0.28.1
Expand All @@ -61,10 +61,12 @@ joblib==1.4.2
jsonpath-python==1.0.6
# via unstructured-client
langdetect==1.0.9
# via -r ./base.in
# via -r base.in
lxml==5.3.0
# via -r ./base.in
marshmallow==3.26.0
# via
# -c ./deps/constraints.txt
# -r base.in
marshmallow==3.26.1
# via
# dataclasses-json
# unstructured-client
Expand All @@ -75,38 +77,38 @@ mypy-extensions==1.0.0
nest-asyncio==1.6.0
# via unstructured-client
nltk==3.9.1
# via -r ./base.in
# via -r base.in
numpy==1.26.4
# via -r ./base.in
# via -r base.in
olefile==0.47
# via python-oxmsg
orderly-set==5.2.3
orderly-set==5.3.0
# via deepdiff
packaging==24.2
# via
# marshmallow
# unstructured-client
psutil==6.1.1
# via -r ./base.in
psutil==7.0.0
# via -r base.in
pycparser==2.22
# via cffi
pypdf==5.2.0
pypdf==5.3.0
# via unstructured-client
python-dateutil==2.9.0.post0
# via unstructured-client
python-iso639==2025.1.28
# via -r ./base.in
python-iso639==2025.2.18
# via -r base.in
python-magic==0.4.27
# via -r ./base.in
python-oxmsg==0.0.1
# via -r ./base.in
rapidfuzz==3.11.0
# via -r ./base.in
# via -r base.in
python-oxmsg==0.0.2
# via -r base.in
rapidfuzz==3.12.1
# via -r base.in
regex==2024.11.6
# via nltk
requests==2.32.3
# via
# -r ./base.in
# -r base.in
# requests-toolbelt
# unstructured-client
requests-toolbelt==1.0.0
Expand All @@ -123,12 +125,13 @@ soupsieve==2.6
# via beautifulsoup4
tqdm==4.67.1
# via
# -r ./base.in
# -r base.in
# nltk
typing-extensions==4.12.2
# via
# -r ./base.in
# -r base.in
# anyio
# beautifulsoup4
# pypdf
# python-oxmsg
# typing-inspect
Expand All @@ -139,14 +142,14 @@ typing-inspect==0.9.0
# unstructured-client
unstructured-client==0.25.9
# via
# -c ././deps/constraints.txt
# -r ./base.in
# -c ./deps/constraints.txt
# -r base.in
urllib3==1.26.20
# via
# -c ././deps/constraints.txt
# -c ./deps/constraints.txt
# requests
# unstructured-client
webencodings==0.5.1
# via html5lib
wrapt==1.17.2
# via -r ./base.in
# via -r base.in
4 changes: 3 additions & 1 deletion requirements/deps/constraints.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ weaviate-client>=3.26.7,<4.0.0
# TODO: Constriant due to multiple versions being installed during pip-compile
grpcio>=1.65.5
# TODO: Pinned in transformers package, remove when that gets updated (https://github.com/huggingface/transformers/blob/main/setup.py)
tokenizers>=0.19,<0.20
tokenizers>=0.21,<0.22
# TODO: Constaint due to boto, with python before 3.10 not requiring openssl 1.1.1, remove when that gets
# updated or we drop support for 3.9
urllib3<1.27
Expand All @@ -18,3 +18,5 @@ botocore<1.34.132
importlib-metadata>=8.5.0
# (austin): Versions below this have a different interface for passing parameters
unstructured-client>=0.23.0,<0.26.0
# (luke): conflicting versions installed. pinned to 5.3.0 for now.
lxml==5.3.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like @ahmetmeleq also opened a PR to address CVEs but it doesn't include this pin. Would the changes in #3925 resolve the CVE?

Copy link
Contributor Author

@luke-kucing luke-kucing Feb 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like that PR would resolve the cryptography CVE and label-studio sdk but would fix the transformers CVE in version 4.442 thats resolved in version 4.48.0

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested removing the constraint and it doesnt seem like anything required 5.3.0 so that might have just been an error on my part

26 changes: 13 additions & 13 deletions requirements/dev.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,56 +2,56 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./dev.in
# pip-compile dev.in
#
build==1.2.2.post1
# via pip-tools
cfgv==3.4.0
# via pre-commit
click==8.1.8
# via
# -c ./base.txt
# -c ./test.txt
# -c base.txt
# -c test.txt
# pip-tools
distlib==0.3.9
# via virtualenv
filelock==3.17.0
# via virtualenv
identify==2.6.6
identify==2.6.7
# via pre-commit
importlib-metadata==8.6.1
# via
# -c ././deps/constraints.txt
# -c ./deps/constraints.txt
# build
nodeenv==1.9.1
# via pre-commit
packaging==24.2
# via
# -c ./base.txt
# -c ./test.txt
# -c base.txt
# -c test.txt
# build
pip-tools==7.4.1
# via -r ./dev.in
# via -r dev.in
platformdirs==4.3.6
# via
# -c ./test.txt
# -c test.txt
# virtualenv
pre-commit==4.1.0
# via -r ./dev.in
# via -r dev.in
pyproject-hooks==1.2.0
# via
# build
# pip-tools
pyyaml==6.0.2
# via
# -c ./test.txt
# -c test.txt
# pre-commit
tomli==2.2.1
# via
# -c ./test.txt
# -c test.txt
# build
# pip-tools
virtualenv==20.29.1
virtualenv==20.29.2
# via pre-commit
wheel==0.45.1
# via pip-tools
Expand Down
12 changes: 6 additions & 6 deletions requirements/extra-csv.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,23 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./extra-csv.in
# pip-compile extra-csv.in
#
numpy==1.26.4
# via
# -c ./base.txt
# -c base.txt
# pandas
pandas==2.2.3
# via -r ./extra-csv.in
# via -r extra-csv.in
python-dateutil==2.9.0.post0
# via
# -c ./base.txt
# -c base.txt
# pandas
pytz==2024.2
pytz==2025.1
# via pandas
six==1.17.0
# via
# -c ./base.txt
# -c base.txt
# python-dateutil
tzdata==2025.1
# via pandas
9 changes: 5 additions & 4 deletions requirements/extra-docx.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,16 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./extra-docx.in
# pip-compile extra-docx.in
#
lxml==5.3.0
# via
# -c ./base.txt
# -c ./deps/constraints.txt
# -c base.txt
# python-docx
python-docx==1.1.2
# via -r ./extra-docx.in
# via -r extra-docx.in
typing-extensions==4.12.2
# via
# -c ./base.txt
# -c base.txt
# python-docx
4 changes: 2 additions & 2 deletions requirements/extra-epub.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./extra-epub.in
# pip-compile extra-epub.in
#
pypandoc==1.15
# via -r ./extra-epub.in
# via -r extra-epub.in
6 changes: 3 additions & 3 deletions requirements/extra-markdown.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./extra-markdown.in
# pip-compile extra-markdown.in
#
importlib-metadata==8.6.1
# via
# -c ././deps/constraints.txt
# -c ./deps/constraints.txt
# markdown
markdown==3.7
# via -r ./extra-markdown.in
# via -r extra-markdown.in
zipp==3.21.0
# via importlib-metadata
11 changes: 6 additions & 5 deletions requirements/extra-odt.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,18 @@
# This file is autogenerated by pip-compile with Python 3.9
# by the following command:
#
# pip-compile ./extra-odt.in
# pip-compile extra-odt.in
#
lxml==5.3.0
# via
# -c ./base.txt
# -c ./deps/constraints.txt
# -c base.txt
# python-docx
pypandoc==1.15
# via -r ./extra-odt.in
# via -r extra-odt.in
python-docx==1.1.2
# via -r ./extra-odt.in
# via -r extra-odt.in
typing-extensions==4.12.2
# via
# -c ./base.txt
# -c base.txt
# python-docx
Loading
Loading