Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating packages with vulnerabilities #7713

Merged
merged 9 commits into from
Apr 12, 2024
Merged

Updating packages with vulnerabilities #7713

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8cfbd00
update Django and Pillow versions
novda Apr 2, 2024
b036c8f
update quay.io/nuclio/dashboard version
novda Apr 2, 2024
4a09890
update pillow version to proposed by Snyk
novda Apr 4, 2024
2266a37
update nuclio docs and siammask run envs
novda Apr 10, 2024
5b85822
update openpolicyagent/opa version
novda Apr 11, 2024
f165a81
use OPA from the docker image for testing
novda Apr 11, 2024
6df797f
update python version for gpu
novda Apr 11, 2024
9f3e190
add autogenerated OPA tests
novda Apr 11, 2024
f879ec1
revert nuclio update
novda Apr 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/schedule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ jobs:

- name: OPA tests
run: |
curl -L -o opa https://openpolicyagent.org/downloads/v0.45.0/opa_linux_amd64_static
curl -L -o opa https://openpolicyagent.org/downloads/v0.63.0/opa_linux_amd64_static
SpecLad marked this conversation as resolved.
Show resolved Hide resolved
chmod +x ./opa
./opa test cvat/apps/iam/rules

Expand Down
2 changes: 1 addition & 1 deletion components/serverless/docker-compose.serverless.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
services:
nuclio:
container_name: nuclio
image: quay.io/nuclio/dashboard:1.11.24-amd64
image: quay.io/nuclio/dashboard:1.13.0-amd64
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few points here:

  • There should be an equivalent change to the Helm chart.

  • I'm pretty sure we mention the supported version of Nuclio in the documentation somewhere. Please check and update it there.

  • The gap between 1.11.24 and 1.13.0 is fairly large. I think you should try every serverless function and make sure they still work with the new Nuclio version.

restart: always
networks:
- cvat
Expand Down
2 changes: 1 addition & 1 deletion cvat-cli/requirements/base.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
cvat-sdk~=2.12.0
Pillow>=10.1.0
Pillow>=10.3.0
setuptools>=65.5.1 # not directly required, pinned by Snyk to avoid a vulnerability
2 changes: 1 addition & 1 deletion cvat-sdk/requirements/base.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

attrs >= 21.4.0
packaging >= 21.3
Pillow >= 10.1.0
Pillow >= 10.3.0
platformdirs >= 2.1.0
tqdm >= 4.64.0
tuspy == 0.2.5 # have it pinned, because SDK has lots of patched TUS code
Expand Down
4 changes: 2 additions & 2 deletions cvat/requirements/base.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ django-filter==2.4.0
django-health-check>=3.18.1,<4
django-rq==2.8.1
django-sendfile2==0.7.0
Django~=4.2.1
Django~=4.2.7
djangorestframework~=3.14.0
drf-spectacular==0.26.2
furl==2.1.0
Expand All @@ -39,7 +39,7 @@ opencv-python-headless~=4.8
patool==1.12

pdf2image==1.14.0
Pillow>=10.1.0
Pillow>=10.3.0
psutil==5.9.4
psycopg2-binary==2.9.5
python-ldap==3.4.3
Expand Down
2 changes: 1 addition & 1 deletion docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ services:

cvat_opa:
container_name: cvat_opa
image: openpolicyagent/opa:0.45.0-rootless
image: openpolicyagent/opa:0.63.0
restart: always
networks:
cvat:
Expand Down
2 changes: 1 addition & 1 deletion helm-chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ cvat:
opa:
replicas: 1
image: openpolicyagent/opa
tag: 0.45.0-rootless
tag: 0.63.0
imagePullPolicy: IfNotPresent
labels: {}
# test: test
Expand Down
4 changes: 2 additions & 2 deletions serverless/pytorch/foolwood/siammask/nuclio/function.yaml
View file
Open in desktop
SpecLad marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ metadata:

spec:
description: Fast Online Object Tracking and Segmentation
runtime: 'python:3.6'
runtime: 'python:3.7'
SpecLad marked this conversation as resolved.
Show resolved Hide resolved
handler: main:handler
eventTimeout: 30s
env:
Expand All @@ -35,7 +35,7 @@ spec:
- kind: WORKDIR
value: /opt/nuclio
- kind: RUN
value: conda create -y -n siammask python=3.6
value: conda create -y -n siammask python=3.7
- kind: SHELL
value: '["conda", "run", "-n", "siammask", "/bin/bash", "-c"]'
- kind: RUN
Expand Down
2 changes: 1 addition & 1 deletion site/content/en/docs/administration/advanced/installation_automatic_annotation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ description: 'Information about the installation of components needed for semi-a
```

- You have to install `nuctl` command line tool to build and deploy serverless
functions. Download [version 1.11.24](https://github.com/nuclio/nuclio/releases/tag/1.11.24).
functions. Download [version 1.13.0](https://github.com/nuclio/nuclio/releases/tag/1.13.0).
It is important that the version you download matches the version in
[docker-compose.serverless.yml](https://github.com/cvat-ai/cvat/blob/develop/components/serverless/docker-compose.serverless.yml).
For example, using wget.
Expand Down
4 changes: 2 additions & 2 deletions site/content/en/docs/contributing/running-tests.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,13 +213,13 @@ python cvat/apps/iam/rules/tests/generate_tests.py \
- In a Docker container
```bash
docker run --rm -v ${PWD}/cvat/apps/iam/rules:/rules \
openpolicyagent/opa:0.45.0-rootless \
openpolicyagent/opa:0.63.0 \
test /rules -v
```

- or execute OPA directly
```bash
curl -L -o opa https://openpolicyagent.org/downloads/v0.45.0/opa_linux_amd64_static
curl -L -o opa https://openpolicyagent.org/downloads/v0.63.0/opa_linux_amd64_static
chmod +x ./opa
./opa test cvat/apps/iam/rules
```
Expand Down
29 changes: 16 additions & 13 deletions site/content/en/docs/manual/advanced/serverless-tutorial.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,19 +110,22 @@ nuctl create project cvat
nuctl deploy --project-name cvat --path "./serverless/pytorch/foolwood/siammask/nuclio" --platform local
```
```
21.05.07 13:00:22.233 nuctl (I) Deploying function {"name": ""}
21.05.07 13:00:22.233 nuctl (I) Building {"versionInfo": "Label: 1.5.16, Git commit: ae43a6a560c2bec42d7ccfdf6e8e11a1e3cc3774, OS: linux, Arch: amd64, Go version: go1.14.3", "name": ""}
21.05.07 13:00:22.652 nuctl (I) Cleaning up before deployment {"functionName": "pth-foolwood-siammask"}
21.05.07 13:00:22.705 nuctl (I) Staging files and preparing base images
21.05.07 13:00:22.706 nuctl (I) Building processor image {"imageName": "cvat/pth.foolwood.siammask:latest"}
21.05.07 13:00:22.706 nuctl.platform.docker (I) Pulling image {"imageName": "quay.io/nuclio/handler-builder-python-onbuild:1.5.16-amd64"}
21.05.07 13:00:26.351 nuctl.platform.docker (I) Pulling image {"imageName": "quay.io/nuclio/uhttpc:0.0.1-amd64"}
21.05.07 13:00:29.819 nuctl.platform (I) Building docker image {"image": "cvat/pth.foolwood.siammask:latest"}
21.05.07 13:00:30.103 nuctl.platform (I) Pushing docker image into registry {"image": "cvat/pth.foolwood.siammask:latest", "registry": ""}
21.05.07 13:00:30.103 nuctl.platform (I) Docker image was successfully built and pushed into docker registry {"image": "cvat/pth.foolwood.siammask:latest"}
21.05.07 13:00:30.104 nuctl (I) Build complete {"result": {"Image":"cvat/pth.foolwood.siammask:latest","UpdatedFunctionConfig":{"metadata":{"name":"pth-foolwood-siammask","namespace":"nuclio","labels":{"nuclio.io/project-name":"cvat"},"annotations":{"framework":"pytorch","name":"SiamMask","spec":"","type":"tracker"}},"spec":{"description":"Fast Online Object Tracking and Segmentation","handler":"main:handler","runtime":"python:3.6","env":[{"name":"PYTHONPATH","value":"/opt/nuclio/SiamMask:/opt/nuclio/SiamMask/experiments/siammask_sharp"}],"resources":{},"image":"cvat/pth.foolwood.siammask:latest","targetCPU":75,"triggers":{"myHttpTrigger":{"class":"","kind":"http","name":"myHttpTrigger","maxWorkers":2,"workerAvailabilityTimeoutMilliseconds":10000,"attributes":{"maxRequestBodySize":33554432}}},"build":{"image":"cvat/pth.foolwood.siammask","baseImage":"continuumio/miniconda3","directives":{"preCopy":[{"kind":"WORKDIR","value":"/opt/nuclio"},{"kind":"RUN","value":"conda create -y -n siammask python=3.6"},{"kind":"SHELL","value":"[\"conda\", \"run\", \"-n\", \"siammask\", \"/bin/bash\", \"-c\"]"},{"kind":"RUN","value":"git clone https://github.com/foolwood/SiamMask.git"},{"kind":"RUN","value":"pip install -r SiamMask/requirements.txt jsonpickle"},{"kind":"RUN","value":"conda install -y gcc_linux-64"},{"kind":"RUN","value":"cd SiamMask \u0026\u0026 bash make.sh \u0026\u0026 cd -"},{"kind":"RUN","value":"wget -P SiamMask/experiments/siammask_sharp http://www.robots.ox.ac.uk/~qwang/SiamMask_DAVIS.pth"},{"kind":"ENTRYPOINT","value":"[\"conda\", \"run\", \"-n\", \"siammask\"]"}]},"codeEntryType":"image"},"platform":{"attributes":{"mountMode":"volume","restartPolicy":{"maximumRetryCount":3,"name":"always"}}},"readinessTimeoutSeconds":60,"securityContext":{},"eventTimeout":"30s"}}}}
21.05.07 13:00:31.387 nuctl.platform (I) Waiting for function to be ready {"timeout": 60}
21.05.07 13:00:32.796 nuctl (I) Function deploy complete {"functionName": "pth-foolwood-siammask", "httpPort": 49155}
24.04.10 09:06:21.661 (I) nuctl Deploying function {"name": "pth-foolwood-siammask"}
24.04.10 09:06:21.661 (I) nuctl Building {"builderKind": "docker", "versionInfo": "Label: 1.13.0, Git commit: c4422eb772781fb50fbf017698aae96199d81388, OS: linux, Arch: amd64, Go version: go1.21.7", "name": "pth-foolwood-siammask"}
24.04.10 09:06:21.676 (W) nuctl.platform MaxWorkers is deprecated and will be removed in v1.15.x, use NumWorkers instead
24.04.10 09:06:21.809 (I) nuctl Staging files and preparing base images
24.04.10 09:06:21.810 (W) nuctl Python 3.7 runtime is deprecated and will soon not be supported. Migrate your code and use Python 3.9 runtime (`python:3.9`) or higher
24.04.10 09:06:21.810 (W) nuctl Using user provided base image, runtime interpreter version is provided by the base image {"baseImage": "ubuntu:20.04"}
24.04.10 09:06:21.810 (I) nuctl Building processor image {"registryURL": "", "taggedImageName": "cvat.pth.foolwood.siammask:latest"}
24.04.10 09:06:21.810 (I) nuctl.platform.docker Pulling image {"imageName": "quay.io/nuclio/handler-builder-python-onbuild:1.13.0-amd64"}
24.04.10 09:06:23.650 (I) nuctl.platform.docker Pulling image {"imageName": "quay.io/nuclio/uhttpc:0.0.1-amd64"}
24.04.10 09:06:25.395 (I) nuctl.platform Building docker image {"image": "cvat.pth.foolwood.siammask:latest"}
24.04.10 09:10:02.913 (I) nuctl.platform Pushing docker image into registry {"image": "cvat.pth.foolwood.siammask:latest", "registry": ""}
24.04.10 09:10:02.913 (I) nuctl.platform Docker image was successfully built and pushed into docker registry {"image": "cvat.pth.foolwood.siammask:latest"}
24.04.10 09:10:02.913 (I) nuctl Build complete {"image": "cvat.pth.foolwood.siammask:latest"}
24.04.10 09:10:02.920 (I) nuctl Cleaning up before deployment {"functionName": "pth-foolwood-siammask"}
24.04.10 09:10:03.869 (I) nuctl.platform Waiting for function to be ready {"timeout": 120}
24.04.10 09:10:05.626 (I) nuctl Function deploy complete {"functionName": "pth-foolwood-siammask", "httpPort": 32769, "internalInvocationURLs": ["172.17.0.5:8080"], "externalInvocationURLs": ["0.0.0.0:32769"]}
```

```bash
Expand Down
2 changes: 1 addition & 1 deletion tests/python/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ pytest-cov==4.1.0
requests==2.31.0
deepdiff==5.6.0
boto3==1.17.61
Pillow==10.2.0
Pillow==10.3.0
python-dateutil==2.8.2
pyyaml==6.0.0
numpy==1.22.0
2 changes: 1 addition & 1 deletion utils/dataset_manifest/requirements.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
av==9.2.0 # Pinned for the whole CVAT
natsort>=8.0.0
opencv-python-headless>=4.4.0.42
Pillow>=10.1.0
Pillow>=10.3.0
tqdm>=4.58.0
2 changes: 1 addition & 1 deletion utils/dataset_manifest/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ numpy==1.22.4
# via opencv-python-headless
opencv-python-headless==4.9.0.80
# via -r utils/dataset_manifest/requirements.in
pillow==10.2.0
pillow==10.3.0
# via -r utils/dataset_manifest/requirements.in
tqdm==4.66.2
# via -r utils/dataset_manifest/requirements.in
2 changes: 1 addition & 1 deletion utils/dicom_converter/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
numpy==1.22.0
Pillow==10.2.0
Pillow==10.3.0
pydicom==2.1.2
tqdm==4.60.0
Loading