[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #28

spolti · 2024-07-09T15:04:39Z

This PR was automatically created by Snyk using the credentials of a real user.

![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

requirements-rocm.txt

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.
Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

…errupted (vllm-project#4363)

) Co-authored-by: DefTruth <31974251+deftruth@users.noreply.github.com>

Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Travis Johnson <tjohnson31415@gmail.com>

…ect#4402)

…ct#4418)

Co-authored-by: Robert Shaw <114415538+robertgshaw2-neuralmagic@users.noreply.github.com> Co-authored-by: Robert Shaw <rshaw@neuralmagic.com>

…project#3922) Co-authored-by: alexm <alexm@neuralmagic.com> Co-authored-by: mgoin <michael@neuralmagic.com>

…project#4444)

…ect#4165) Co-authored-by: Lei Wen <wenlei03@qiyi.com>

Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Roger Wang <ywang@roblox.com>

Co-authored-by: Philipp Moritz <pcmoritz@gmail.com> Co-authored-by: Woosuk Kwon <woosuk.kwon@berkeley.edu> Co-authored-by: mgoin <michael@neuralmagic.com> Co-authored-by: Tyler Michael Smith <tyler@neuralmagic.com> Co-authored-by: Cody Yu <hao.yu.cody@gmail.com>

…int (vllm-project#3467) Co-authored-by: Lily Liu <lilyliupku@gmail.com> Co-authored-by: Cyrus Leung <tlleungac@connect.ust.hk>

…ersion (vllm-project#4467)

…vllm-project#4494) Co-authored-by: Simon Mo <simon.mo@hey.com>

Fixed upstream in vllm-project#5091

fixes RHOAIENG-8043 Co-authored-by: Chih-Chieh-Yang <chih.chieh.yang@ibm.com> Signed-off-by: Thomas Parnell <tpa@zurich.ibm.com>

- get rid cuda-devel stage, use cuda 12.4 - add build flags - remove useless installs

…main sync release with main @ v0.5.0.post1-99-g8720c92e

add libsodium for tensorizer encryption --------- Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Daniele <36171005+dtrifiro@users.noreply.github.com>

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ANYIO-7361842

sync release with main

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899

openshift-ci · 2024-07-09T15:04:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: spolti
Once this PR has been reviewed and has the lgtm label, please assign vaibhavjainwiz for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-robot · 2024-08-02T16:22:05Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

esmeetu and others added 30 commits May 6, 2024 11:32

[Bugfix][Core] Fix get decoding config from ray (vllm-project#4335)

0c5790d

[Bugfix] Abort requests when the connection to /v1/completions is int…

6c3326a

…errupted (vllm-project#4363)

[BugFix] Fix min_tokens when eos_token_id is None (vllm-project#4389

1a91ddf

) Co-authored-by: DefTruth <31974251+deftruth@users.noreply.github.com>

[Core] Support offline use of local cache for models (vllm-project#4374)

c7334d2

Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Travis Johnson <tjohnson31415@gmail.com>

[BugFix] Fix return type of executor execute_model methods (vllm-proj…

b2ae047

…ect#4402)

[BugFix] Resolved Issues For LinearMethod --> QuantConfig (vllm-proje…

3a3ea57

…ct#4418)

[Misc] fix typo in llm_engine init logging (vllm-project#4428)

53299da

Add more Prometheus metrics (vllm-project#2764)

91aabb0

Co-authored-by: Robert Shaw <114415538+robertgshaw2-neuralmagic@users.noreply.github.com> Co-authored-by: Robert Shaw <rshaw@neuralmagic.com>

[CI] clean docker cache for neuron (vllm-project#4441)

46a9863

[mypy][5/N] Support all typing on model executor (vllm-project#4427)

0733647

[Kernel] Marlin Expansion: Support AutoGPTQ Models with Marlin (vllm-…

70d7507

…project#3922) Co-authored-by: alexm <alexm@neuralmagic.com> Co-authored-by: mgoin <michael@neuralmagic.com>

[CI] hotfix: soft fail neuron test (vllm-project#4458)

1e25f6a

[Core][Distributed] use cpu group to broadcast metadata in cpu (vllm-…

826a21c

…project#4444)

[Misc] Upgrade to torch==2.3.0 (vllm-project#4454)

aa6c82d

[Bugfix][Kernel] Fix compute_type for MoE kernel (vllm-project#4463)

61e6343

[Core]Refactor gptq_marlin ops (vllm-project#4466)

c92cac9

[BugFix] fix num_lookahead_slots missing in async executor (vllm-proj…

d1176c8

…ect#4165) Co-authored-by: Lei Wen <wenlei03@qiyi.com>

[Doc] add visualization for multi-stage dockerfile (vllm-project#4456)

eb69d24

Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Roger Wang <ywang@roblox.com>

[Frontend] Support complex message content for chat completions endpo…

d9e9d52

…int (vllm-project#3467) Co-authored-by: Lily Liu <lilyliupku@gmail.com> Co-authored-by: Cyrus Leung <tlleungac@connect.ust.hk>

[Frontend] [Core] Tensorizer: support dynamic num_readers, update v…

3fc345a

…ersion (vllm-project#4467)

[Bugfix][Minor] Make ignore_eos effective (vllm-project#4468)

80d0058

fix_tokenizer_snapshot_download_bug (vllm-project#4493)

f8e22b3

Unable to find Punica extension issue during source code installation (…

ecb3620

…vllm-project#4494) Co-authored-by: Simon Mo <simon.mo@hey.com>

[Core] Centralize GPU Worker construction (vllm-project#4419)

edd9c67

[Misc][Typo] type annotation fix (vllm-project#4495)

1b710d6

[Misc] fix typo in block manager (vllm-project#4453)

28a0f80

Allow user to define whitespace pattern for outlines (vllm-project#4305)

c49d777

[Misc]Add customized information for models (vllm-project#4132)

8eba757

[Test] Add ignore_eos test (vllm-project#4519)

9f85f52

dtrifiro and others added 23 commits June 21, 2024 13:32

gha: add sync workflow

955598d

Dockerfile.ubi: use distributed-executor-backend=mp as default

119767e

Dockerfile.ubi: remove vllm-nccl workaround

a82fb14

Fixed upstream in vllm-project#5091

Dockerfile.ubi: add missing requirements-*.txt bind mounts

cc5d64a

add triton CustomCacheManger

f9f3bc7

fixes RHOAIENG-8043 Co-authored-by: Chih-Chieh-Yang <chih.chieh.yang@ibm.com> Signed-off-by: Thomas Parnell <tpa@zurich.ibm.com>

gha: sync-with-upstream workflow create PRs as draft

40ae5b9

add smoke/unit tests scripts

5c44d84

extras: exit unit tests on err

f722b3e

Dockerfile.ubi: misc improvements

5b66f1e

- get rid cuda-devel stage, use cuda 12.4 - add build flags - remove useless installs

update OWNERS

8720c92

sync release with main @ 8720c92

eeb6f33

Merge pull request opendatahub-io#63 from dtrifiro/sync-release-with-…

7cc6a9b

…main sync release with main @ v0.5.0.post1-99-g8720c92e

Dockerfile.ubi: use tensorizer (opendatahub-io#64)

1a26fcf

add libsodium for tensorizer encryption --------- Signed-off-by: Prashant Gupta <prashantgupta@us.ibm.com> Co-authored-by: Daniele <36171005+dtrifiro@users.noreply.github.com>

fix: docs/requirements-docs.txt to reduce vulnerabilities

32e05a6

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ANYIO-7361842

Dockerfile.ubi: pin vllm-tgis-adapter to 0.1.2

1f39759

Merge pull request opendatahub-io#67 from opendatahub-io/main

7fd7fba

sync release with main

Merge remote-tracking branch 'upstream/release'

65fa312

gha: fix fetch step in upstream sync workflow

e96dd03

gha: always update sync workflow PR body/title

b4ecf73

Dockerfile.ubi: bump vllm-tgis-adapter to 0.1.3

3ff733b

Merge pull request opendatahub-io#80 from opendatahub-io/main

27d7746

sync release with main

Merge remote-tracking branch 'upstream/release'

44ec37d

fix: requirements-rocm.txt to reduce vulnerabilities

4550303

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899

openshift-ci bot requested review from terrytangyuan and Xaenalt July 9, 2024 15:04

Xaenalt force-pushed the main branch from bc34f22 to 3c9b8f7 Compare August 2, 2024 15:06

openshift-merge-robot added the needs-rebase label Aug 2, 2024

dtrifiro closed this Sep 10, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #28

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #28

spolti commented Jul 9, 2024

openshift-ci bot commented Jul 9, 2024

openshift-merge-robot commented Aug 2, 2024

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #28

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #28

Conversation

spolti commented Jul 9, 2024

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

openshift-ci bot commented Jul 9, 2024

openshift-merge-robot commented Aug 2, 2024