Patch aiohttp for CVE-2025-69223#33621
Conversation
Signed-off-by: Zachary Aristei <zaristei@nvidia.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly upgrades aiohttp to patch a security vulnerability. The CVE mentioned in the title and description appears to be incorrect; the upgrade to aiohttp version 3.13.3 addresses CVE-2024-23829, which is a request smuggling vulnerability. The changes in requirements/rocm-test.txt and requirements/test.txt are appropriate. I've added one suggestion for requirements/common.txt to improve dependency reproducibility.
| protobuf # Required by LlamaTokenizer, gRPC. | ||
| fastapi[standard] >= 0.115.0 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint. | ||
| aiohttp | ||
| aiohttp >= 3.13.3 |
There was a problem hiding this comment.
For better reproducibility and to prevent potential breakages with future aiohttp releases, it's recommended to pin the version to ==3.13.3. This would also make it consistent with rocm-test.txt and test.txt where the version is pinned. While using >= allows for automatic bug fixes from upstream, it can also introduce unexpected issues if a new version has breaking changes.
aiohttp == 3.13.3
DarkLight1337
added
the
ready
|
cc @russellb |
Signed-off-by: Zachary Aristei <zaristei@nvidia.com> Co-authored-by: Zachary Aristei <zaristei@nvidia.com>
Signed-off-by: Zachary Aristei <zaristei@nvidia.com> Co-authored-by: zaristei2 <zaristei2@gmail.com> Co-authored-by: Zachary Aristei <zaristei@nvidia.com> Signed-off-by: felix01.yu <felix01.yu@vipshop.com>
This reverts commit 32a02c7.
This reverts commit 32a02c7. Signed-off-by: Hashem Hashemi <hashem.hashemi@amd.com>
Signed-off-by: Zachary Aristei <zaristei@nvidia.com> Co-authored-by: zaristei2 <zaristei2@gmail.com> Co-authored-by: Zachary Aristei <zaristei@nvidia.com>
Signed-off-by: Zachary Aristei <zaristei@nvidia.com> Co-authored-by: zaristei2 <zaristei2@gmail.com> Co-authored-by: Zachary Aristei <zaristei@nvidia.com>
4 participants
Purpose
upgrade aiohttp to bypass CVE-2025-69223 for the 0.15.1 release.
Test Plan
Test Result