build(deps): update bundled log4j, aiohttp, and idna versions - #64056
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades several dependencies, including updating aiohttp to 3.14.0, idna to 3.15, and log4j to 2.25.4. It also introduces a new Bazel test to verify that these bundled dependency versions remain fixed. Feedback is provided to replace .resolve() with .absolute() on __file__ in the test to prevent escaping the Bazel runfiles directory, which can cause failures in sandboxed or remote execution environments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| from pathlib import Path | ||
|
|
||
|
|
||
| REPO_ROOT = Path(__file__).resolve().parents[3] |
There was a problem hiding this comment.
Using .resolve() on __file__ in a Bazel test resolves symlinks, which escapes the Bazel runfiles directory and points to the absolute path of the source file on the host machine. This can break in strict sandboxing or Remote Build Execution (RBE) environments where the host source directory is not present or accessible on the worker.
Using .absolute() instead of .resolve() keeps the path within the runfiles directory structure, which is correctly populated by Bazel and works reliably across all execution environments.
| REPO_ROOT = Path(__file__).resolve().parents[3] | |
| REPO_ROOT = Path(__file__).absolute().parents[3] |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
ray-gardener
Bot
added
core
There was a problem hiding this comment.
can you do the following please:
- move the test_bundled_dependency_versions.py -> ci/build/bundled_dependency_versions_test.py (rename as well please)
- Add the py_test to ci/build/BUILD.bazel instead of ci/raydepsets/BUILD.bazel, keeping the data = ["//:python/setup.py",
"//java:dependencies.bzl"] deps and team:ci/ci_unit tags. - The REPO_ROOT = Path(file).absolute().parents[3] needs to become parents[2] (file moves from ci/raydepsets/tests/ to
ci/build/, one level shallower)
|
Thanks @elliot-barn, I addressed your requested changes.
Verified locally with: python -m pytest ci/build/bundled_dependency_versions_test.py -q
bazel test //ci/build:bundled_dependency_versions_test |
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
|
just a minor formatting issue is left and we should be good to run the full test suite and merge |
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
|
Thanks @elliot-barn. I addressed the formatting issue and pushed a follow-up commit. CI is running again. |
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
Signed-off-by: nh-atuan <anhtuan21347@gmail.com> # Conflicts: # ci/env/install-dependencies.sh
|
Hi @elliot-barn, All requested updates have been completed and all checks are passing. It looks like the PR is now only waiting for a code owner review. Could you please help take a look or point me to the appropriate code owner if any additional review is needed? Thanks again for all your help! |
|
This pull request has been automatically marked as stale because it has not had You can always ask for help on our discussion forum or Ray's public slack channel. If you'd like to keep this open, just leave any comment, and the stale label will be removed. |
github-actions
Bot
added
the
stale
|
Friendly ping. Just keeping this PR active. All requested changes have been completed and all checks are passing. The PR is currently waiting for a code owner review. Please let me know if there is anything else I should update. Thank you! |
github-actions
Bot
added
unstale
|
Hello, we're actively patching around this, it would be great to get merged into the next release. |
|
apologies, we'll ensure it gets picked up |
|
Hi @edoakes, thanks for taking a look. I noticed the PR currently has merge conflicts in the generated dependency lock files. Should I resolve the conflicts and regenerate the lock files on my branch now, or would you prefer to handle this during the review/merge process? |
It would be great if you could resolve them |
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
|
@nh-atuan some pip compile resolution errors: https://buildkite.com/ray-project/premerge/builds/70754#019f9eb5-6c70-430b-b760-5079ec6eef6a |
|
Thanks for pointing this out, @edoakes. I’ll investigate the pip compile resolution errors and push a fix as soon as possible. |
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Reviewed by Cursor Bugbot for commit a0f6b89. Configure here.
Signed-off-by: nh-atuan <anhtuan21347@gmail.com>
|
@edoakes Hi, we are waiting to adopt these changes to mitigate the vulnerabilities. Do you have an estimated release date for the version that includes this change? Thank you! |
Description
Updates bundled dependency versions in the Ray Python wheel to address scanner-visible vulnerable artifacts reported in installed
site-packages/ray/...contents.This PR updates:
log4j-api,log4j-core, andlog4j-slf4j-implfrom2.25.3to2.25.4forray/jars/ray_dist.jar.aiohttp==3.14.0andidna==3.15, so generated wheels include fixed*.dist-infoartifacts.aiohttp>=3.14.0andidna>=3.15.It also adds a small CI test to guard the bundled dependency versions used by the wheel packaging path.
Related issues
Fixes #64050
Additional information
Validated locally with:
python -m pytest ci/raydepsets/tests/test_bundled_dependency_versions.py -q bazel test //ci/raydepsets:test_bundled_dependency_versionsAlso verified that installing the runtime env agent package set produces: