[Snyk] Fix for 3 vulnerabilities#699
Conversation
…rabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-TORCH-10332644 - https://snyk.io/vuln/SNYK-PYTHON-TORCH-10332645 - https://snyk.io/vuln/SNYK-PYTHON-WHEEL-15053866
Summary of ChangesHello @alejandrosuarez, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request, automatically generated by Snyk, aims to enhance the security posture of the project by resolving identified vulnerabilities within its Python dependencies. It specifically targets issues in Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
Code Review
This pull request, automatically generated by Snyk, addresses security vulnerabilities by updating torch and wheel dependencies. While these updates are necessary, the major version upgrade of torch from 1.x to 2.x introduces a high risk of breaking changes in the associated example script, which will require careful testing. Additionally, I've suggested adding a newline at the end of the requirements.txt file to follow best practices.
| Jinja2 | ||
| git+https://github.com/huggingface/peft.git No newline at end of file | ||
| git+https://github.com/huggingface/peft.git | ||
| torch>=2.10.0 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
Upgrading torch to a new major version (from 1.x to 2.x) is a significant change that could introduce breaking changes. The associated training script train_text_to_image_lora.py will likely require thorough testing and potential updates to be compatible with PyTorch 2.x APIs.
| git+https://github.com/huggingface/peft.git No newline at end of file | ||
| git+https://github.com/huggingface/peft.git | ||
| torch>=2.10.0 # not directly required, pinned by Snyk to avoid a vulnerability | ||
| wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability No newline at end of file |
There was a problem hiding this comment.
It's a good practice for text files to end with a newline character. This prevents issues with some tools and file concatenations.
wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability
Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
examples/research_projects/lora/requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Buffer Overflow
🦉 Directory Traversal