This repository has been archived by the owner on Nov 17, 2023. It is now read-only.
[v1.9.x] [BUGFIX] Upgrade numpy to <1.20.0 to avoid security vulnerabilities affecting numpy<1.19.1 #20940
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hey @DickJC123 , Thanks for submitting the PR
CI supported jobs: [edge, website, windows-cpu, clang, centos-cpu, unix-cpu, sanity, centos-gpu, windows-gpu, unix-gpu, miscellaneous] Note: |
DickJC123
changed the title
mseth10
added
pr-awaiting-testing
|
FYI, issue #20869 discussing the numpy upgrade motivation had the comment from @huubvh95: My feeling on this: |
samskalicky
approved these changes
Mar 10, 2022
DickJC123
added a commit
to DickJC123/mxnet
that referenced
this pull request
Mar 12, 2022
…ilities affecting numpy<1.19.1 (apache#20940) * Pin numpy==1.19.1 to demonstrate issues * Relax min numpy version * Make test_np_array_function_protocol delete() testing work with numpy>=1.19 * Fix test_np_delete to also work with numpy>=1.19 * Pip install python module 'packaging' * More pip-install 'packaging' * Update windows requirements.txt * Allow numpy as advanced as 1.19.5
6 tasks
DickJC123
added a commit
to DickJC123/mxnet
that referenced
this pull request
Mar 14, 2022
…ilities affecting numpy<1.19.1 (apache#20940) * Pin numpy==1.19.1 to demonstrate issues * Relax min numpy version * Make test_np_array_function_protocol delete() testing work with numpy>=1.19 * Fix test_np_delete to also work with numpy>=1.19 * Pip install python module 'packaging' * More pip-install 'packaging' * Update windows requirements.txt * Allow numpy as advanced as 1.19.5
DickJC123
added a commit
that referenced
this pull request
Mar 18, 2022
* [v1.9.x] [BUGFIX] Upgrade numpy to <1.20.0 to avoid security vulnerabilities affecting numpy<1.19.1 (#20940) * Pin numpy==1.19.1 to demonstrate issues * Relax min numpy version * Make test_np_array_function_protocol delete() testing work with numpy>=1.19 * Fix test_np_delete to also work with numpy>=1.19 * Pip install python module 'packaging' * More pip-install 'packaging' * Update windows requirements.txt * Allow numpy as advanced as 1.19.5 * Trigger CI
DickJC123
added a commit
that referenced
this pull request
Mar 18, 2022
#20957) * Stop skipping tests mentioned in issue 18600 * Reenable test_np_random_chisquare also * [v1.9.x] [BUGFIX] Upgrade numpy to <1.20.0 to avoid security vulnerabilities affecting numpy<1.19.1 (#20940) * Pin numpy==1.19.1 to demonstrate issues * Relax min numpy version * Make test_np_array_function_protocol delete() testing work with numpy>=1.19 * Fix test_np_delete to also work with numpy>=1.19 * Pip install python module 'packaging' * More pip-install 'packaging' * Update windows requirements.txt * Allow numpy as advanced as 1.19.5 * Fix test_np_random_{beta,f,chisquare}
Closed
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
There are vulnerabilities reported in numpy versions currently used in our CI system, as mentioned in issue #20869:
https://nvd.nist.gov/vuln/detail/CVE-2021-41495
https://nvd.nist.gov/vuln/detail/CVE-2021-41496
These issues require a numpy version >= 1.19.1 to avoid. This PR takes the somewhat conservative approach of only advancing the numpy version to 1.19.5 (actually <1.20.0) in order to avoid the issues, without advancing numpy farther and risking creating additional issues. Note that the numpy version is not restricted to >=1.19.1, since some of the build and test environments do not support numpy 1.19. Thus, with this PR, MXNet will be built to avoid the vulnerabilities if the system supports it.
The unittests that started failing on numpy 1.19 were test_np_delete and test_np_array_function_protocol, due to the change in the way numpy 1.19 delete() interprets the indices-to-delete when supplied as an array. The tests were modified to pass for all versions of numpy, both 1.19 and earlier. See https://numpy.org/doc/stable/release.html for more details.
Checklist
Essentials