chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints

codeserver/ubi9-python-3.12/pylock.toml

@@ -477,10 +477,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/cb/a8/20d0723294217e4
 
 [[packages]]
 name = "feast"
-version = "0.54.1"
+version = "0.65.0"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/c6/e7/0598b9042d80c43af6f67fe60dc00df658dd2c65e7c217630b6494f3cbef/feast-0.54.1.tar.gz", upload-time = 2025-12-04T05:52:24Z, size = 6133444, hashes = { sha256 = "c72bb646e90139fb5ae13bb66e327659b69842b01482d8bdcc0b71c3fdbfe070" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/6d/08/f6e5c36fa71c2c717b22954857205803aa86c8891a0123be76df33c4ef94/feast-0.54.1-py2.py3-none-any.whl", upload-time = 2025-12-04T05:52:21Z, size = 7619663, hashes = { sha256 = "41c1c5e732197d95759fa4cbad886708b582763c003f67c77ab66d736f885550" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/df/83/3f3501b449bc17989353c07239c82941a66350126af54920ef0aa1f549bd/feast-0.65.0.tar.gz", upload-time = 2026-07-20T13:38:31Z, size = 7879801, hashes = { sha256 = "2f2c8c9ae6179fba9ec161205e7c30ab5a952e203cf444880e208c217691b9e2" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/51/45/3d6f346c7136433186ba0a4005bc648ff12e0181c2926ce1f75794ad327c/feast-0.65.0-py3-none-any.whl", upload-time = 2026-07-20T13:38:29Z, size = 9253730, hashes = { sha256 = "1b40680587e49202869b85dd17a1a65d1c2aaf6d91bdc2b12d1a100ccca4cd3b" } }]
 
 [[packages]]
 name = "filelock"

codeserver/ubi9-python-3.12/pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "skl2onnx~=1.19.1; platform_machine != 's390x'",
     "onnx>=1.21.0; platform_machine != 's390x'",
     "kubeflow-training==1.9.3",
-    "feast~=0.54.1",
+    "feast>=0.63.0",
 
     # Some extra useful packages
     "opencensus~=0.11.4",

dependencies/cve-constraints.txt

@@ -5,27 +5,69 @@
 #
 # When adding a new CVE fix:
 # 1. Add the constraint below with CVE ID and issue reference in a comment
-# 2. Regenerate the affected lock files
+# 2. Regenerate lock files: bash scripts/sync-python-lockfiles.sh
 
-# RHAIENG-4014: CVE-2026-33236 NLTK path traversal in XML index files
+# RHAIENG-4014 / RHAIENG-5886 / RHAIENG-5781 / RHAIENG-5987: NLTK CVEs
 # Reference: https://access.redhat.com/security/cve/CVE-2026-33236
-nltk>=3.9.4
+nltk>=3.10.0
 
-# CVE-2026-28500: onnx.hub unsafe loads (fixed in onnx>=1.21.0). ml-dtypes (ONNX dep) lacks
-# reliable s390x wheels — align marker with pyproject direct deps.
+# RHAIENG-4276: CVE-2026-34445 onnx.hub unsafe loads (fixed in onnx>=1.21.0).
+# ml-dtypes (ONNX dep) lacks reliable s390x wheels — align marker with pyproject direct deps.
 onnx>=1.21.0 ; platform_machine != 's390x'
 # ONNX 1.21+ API compatibility (replaces onnx.mapping usage in older releases)
 onnxconverter-common~=1.16.0
-# RHAIENG-3793:CVE-2026-31958 Tornado: Denial of Service via large multipart bodies
+
+# RHAIENG-4278: CVE-2026-35536 Tornado DoS via large multipart bodies
 tornado>=6.5.5
-# RHAIENG-5355: CVE-2026-48710 Starlette: Security restriction bypass via malformed HTTP Host header
-starlette>=1.0.1
-# RHAIENG-3795: CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 violation)
-# Reference: https://access.redhat.com/security/cve/CVE-2026-32597
-pyjwt>=2.12.0
-# RHAIENG-3841: CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
-# Reference: https://access.redhat.com/security/cve/CVE-2026-30922
-pyasn1>=0.6.3
-# RHAIENG-4594: CVE-2026-40192 Pillow: Denial of Service via decompression bomb in FITS image processing
-# Reference: https://access.redhat.com/security/cve/CVE-2026-40192
-pillow>=12.2.0
+
+# RHAIENG-5355 / RHAIENG-6324: Starlette Host header bypass
+starlette>=1.3.1
+
+# RHAIENG-3795 / RHAIENG-5794: PyJWT unknown crit header extensions
+pyjwt>=2.13.0
+
+# RHAIENG-3841 / RHAIENG-6370 / RHAIENG-6354: pyasn1 DoS via unbounded recursion / crafted OID
+pyasn1>=0.6.4
+
+# RHAIENG-4594 / RHAIENG-6097+ / RHAIENG-6108+: Pillow CVE batch (FITS bomb, buffer overflows, etc.)
+pillow>=12.3.0
+
+# RHAIENG-5051: CVE-2026-39892 cryptography OpenSSL-adjacent fixes
+cryptography>=46.0.7
+
+# RHAIENG-5214 / RHAIENG-5800 / RHAIENG-5832 / RHAIENG-5850: jupyter-server CVE batch
+jupyter-server>=2.20.0
+
+# RHAIENG-5789 / RHAIENG-5895: jupyterlab CVE batch
+jupyterlab>=4.5.7
+
+# RHAIENG-5302 / RHAIENG-5304: urllib3 redirect and decompression CVEs
+urllib3>=2.7.0
+
+# RHAIENG-5306: CVE-2026-8643 pip path traversal
+pip>=26.1.2
+
+# RHAIENG-5488: CVE-2026-34993 aiohttp chunked encoding DoS
+aiohttp>=3.14.0
+
+# RHAIENG-5830 / RHAIENG-5883: mistune XSS / parsing CVEs
+mistune>=3.3.0
+
+# RHAIENG-4686: CVE-2026-28684 python-dotenv
+python-dotenv>=1.2.2
+
+# RHAIENG-6314 / RHAIENG-6317: soupsieve CSS selector parsing CVEs
+soupsieve>=2.8.4
+
+# RHAIENG-5791: CVE-2026-44660 ujson buffer overflow
+ujson>=5.12.1
+
+# RHAIENG-4458 / RHAIENG-5701 / RHAIENG-6358: keras deserialization and path traversal CVEs
+# Fixed in keras>=3.14.0 (CVE-2026-1462, CVE-2026-11816)
+keras>=3.14.0
+
+# RHAIENG-5873: CVE-2026-56121 Feast gRPC registry RCE (fixed in feast>=0.63.0)
+feast>=0.63.0
+
+# RHAIENG-5853: CVE-2026-48746 vllm (defensive floor; not a direct notebook dependency today)
+vllm>=0.22.0

jupyter/datascience/ubi9-python-3.12/pylock.toml

@@ -609,10 +609,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/cb/a8/20d0723294217e4
 
 [[packages]]
 name = "feast"
-version = "0.54.1"
+version = "0.65.0"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/c6/e7/0598b9042d80c43af6f67fe60dc00df658dd2c65e7c217630b6494f3cbef/feast-0.54.1.tar.gz", upload-time = 2025-12-04T05:52:24Z, size = 6133444, hashes = { sha256 = "c72bb646e90139fb5ae13bb66e327659b69842b01482d8bdcc0b71c3fdbfe070" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/6d/08/f6e5c36fa71c2c717b22954857205803aa86c8891a0123be76df33c4ef94/feast-0.54.1-py2.py3-none-any.whl", upload-time = 2025-12-04T05:52:21Z, size = 7619663, hashes = { sha256 = "41c1c5e732197d95759fa4cbad886708b582763c003f67c77ab66d736f885550" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/df/83/3f3501b449bc17989353c07239c82941a66350126af54920ef0aa1f549bd/feast-0.65.0.tar.gz", upload-time = 2026-07-20T13:38:31Z, size = 7879801, hashes = { sha256 = "2f2c8c9ae6179fba9ec161205e7c30ab5a952e203cf444880e208c217691b9e2" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/51/45/3d6f346c7136433186ba0a4005bc648ff12e0181c2926ce1f75794ad327c/feast-0.65.0-py3-none-any.whl", upload-time = 2026-07-20T13:38:29Z, size = 9253730, hashes = { sha256 = "1b40680587e49202869b85dd17a1a65d1c2aaf6d91bdc2b12d1a100ccca4cd3b" } }]
 
 [[packages]]
 name = "filelock"
@@ -1029,6 +1029,13 @@ marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and
 sdist = { url = "https://files.pythonhosted.org/packages/b4/fd/8f0213c704bf36b5f523ae5bf7dc367f3687e75dcc2354084b75c05d2b53/jupyter_bokeh-4.0.5.tar.gz", upload-time = 2024-06-03T06:33:33Z, size = 149140, hashes = { sha256 = "a33d6ab85588f13640b30765fa15d1111b055cbe44f67a65ca57d3593af8245d" } }
 wheels = [{ url = "https://files.pythonhosted.org/packages/47/78/33b2294aad62e5f95b89a89379c5995c2bd978018387ef8bec79f6dc272c/jupyter_bokeh-4.0.5-py3-none-any.whl", upload-time = 2024-06-03T06:33:35Z, size = 148593, hashes = { sha256 = "1110076c14c779071cf492646a1a871aefa8a477261e4721327a666e65df1a2c" } }]
 
+[[packages]]
+name = "jupyter-builder"
+version = "1.1.1"
+marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
+sdist = { url = "https://files.pythonhosted.org/packages/c3/61/47f7ae054f5cd3983c10e1d65a6eb7fcd4b87ebb1056e190ef7d63ff4f19/jupyter_builder-1.1.1.tar.gz", upload-time = 2026-07-17T13:14:47Z, size = 971667, hashes = { sha256 = "1a13977912b08deda77fce2c803940131c27cf77a27ed64b9ffca25aa0ed7e6c" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/83/cc/f6a12de1c890ea5dd2816c5c76d5ac6d3ed52db3c37f78691328207d13b9/jupyter_builder-1.1.1-py3-none-any.whl", upload-time = 2026-07-17T13:14:45Z, size = 913264, hashes = { sha256 = "f9c14bc55c0488a073f62af12d468936fcf9ecb7e9dd802f6f9c33de46ad70db" } }]
+
 [[packages]]
 name = "jupyter-client"
 version = "8.9.1"
@@ -1073,10 +1080,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/5a/80/5a1162f78414298
 
 [[packages]]
 name = "jupyter-server"
-version = "2.17.0"
+version = "2.20.0"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/5b/ac/e040ec363d7b6b1f11304cc9f209dac4517ece5d5e01821366b924a64a50/jupyter_server-2.17.0.tar.gz", upload-time = 2025-08-21T14:42:54Z, size = 731949, hashes = { sha256 = "c38ea898566964c888b4772ae1ed58eca84592e88251d2cfc4d171f81f7e99d5" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/92/80/a24767e6ca280f5a49525d987bf3e4d7552bf67c8be07e8ccf20271f8568/jupyter_server-2.17.0-py3-none-any.whl", upload-time = 2025-08-21T14:42:52Z, size = 388221, hashes = { sha256 = "e8cb9c7db4251f51ed307e329b81b72ccf2056ff82d50524debde1ee1870e13f" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/6b/dc/db3a582633170186f8c8b31298d7eb26ad0eb031a1f53476c258b64eed05/jupyter_server-2.20.0.tar.gz", upload-time = 2026-06-17T12:09:09Z, size = 756523, hashes = { sha256 = "b5778ba337d8015a3dc2b80803ecdd5ac18d3797fddf61a50ea5fb472b4ebe14" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/f3/71/8c002223e873a870f5c41dc69b0a7c922301123e4a31d5d01ecb700aef77/jupyter_server-2.20.0-py3-none-any.whl", upload-time = 2026-06-17T12:09:07Z, size = 393143, hashes = { sha256 = "c3b67c93c471e947c18b5026f04f21614218adb706df8f48227d3ee8e0a7cdcc" } }]
 
 [[packages]]
 name = "jupyter-server-proxy"
@@ -1094,10 +1101,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/d1/2d/6674563f71c6320
 
 [[packages]]
 name = "jupyterlab"
-version = "4.4.7"
+version = "4.6.2"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/d0/07/b3beaeb5722d4a55e345a38884c67baebd9cec2269c5309ce494485a5858/jupyterlab-4.4.7.tar.gz", upload-time = 2025-09-03T13:26:40Z, size = 22965570, hashes = { sha256 = "8c8e225492f4513ebde9bbbc00a05b651ab9a1f5b0013015d96fabf671c37188" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/7e/01/44f35124896dd5c73b26705c25bb8af2089895b32f057a1e4a3488847333/jupyterlab-4.4.7-py3-none-any.whl", upload-time = 2025-09-03T13:26:35Z, size = 12291583, hashes = { sha256 = "808bae6136b507a4d18f04254218bfe71ed8ba399a36ef3280d5f259e69abf80" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/7a/7f/51c0c856ab286bdaf5709cf61ed13584ed9d4bee906479707da45b11b353/jupyterlab-4.6.2.tar.gz", upload-time = 2026-07-21T12:05:24Z, size = 28183650, hashes = { sha256 = "e18ce8b34f3de350e93cd5b2c4f3ae884cbe266eb76bf5d6825a4ed34c13bcff" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/63/1f/e39b248c76bb3736bc05a9491a6aa1315414c32dea12f548ecc1b24c758e/jupyterlab-4.6.2-py3-none-any.whl", upload-time = 2026-07-21T12:05:19Z, size = 17166703, hashes = { sha256 = "5964447036629adfcd3fc0969effc1da6f47d2cbd0a60b2c2eea7c31be0ec6a8" } }]
 
 [[packages]]
 name = "jupyterlab-git"
@@ -1891,10 +1898,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d920
 
 [[packages]]
 name = "prometheus-client"
-version = "0.25.0"
+version = "0.24.1"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/1b/fb/d9aa83ffe43ce1f19e557c0971d04b90561b0cfd50762aafb01968285553/prometheus_client-0.25.0.tar.gz", upload-time = 2026-04-09T19:53:42Z, size = 86035, hashes = { sha256 = "5e373b75c31afb3c86f1a52fa1ad470c9aace18082d39ec0d2f918d11cc9ba28" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/8d/9b/d4b1e644385499c8346fa9b622a3f030dce14cd6ef8a1871c221a17a67e7/prometheus_client-0.25.0-py3-none-any.whl", upload-time = 2026-04-09T19:53:41Z, size = 64154, hashes = { sha256 = "d5aec89e349a6ec230805d0df882f3807f74fd6c1a2fa86864e3c2279059fed1" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/f0/58/a794d23feb6b00fc0c72787d7e87d872a6730dd9ed7c7b3e954637d8f280/prometheus_client-0.24.1.tar.gz", upload-time = 2026-01-14T15:26:26Z, size = 85616, hashes = { sha256 = "7e0ced7fbbd40f7b84962d5d2ab6f17ef88a72504dcf7c0b40737b43b2a461f9" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/74/c3/24a2f845e3917201628ecaba4f18bab4d18a337834c1df2a159ee9d22a42/prometheus_client-0.24.1-py3-none-any.whl", upload-time = 2026-01-14T15:26:24Z, size = 64057, hashes = { sha256 = "150db128af71a5c2482b36e588fc8a6b95e498750da4b17065947c16070f4055" } }]
 
 [[packages]]
 name = "prompt-toolkit"
@@ -2023,10 +2030,10 @@ wheels = [
 
 [[packages]]
 name = "pyasn1"
-version = "0.6.3"
+version = "0.6.4"
 marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
-sdist = { url = "https://files.pythonhosted.org/packages/5c/5f/6583902b6f79b399c9c40674ac384fd9cd77805f9e6205075f828ef11fb2/pyasn1-0.6.3.tar.gz", upload-time = 2026-03-17T01:06:53Z, size = 148685, hashes = { sha256 = "697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf" } }
-wheels = [{ url = "https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl", upload-time = 2026-03-17T01:06:52Z, size = 83997, hashes = { sha256 = "a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde" } }]
+sdist = { url = "https://files.pythonhosted.org/packages/a4/9a/23310166d960def5897e91fe20e5b724601b02a22e84ba1f94232c0b7f67/pyasn1-0.6.4.tar.gz", upload-time = 2026-07-09T01:12:33Z, size = 151262, hashes = { sha256 = "9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81" } }
+wheels = [{ url = "https://files.pythonhosted.org/packages/9a/3b/6163796d69c3977d1e4287bea4a6979161cbbdd170ebb430511e8e1999ce/pyasn1-0.6.4-py3-none-any.whl", upload-time = 2026-07-09T01:12:32Z, size = 84410, hashes = { sha256 = "deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b" } }]
 
 [[packages]]
 name = "pyasn1-modules"

jupyter/datascience/ubi9-python-3.12/pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
     "onnx>=1.21.0; platform_machine != 's390x'",  # CVE-2026-28500
     "kubeflow-training==1.9.3",
     "codeflare-sdk~=0.31.2; platform_machine != 'ppc64le' and platform_machine != 's390x'",
-    "feast~=0.54.1",
+    "feast>=0.63.0",
 
     # DB connectors
     "pymongo~=4.14.1",
@@ -31,9 +31,9 @@ dependencies = [
     "odh-elyra==4.2.4",
     "odh-jupyter-trash-cleanup==0.1.1",
 
-    "jupyterlab==4.4.7",
+    "jupyterlab==4.5.7",
     "jupyter-bokeh~=4.0.5",
-    "jupyter-server~=2.17.0",
+    "jupyter-server~=2.20.0",
     "jupyter-server-proxy~=4.4.0",
     "jupyter-server-terminals~=0.5.3",
     "jupyterlab-git~=0.51.2",
@@ -56,14 +56,16 @@ environments = [
     "python_version == '3.12' and sys_platform == 'linux' and platform_machine == 'aarch64'",
 ]
 override-dependencies = [
+    # RHAIENG-5789/5895: jupyterlab CVE batch (odh-elyra<4.5 cap)
+    "jupyterlab>=4.5.7",
     # RHAIENG-3211: CVE-2026-26007 cryptography Subgroup Attack
-    "cryptography>=46.0.5",
+    "cryptography>=46.0.7",
     # RHAIENG-2458: CVE-2025-66418 urllib3 decompression vulnerability
     # Upstream: https://github.com/elyra-ai/elyra/issues/3325
-    "urllib3>=2.6.0",
+    "urllib3>=2.7.0",
     # RHAIENG-3209: CVE-2026-25990  Pillow: Out-of-bounds Write
     # Upstream: https://github.com/vllm-project/llm-compressor/releases/tag/0.7.1.1
-    "pillow>=12.1.1",
+    "pillow>=12.3.0",
     # RHOAIENG-53183: CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name
     "black>=26.3.1",
 ]