Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[anaconda] Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p vulnerabilities #690

Merged
merged 18 commits into from
Aug 14, 2023
Merged

[anaconda] Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p vulnerabilities #690

merged 18 commits into from
Aug 14, 2023

Conversation

alexander-smolyakov
Copy link
Contributor

@alexander-smolyakov alexander-smolyakov commented Aug 1, 2023

Dev container name:

  • anaconda

Description:

This PR patches the following vulnerabilities:

These vulnerabilities come from the continuumio/anaconda3 image used upstream for the anaconda devcontainer.

Changelog:

  • Updated Dockerfile:

    • Removed lock from continuumio/anaconda3 image to use the latest version of the image (Contains fixes for torch and pygments packages);
    • Locked versions for patched Python packages;
    • Added patch to install updated versions of transformers packages;
  • Added tests to verify minimum versions of the following packages:

    • torch - minimum package version set to 1.13.1;
    • transformers - minimum package version set to 4.30.0;
    • pygments - minimum package version set to 2.15.1;
  • Updated information about packages in the devcontainer manifest;

  • Updated tests to use different environments when installing packages from the conda-forge channel;

  • Updated README.md to add info about possible conflicts in Conda's environment when channels are mixed;

Checklist:

  • Checked that applied changes work as expected

@alexander-smolyakov alexander-smolyakov requested a review from a team as a code owner August 1, 2023 14:01
- Remove version lock for `continuumio/anaconda3` image;
- Remove patches for `torch` and `pygments`
- Lock packages versions;
- Clean up `manifest.json`;
@samruddhikhandale samruddhikhandale merged commit 5f5cfbc into devcontainers:main Aug 14, 2023
3 checks passed
@samruddhikhandale samruddhikhandale mentioned this pull request Aug 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants