Update dependency google-cloud-aiplatform to v1.133.0 [SECURITY]#14087
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the google-cloud-aiplatform library to version 1.133.0 across multiple directories, including Dataflow templates, Generative AI samples, and Model Garden. The review feedback highlights that this version bump introduces breaking changes for Vertex AI Experiments, which now require an explicit staging_bucket or uri. Specifically, the evaluation and model tuning samples need updates to provide a staging bucket to prevent potential failures.
| pillow==10.4.0; python_version < '3.8' | ||
| pillow==10.4.0; python_version >= '3.8' | ||
| google-cloud-aiplatform[all]==1.69.0 | ||
| google-cloud-aiplatform[all]==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a breaking change for Vertex AI Experiments (see CVE-2026-2473). The SDK now requires an explicit staging_bucket or uri when saving results to an experiment. The code in generative_ai/evaluation/pairwise_summarization_quality.py uses Vertex AI Experiments (experiment='pairwise-experiment') without specifying a staging_bucket in vertexai.init(). This may lead to failures with version 1.133.0 due to the new security requirements for experiment storage. Consider updating the sample to provide a staging bucket.
| pillow==10.4.0; python_version < '3.8' | ||
| pillow==10.4.0; python_version >= '3.8' | ||
| google-cloud-aiplatform[all]==1.69.0 | ||
| google-cloud-aiplatform[all]==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a breaking change for Vertex AI Experiments (see CVE-2026-2473). The SDK now requires an explicit staging_bucket or uri when saving models to an experiment. The code in generative_ai/model_tuning/supervised_example.py currently calls sft.train() without providing a staging bucket (either in the call or via vertexai.init()), which will likely cause it to fail with a ValueError in this new version. Please update the sample code to include a staging bucket.
This PR contains the following updates:
==1.47.0→==1.133.0==1.103.0→==1.133.0==1.69.0→==1.133.0==1.87.0→==1.133.0==1.82.0→==1.133.0==1.74.0→==1.133.0==1.86.0→==1.133.0==1.84.0→==1.133.0==1.64.0→==1.133.0==1.57.0→==1.133.0==1.62.0→==1.133.0GitHub Vulnerability Alerts
CVE-2026-2473
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).
This vulnerability was patched and no customer action is needed.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:ClearRelease Notes
googleapis/python-aiplatform (google-cloud-aiplatform)
v1.133.0Compare Source
Features
optimize_promptmethod (715cc5b)Bug Fixes
examples_dataframetype toPandasDataFramein Prompt Optimizer. (a2564cc)v1.132.0Compare Source
Features
Documentation
restart_job_on_worker_restartin message.google.cloud.aiplatform.v1beta1.Schedulingis changed (71747e8)timeoutin message.google.cloud.aiplatform.v1beta1.Schedulingis changed (71747e8)v1.131.0Compare Source
Features
Bug Fixes
v1.130.0Compare Source
Features
min_gpu_driver_versionis added to message.google.cloud.aiplatform.v1beta1.MachineSpec(26dfdfe)Documentation
ReplicatedVoiceConfig.mime_typecomment (26dfdfe)ReplicatedVoiceConfig.mime_typecomment (26dfdfe)v1.129.0Compare Source
⚠ BREAKING CHANGES
transfer_to_agentis removed from message.google.cloud.aiplatform.v1beta1.EventActionsbigtable_metadatafield name inFeatureOnlineStoreenableDirectBigtableAccessfield name in FeatureOnlineStore`bigtable_metadatafield name inFeatureViewFeatures
gpu_partition_sizeinmachine_specv1 api (e0bc3d8)ReplicatedVoiceConfigtoVoiceConfigto enable Gemini TTS voice replication (e0bc3d8)ReplicatedVoiceConfigtoVoiceConfigto enable Gemini TTS voice replication (e0bc3d8)SUCCESSFULLY_DEPLOYEDandFAILED_TO_DEPLOYtoDeploymentStage(e0bc3d8)SUCCESSFULLY_DEPLOYEDandFAILED_TO_DEPLOYtoDeploymentStage(e0bc3d8)Bug Fixes
transfer_to_agentis removed from message.google.cloud.aiplatform.v1beta1.EventActions(e0bc3d8)adk deploy agent_engine(9301551)from vertexai.types import TypeNamewithout needing to runfrom vertexai import typesfirst (46285bf)from vertexai.types import TypeNamewithout needing to runfrom vertexai import typesfirst (f4a6cbe)bigtable_metadatafield name inFeatureOnlineStore(e0bc3d8)bigtable_metadatafield name inFeatureView(e0bc3d8)enableDirectBigtableAccessfield name in FeatureOnlineStore` (e0bc3d8)Documentation
filterin message.google.cloud.aiplatform.v1beta1.ListSessionsRequestis changed (e0bc3d8)package_specin message.google.cloud.aiplatform.v1.ReasoningEngineSpecis changed (e0bc3d8)package_specin message.google.cloud.aiplatform.v1beta1.ReasoningEngineSpecis changed (e0bc3d8)ReasoningEngineSpecis changed (e0bc3d8)ReasoningEngineSpecis changed (e0bc3d8)Miscellaneous Chores
v1.128.0Compare Source
Features
pass_ratetoAggregatedMetricResultand calculate it for adaptive rubric metrics. (1f1f67e)build optionsin Agent Engine GCS Deployment. (28499a9)build optionsin Agent Engine source-based Deployment. (f7e718f)Bug Fixes
v1.127.0Compare Source
Features
Bug Fixes
Documentation
v1.126.1Compare Source
Bug Fixes
v1.126.0Compare Source
Features
Bug Fixes
v1.125.0Compare Source
⚠ BREAKING CHANGES
cloudtrace.googleapis.comtotelemetry.googleapis.comfor tracing API.Features
Bug Fixes
agent_info.agentincreate_evaluation_runin Vertex AI GenAI SDK evals. (d02a7da)Miscellaneous Chores
cloudtrace.googleapis.comtotelemetry.googleapis.comfor tracing API. (c81f912)v1.124.0Compare Source
⚠ BREAKING CHANGES
Features
Bug Fixes
datasetincreate_evaluation_runin Vertex AI GenAI SDK evals (741c6ad)Miscellaneous Chores
v1.123.0Compare Source
Features
appinput in AdkApp template (10ca56f)showin Vertex AI GenAI SDK evals (d62afc3)Bug Fixes
Documentation
v1.122.0Compare Source
Features
create_evaluation_setandcreate_evaluation_itemmethods to Vertex AI GenAI SDK evals (83553a9)evaluation_dfinput support tocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (7a1262b)inference_configstocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (5b5e6bd)labelsto EvaluationRun in Vertex AI GenAI SDK evals (67cf80b)metricstocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (ce35218)showmethod for EvaluationRun for Vertex AI GenAI SDK evals (dc16065)Bug Fixes
showmethod for EvaluationRun for Vertex AI GenAI SDK evals (3ac82ea)v1.121.0Compare Source
⚠ BREAKING CHANGES
Features
ScaleToZeroSpecis added (62ea30a)class_methodsin Agent Engine config. (af8c898)Bug Fixes
Miscellaneous Chores
v1.120.0Compare Source
Features
get_evaluation_setandget_evaluation_itemmethods to Vertex AI GenAI SDK evals (7757886)showmethod for EvaluationRun class in Vertex AI GenAI SDK evals (0c932b9)Bug Fixes
Documentation
v1.119.0Compare Source
Features
get_evaluation_runmethod response in Vertex AI GenAI SDK evals (f07ecc3)v1.118.0Compare Source
⚠ BREAKING CHANGES
Features
create_evaluation_runmethod to Vertex AI GenAI SDK evals (7db9b4f)get_evaluation_runmethod to Vertex AI GenAI SDK evals (bbbadbc)Bug Fixes
Documentation
dedicated_endpoint_disabledin message.google.cloud.aiplatform.v1beta1.DeployRequestis changed (0722687)Miscellaneous Chores
v1.117.0Compare Source
Features
Documentation
v1.116.0Compare Source
Features
Bug Fixes
contextin Grounding metric (e75d91f)Documentation
v1.115.0Compare Source
⚠ BREAKING CHANGES
optimize_promptmethod no longer returns the parsed response directly. Code must be updated to access the.raw_text_responseor.parsed_responseattribute on the new return object.Features
has_template_configto MultimodalDataset. (97a6e71)Bug Fixes
Documentation
Miscellaneous Chores
v1.114.0Compare Source
Features
Bug Fixes
v1.113.0Compare Source
Features
Bug Fixes
v1.112.0Compare Source
Features
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.