Repository navigation
fix(security): bump pillow, mlflow, gitpython, cryptography for known… - #1450
Conversation
… CVEs - pillow 12.2.0 -> 12.3.0: fixes 7 CVEs (up to CVSS 8.2, heap OOB writes, decompression-bomb-check bypasses). Base runtime dependency, already fixed on release/0.13.0 (#1440) -- this forward-ports that fix to main. - gitpython 3.1.59 -> 3.1.62: fixes CVE-2026-87817/87818/87819 (incl. an RCE via git directory impersonation, 7.5 ReDoS). - cryptography 49.0.0 -> 50.0.1: fixes CVE-2026-69247 (Bleichenbacher oracle in PKCS#7 EnvelopedData decryption). Required bumping mlflow 3.15.1 -> 3.16.1 to lift its `cryptography<50` cap. nltk 3.9.1 is NOT bumped here: lighteval 0.13.0 (latest release) hard-pins `nltk==3.9.1` exactly, so nltk can't move without lighteval releasing a new version. Tracked as a follow-up, not blocking. gitpython/cryptography/mlflow only reach the dependency graph via the `accuracy` optional extra (lighteval/mlflow chain) and are not installed in the shipped runtime container -- fixed opportunistically since not urgent, but pillow is the one with actual runtime exposure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Try out this PRQuick install: pip install --upgrade --force-reinstall git+https://github.com/ai-dynamo/aiperf.git@1b4baa7c66b057e804d122be17219497a514b438Recommended with virtual environment (using uv): uv venv --python 3.12 && source .venv/bin/activate
uv pip install --upgrade --force-reinstall git+https://github.com/ai-dynamo/aiperf.git@1b4baa7c66b057e804d122be17219497a514b438Last updated for commit: |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
 |
| Layer / File(s) | Summary |
|---|---|
Pillow version constraint pyproject.toml |
The Pillow requirement changes from ~=12.2.0 to ~=12.3.0. |
Priority:
Estimated code review effort: 1 (Trivial) | ~2 minutes
Merge Risk: 
60aad
-
No actionable merge-blocking risk is evident in this dependency-only update.
🚥 Pre-merge checks | ✅ 5
-
✅ Passed checks (5 passed)
-
Check name Status Explanation Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled. Title check ✅ Passed The title clearly identifies a security-related dependency update and names the affected packages. It matches the pull request objectives, including the Pillow, MLflow, GitPython, and cryptography upg… Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the version line
Pillow hops to three-oh-nine
One small change in the project burrow
Keeps the package path in order
Ears up for the next release
The build now follows the breeze
Comment @coderabbitai help to get the list of available commands.
![dynamo-review-agent[bot]](https://avatars.githubusercontent.com/u/201626793?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days. |
|
/ok to test 1b4baa7 |
… CVEs
cryptography<50cap.nltk 3.9.1 is NOT bumped here: lighteval 0.13.0 (latest release) hard-pins
nltk==3.9.1exactly, so nltk can't move without lighteval releasing a new version. Tracked as a follow-up, not blocking.gitpython/cryptography/mlflow only reach the dependency graph via the
accuracyoptional extra (lighteval/mlflow chain) and are not installed in the shipped runtime container -- fixed opportunistically since not urgent, but pillow is the one with actual runtime exposure.Summary by CodeRabbit