CVE-2024-24762 - update fastapi to 0.109.1 #3556
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chore: Fix [CVE-2024-24762](https://www.cve.org/CVERecord?id=CVE-2024-24762) - fastapi Regular Expression Denial of Service (ReDoS) Plus, update Ray to 2.10 to allow updating fastapi. On previous versions of Ray the fastapi version was pinned, which was preventing the fastapi version update. use the new handle api: From Ray Serve docs: Ray 2.7 introduces a new {mod}`DeploymentHandle <ray.serve.handle.DeploymentHandle>` API that will replace the existing `RayServeHandle` and `RayServeSyncHandle` APIs. Signed-off-by: Spolti <fspolti@redhat.com>
|
Hi all, this update required a few more tweaks to remove the |
Signed-off-by: Spolti <fspolti@redhat.com>
|
@spolti thanks for the ping, the change looks good to me! |
|
related issue #3541 |
|
/lgtm |
sivanantha321
approved these changes
Mar 29, 2024
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sivanantha321, spolti, yuzisun The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
thanks all. |
Jooho
pushed a commit
to Jooho/kserve
that referenced
this pull request
Apr 4, 2024
* CVE-2024-24762 - update fastapi to 0.109.1 chore: Fix [CVE-2024-24762](https://www.cve.org/CVERecord?id=CVE-2024-24762) - fastapi Regular Expression Denial of Service (ReDoS) Plus, update Ray to 2.10 to allow updating fastapi. On previous versions of Ray the fastapi version was pinned, which was preventing the fastapi version update. use the new handle api: From Ray Serve docs: Ray 2.7 introduces a new {mod}`DeploymentHandle <ray.serve.handle.DeploymentHandle>` API that will replace the existing `RayServeHandle` and `RayServeSyncHandle` APIs. Signed-off-by: Spolti <fspolti@redhat.com> * add link to about the RayServeHandle deprecation Signed-off-by: Spolti <fspolti@redhat.com> --------- Signed-off-by: Spolti <fspolti@redhat.com>
tjandy98
pushed a commit
to tjandy98/kserve
that referenced
this pull request
Apr 10, 2024
* CVE-2024-24762 - update fastapi to 0.109.1 chore: Fix [CVE-2024-24762](https://www.cve.org/CVERecord?id=CVE-2024-24762) - fastapi Regular Expression Denial of Service (ReDoS) Plus, update Ray to 2.10 to allow updating fastapi. On previous versions of Ray the fastapi version was pinned, which was preventing the fastapi version update. use the new handle api: From Ray Serve docs: Ray 2.7 introduces a new {mod}`DeploymentHandle <ray.serve.handle.DeploymentHandle>` API that will replace the existing `RayServeHandle` and `RayServeSyncHandle` APIs. Signed-off-by: Spolti <fspolti@redhat.com> * add link to about the RayServeHandle deprecation Signed-off-by: Spolti <fspolti@redhat.com> --------- Signed-off-by: Spolti <fspolti@redhat.com> Signed-off-by: tjandy98 <3953059+tjandy98@users.noreply.github.com>
wmfgerrit
pushed a commit
to wikimedia/machinelearning-liftwing-inference-services
that referenced
this pull request
Apr 23, 2024
Bump kserve to 0.12.1 that includes the following fixes we need: * support for pydantic v2 (kserve/kserve#3374) which is used by knowledge_integrity v0.6 * fix for ray serve compatibility issue (kserve/kserve#3556). Bug: T363127 Change-Id: I3fd7c5963c647ab1f407f21c4bd9e2b530fe8a47
wmfgerrit
pushed a commit
to wikimedia/machinelearning-liftwing-inference-services
that referenced
this pull request
Apr 23, 2024
Bump kserve to 0.12.1 that includes the following fixes we need: * support for pydantic v2 (kserve/kserve#3374) which is used by knowledge_integrity v0.6 * fix for ray serve compatibility issue (kserve/kserve#3556). Bug: T363129 Change-Id: I6a4babe2155b0638beb83a0a03af99ef396a666b
wmfgerrit
pushed a commit
to wikimedia/machinelearning-liftwing-inference-services
that referenced
this pull request
Apr 23, 2024
Bump kserve to 0.12.1 that includes the following fixes we need: * support for pydantic v2 (kserve/kserve#3374) which is used by knowledge_integrity v0.6 * fix for ray serve compatibility issue (kserve/kserve#3556). Bug: T363130 Change-Id: I9b13d5235b2c52cc71d92db19fe3adc7cdafea1a
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
chore: Fix CVE-2024-24762 - fastapi Regular Expression Denial of Service (ReDoS)
Plus, update Ray to 2.10 to allow updating fastapi. On previous versions of Ray
the fastapi version was pinned, which was preventing the fastapi version update.
fixes #3541
Release note: