fix(security): upgrade mlflow, grpcio, torch (longmt_eval) for CVE remediation - #1657
Merged
Conversation
- bump mlflow/mlflow-skinny >=3.12.0 → >=3.14.0 - bump torch 2.5.1 → 2.12.0+cu130 and torchvision 0.20.1 → 0.27.0+cu130 in wmt_translation; add pytorch cu130 wheel index (PyPI only ships CPU-only wheels for torch 2.12.0+, CUDA 12 support was dropped) - add grpcio>=1.81.0rc1 as a uv constraint-dependency (transitive via ray) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…CVE remediation torch 2.12.0 dropped CUDA 12; GPU wheels only exist at the pytorch cu130 index. PyPI ships CPU-only for 2.12.0+, so add --extra-index-url and pin the +cu130 local version to force the CUDA 13 wheel. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
kajalj22
changed the title
…EGALE fork Point SEGALE to kajalj22/SEGALE@a7c9a1a which relaxes the torch==2.5.0 pin to torch==2.12.0. No CUDA variant pinned — cu126/cu130/cu132 are all available at the pytorch wheel index; select via UV_EXTRA_INDEX_URL at deploy time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>
thomasdhc
previously approved these changes
Jun 22, 2026
Updated: grpcio 1.76.0 → 1.82.0rc1, mlflow/mlflow-skinny/mlflow-tracing 3.12.0 → 3.14.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
ananthsub
approved these changes
Jun 23, 2026
chtruong814
approved these changes
Jun 23, 2026
kajalj22
enabled auto-merge (squash)
June 23, 2026 05:12
ritaneves
pushed a commit
that referenced
this pull request
Jun 25, 2026
…mediation (#1657) ## Summary - Bump `mlflow`/`mlflow-skinny` `>=3.12.0` → `>=3.14.0` to fix CVEs - Add `grpcio>=1.81.0rc1` as a `uv` `constraint-dependency` (transitive via ray) to fix CVEs - Bump `torch` `2.5.0` → `2.12.0` and `torchvision` `0.20.0` → `0.27.0` in `longmt_eval` via [kajalj22/SEGALE@a7c9a1a](kajalj22/SEGALE@a7c9a1a) which relaxes the upstream `torch==2.5.0` pin 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Kajal Jain <kajalj@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Rita Fernandes Neves <rfernandesne@nvidia.com>
Glorf
added a commit
that referenced
this pull request
Jul 8, 2026
ECS Fargate `SandboxProvider` on top of the sandbox API (#1377, now merged to `main`). Auto-mirrors public images to ECR on demand; SSH reverse-tunnel for exec / file-transfer / model egress. Rebased onto `main` now that the sandbox base (#1377) has landed — this PR stands on its own and is ready for review. **Sandbox-bound agents line of work:** **ECS Fargate (this PR)** → adapter middleware base (#1646) → sandbox-bound CLI agents + capture (#1647). Interceptor follow-ups on the adapter base: #1649 (caching), #1650 (observability), #1651 (rewrites). 3 commits, +5974: ECS provider + engine, on-demand ECR mirroring + conda activation fix, and 233 unit tests (engine.py to 99%). `uv.lock` reconciled with main's security upgrades (#1657). --------- Signed-off-by: Michal Bien <mbien@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mlflow/mlflow-skinny>=3.12.0→>=3.14.0to fix CVEsgrpcio>=1.81.0rc1as auvconstraint-dependency(transitive via ray) to fix CVEstorch2.5.0→2.12.0andtorchvision0.20.0→0.27.0inlongmt_evalvia kajalj22/SEGALE@a7c9a1a which relaxes the upstreamtorch==2.5.0pin🤖 Generated with Claude Code