Skip to content

chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints #2634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiridanek merged 3 commits into from
Jul 29, 2026
Merged

chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints #2634

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4fac78b
chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints
jiridanek Jul 28, 2026
9359437
fix(manifests): align ImageStream pins with pylock CVE bumps
jiridanek Jul 28, 2026
960ac94
fix(ci): align minimal JupyterLab and codeserver hermetic feast lock
jiridanek Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions codeserver/ubi9-python-3.12/pylock.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,10 +477,10 @@ wheels = [{ url = "https://files.pythonhosted.org/packages/cb/a8/20d0723294217e4

[[packages]]
name = "feast"
version = "0.54.1"
version = "0.65.0"
marker = "(python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux')"
sdist = { url = "https://files.pythonhosted.org/packages/c6/e7/0598b9042d80c43af6f67fe60dc00df658dd2c65e7c217630b6494f3cbef/feast-0.54.1.tar.gz", upload-time = 2025-12-04T05:52:24Z, size = 6133444, hashes = { sha256 = "c72bb646e90139fb5ae13bb66e327659b69842b01482d8bdcc0b71c3fdbfe070" } }
wheels = [{ url = "https://files.pythonhosted.org/packages/6d/08/f6e5c36fa71c2c717b22954857205803aa86c8891a0123be76df33c4ef94/feast-0.54.1-py2.py3-none-any.whl", upload-time = 2025-12-04T05:52:21Z, size = 7619663, hashes = { sha256 = "41c1c5e732197d95759fa4cbad886708b582763c003f67c77ab66d736f885550" } }]
sdist = { url = "https://files.pythonhosted.org/packages/df/83/3f3501b449bc17989353c07239c82941a66350126af54920ef0aa1f549bd/feast-0.65.0.tar.gz", upload-time = 2026-07-20T13:38:31Z, size = 7879801, hashes = { sha256 = "2f2c8c9ae6179fba9ec161205e7c30ab5a952e203cf444880e208c217691b9e2" } }
wheels = [{ url = "https://files.pythonhosted.org/packages/51/45/3d6f346c7136433186ba0a4005bc648ff12e0181c2926ce1f75794ad327c/feast-0.65.0-py3-none-any.whl", upload-time = 2026-07-20T13:38:29Z, size = 9253730, hashes = { sha256 = "1b40680587e49202869b85dd17a1a65d1c2aaf6d91bdc2b12d1a100ccca4cd3b" } }]

[[packages]]
name = "filelock"
Expand Down
2 changes: 1 addition & 1 deletion codeserver/ubi9-python-3.12/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ dependencies = [
"skl2onnx~=1.19.1; platform_machine != 's390x'",
"onnx>=1.21.0; platform_machine != 's390x'",
"kubeflow-training==1.9.3",
"feast~=0.54.1",
"feast>=0.63.0",

# Some extra useful packages
"opencensus~=0.11.4",
Expand Down
6 changes: 3 additions & 3 deletions codeserver/ubi9-python-3.12/requirements.cpu.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,9 +291,9 @@ fastapi==0.139.0 ; (python_full_version == '3.12.*' and platform_machine == 'aar
fastjsonschema==2.21.2 ; (python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux') \
--hash=sha256:1c797122d0a86c5cace2e54bf4e819c36223b552017172f32c5c024a6b77e463 \
--hash=sha256:b1eb43748041c880796cd077f1a07c3d94e93ae84bba5ed36800a33554ae05de
feast==0.54.1 ; (python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux') \
--hash=sha256:41c1c5e732197d95759fa4cbad886708b582763c003f67c77ab66d736f885550 \
--hash=sha256:c72bb646e90139fb5ae13bb66e327659b69842b01482d8bdcc0b71c3fdbfe070
feast==0.65.0 ; (python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux') \
--hash=sha256:1b40680587e49202869b85dd17a1a65d1c2aaf6d91bdc2b12d1a100ccca4cd3b \
--hash=sha256:2f2c8c9ae6179fba9ec161205e7c30ab5a952e203cf444880e208c217691b9e2
filelock==3.29.7 ; (python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'ppc64le' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 's390x' and sys_platform == 'linux') or (python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux') \
--hash=sha256:987db6f789a3a2a59f55081801b2b3697cb97e2a736b5f1a9e99b559285fbc51 \
--hash=sha256:5b481979797ae69e72f0b389d89a80bdd585c260c5b3f1fb9c0a5ba9bb3f195d
Expand Down
6 changes: 3 additions & 3 deletions codeserver/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

76 changes: 59 additions & 17 deletions dependencies/cve-constraints.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,27 +5,69 @@
#
# When adding a new CVE fix:
# 1. Add the constraint below with CVE ID and issue reference in a comment
# 2. Regenerate the affected lock files
# 2. Regenerate lock files: bash scripts/sync-python-lockfiles.sh

# RHAIENG-4014: CVE-2026-33236 NLTK path traversal in XML index files
# RHAIENG-4014 / RHAIENG-5886 / RHAIENG-5781 / RHAIENG-5987: NLTK CVEs
# Reference: https://access.redhat.com/security/cve/CVE-2026-33236
nltk>=3.9.4
nltk>=3.10.0

# CVE-2026-28500: onnx.hub unsafe loads (fixed in onnx>=1.21.0). ml-dtypes (ONNX dep) lacks
# reliable s390x wheels — align marker with pyproject direct deps.
# RHAIENG-4276: CVE-2026-34445 onnx.hub unsafe loads (fixed in onnx>=1.21.0).
# ml-dtypes (ONNX dep) lacks reliable s390x wheels — align marker with pyproject direct deps.
onnx>=1.21.0 ; platform_machine != 's390x'
# ONNX 1.21+ API compatibility (replaces onnx.mapping usage in older releases)
onnxconverter-common~=1.16.0
# RHAIENG-3793:CVE-2026-31958 Tornado: Denial of Service via large multipart bodies

# RHAIENG-4278: CVE-2026-35536 Tornado DoS via large multipart bodies
tornado>=6.5.5
# RHAIENG-5355: CVE-2026-48710 Starlette: Security restriction bypass via malformed HTTP Host header
starlette>=1.0.1
# RHAIENG-3795: CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 violation)
# Reference: https://access.redhat.com/security/cve/CVE-2026-32597
pyjwt>=2.12.0
# RHAIENG-3841: CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
# Reference: https://access.redhat.com/security/cve/CVE-2026-30922
pyasn1>=0.6.3
# RHAIENG-4594: CVE-2026-40192 Pillow: Denial of Service via decompression bomb in FITS image processing
# Reference: https://access.redhat.com/security/cve/CVE-2026-40192
pillow>=12.2.0

# RHAIENG-5355 / RHAIENG-6324: Starlette Host header bypass
starlette>=1.3.1

# RHAIENG-3795 / RHAIENG-5794: PyJWT unknown crit header extensions
pyjwt>=2.13.0

# RHAIENG-3841 / RHAIENG-6370 / RHAIENG-6354: pyasn1 DoS via unbounded recursion / crafted OID
pyasn1>=0.6.4

# RHAIENG-4594 / RHAIENG-6097+ / RHAIENG-6108+: Pillow CVE batch (FITS bomb, buffer overflows, etc.)
pillow>=12.3.0

# RHAIENG-5051: CVE-2026-39892 cryptography OpenSSL-adjacent fixes
cryptography>=46.0.7

# RHAIENG-5214 / RHAIENG-5800 / RHAIENG-5832 / RHAIENG-5850: jupyter-server CVE batch
jupyter-server>=2.20.0

# RHAIENG-5789 / RHAIENG-5895: jupyterlab CVE batch
jupyterlab>=4.5.7

# RHAIENG-5302 / RHAIENG-5304: urllib3 redirect and decompression CVEs
urllib3>=2.7.0

# RHAIENG-5306: CVE-2026-8643 pip path traversal
pip>=26.1.2

# RHAIENG-5488: CVE-2026-34993 aiohttp chunked encoding DoS
aiohttp>=3.14.0

# RHAIENG-5830 / RHAIENG-5883: mistune XSS / parsing CVEs
mistune>=3.3.0

# RHAIENG-4686: CVE-2026-28684 python-dotenv
python-dotenv>=1.2.2

# RHAIENG-6314 / RHAIENG-6317: soupsieve CSS selector parsing CVEs
soupsieve>=2.8.4

# RHAIENG-5791: CVE-2026-44660 ujson buffer overflow
ujson>=5.12.1

# RHAIENG-4458 / RHAIENG-5701 / RHAIENG-6358: keras deserialization and path traversal CVEs
# Fixed in keras>=3.14.0 (CVE-2026-1462, CVE-2026-11816)
keras>=3.14.0

# RHAIENG-5873: CVE-2026-56121 Feast gRPC registry RCE (fixed in feast>=0.63.0)
feast>=0.63.0

# RHAIENG-5853: CVE-2026-48746 vllm (defensive floor; not a direct notebook dependency today)
vllm>=0.22.0
Loading
Loading