fix(dependencies): bump Pillow version to 12.3.0 - #144
Conversation
Override Hermes Agent's Pillow 12.2.0 pin with Pillow 12.3.0 and refresh the lockfile and generated Python attribution. This remediates CVE-2026-54058 and CVE-2026-59197 in the repository-managed environment. Signed-off-by: Yuchen Zhang <yuchenz@nvidia.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (20)
🧰 Additional context used📓 Path-based instructions (14)**/*📄 CodeRabbit inference engine (.agents/skills/karpathy-guidelines/SKILL.md)
Files:
{Cargo.toml,python/pyproject.toml,pyproject.toml}📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
{Cargo.toml,Cargo.lock,pyproject.toml,uv.lock,python/pyproject.toml}📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
{Cargo.toml,pyproject.toml,python/pyproject.toml}📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
{Cargo.toml,Cargo.lock,pyproject.toml,uv.lock}📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
{pyproject.toml,python/pyproject.toml,Cargo.toml,docs/package.json,.github/workflows/*.yml,justfile}📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
**/*.{rs,toml}📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Files:
**/{Cargo.toml,Cargo.lock,pyproject.toml,package.json}📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Files:
**/*.{toml,lock}📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Files:
**/*.{yml,yaml,toml,lock}📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Files:
{pyproject.toml,adapters/**/pyproject.toml}📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
Files:
**/*.{rs,py,toml}📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
Files:
**/*.{toml,rs,py}📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
Files:
**/*.{rs,py,html,md,mdx,toml,yml,yaml,sh,bash}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
🔇 Additional comments (1)
WalkthroughPillow is constrained to version 12.3.0 or newer for Python versions below 3.14 through uv dependency overrides, and the corresponding third-party attribution entry is updated. ChangesPillow version update
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Fern docs preview: https://nvidia-preview-pull-request-144.docs.buildwithfern.com/nemo/fabric |
yczhang-nv
changed the title
Pillow version to 12.3.0
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Around line 117-120: Update the Pillow entry in the override-dependencies
configuration to use a minimum version of 12.3.0 rather than an exact pin, while
preserving the existing python_version < '3.14' marker.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 6ebf7ae3-f26c-4873-930d-71cf0146ed87
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
ATTRIBUTIONS-Python.mdpyproject.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (15)
- GitHub Check: Preview docs
- GitHub Check: Test (Python 3.12, windows-amd64)
- GitHub Check: Test (Python 3.14, linux-arm64)
- GitHub Check: Test (Python 3.11, windows-amd64)
- GitHub Check: Test (Python 3.12, linux-arm64)
- GitHub Check: Test (Python 3.11, linux-arm64)
- GitHub Check: Test (Python 3.13, linux-amd64)
- GitHub Check: Test (Python 3.14, linux-amd64)
- GitHub Check: Test (Python 3.13, linux-arm64)
- GitHub Check: Test (Python 3.12, linux-amd64)
- GitHub Check: Test (Python 3.14, windows-amd64)
- GitHub Check: Test (Python 3.13, windows-amd64)
- GitHub Check: Test (Python 3.11, linux-amd64)
- GitHub Check: Test (Python 3.11, macos-arm64)
- GitHub Check: Pre-commit
🧰 Additional context used
📓 Path-based instructions (22)
**/*
📄 CodeRabbit inference engine (.agents/skills/karpathy-guidelines/SKILL.md)
**/*: Before implementing, explicitly state assumptions, surface ambiguity and tradeoffs, present multiple interpretations when relevant, and ask for clarification rather than silently deciding or proceeding when requirements are unclear.
Prefer the minimum code needed to solve the requested problem: avoid speculative features, unnecessary abstractions, unrequested flexibility, and handling of impossible scenarios; simplify overcomplicated solutions.
When editing existing code, make surgical changes only: do not modify unrelated code, comments, formatting, or pre-existing dead code; match the existing style, and remove only unused imports, variables, or functions introduced by your changes.
Define verifiable success criteria for each task, such as writing regression tests for bugs and invalid-input tests for validation, then verify the implementation against those criteria. For multi-step work, state a brief plan with a verification check for each step.
**/*: Always spellNVIDIAin all caps; do not useNvidia,nvidia,nVidia,nVIDIA, orNV.
Usean NVIDIAbefore a noun, because the name begins with an “en” sound.
Do not add a registered trademark symbol afterNVIDIAwhen referring to the company; use trademark symbols with product names only when required by the document type or legal guidance.
Verify official capitalization, spacing, hyphenation, and spelling for NVIDIA and third-party product names; do not rewrite official product names for grammar or title-case rules.
Precede NVIDIA product names withNVIDIAon first mention when natural and accurate, and link the first mention when the destination helps the reader.
On first use, include the company name and full model qualifier when it helps identify the model; preserve official capitalization and punctuation, and use shorter family names only after establishing the full name.
For learning-oriented and developer content, do not force trademark symbols unless explicitly required; for press, ...
Files:
pyproject.tomlATTRIBUTIONS-Python.md
{Cargo.toml,python/pyproject.toml,pyproject.toml}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep Rust workspace/package metadata and Python/maturin package metadata internally consistent, including package names, versions, import paths, and module names.
Files:
pyproject.toml
{Cargo.toml,Cargo.lock,pyproject.toml,uv.lock,python/pyproject.toml}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
{Cargo.toml,Cargo.lock,pyproject.toml,uv.lock,python/pyproject.toml}: Keep workspace, Python, and lockfile dependency versions aligned where required, and review both direct and transitive dependency changes from resolved lockfiles.
Inspect resolved transitive licenses, explicitly surface UNKNOWN, non-SPDX/custom, proprietary, source-available, copyleft, or network-copyleft terms, and route unresolved licensing questions to dependency approvers with distribution and linkage context.
Document the functional need, alternatives considered, rationale for the selected dependency, and any unresolved licensing question when introducing dependencies.
Files:
pyproject.toml
{Cargo.toml,pyproject.toml,python/pyproject.toml}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Before adding a dependency, prefer the standard library, an existing dependency, or a small local implementation when appropriate; otherwise select a maintained, narrow-fit dependency with clear SPDX metadata and a permissive license where possible.
Files:
pyproject.toml
{Cargo.toml,Cargo.lock,pyproject.toml,uv.lock}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
After updating manifests or lockfiles, run
uv run --no-project python scripts/licensing/license_diff.py --base-ref origin/mainand review added packages and license changes.
Files:
pyproject.toml
{pyproject.toml,python/pyproject.toml,Cargo.toml,docs/package.json,.github/workflows/*.yml,justfile}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Reflect public packaging changes in release-facing documentation and ensure CI references the same package names and commands used by local workflows.
Files:
pyproject.toml
**/*.{rs,toml}
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
For any Rust change, run
just test-rustandcargo fmt --all -- --check.For Rust core, CLI, or shared runtime semantic changes, run Rust formatting and tests, and add Python tests when behavior is exposed through the SDK.
Files:
pyproject.toml
**/{Cargo.toml,Cargo.lock,pyproject.toml,package.json}
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
For new or updated dependencies, document the functional need, alternatives considered, and why the selected dependency is the narrowest fit.
Files:
pyproject.toml
**/*.{toml,lock}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If a manifest or lockfile changes, run the license-diff script against
origin/main, review transitive license changes, and run theattributions-rustandattributions-pythonpre-commit hooks.
Files:
pyproject.toml
**/*.{yml,yaml,toml,lock}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
For CI or packaging changes, use
maintain-ciormaintain-packaging, then run recipes and checks whose behavior changed.
Files:
pyproject.toml
{pyproject.toml,adapters/**/pyproject.toml}
📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
{pyproject.toml,adapters/**/pyproject.toml}: Update the literalproject.versionin the root setuptools project and every adapterpyproject.toml.
Keep internal exact-version requirements aligned: rootnemo-fabric-* == <version>optional dependencies and each adapter'snemo-fabric-adapters-common == <version>dependency.
Files:
pyproject.toml
**/*.{rs,py,toml}
📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
When editing version helpers, verify every
nemo-fabric-*workspace package through Cargo metadata and reject a static version inpython/pyproject.toml.
Files:
pyproject.toml
**/*.{toml,rs,py}
📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
Avoid blind repository-wide replacement of version-like strings; distinguish package-version references from examples and unrelated dependency versions.
Files:
pyproject.toml
**/*.{rs,py,html,md,mdx,toml,yml,yaml,sh,bash}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
All Rust, Python, HTML, Markdown, MDX, TOML, YAML, and shell source files must include the project SPDX copyright and Apache-2.0 license headers using the comment syntax appropriate to each file type.
Files:
pyproject.tomlATTRIBUTIONS-Python.md
**/*.{md,rst}
📄 CodeRabbit inference engine (.agents/skills/contribute-api/SKILL.md)
Update documentation and examples in the same branch as the public API change.
Files:
ATTRIBUTIONS-Python.md
**/*.{md,mdx,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
**/*.{md,mdx,rst}: For NeMo Fabric documentation, verify technical claims against the current repository, public API, or documented command before reviewing style.
Always spellNVIDIAin all caps; do not useNvidia,nvidia, orNV.
Format commands, code elements, expressions, package names, file names, and paths as inline code.
Use descriptive link text; avoid raw URLs and weak anchors such ashereorread more.
Use title case consistently for technical documentation headings.
Introduce code blocks, lists, tables, and images with complete sentences.
Write procedures as imperative, parallel steps; split long procedures into smaller tasks.
Prefer active voice, present tense, short sentences, contractions, and plain English while preserving necessary technical precision.
Usecanfor possibility and reservemayfor permission.
Useafterfor temporal relationships instead ofonce, and preferrefer tooverseewhen directing readers to another resource.
Avoid culture-specific idioms, unnecessary Latinisms, jokes, and marketing exaggeration in technical documentation.
Spell out months in body text, avoid ordinal dates, and use clear time zones.
Spell out whole numbers from zero through nine unless they are technical values, parameters, versions, or UI values; use numerals for 10 or greater and commas in thousands.
Do not add trademark symbols to learning-oriented documentation unless the source, platform, or legal guidance explicitly requires them.
Do not replace precise technical terms with simpler words when doing so would lose precision.
Do not flag passive voice when the actor is unknown or the action is the important part.
Do not rewrite API names, package names, command flags, or code literals for style.
**/*.{md,mdx,rst}: Use consistent title case for technical-document headings and table headers; avoid quotation marks, ampersands, and exclamation marks in headings, while preserving official product, event, research, and whitepaper title ...
Files:
ATTRIBUTIONS-Python.md
**/*.{md,rst,txt,adoc}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-language-mechanics.md)
**/*.{md,rst,txt,adoc}: For technical documentation, use professional, active, conversational, engaging, precise, and plain-English prose. Prefer active voice, present tense, short sentences, and scannable paragraphs. Avoid casual or imprecise language, swearing, threats, insults, jokes, puns, culture-specific idioms, marketing exaggeration, and unsupported third-party comparisons.
Usecanfor possibility and reservemayfor permission; useafterfor temporal order; userefer tofor cross-references; prefer short direct sentences and specific verbs; avoid unnecessarypleasein technical documentation.
Prefer active voice when the actor matters. Passive voice is acceptable when the actor is unknown or irrelevant, when the action or result is the focus, or in programmer documentation.
Use natural contractions in conversational technical prose, but do not force them in formal legal copy, API references, or generated text.
Prefer simpler English over Latinisms: usefor exampleorsuch asinstead ofe.g.,and so oninstead ofetc.,that isinstead ofi.e.,compared toinstead ofvs., andby,through, orusinginstead ofvia. Use industry-standard terms such as in silico, in vitro, and in vivo when appropriate, and italicize them in running text.
Usethatwithout commas for essential clauses, andwhichwith commas for nonessential clauses.
Format dates and times clearly: spell out months in body text; use forms such asJune 12, 2025; avoid numeric or ordinal dates; capitalize days; use 12-hour time when appropriate; include a space beforea.m.orp.m.; useETandPTfor needed time zones; avoid24/7; and preferfrom 12:30 to 1:00 p.m.for prose ranges.
Format numbers consistently: spell out zero through nine in body text, use numerals for 10 or greater and for technical values, use commas in thousands, do not begin a sentence with a numeral, spell out ordinals, and use numerals consistently within a category wh...
Files:
ATTRIBUTIONS-Python.md
**/ATTRIBUTIONS-*.md
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Regenerate and include changed
ATTRIBUTIONS-*.mdfiles.
Files:
ATTRIBUTIONS-Python.md
**/*.{md,mdx}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/SKILL.md)
**/*.{md,mdx}: Use the full product nameNVIDIA NeMo Fabricon its first usage, typically in the title or H1; useNeMo Fabricthereafter.
Usefabricby itself only when referring to the CLI tool, and surround those references with backticks.
CapitalizeNVIDIAcorrectly in public documentation.
Format commands, code elements, expressions, file names, paths, and filenames as inline code where needed.
Use title case consistently for headings in technical documentation.
Introduce code blocks, tables, and lists with complete lead-in sentences.
Use descriptive anchor text instead of raw URLs or generic link text such ashere.
Prefer active voice, present tense, short sentences, and plain English.
Use consistent terminology for the same concept throughout a document.
Write procedures as imperative, parallel, easy-to-scan steps, and split long sequences into smaller tasks.
Useafterinstead ofoncewhen expressing temporal sequence.
Usecaninstead ofmaywhen the intended meaning is possibility rather than permission.
Avoid ambiguous numeric dates and ordinal dates in body text.
For learning-oriented documentation, do not force trademark symbols unless the source document explicitly requires them.
Introduce examples' code blocks with full sentences and ensure examples match current APIs and build commands.For docs site changes, run
just docsto regenerate Python and Rust API references and validate the Fern configuration.
Files:
ATTRIBUTIONS-Python.md
**/{README.md,*.md,*.mdx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Update relevant documentation when changes affect public behavior, adapters, examples, or workspace structure.
Files:
ATTRIBUTIONS-Python.md
**/*.md
📄 CodeRabbit inference engine (.agents/skills/README.md)
Documentation and examples must be updated consistently with changes to public behavior and reviewed for NVIDIA technical-writing style.
Files:
ATTRIBUTIONS-Python.md
{*.md,**/*.md,**/*.mdx,**/*.ipynb}
⚙️ CodeRabbit configuration file
{*.md,**/*.md,**/*.mdx,**/*.ipynb}: Enforce the product name in user-facing prose: use "NVIDIA NeMo Fabric" on first use and "NeMo Fabric" thereafter. Flag standalone capitalized "Fabric" when it refers to the product. Do not flag the lowercasefabricCLI command, package/import/crate names, code identifiers, API symbols, configuration keys, file paths, or unrelated generic uses of the word.
Files:
ATTRIBUTIONS-Python.md
🔇 Additional comments (2)
ATTRIBUTIONS-Python.md (1)
6881-6881: LGTM!pyproject.toml (1)
119-121: 🗄️ Data Integrity & IntegrationI need the exact surrounding config and any Hermes Agent dependency entries to determine whether the current override is truly global. Then I can compare that with uv’s supported override syntax.
Signed-off-by: Yuchen Zhang <yuchenz@nvidia.com>
Signed-off-by: Yuchen Zhang <yuchenz@nvidia.com>
|
/merge |
2 participants
Overview
Overriding Hermes Agent's transitive
Pillow==12.2.0pin with Pillow 12.3.0 in the repository-manageduv environment.
Details
tool.uv.override-dependenciesentry for Pillow 12.3.0.uv.lockso Hermes Agent resolves to Pillow 12.3.0.Known limitation: Hermes Agent 0.17.0 still publishes metadata requiring
Pillow==12.2.0, souv pip checkreports that upstream metadata mismatchwhen the Hermes extra is installed. The override is uv-project-local and does
not change the metadata of a published Hermes Agent wheel.
Validation
uvx --from uv==0.11.31 uv lock --checkuvx --from uv==0.11.31 uv sync --extra hermes-agentuvx --from uv==0.11.31 uv tree --invert --package pillowuvx --from uv==0.11.31 uv run --no-sync pytest tests/adapters/test_hermes_adapter.py tests/adapters/test_hermes_streaming.py tests/adapters/test_hermes_config_builder.py— 28 passed.pip-auditof Pillow 12.3.0 — no known vulnerabilities found.uv run --no-project python scripts/licensing/license_diff.py --base-ref HEAD— only Pillow 12.2.0 → 12.3.0; MIT-CMU unchanged.uv run pre-commit run --all-files attributions-rustuv run pre-commit run --all-files attributions-pythonjust build-pythonPYO3_PYTHON=.venv/bin/python cargo check -p fabric-python --lockedgit diff --checkWhere should the reviewer start?
Start with the override and removal comment in
pyproject.toml, then verify thePillow package and manifest override in
uv.lock.Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)
Relates to: none
I confirm this contribution is my own work, or I have the right to submit it under this project's license.
I searched existing issues and open pull requests, and this does not duplicate existing work.
Summary by CodeRabbit
Summary by CodeRabbit
Dependency Updates
12.3.0or newer.Documentation
12.3.0.