Repository navigation
[Security] Bump pyjwt and rand for remaining GHSAs - #59427
Merged
DarkLight1337 merged 3 commits intoSep 30, 2026
Merged
DarkLight1337 merged 3 commits into
DarkLight1337 merged 3 commits into
Conversation
Raise pyjwt to >=2.14.0 (clears new XPU advisories including a critical), allow setuptools >=83.0.0 (GHSA-h35f-9h28-mq5c), and bump Rust rand to 0.9.3+. Regenerate test lockfiles and Cargo.lock. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
jperezdealgaba
requested review from
AndreasKaratzas,
BugenZhao,
njhill and
tjtanaa
as code owners
September 30, 2026 12:57
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
Author
|
/ci run |
|
✅ Triggered Buildkite CI #92143 for commit |
Drop the setuptools >=83 change from this PR. The <80/<81 caps remain for ROCm editable installs and CMake build-dir reuse (see vllm-project#17320, vllm-project#28592). Keep pyjwt >=2.14.0 and rand 0.9.3+ only. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
jperezdealgaba
changed the title
DarkLight1337
approved these changes
Sep 30, 2026
DarkLight1337
enabled auto-merge (squash)
September 30, 2026 13:07
Member
|
/ci run --allow-stale |
github-actions
Bot
added
the
ready
|
✅ Triggered Buildkite CI #92147 for commit |
Contributor
|
Hi @jperezdealgaba, the pre-commit checks have failed. Please run: uv pip install pre-commit>=4.5.1
pre-commit install
pre-commit run --all-filesThen, commit the changes and push to your branch. For future commits, |
Collaborator
CI selector (shadow): 169 test steps (236 jobs) instead of 8 (8 jobs)Shadow mode: this changes nothing about what CI runs. It shows what the evidence-based selector would pick for this PR, next to today's rules. How it works. Feedback welcome: reply here if it would skip a step this change needs, or runs something unrelated.
Selector would run (169)
Would skip (today's rules run them) (0)none Would add (today's rules do not run them) (161)
AMD mirrors: would skip (0)none AMD mirrors: would add (148)
CI results (2026-09-30 14:52 UTC)25 passed, 0 failed, 1 pending. No failures to judge. 6 changed files · base |
Member
|
/ci run |
|
✅ Triggered Buildkite CI #92154 for commit |
1 of 8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #59249 and #59315 for the remaining actionable Dependabot alerts that do not conflict with intentional pins.
Dependabot exposure addressed (as of 2026-09-30)
>=2.14.0/2.15.1(XPU was still on2.13.0)0.9.3/0.9.5Intentionally not included
setuptools<80/<81) kept for ROCm editable installs and CMake build-dir reuse (#17320, #28592); mediumGHSA-h35f-9h28-mq5cneeds>=83nltk,sqlitedict,accelerate,lmcachetorch,ray.github/dependabot.ymlignoreChanges
pyjwt>=2.14.0in test.infiles; XPU lock bumped to2.15.1(CUDA/CPU/ROCm already had it)rand = "0.9.3"inrust/Cargo.toml+Cargo.lockupdateWhy not duplicating
Test plan
pyjwt==2.15.1on CUDA/CPU/ROCm/XPU locks; setuptools caps unchangedcargo updateforrand→0.9.5randbump