pillow - Buffer Overflow

chore: Fixes [CVE-2024-28219](https://www.cve.org/CVERecord?id=CVE-2024-28219) Signed-off-by: Spolti <fspolti@redhat.com>
kserve · May 7, 2024 · 900e33d · 900e33d
1 parent bfc2e21
commit 900e33d
Show file tree

Hide file tree

Showing 20 changed files with 8,077 additions and 8,202 deletions.
diff --git a/docs/samples/explanation/alibi/alibiexplainer/poetry.lock b/docs/samples/explanation/alibi/alibiexplainer/poetry.lock
diff --git a/docs/samples/explanation/alibi/alibiexplainer/pyproject.toml b/docs/samples/explanation/alibi/alibiexplainer/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "alibiexplainer"
-version = "0.12.1"
+version = "0.13.0rc0"
 description = "Model Explanation Server. Not intended for use outside KServe Frameworks Images."
 authors = ["cliveseldon <cc@seldon.io>"]
 license = "https://github.com/kserve/kserve/blob/master/LICENSE"
@@ -11,7 +11,7 @@ packages = [
 
 [tool.poetry.dependencies]
 python = ">=3.8,<3.12"
-kserve = { path = "../kserve", extras = ["storage"], develop = true }
+kserve = { path = "../../../../../python/kserve", extras = ["storage"], develop = true }
 alibi = { version = "^0.9.4", extras = ["shap", "tensorflow"] } # From 0.9.5 alibi uses BSL license
 tensorflow = ">=2.12.0,<2.14"  # the range that supports python 3.8 -- 3.11
 dill = "^0.3.6"
@@ -26,7 +26,7 @@ optional = true
 pytest = "^7.2.0"
 pytest-cov = "^4.0.0"
 mypy = "^0.991"
-sklearnserver = { path = "../sklearnserver", develop = true }
+sklearnserver = { path = "../../../../../python/sklearnserver", develop = true }
 
 [tool.poetry.group.dev]
 optional = true
@@ -36,7 +36,7 @@ black = { version = "~24.3.0", extras = ["colorama"] }
 
 [tool.poetry-version-plugin]
 source = "file"
-file_path = "../VERSION"
+file_path = "../../../../../python/VERSION"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]

diff --git a/hack/generate-licenses.sh b/hack/generate-licenses.sh
@@ -12,7 +12,7 @@ mv license.txt third_party/library/license_go.txt
 
 ## Generate a Python License
 # See https://github.com/kubeflow/testing/blob/master/py/kubeflow/testing/python-license-tools/README.md
-pipenv install -e python/alibiexplainer python/kfserving python/sklearnserver python/xgbserver
+pipenv install -e python/kfserving python/sklearnserver python/xgbserver
 python ../testing/py/kubeflow/testing/python-license-tools/pipfile_to_github_repo.py
 # See https://github.com/kubeflow/testing/blob/master/py/kubeflow/testing/go-license-tools/README.md
 python ../testing/py/kubeflow/testing/go-license-tools/get_github_license_info.py --github-api-token-file ~/.github_api_token

diff --git a/python/aiffairness/poetry.lock b/python/aiffairness/poetry.lock
diff --git a/python/artexplainer/poetry.lock b/python/artexplainer/poetry.lock
diff --git a/python/artexplainer/pyproject.toml b/python/artexplainer/pyproject.toml
@@ -14,7 +14,9 @@ python = ">=3.9,<3.12"
 kserve = {path = "../kserve", develop = true}
 adversarial-robustness-toolbox = {version = "^1.10.3", extras = ["keras"]}
 nest-asyncio = "^1.4.0"
-pillow = "^10.2.0"
+pillow = "^10.3.0"
+# pin to avoid https://github.com/kserve/kserve/actions/runs/8990775750/job/24696874468?pr=3598
+h5py = "3.10.0"
 
 [tool.poetry.group.test]
 optional = true

diff --git a/python/custom_model/poetry.lock b/python/custom_model/poetry.lock
diff --git a/python/custom_model/pyproject.toml b/python/custom_model/pyproject.toml
@@ -13,7 +13,7 @@ python = ">=3.9,<3.12"
 kserve = {path = "../kserve", develop = true}
 torchvision = {version = "0.15.1+cpu", source = "pytorch"}
 torch = {version = "2.0.0", source = "pytorch"}
-pillow = "^10.2.0"
+pillow = "^10.3.0"
 
 
 [[tool.poetry.source]]

diff --git a/python/custom_tokenizer/poetry.lock b/python/custom_tokenizer/poetry.lock
diff --git a/python/custom_transformer/poetry.lock b/python/custom_transformer/poetry.lock
diff --git a/python/custom_transformer/pyproject.toml b/python/custom_transformer/pyproject.toml
@@ -13,7 +13,7 @@ python = ">=3.9,<3.12"
 kserve = {path = "../kserve", develop = true}
 torchvision = {version = "0.15.1+cpu", source = "pytorch"}
 torch = {version = "2.0.0+cpu", source = "pytorch"}
-pillow = "^10.2.0"
+pillow = "^10.3.0"
 
 
 [[tool.poetry.source]]

diff --git a/python/huggingfaceserver/poetry.lock b/python/huggingfaceserver/poetry.lock
diff --git a/python/kserve/poetry.lock b/python/kserve/poetry.lock
diff --git a/python/lgbserver/poetry.lock b/python/lgbserver/poetry.lock
diff --git a/python/paddleserver/poetry.lock b/python/paddleserver/poetry.lock
diff --git a/python/pmmlserver/poetry.lock b/python/pmmlserver/poetry.lock
diff --git a/python/sklearnserver/poetry.lock b/python/sklearnserver/poetry.lock
diff --git a/python/test_resources/graph/error_404_isvc/poetry.lock b/python/test_resources/graph/error_404_isvc/poetry.lock
diff --git a/python/test_resources/graph/success_200_isvc/poetry.lock b/python/test_resources/graph/success_200_isvc/poetry.lock
diff --git a/python/xgbserver/poetry.lock b/python/xgbserver/poetry.lock