Skip to content

Commit 4fbc371

Browse files
committed
Fix Pillow CVEs for llmcompressor images: bump llmcompressor 0.10.0.3
llmcompressor 0.10.0.3 relaxes pillow upper bound from <=12.1.1 to <13.0.0, unblocking the pillow>=12.3.0 CVE constraint for the 2 llmcompressor images. No breaking changes — same 0.10.x branch patch. pillow 12.1.1 → 12.3.0, llmcompressor 0.10.0.1 → 0.10.0.3
1 parent 2b2162b commit 4fbc371

32 files changed

Lines changed: 222 additions & 94 deletions

File tree

codeserver/ubi9-python-3.12/requirements.cpu.txt

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,8 @@ onnx==1.20.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
236236
--hash=sha256:a9732f815fda1639da7da2e944dbaca68c75a931c513db554b6ce2f175b2ead9 \
237237
--hash=sha256:e3c55648d21692275147c704b358c8e575a61ccccb700bccea2d3064ab2ed316
238238
onnxconverter-common==1.16.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
239-
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c
239+
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c \
240+
--hash=sha256:a1984033698675d036c6656a5cbdccb61fcf73ba0800079557b25c5833909543
240241
opencensus==0.11.4 ; implementation_name == 'cpython' and sys_platform == 'linux' \
241242
--hash=sha256:d22373d6a6c2e976b7d554e47bda1839f3651e0d665338fd5174c93c4070b765
242243
opencensus-context==0.1.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
@@ -259,7 +260,11 @@ pandas==2.3.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
259260
--hash=sha256:fe0a87d52babe4a95c84948e303a56edef5e6d6aa84bfd269e3a45674f8bdd53 \
260261
--hash=sha256:42a2816775db605c26c228748c13c7df65323f49570a9d5b90a7f7dadec5d2e5 \
261262
--hash=sha256:e4214e846115332db48099a32ec1f35cf25282a875b66fa358596cbf6b93e6f6 \
262-
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f
263+
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f \
264+
--hash=sha256:874bf118802e3b353fc2ccdbeb50d88dabec955a6e5f40695b1e93f5e6d1459b \
265+
--hash=sha256:3300130acdb89b4c1e5fc651c3db8c84828cf49a26c7ef5fc6357203dbec32b2 \
266+
--hash=sha256:cdf1fd2e171f4eaa830c7ddc61b80d67db27e716c1806e86b6d19028f68f2c57 \
267+
--hash=sha256:11a75fdb52eb65fe2d5bba26cbefd480406a4f3c43b4112212659ded2a858f18
263268
parso==0.8.6 ; implementation_name == 'cpython' and sys_platform == 'linux' \
264269
--hash=sha256:a45ac53bde97ca8c76f9cc9fb0c77a5bccadc5b6bf384c2cbd3b148f0f791512
265270
partd==1.4.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \

codeserver/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml

Lines changed: 9 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

jupyter/datascience/ubi9-python-3.12/requirements.cpu.txt

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -405,7 +405,8 @@ onnx==1.20.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
405405
--hash=sha256:a9732f815fda1639da7da2e944dbaca68c75a931c513db554b6ce2f175b2ead9 \
406406
--hash=sha256:e3c55648d21692275147c704b358c8e575a61ccccb700bccea2d3064ab2ed316
407407
onnxconverter-common==1.16.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
408-
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c
408+
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c \
409+
--hash=sha256:a1984033698675d036c6656a5cbdccb61fcf73ba0800079557b25c5833909543
409410
opencensus==0.11.4 ; implementation_name == 'cpython' and platform_machine != 'ppc64le' and platform_machine != 's390x' and sys_platform == 'linux' \
410411
--hash=sha256:d22373d6a6c2e976b7d554e47bda1839f3651e0d665338fd5174c93c4070b765
411412
opencensus-context==0.1.3 ; implementation_name == 'cpython' and platform_machine != 'ppc64le' and platform_machine != 's390x' and sys_platform == 'linux' \
@@ -432,7 +433,11 @@ pandas==2.3.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
432433
--hash=sha256:fe0a87d52babe4a95c84948e303a56edef5e6d6aa84bfd269e3a45674f8bdd53 \
433434
--hash=sha256:42a2816775db605c26c228748c13c7df65323f49570a9d5b90a7f7dadec5d2e5 \
434435
--hash=sha256:e4214e846115332db48099a32ec1f35cf25282a875b66fa358596cbf6b93e6f6 \
435-
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f
436+
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f \
437+
--hash=sha256:874bf118802e3b353fc2ccdbeb50d88dabec955a6e5f40695b1e93f5e6d1459b \
438+
--hash=sha256:3300130acdb89b4c1e5fc651c3db8c84828cf49a26c7ef5fc6357203dbec32b2 \
439+
--hash=sha256:cdf1fd2e171f4eaa830c7ddc61b80d67db27e716c1806e86b6d19028f68f2c57 \
440+
--hash=sha256:11a75fdb52eb65fe2d5bba26cbefd480406a4f3c43b4112212659ded2a858f18
436441
pandocfilters==1.5.1 ; implementation_name == 'cpython' and sys_platform == 'linux' \
437442
--hash=sha256:37d33c8c75eb39b881537db96acb40fe1ba9dd2184aa1db6551252d634991e22
438443
papermill==2.7.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \

jupyter/datascience/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml

Lines changed: 9 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

jupyter/minimal/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

jupyter/minimal/ubi9-python-3.12/uv.lock.d/pylock.cuda.toml

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

jupyter/minimal/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)