[Bug] docker image opea/gpt-sovits has security issue

[ZePan110]

Priority

P2-High

OS type

Ubuntu

Hardware type

Xeon-GNR

Installation method

• Pull docker images from hub.docker.com
• Build docker images from source
• Other

Deploy method

• Docker
• Docker Compose
• Kubernetes Helm Charts
• Kubernetes GMC
• Other

Running nodes

Single Node

What's the version?

latest image

Description

Docker image opea/gpt-sovits has security issue, need change gradio sversion in GPT-SoVITS/requirements.txt

Link: https://github.com/opea-project/GenAIExamples/actions/runs/13361338646/job/37311452549

Reproduce steps

docker pull opea/gpt-sovits:latest
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image opea/gpt-sovits

Raw log

Attachments

No response

[Spycsh]

Now it should be fixed.

[ZePan110]

New issue, starlette is depend on fastapi==0.112.1. So need chang fastapi version in https://github.com/Spycsh/GPT-SoVITS/blob/d673b3648d8b200e605c79bfe39b9624c7f8baba/requirements.txt#L36.

[Spycsh]

@ZePan110 You mean update fastapi from 0.112.1 to latest?

[ZePan110]

@ZePan110 You mean update fastapi from 0.112.1 to latest?

Maybe. I'm not sure which version is available. Because the captured message shows that the security issue is from starlette==0.38.6, and starlette==0.38.6 depends on fastapi==0.112.1

[Spycsh]

@ZePan110 You mean update fastapi from 0.112.1 to latest?

Maybe. I'm not sure which version is available. Because the captured message shows that the security issue is from starlette==0.38.6, and starlette==0.38.6 depends on fastapi==0.112.1

Could you try again? I've removed the version limit fastapi.

[ZePan110]

@ZePan110 You mean update fastapi from 0.112.1 to latest?

Maybe. I'm not sure which version is available. Because the captured message shows that the security issue is from starlette==0.38.6, and starlette==0.38.6 depends on fastapi==0.112.1

Could you try again? I've removed the version limit fastapi.

The security issue has been fixed and tested successfully. So it's closed.