[rhoai-2.25] fix(deps): bump keras override to >=3.14.0 for CVE-2026-1462

[swattamw2024]

Summary

• Bumps keras override from ~=3.13.2 to >=3.14.0 (locks resolve to 3.15.0) to fix CVE-2026-1462 (Keras safe_mode bypass via TFSMLayer deserialization)
• Adds keras>=3.14.0 to dependencies/cve-constraints.txt and regenerates TensorFlow pylock.toml files
• Trackers: RHOAIENG-57858, RHOAIENG-57859

Prefer same-repo PR for merge / full CI: #2635
Build Notebooks (push): https://github.com/red-hat-data-services/notebooks/actions/runs/30372605566

Fork PR CI cannot use SUBSCRIPTION_* / AIPCC_QUAY_BOT_* / GIT_CRYPT_KEY secrets — use #2635 for validation.

Test plan

• Confirm regenerated pylock.toml files pin keras to >=3.14.0 (3.15.0)
• Build Notebooks (push) on same-repo branch
• Konflux builds pass for notebook images on rhoai-2.25

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependency versions are updated across CVE constraints and environment-specific configuration files. Keras is upgraded from 3.13.2 to 3.14.0 and keras overrides are broadened from ~=3.13.2 to >=3.14.0. Cryptography is bumped from 46.0.5 to 46.0.7, and pytokens updated from 0.3.0 to 0.4.1 in select files, with corresponding lock file hashes refreshed.

Changes

Cohort / File(s)	Summary
CVE Constraint dependencies/cve-constraints.txt	Added new CVE-driven constraint keras>=3.14.0 with accompanying issue comments.
Keras Override Updates in pyproject.toml jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml, jupyter/tensorflow/ubi9-python-3.12/pyproject.toml, runtimes/rocm-tensorflow/ubi9-python-3.12/pyproject.toml, runtimes/tensorflow/ubi9-python-3.12/pyproject.toml	Updated tool.uv.override-dependencies keras constraint from ~=3.13.2 to >=3.14.0 in all four environment configurations.
Jupyter Environment Lock Files jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml, jupyter/tensorflow/ubi9-python-3.12/pylock.toml	Bumped cryptography from 46.0.5 to 46.0.7, keras from 3.13.2 to 3.14.0, and pytokens from 0.3.0 to 0.4.1 with updated sdist URLs, hashes, and wheel manifests.
Runtimes Environment Lock Files runtimes/rocm-tensorflow/ubi9-python-3.12/pylock.toml, runtimes/tensorflow/ubi9-python-3.12/pylock.toml	Updated cryptography from 46.0.5 to 46.0.7 and keras from 3.13.2 to 3.14.0 with refreshed sdist/wheel URLs and sha256 hashes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• dibryant
• daniellutz
• jiridanek

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: widening the Keras override to >=3.14.0 to fix CVE-2026-1462.
Description check	✅ Passed	The PR body includes a clear summary, test plan, and related tracking links, covering the required template sections mostly well.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@swattamw2024 — This PR is from a fork.
The build-rhoai CI job was skipped because subscription
builds (RHEL, AIPCC) need secrets unavailable to forks.
ODH builds and code quality checks still ran.

Recommended: Push your branch to the main repo for full CI:

git remote add upstream https://github.com/red-hat-data-services/notebooks.git
git push upstream HEAD:swattamw2024/your-branch-name

Then open a new PR from that branch.

No push access? A maintainer will cherry-pick and test your changes.

See CONTRIBUTING.md for details.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml`:
- Around line 749-800: The lockfile shows incidental transitive upgrades
(cryptography bumped to 46.0.7 and pytokens 0.4.1 with expanded wheels)
unrelated to the Keras CVE fix; either constrain these changes or explicitly
document and sync them: decide whether to pin cryptography back to "46.0.5" (and
remove pytokens 0.4.1 changes) to keep the patch minimal, or accept them by
updating all regenerated pylock.toml files consistently and add a PR
description/changelog entry listing cryptography=46.0.7 and pytokens=0.4.1 so
downstream consumers are aware. Ensure the chosen action is applied to every
pylock.toml regeneration to avoid divergence.

In `@jupyter/tensorflow/ubi9-python-3.12/pylock.toml`:
- Around line 747-800: Update the PR description to explicitly state that the
cryptography package was bumped from 46.0.5 to 46.0.7 to remediate
CVE-2026-39892 (buffer overflow affecting >=45.0.0 <46.0.7) alongside the Keras
CVE; reference the package entry "name = \"cryptography\"" and the new "version
= \"46.0.7\"" in the pylock.toml diff and add a short note that this is a
security-only change. Also check the other three lockfiles for the same
"cryptography" version change and, if present, add the same CVE note to the PR
so reviewers know the cryptography bump is intentional and security-motivated.
- Around line 4055-4100: The PR accidentally bumped the dependency "pytokens"
from 0.3.0 to 0.4.1 (see the pytokens entry showing wheels and sdist), which
introduces compiled wheels and expands ABI/supply-chain scope; confirm whether
that bump is intended and, if not, revert the pytokens change or restrict
lockfile regeneration to only upgrade the target package (e.g., regenerate the
lock with the tool flag to --upgrade-package keras) so pytokens remains at
0.3.0; if the bump is intended, add an explicit rationale and verify
compatibility across our supported Python ABIs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 57f95924-ed44-4dbc-95dc-ca1c4820f735

📥 Commits

Reviewing files that changed from the base of the PR and between f7e6bfb and 0cebd7c.

📒 Files selected for processing (9)

• dependencies/cve-constraints.txt
• jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml
• jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml
• jupyter/tensorflow/ubi9-python-3.12/pylock.toml
• jupyter/tensorflow/ubi9-python-3.12/pyproject.toml
• runtimes/rocm-tensorflow/ubi9-python-3.12/pylock.toml
• runtimes/rocm-tensorflow/ubi9-python-3.12/pyproject.toml
• runtimes/tensorflow/ubi9-python-3.12/pylock.toml
• runtimes/tensorflow/ubi9-python-3.12/pyproject.toml

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

cryptography 46.0.7 release notes changelog

💡 Result:

PyCA cryptography 46.0.7 was released on April 8, 2026 (noted in announcements, though changelog lists January 27 possibly pre-update). Key changes: - SECURITY ISSUE: Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers (e.g., Hash.update), potentially leading to buffer overflow. CVE-2026-39892. Affected versions: >=45.0.0 <46.0.7. Example: h = Hash(SHA256); h.update(buf[::-1]) could read past buffer end on Python >3.11. - Updated Windows, macOS, and Linux wheels to use OpenSSL 3.5.6. Official changelog: https://cryptography.io/en/stable/changelog/#46-0-7 PyPI release: https://pypi.org/project/cryptography/46.0.7/ GitHub advisory: GHSA-p423-j2cm-9vmq

Citations:

• 1: https://cryptography.io/en/stable/changelog/
• 2: https://seclists.org/oss-sec/2026/q2/51
• 3: https://pypi.org/project/cryptography/

---

Update PR description to document the security fix for cryptography 46.0.7

The cryptography bump from 46.0.5 to 46.0.7 is intentional: it fixes CVE-2026-39892, a buffer overflow vulnerability affecting versions >=45.0.0 <46.0.7. Since the intent is to address the Keras CVE, clarify in the PR description that this security update to cryptography is included alongside it. Verify the same applies to the other three lockfiles.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@jupyter/tensorflow/ubi9-python-3.12/pylock.toml` around lines 747 - 800,
Update the PR description to explicitly state that the cryptography package was
bumped from 46.0.5 to 46.0.7 to remediate CVE-2026-39892 (buffer overflow
affecting >=45.0.0 <46.0.7) alongside the Keras CVE; reference the package entry
"name = \"cryptography\"" and the new "version = \"46.0.7\"" in the pylock.toml
diff and add a short note that this is a security-only change. Also check the
other three lockfiles for the same "cryptography" version change and, if
present, add the same CVE note to the PR so reviewers know the cryptography bump
is intentional and security-motivated.

[jiridanek]

@coderabbitai doublecheck, updated

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

repo="red-hat-data-services/notebooks"
pr="2137"

printf '%s\n' '--- Current PR body ---'
gh pr view "$pr" --repo "$repo" --json body --jq '.body'

printf '%s\n' '--- cryptography changes in the PR ---'
git diff --unified=2 "origin/rhoai-2.25...HEAD" -- \
  'jupyter/tensorflow/ubi9-python-3.12/pylock.toml' \
  'jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml' \
  'runtimes/tensorflow/ubi9-python-3.12/pylock.toml' \
  'runtimes/rocm-tensorflow/ubi9-python-3.12/pylock.toml' \
  | grep -E -B2 -A3 'name = "cryptography"|version = "46\.0\.(5|7)"' || true

Length of output: 2021

---

@jiridanek, I double-checked PR #2137. The current description still does not mention the incidental cryptography 46.0.5 → 46.0.7 security update or CVE-2026-39892, so this finding remains open.

Please add a brief Summary bullet such as:

Regenerated locks also update cryptography from 46.0.5 to 46.0.7, remediating CVE-2026-39892; this is an intentional security-only transitive dependency update.

The local comparison of the other lockfiles was inconclusive because origin/rhoai-2.25 was unavailable in the sandbox, but the supplied diff confirms this update in the reviewed lockfile.

---

🧠 Learnings used

Learnt from: jiridanek
Repo: red-hat-data-services/notebooks PR: 2192
File: runtimes/pytorch+llmcompressor/ubi9-python-3.12/pyproject.toml:55-58
Timestamp: 2026-05-05T11:18:20.110Z
Learning: In red-hat-data-services/notebooks, do not regenerate or update per-image pylock.toml files as part of CVE-fix PRs. This is intentional to avoid public-index vs RH-index diff noise; lock regeneration should be handled by CI/maintainers instead. During review, tolerate that pylock.toml may be stale relative to dependency overrides added in the corresponding pyproject.toml (e.g., pyproject overrides like pyasn1>=0.6.2), and check that deviations are intentional for the affected images rather than treating them as accidental drift.

[jiridanek]

Rebased onto current rhoai-2.25 tip (cherry-pick 0cebd7c0 → d986b102) and force-pushed this fork branch.

Prefer merge via same-repo PR (full CI with subscription/AIPCC secrets): #2635

Build Notebooks (push): https://github.com/red-hat-data-services/notebooks/actions/runs/30372605566

Fork PR CI cannot use SUBSCRIPTION_* / AIPCC_QUAY_BOT_* / GIT_CRYPT_KEY secrets — use #2635 for validation.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (rhoai-2.25@8500837). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff              @@
##             rhoai-2.25   #2137   +/-   ##
============================================
  Coverage              ?       0           
============================================
  Files                 ?       0           
  Lines                 ?       0           
  Branches              ?       0           
============================================
  Hits                  ?       0           
  Misses                ?       0           
  Partials              ?       0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jiridanek]

/build-konflux

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiridanek]

Thanks @swattamw2024 — rebased this branch onto current rhoai-2.25 and updated both remotes:

• red-hat-data-services/notebooks → fix/rhoai-2.25-cve-2026-1462-keras
• swattamw2024/notebooks → cve-2026-1462-keras-override-fix

After rebase, the keras commit is fully superseded by the merged CVE batch in #2634 (keras>=3.14.0 is already on rhoai-2.25). The branch tip is now 6ae9aaa with no remaining diff vs base.

Closing as superseded by #2634 — your original change is landed; no further action needed on this PR.