RHAIENG-3998: Refresh lock files for rhoai-3.3 to resolve CVE issues#2073
Conversation
Regenerated pylock.toml files using the public-index mode to update package URLs and ensure all dependencies are current. Updated files: - jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml - jupyter/pytorch/ubi9-python-3.12/pylock.toml - jupyter/rocm/pytorch/ubi9-python-3.12/pylock.toml - jupyter/trustyai/ubi9-python-3.12/pylock.toml - runtimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml - runtimes/pytorch/ubi9-python-3.12/pylock.toml - runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
📝 WalkthroughWalkthroughMultiple pylock.toml dependency lock files across Jupyter and runtime environments are updated to migrate package wheel download URLs from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
runtimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml (1)
4503-4527: Please confirm lockfile regeneration used the repo-standard target.The PR description mentions
refresh-lock-files, while repo guidance forpylock.tomlspecifiesmake refresh-pipfilelock-files. Please confirm which command produced this file so we stay aligned with the documented lockfile workflow.As per coding guidelines: "
**/{pyproject,pylock}.toml: ... regenerate lock files after dependency changes by runningmake refresh-pipfilelock-files."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@runtimes/pytorch`+llmcompressor/ubi9-python-3.12/pylock.toml around lines 4503 - 4527, The pylock.toml appears regenerated but the PR says `refresh-lock-files`; please confirm and, if you did not run the repo-standard target, re-run the documented command `make refresh-pipfilelock-files` to regenerate pylock.toml and update the PR description to state the exact command used; reference the pylock.toml artifact in your changes and ensure the regenerated file matches the result of `make refresh-pipfilelock-files` before pushing the update.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@runtimes/pytorch/ubi9-python-3.12/pylock.toml`:
- Around line 4266-4277: The lock file contains torchvision wheel entries
pointing to download-r2.pytorch.org (see the torchvision wheel URL entries),
which is not an official PyTorch index; replace those URLs with the official
download.pytorch.org/whl equivalents (or restore the previous URLs) and then
regenerate the lock file by running the documented Makefile target (make
refresh-pipfilelock-files) so the pylock.toml entries for torchvision and their
sha256 hashes are updated from the official PyTorch index.
In `@runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml`:
- Around line 3452-3457: Documentation references to a non-existent Makefile
target need to be corrected: replace occurrences of "refresh-pipfilelock-files"
in CONTRIBUTING.md and Agents.md with the actual target "make
refresh-lock-files" (or just "refresh-lock-files" where appropriate) so docs
match the repository Makefile; update any example commands to use "make
refresh-lock-files" and run a quick search to ensure no other docs reference the
old target.
---
Nitpick comments:
In `@runtimes/pytorch`+llmcompressor/ubi9-python-3.12/pylock.toml:
- Around line 4503-4527: The pylock.toml appears regenerated but the PR says
`refresh-lock-files`; please confirm and, if you did not run the repo-standard
target, re-run the documented command `make refresh-pipfilelock-files` to
regenerate pylock.toml and update the PR description to state the exact command
used; reference the pylock.toml artifact in your changes and ensure the
regenerated file matches the result of `make refresh-pipfilelock-files` before
pushing the update.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dea25981-0ba1-4f5d-9e44-f88adc290d94
📒 Files selected for processing (7)
jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomljupyter/pytorch/ubi9-python-3.12/pylock.tomljupyter/rocm/pytorch/ubi9-python-3.12/pylock.tomljupyter/trustyai/ubi9-python-3.12/pylock.tomlruntimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomlruntimes/pytorch/ubi9-python-3.12/pylock.tomlruntimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp310-cp310-manylinux_2_28_x86_64.whl", hashes = { sha256 = "538f4db667286d939b4eee0a66d31ed21b51186668006b0e0ffe20338ecc7e00" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp310-cp310-win_amd64.whl", hashes = { sha256 = "ad48ba3c3ffd48027e3a8de42fcea131a53a524ee9416ca4efb22f9ac6b7328d" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp311-cp311-manylinux_2_28_x86_64.whl", hashes = { sha256 = "92568ac46b13a8c88b61589800b1b9c4629be091ea7ce080fc6fc622e11e0915" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp311-cp311-win_amd64.whl", hashes = { sha256 = "85ecd729c947151eccea502853be6efc2c0029dc26e6e5148e04684aed008390" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp312-cp312-manylinux_2_28_x86_64.whl", hashes = { sha256 = "f64ef9bb91d71ab35d8384912a19f7419e35928685bc67544d58f45148334373" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp312-cp312-win_amd64.whl", hashes = { sha256 = "650561ba326d21021243f5e064133dc62dc64d52f79623db5cd76637a9665f96" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp313-cp313-manylinux_2_28_x86_64.whl", hashes = { sha256 = "bc4fef193917b51db6b409acd3ffdec9286d877baac0aee5dcfbb72592d00bfc" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp313-cp313-win_amd64.whl", hashes = { sha256 = "eb784cc75a66f3336a04ff3a992bf74160842132db69e8bdbb58b5ab9422c345" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp313-cp313t-manylinux_2_28_x86_64.whl", hashes = { sha256 = "02faf51fbf5070592768fa935327d13a484b745faef38b0fee01d85cfb35f5bc" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp313-cp313t-win_amd64.whl", hashes = { sha256 = "e5320bb2c9f69636f3dc18abc3291fe8c8e448cb9ef0112510a5413a5af3f8f2" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp39-cp39-manylinux_2_28_x86_64.whl", hashes = { sha256 = "51f25bc1d28b037d98a1415c917441726244d8a00971907e6dfb00eccc31365f" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp39-cp39-win_amd64.whl", hashes = { sha256 = "d44d8bc41162167aa7b9eba0587362d007e84b7ecab5774972ad78eb4d30c004" } }, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Test accessibility of new PyTorch CDN domain and sample wheel URL
echo "Testing new domain resolution and HTTPS accessibility..."
# Test domain resolution
host download-r2.pytorch.org
# Test one sample wheel URL from the changes
sample_url="https://download-r2.pytorch.org/whl/cu128/torchvision-0.22.1%2Bcu128-cp312-cp312-manylinux_2_28_x86_64.whl"
echo -e "\nTesting sample wheel URL accessibility (HEAD request)..."
curl -I -L --max-time 10 "$sample_url"
# Check if old domain still resolves (for comparison)
echo -e "\nChecking old domain for comparison..."
host download.pytorch.orgRepository: red-hat-data-services/notebooks
Length of output: 1255
🌐 Web query:
Is download-r2.pytorch.org an official PyTorch CDN? Has PyTorch migrated from download.pytorch.org to download-r2.pytorch.org for wheel distribution?
💡 Result:
No, download-r2.pytorch.org is not mentioned in any official PyTorch documentation or recent sources as an official PyTorch CDN. All current official installation instructions and wheel indexes explicitly use download.pytorch.org/whl (e.g., pip install --index-url https://download.pytorch.org/whl/cu118). There is no evidence of a migration from download.pytorch.org to download-r2.pytorch.org for wheel distribution. download.pytorch.org is backed by CloudFront CDN (AWS), with some past flakiness noted but no switch to Cloudflare R2 indicated in PyTorch repos, blogs, or docs as of 2026-04-02.
Citations:
- 1: https://pytorch.org/get-started/previous-versions/
- 2: https://pytorch.org/get-started/locally/
- 3: https://pytorch.org/get-started/pytorch-2-x/
- 4: No matching distribution from download.pytorch.org/whl pytorch/pytorch#170511
- 5: https://pytorch.org/blog/pytorch-wheel-variants/
- 6: https://pytorch.org/get-started
- 7: https://pytorch.org/get-started/pytorch-2-x
- 8: https://www.pytorch.org
- 9: download.pytorch.org flaky pytorch/pytorch#100400
Do not merge: Lock file contains URLs from non-official PyTorch domain.
The torchvision wheel URLs in lines 4266-4277 have been migrated to download-r2.pytorch.org, which is not documented as an official PyTorch distribution source. Official PyTorch installation instructions and all documented wheel indexes use download.pytorch.org/whl. While the URLs are currently accessible and return valid wheel files, the absence of official documentation for this domain migration creates a supply chain security risk.
This contradicts the coding guideline to "regenerate lock files after dependency changes by running make refresh-pipfilelock-files"—that process should source from official PyTorch infrastructure only. Verify that the lock file was regenerated using the official PyTorch index (download.pytorch.org) via the documented Makefile target, or restore the original URLs.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@runtimes/pytorch/ubi9-python-3.12/pylock.toml` around lines 4266 - 4277, The
lock file contains torchvision wheel entries pointing to download-r2.pytorch.org
(see the torchvision wheel URL entries), which is not an official PyTorch index;
replace those URLs with the official download.pytorch.org/whl equivalents (or
restore the previous URLs) and then regenerate the lock file by running the
documented Makefile target (make refresh-pipfilelock-files) so the pylock.toml
entries for torchvision and their sha256 hashes are updated from the official
PyTorch index.
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp310-cp310-linux_x86_64.whl", hashes = { sha256 = "d54db030d74dcd0df1d166f4d6a63c0a59310297af4a57cbe867dea6e82fb07b" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp311-cp311-linux_x86_64.whl", hashes = { sha256 = "8eb26aec84408b2be3d5b942a9edef9fadc6e249afe6aab795872e227ce8f579" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp312-cp312-linux_x86_64.whl", hashes = { sha256 = "977423eee5c542a3f8aa4f527aec1688c4d485f207089cb595a8e638fcc3888a" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp313-cp313-linux_x86_64.whl", hashes = { sha256 = "104d1087692ea24dbfdb178b7a245c59b04d2121540587e392e30a668cf98edd" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp313-cp313t-linux_x86_64.whl", hashes = { sha256 = "dd521c3f3679a79081ebaa9a416d2090b0d3970a157e0bbe1e163dc75e8da4bf" } }, | ||
| { url = "https://download-r2.pytorch.org/whl/pytorch_triton_rocm-3.3.1-cp39-cp39-linux_x86_64.whl", hashes = { sha256 = "126dc1abacb6b48c24ba0a4850423dc5395169ca03ecb242c789c4ad0d25ce88" } }, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only verification of lock refresh targets and references.
set -euo pipefail
echo "== Makefile targets =="
fd -i 'Makefile' --exec rg -n 'refresh-(pipfilelock-files|lock-files)\b' {}
echo
echo "== Docs/repo references =="
rg -n --iglob '*.{md,txt,toml,yml,yaml}' 'refresh-(pipfilelock-files|lock-files)\b'
echo
echo "== Ensure old pytorch host is gone in reviewed file =="
rg -n 'download\.pytorch\.org' runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml || trueRepository: red-hat-data-services/notebooks
Length of output: 458
🏁 Script executed:
#!/bin/bash
# Verify the actual Makefile target and check for any pipfilelock references
set -euo pipefail
echo "=== Full refresh-lock-files target definition ==="
sed -n '420,450p' Makefile || true
echo
echo "=== Search for any pipfilelock references ==="
rg -i 'pipfilelock' --type makefile --type markdown --type txt . || echo "No pipfilelock references found"
echo
echo "=== Confirm refresh-pipfilelock-files does not exist ==="
rg 'refresh-pipfilelock-files' . || echo "Confirmed: refresh-pipfilelock-files not found in repo"Repository: red-hat-data-services/notebooks
Length of output: 2169
Update documentation to use correct Makefile target name.
The lock file was properly regenerated, but documentation inconsistency exists: the repo's Makefile defines refresh-lock-files as the target, while CONTRIBUTING.md and Agents.md reference refresh-pipfilelock-files (which does not exist). Update docs to use the correct target make refresh-lock-files.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml` around lines 3452 - 3457,
Documentation references to a non-existent Makefile target need to be corrected:
replace occurrences of "refresh-pipfilelock-files" in CONTRIBUTING.md and
Agents.md with the actual target "make refresh-lock-files" (or just
"refresh-lock-files" where appropriate) so docs match the repository Makefile;
update any example commands to use "make refresh-lock-files" and run a quick
search to ensure no other docs reference the old target.
|
Hey @ayush17 — it looks like the refresh only updated the wheels. I just thought that the This approach will be much more effective for releases ≥ 3.4, where version constraints have been removed. |
|
Update based on review feedback from @atheo89: After further analysis, the lockfile refresh on this branch (rhoai-3.3) has limited effectiveness for resolving CVEs because the dependencies in For example, in The What this PR actually changed:
Recommendation:
Keeping this PR open for visibility, but noting that it won't significantly impact CVE counts on this branch. |
|
/kfbuild all |
|
@ayush17 if we don't have any CVE that affect this branch then just merge and update/close the Jira. |
|
@atheo89 Thanks for confirming! The Snyk check shows "No manifest changes detected" which confirms no CVEs are affected by this branch. This PR only updates the PyTorch download URLs from Could you please approve so we can merge? I'll update the Jira ticket accordingly. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: atheo89 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
ayush17
merged commit 4751622
into
red-hat-data-services:rhoai-3.3
3 participants
Summary
refresh-lock-filesMakefile target withpublic-indexmodedownload.pytorch.orgtodownload-r2.pytorch.orgfor torchvision packagesUpdated Files
Test Plan
Jira: RHAIENG-3998
Summary by CodeRabbit