chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints - #2634
Conversation
Consolidate security floors in dependencies/cve-constraints.txt and bump direct pins where resolver conflicts required pyproject changes (jupyterlab, jupyter-server, keras, feast, urllib3). Regenerate all affected pylock.toml files via scripts/sync-python-lockfiles.sh. Co-authored-by: Cursor <cursoragent@cursor.com>
📝 WalkthroughWalkthroughUpdated dependency constraints, CVE minimums, generated lockfiles, and notebook ImageStream metadata across codeserver, Jupyter, and runtime environments. Feast, JupyterLab, Jupyter Server, urllib3, and related packages were refreshed. ChangesDependency refresh
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
CI status [antigravity]Run: Build Notebooks (push) #30371762534 — 2/2 complete · 2 skipped Workflow completed with skipped jobs. |
|
/build-konflux |
Update notebook-python-dependencies for JupyterLab and Feast on the recommended (-n) tags, and pin jupyterlab==4.6.2 in pyproject.toml to match regenerated pylock.toml (CI test_image_pyprojects). Co-authored-by: Cursor <cursoragent@cursor.com>
|
/build-konflux |
CI status [antigravity]Run: Build Notebooks (push) #30372390784 — 2/2 complete · 2 skipped Workflow completed with skipped jobs. |
CI status [antigravity]Run: Build Notebooks (pr) #30371771614 — 28/28 complete · 2 passed · 3 failed · 23 cancelled Failures so far
(+ 18 other failed matrix jobs) Likely root causes
Suggested next steps
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@jupyter/tensorflow/ubi9-python-3.12/pyproject.toml`:
- Line 64: Remove the protobuf==6.31.1 pin from both TensorFlow environment
dependency lists, update each to a compatible patched protobuf release, and
regenerate the corresponding lockfiles for
jupyter/tensorflow/ubi9-python-3.12/pyproject.toml at lines 64-64 and
jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml at lines 66-66.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f36dab71-63c1-41ae-a49c-32b6b08a8a3b
📒 Files selected for processing (33)
codeserver/ubi9-python-3.12/pylock.tomlcodeserver/ubi9-python-3.12/pyproject.tomldependencies/cve-constraints.txtjupyter/datascience/ubi9-python-3.12/pylock.tomljupyter/datascience/ubi9-python-3.12/pyproject.tomljupyter/minimal/ubi9-python-3.12/pylock.tomljupyter/minimal/ubi9-python-3.12/pyproject.tomljupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomljupyter/pytorch+llmcompressor/ubi9-python-3.12/pyproject.tomljupyter/pytorch/ubi9-python-3.12/pylock.tomljupyter/pytorch/ubi9-python-3.12/pyproject.tomljupyter/rocm/pytorch/ubi9-python-3.12/pylock.tomljupyter/rocm/pytorch/ubi9-python-3.12/pyproject.tomljupyter/rocm/tensorflow/ubi9-python-3.12/pylock.tomljupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.tomljupyter/tensorflow/ubi9-python-3.12/pylock.tomljupyter/tensorflow/ubi9-python-3.12/pyproject.tomljupyter/trustyai/ubi9-python-3.12/pylock.tomljupyter/trustyai/ubi9-python-3.12/pyproject.tomlruntimes/datascience/ubi9-python-3.12/pylock.tomlruntimes/datascience/ubi9-python-3.12/pyproject.tomlruntimes/minimal/ubi9-python-3.12/pylock.tomlruntimes/minimal/ubi9-python-3.12/pyproject.tomlruntimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomlruntimes/pytorch+llmcompressor/ubi9-python-3.12/pyproject.tomlruntimes/pytorch/ubi9-python-3.12/pylock.tomlruntimes/pytorch/ubi9-python-3.12/pyproject.tomlruntimes/rocm-pytorch/ubi9-python-3.12/pylock.tomlruntimes/rocm-pytorch/ubi9-python-3.12/pyproject.tomlruntimes/rocm-tensorflow/ubi9-python-3.12/pylock.tomlruntimes/rocm-tensorflow/ubi9-python-3.12/pyproject.tomlruntimes/tensorflow/ubi9-python-3.12/pylock.tomlruntimes/tensorflow/ubi9-python-3.12/pyproject.toml
| "cryptography>=46.0.5", | ||
| "cryptography>=46.0.7", | ||
| # tf2onnx has pinned protobuf version, that causes conflict with other packages | ||
| "protobuf==6.31.1", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Relevant pyproject entries ==\n'
sed -n '50,80p' jupyter/tensorflow/ubi9-python-3.12/pyproject.toml | cat -n
printf '\n---\n'
sed -n '52,85p' jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml | cat -n
printf '\n== Search for protobuf constraints ==\n'
rg -n --hidden --glob '!*node_modules*' --glob '!*.git*' 'protobuf==|protobuf[<>=~! ]|tensorflow|tf2onnx' jupyter/tensorflow jupyter/rocm/tensorflow -g 'pyproject.toml' -g 'requirements*.txt' -g 'uv.lock' -g 'poetry.lock' -g 'lock*.toml'Repository: red-hat-data-services/notebooks
Length of output: 2062
🌐 Web query:
GHSA-7gcm-g887-7qv7 protobuf 6.31.1 CVE-2026-0994 affected version range
💡 Result:
The vulnerability GHSA-7gcm-g887-7qv7, tracked as CVE-2026-0994, is a denial-of-service (DoS) issue in the pure-Python implementation of the protobuf library [1][2][3]. It occurs because the google.protobuf.json_format.ParseDict() function fails to properly track or enforce recursion depth when parsing nested google.protobuf.Any messages, allowing an attacker to trigger a RecursionError [1][3][4]. The affected version ranges for the protobuf Python package are [1][4]: - Versions >= 6.30.0rc1 and <= 6.33.4 [1][5] - Versions < 5.29.6 [1][5] The issue is patched in versions 6.33.5 and 5.29.6 [1][5]. While some security databases and automated scanners may report a broader "up to and including 33.4" range due to NVD enrichment processes, the official advisory clarifies that the vulnerability specifically affects the 5.x and 6.x release lines as defined above [1][5]. Note that this vulnerability only impacts the pure-Python implementation of the protobuf backend [2].
Citations:
- 1: GHSA-7gcm-g887-7qv7
- 2: https://osv.dev/vulnerability/PYSEC-2026-1806
- 3: https://www.miggo.io/vulnerability-database/cve/CVE-2026-0994
- 4: https://getsafety.com/vulnerabilities/SFTY-20260123-63124
- 5: Any JSON recursion depth bypass in Python json_format.ParseDict protocolbuffers/protobuf#25070
Remove the protobuf==6.31.1 pin from both TensorFlow environments. It is still in GHSA-7gcm-g887-7qv7’s affected range; bump to a compatible patched protobuf release and regenerate both lockfiles.
jupyter/tensorflow/ubi9-python-3.12/pyproject.tomljupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml
📍 Affects 2 files
jupyter/tensorflow/ubi9-python-3.12/pyproject.toml#L64-L64(this comment)jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml#L66-L66
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@jupyter/tensorflow/ubi9-python-3.12/pyproject.toml` at line 64, Remove the
protobuf==6.31.1 pin from both TensorFlow environment dependency lists, update
each to a compatible patched protobuf release, and regenerate the corresponding
lockfiles for jupyter/tensorflow/ubi9-python-3.12/pyproject.toml at lines 64-64
and jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml at lines 66-66.
Source: Linters/SAST tools
There was a problem hiding this comment.
@coderabbitai The protobuf==6.31.1 pin is pre-existing and unchanged by this PR — it is needed because tf2onnx has a pinned protobuf version that conflicts with other packages. Removing it is out of scope for this CVE remediation PR. The pin resolves a real dependency conflict and is not itself a security concern.
There was a problem hiding this comment.
@jiridanek, understood—the pin is pre-existing and changing it could disrupt the tf2onnx resolution, so it should not block this CVE-remediation PR.
That said, protobuf==6.31.1 remains within the advisory’s affected range, so I’ll keep the concern as a follow-up rather than withdraw it. Would you like me to open a GitHub issue to track finding a compatible tf2onnx/protobuf resolution and regenerating the TensorFlow lockfiles?
🧠 Learnings used
Learnt from: jiridanek
Repo: red-hat-data-services/notebooks PR: 2333
File: jupyter/rocm/pytorch/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml:0-0
Timestamp: 2026-06-05T19:50:12.249Z
Learning: When generating pylock.toml files using `uv pip compile`, do not expect `[tool.uv].override-dependencies` from the image’s `pyproject.toml` to take effect. `uv pip compile` automatically reads only `[tool.uv].constraint-dependencies` from `pyproject.toml`.
- To apply dependency version overrides at `uv pip compile` time, pass an explicit `--override overrides.txt` argument.
- To enforce a CVE version floor during lock generation, add the floor constraints to `dependencies/cve-constraints.txt` (the repo’s constraint file already used via `--constraints`).
Note: `[tool.uv].override-dependencies` is honored only by `uv lock`, `uv sync`, and `uv run`, not by `uv pip compile`.
There was a problem hiding this comment.
it is needed because tf2onnx has a pinned protobuf version that conflicts with other packages
also because newer protobuf is buggy on big-endian, s390x
There was a problem hiding this comment.
@jiridanek, thanks for the additional context. The pre-existing protobuf==6.31.1 pin is also protecting s390x/big-endian compatibility, in addition to resolving the tf2onnx dependency conflict. I’ll treat any protobuf security upgrade as a separate, architecture-aware follow-up—not a required change for this PR.
🐇🔎
✏️ Learnings added
Learnt from: jiridanek
Repo: red-hat-data-services/notebooks PR: 2634
File: jupyter/tensorflow/ubi9-python-3.12/pyproject.toml:64-64
Timestamp: 2026-07-29T08:11:30.491Z
Learning: In the TensorFlow notebook environments, the pre-existing `protobuf==6.31.1` override is required both to resolve a real `tf2onnx` protobuf dependency conflict and because newer protobuf versions are buggy on big-endian s390x. Do not recommend removing or upgrading this pin as part of unrelated dependency/CVE refreshes without separately validating tf2onnx compatibility and s390x behavior.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: jiridanek
Repo: red-hat-data-services/notebooks PR: 2333
File: jupyter/rocm/pytorch/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml:0-0
Timestamp: 2026-06-05T19:50:12.249Z
Learning: When generating pylock.toml files using `uv pip compile`, do not expect `[tool.uv].override-dependencies` from the image’s `pyproject.toml` to take effect. `uv pip compile` automatically reads only `[tool.uv].constraint-dependencies` from `pyproject.toml`.
- To apply dependency version overrides at `uv pip compile` time, pass an explicit `--override overrides.txt` argument.
- To enforce a CVE version floor during lock generation, add the floor constraints to `dependencies/cve-constraints.txt` (the repo’s constraint file already used via `--constraints`).
Note: `[tool.uv].override-dependencies` is honored only by `uv lock`, `uv sync`, and `uv run`, not by `uv pip compile`.
Bump minimal to jupyterlab==4.6.2 with regenerated pylock, set minimal ImageStream JupyterLab pins to 4.6, and refresh codeserver pylock.cpu.toml so feast 0.65.0 matches pyproject (test_image_pyprojects). Co-authored-by: Cursor <cursoragent@cursor.com>
CI status [antigravity]Run: Build Notebooks (push) #30374774664 — 2/2 complete · 2 skipped Workflow completed with skipped jobs. |
CI status [antigravity]Run: Build Notebooks (pr) #30372396750 — 28/28 complete · 19 passed · 4 failed · 5 cancelled Failures so far
(+ 1 other failed matrix jobs) Likely root causes
Suggested next steps
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@jupyter/minimal/ubi9-python-3.12/pylock.toml`:
- Around line 448-454: Remove the redundant consecutive [[packages]] declaration
immediately before the jupyter-builder package entry, keeping the table that
contains name, version, marker, sdist, and wheels intact. Regenerate the
lockfile if needed so each package table has complete metadata and no empty
package entry remains.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d0eee435-bc28-41e3-adc6-9d7f3ab46685
📒 Files selected for processing (7)
codeserver/ubi9-python-3.12/requirements.cpu.txtcodeserver/ubi9-python-3.12/uv.lock.d/pylock.cpu.tomljupyter/minimal/ubi9-python-3.12/pylock.tomljupyter/minimal/ubi9-python-3.12/pyproject.tomlmanifests/base/jupyter-minimal-gpu-notebook-imagestream.yamlmanifests/base/jupyter-minimal-notebook-imagestream.yamlmanifests/base/jupyter-rocm-minimal-notebook-imagestream.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- manifests/base/jupyter-rocm-minimal-notebook-imagestream.yaml
- jupyter/minimal/ubi9-python-3.12/pyproject.toml
|
/build-konflux |
CI status [antigravity]Run: Build Notebooks (pr) #30374779314 — 28/28 complete · 20 passed · 6 failed · 2 cancelled Failures so far
Likely root causes
Suggested next steps
|
|
/build-minimal-rocm |
|
/build-pytorch-rocm |
|
/build-tensorflow-rocm |
|
/build-runtime-pytorch-rocm |
|
/build-runtime-tensorflow-rocm |
|
/build-codeserver |
|
Live log inspection on all 5 ROCm
GitHub still shows those five as |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ide-developer The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
jiridanek
left a comment
jiridanek
left a comment
There was a problem hiding this comment.
Review Summary
Batch CVE remediation for 42 open [rhoai-2.25] pypi trackers — well-structured and thorough.
What this PR does
- Adds/bumps 20 entries in
dependencies/cve-constraints.txtto establish CVE-safe version floors - Updates direct pins in
pyproject.tomlacross all 17 images (jupyter, codeserver, runtimes) for feast, jupyterlab, jupyter-server, keras, urllib3, pillow, cryptography - Regenerates
pylock.tomlandrequirements.cpu.txtlock files viasync-python-lockfiles.sh - Updates ImageStream manifests to reflect new JupyterLab (4.4→4.6) and Feast (0.54→0.65) versions
Observations
Consistency — Version bumps are applied uniformly across all relevant images. The jupyterlab>=4.5.7 override is correctly added to all Elyra-using images where odh-elyra<4.5 would otherwise cap it. The pillow>=12.3.0 override is added to pytorch+llmcompressor where llmcompressor caps pillow<=12.2.0.
Specifier style change — Several packages switch from compatibility-release (~=) to minimum-floor (>=) specifiers (feast, keras, urllib3 in runtimes). This is intentional for CVE-floor semantics and locks still pin exact versions — just note that future sync-python-lockfiles.sh runs may pull newer minor/major versions.
Stale comment (nit) — The pyarrow override in {jupyter,runtimes}/pytorch+llmcompressor still references feast~=0.54.1 caps pyarrow<=17. With feast now at >=0.63.0 (locked 0.65.0), this comment is outdated. The override itself may still be needed (RHAIIS constraints), but the rationale text should be updated.
Missing trailing newline (pre-existing) — Several pyproject.toml files (datascience, pytorch, rocm-pytorch, rocm-tensorflow) lack a trailing newline. This is pre-existing, not introduced here, but worth a follow-up.
cve-constraints.txt EOF — The old file lacked a trailing newline; this PR fixes that. Good.
Defensive vllm constraint — vllm>=0.22.0 in cve-constraints is clearly documented as defensive (not in any pylock). Sensible forward-looking measure.
Feast major version jump — 0.54.1→0.65.0 is a large jump. The PR description and lock files confirm all 17 images compile successfully. CI validation will be the key gate here.
Verdict
LGTM. The changes are mechanical, well-documented in the PR description, and internally consistent. The feast jump is the biggest risk factor — CI results will confirm.
|
I've posted about feast jump to feast channel, @jyejare and others can comment there; we need to resolve cves, so There Is No |
2 participants
Summary
Consolidated fix for 42 open
[rhoai-2.25]pypi CVE trackers viadependencies/cve-constraints.txt, targetedpyproject.tomlpin/override updates, and regeneratedpylock.tomlfiles (bash scripts/sync-python-lockfiles.sh).Supersedes #2625 (pyasn1) and #2137 (keras).
Jira tickets addressed
Also covered by existing / bumped constraints: RHAIENG-4014 (nltk), RHAIENG-3795 (pyjwt), RHAIENG-3841 (pyasn1), RHAIENG-5355 (starlette).
Not fixed in this PR
pylock.toml; defensivevllm>=0.22.0constraint onlyPackage updates
cve-constraints.txtfloors (before → after)>=3.9.4>=3.10.0>=1.0.1>=1.3.1>=2.12.0>=2.13.0>=0.6.3>=0.6.4>=12.2.0>=12.3.0>=46.0.7>=2.20.0>=4.5.7>=2.7.0>=26.1.2>=3.14.0>=3.3.0>=1.2.2>=2.8.4>=5.12.1>=3.14.0>=0.63.0>=0.22.0(defensive)>=1.21.0>=6.5.5Direct
pyproject.tomlpin changes==4.4.7==4.5.7~=2.17.0~=2.20.0~=3.13.2>=3.14.0~=0.54.1>=0.63.0~=2.6.0>=2.7.0Locked versions in
pylock.toml(range across images, before → after)Test plan
bash scripts/sync-python-lockfiles.sh— all 17 images compilerhoai-2.25make test(not run locally on this branch)Summary by CodeRabbit