Skip to content
This repository has been archived by the owner on Nov 17, 2023. It is now read-only.

Update Requests version to 2.20.0 to handle security risk #13266

Merged
merged 2 commits into from
Nov 20, 2018
Merged

Update Requests version to 2.20.0 to handle security risk #13266

merged 2 commits into from
Nov 20, 2018

Conversation

kalyc
Copy link
Contributor

@kalyc kalyc commented Nov 14, 2018

Description

Update Requests version to 2.20.0 to handle security risk

Fixes #13032

Checklist

Essentials

Please feel free to remove inapplicable items for your PR.

  • The PR title starts with [MXNET-$JIRA_ID], where $JIRA_ID refers to the relevant JIRA issue created (except PRs with tiny changes)
  • Changes are complete (i.e. I finished coding on this PR)
  • All changes have test coverage:
  • Unit tests are added for small changes to verify correctness (e.g. adding a new operator)
  • Nightly tests are added for complicated/long-running ones (e.g. changing distributed kvstore)
  • Build tests will be added for build configuration changes (e.g. adding a new build option with NCCL)
  • Code is well-documented:
  • For user-facing API changes, API doc string has been updated.
  • For new C++ functions in header files, their functionalities and arguments are documented.
  • For new examples, README.md is added to explain the what the example does, the source of the dataset, expected performance on test set and reference to the original paper if applicable
  • Check the API doc at http://mxnet-ci-doc.s3-accelerate.dualstack.amazonaws.com/PR-$PR_ID/$BUILD_ID/index.html
  • To the my best knowledge, examples are either not affected by this change, or have been fixed to be compatible with this change

Changes

  • Update Requests version to 2.20.0 in setup.py

@kalyc kalyc requested a review from szha as a code owner November 14, 2018 18:52
@kalyc
Copy link
Contributor Author

kalyc commented Nov 14, 2018

@nswamy @szha

@kalyc
Copy link
Contributor Author

kalyc commented Nov 14, 2018

@mxnet-label-bot add [pr-awaiting-review]

@marcoabreu marcoabreu added the pr-awaiting-review PR is waiting for code review label Nov 14, 2018
@sandeep-krishnamurthy
Copy link
Contributor

Can you please add some info on testing done?

@kalyc
Copy link
Contributor Author

kalyc commented Nov 17, 2018 •
edited
Loading

Tested on Deep Learning Base AMI (Ubuntu) Version 10.0 (ami-050ffa288f9b282c2)
using make -j8 USE_OPENCV=1 USE_BLAS=openblas USE_CUDA=1 USE_CUDA_PATH=/usr/local/cuda USE_CUDNN=1 & python setup.py install

>> import mxnet as mx

sandeep-krishnamurthy
sandeep-krishnamurthy reviewed Nov 17, 2018
View reviewed changes
Copy link
Contributor

@sandeep-krishnamurthy sandeep-krishnamurthy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@szha

szha
szha reviewed Nov 17, 2018
View reviewed changes
python/setup.py Outdated
@@ -30,7 +30,7 @@
else:
from setuptools import setup
from setuptools.extension import Extension
kwargs = {'install_requires': ['numpy<=1.15.2,>=1.8.2', 'requests<2.19.0,>=2.18.4', 'graphviz<0.9.0,>=0.8.1'], 'zip_safe': False}
kwargs = {'install_requires': ['numpy<=1.15.2,>=1.8.2', 'requests>=2.20.0', 'graphviz<0.9.0,>=0.8.1'], 'zip_safe': False}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requests follow semver. add a limit to ,<3

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done @szha

@szha szha merged commit de5267f into apache:master Nov 20, 2018
lanking520 added a commit that referenced this pull request Nov 21, 2018
@lanking520
Revert "Update Requests version to 2.20.0 to handle security risk (#1…
ff9abeb 
…3266)"

This reverts commit de5267f.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@sandeep-krishnamurthy sandeep-krishnamurthy sandeep-krishnamurthy left review comments

@szha szha szha left review comments

@ChaiBapchya ChaiBapchya ChaiBapchya approved these changes

Assignees
No one assigned
Labels
pr-awaiting-review PR is waiting for code review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

requests need upgrade due to security risk (CVE-2018-18074)
5 participants
@kalyc @sandeep-krishnamurthy @szha @ChaiBapchya @marcoabreu