[anaconda] Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p vulnerabilities

src/anaconda/.devcontainer/Dockerfile

@@ -18,15 +18,21 @@ RUN python3 -m pip install \
     werkzeug \
     # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32862
     nbconvert \
-   # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28370
-    tornado
+    # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28370
+    tornado \
+    # https://github.com/advisories/GHSA-47fc-vmwq-366v
+    torch==1.13.1 \
+    # https://github.com/advisories/GHSA-282v-666c-3fvg
+    transformers==4.30.0
 
 RUN conda install \ 
     # https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
     pyopenssl=23.2.0 \ 
     cryptography=41.0.2 \
     # https://github.com/advisories/GHSA-j8r2-6x86-q33q
-    requests=2.31.0
+    requests=2.31.0 \
+    # https://github.com/advisories/GHSA-mrwq-x4v8-fh7p
+    pygments=2.15.1
 
 # Reset and copy updated files with updated privs to keep image size down
 FROM mcr.microsoft.com/devcontainers/base:1-bullseye

src/anaconda/manifest.json

@@ -38,7 +38,10 @@
 			"pyOpenssl",
 			"werkzeug",
 			"requests",
-			"tornado"
+			"tornado",
+			"pygments",
+			"torch",
+			"transformers"
 		],
 		"other": {
 			"git": {},

src/anaconda/test-project/test.sh

@@ -42,6 +42,8 @@ checkPythonPackageVersion "werkzeug" "2.2.3"
 checkPythonPackageVersion "certifi" "2022.12.07"
 checkPythonPackageVersion "requests" "2.31.0"
 checkPythonPackageVersion "cryptography" "41.0.2"
+checkPythonPackageVersion "torch" "1.13.1"
+checkPythonPackageVersion "transformers" "4.30.0"
 
 # The `tornado` package doesn't have the `__version__` attribute so we can use the `version` attribute.
 tornado_version=$(python -c "import tornado; print(tornado.version)")
@@ -50,6 +52,7 @@ check-version-ge "tornado-requirement" "${tornado_version}" "6.3.2"
 checkCondaPackageVersion "pyopenssl" "23.2.0"
 checkCondaPackageVersion "cryptography" "41.0.2"
 checkCondaPackageVersion "requests" "2.31.0"
+checkCondaPackageVersion "pygments" "2.15.1"
 
 check "conda-update-conda" bash -c "conda update -y conda"
 check "conda-install-tensorflow" bash -c "conda install -c conda-forge --yes tensorflow"