[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #227

VaniHaripriya · 2024-09-09T19:40:19Z

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

sdk/python/requirements.txt

⚠️

Warning

proto-plus 1.24.0 requires protobuf, which is not installed.
kubernetes 30.1.0 requires websocket-client, which is not installed.
kfp-pipeline-spec 0.3.0 requires protobuf, which is not installed.
googleapis-common-protos 1.63.2 requires protobuf, which is not installed.
google-auth 2.32.0 requires pyasn1-modules, which is not installed.
google-api-core 2.19.1 requires protobuf, which is not installed.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.
Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

… duplicate pipeline [Fixes kubeflow#10311] (kubeflow#10546) Validate the error code of pipeline creation in order to return the status conflict when the error represents AlreadyExists. Signed-off-by: champon1020 <nagatelu1020@gmail.com>

daysUntilClose is set to 90 days. This is too much for an issue to keep opened as there is daysUntilStale set to 90 days. That would keep an issue opened for 6 months, and now there are +600 issues opened in the repository. We need to start working on keeping the repository healthy. Signed-off-by: Ricardo M. Oliveira <rmartine@redhat.com>

…nfigMapAsVolume. Fixes kubeflow#10548 (kubeflow#10549) * fix(kubernetes_platform): Add optional field to SecretAsVolume and ConfigMapAsVolume. Signed-off-by: Revital Sur <eres@il.ibm.com> * Update comment. Signed-off-by: Revital Sur <eres@il.ibm.com> --------- Signed-off-by: Revital Sur <eres@il.ibm.com>

PiperOrigin-RevId: 615498240

PiperOrigin-RevId: 615562899

…omponent for vulnerability patch PiperOrigin-RevId: 615593420

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…o support creating ModelEvaluations as part of the AutoSxS Metrics component PiperOrigin-RevId: 615675169

PiperOrigin-RevId: 615914679

PiperOrigin-RevId: 616229944

This reverts commit 4d90770.

PiperOrigin-RevId: 616240307

…ines (kubeflow#9876) * Update resource_spec, retry, secret samples to v2 pipelines * Update resource_spec, retry, secret samples to v2 pipelines

Signed-off-by: Achyut Madhusudan <amadhusu@redhat.com>

PiperOrigin-RevId: 616895855

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…ns (kubeflow#10577) Signed-off-by: connor-mccarthy <mccarthy.connor.james@gmail.com>

…inputs for rlhf PiperOrigin-RevId: 617285265

PiperOrigin-RevId: 617287233

PiperOrigin-RevId: 617579452

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…ction_based PiperOrigin-RevId: 617802429

…files. (kubeflow#10591) Signed-off-by: Achyut Madhusudan <amadhusu@redhat.com>

…vak pipelines from preview to v1 PiperOrigin-RevId: 618017914

PiperOrigin-RevId: 618313694

…peline` in real time PiperOrigin-RevId: 618924675

…nclude generic ephemerl volume (kubeflow#10602) * feat(kubernetes_platform): Update kubernetes_platform go package to include Generic Ephemeral Volume resources Signed-off-by: abaland <abaland@indeed.com> * feat(kubernetes_platform): Update kubernetes_platform go package to include Generic Ephemeral Volume resources (include metadata) Signed-off-by: abaland <abaland@indeed.com>

…flow#10589) Signed-off-by: Rentaro Matsukata <freefood89@users.noreply.github.com>

… EmptyDir (kubeflow#10913) Update kfp backend and kubernetes sdk to support mounting EmptyDir volumes to task pods. Inspired by kubeflow#10427 Fixes: kubeflow#10656 Signed-off-by: Greg Sheremeta <gshereme@redhat.com>

Signed-off-by: Fiona Waters <fiwaters6@gmail.com>

…tegration-test (kubeflow#11132) Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8. - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/4.0.8/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) --- updated-dependencies: - dependency-name: micromatch dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Diego Lovison <diegolovison@gmail.com>

…bleshooting (kubeflow#11098) Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

Signed-off-by: Michael Hu <humichael@google.com> PiperOrigin-RevId: 668536503

Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

… anything in it. Fixes kubeflow#10241 (kubeflow#11096) * Filter pipeline text box shows error when typing anything in it kubeflow#10241 Signed-off-by: Elay Aharoni (EXT-Nokia) <elay.aharoni.ext@nokia.com> * Filter pipeline text box shows error when typing anything in it kubeflow#10241 Signed-off-by: Elay Aharoni (EXT-Nokia) <elay.aharoni.ext@nokia.com> --------- Signed-off-by: Elay Aharoni (EXT-Nokia) <elay.aharoni.ext@nokia.com> Co-authored-by: Elay Aharoni (EXT-Nokia) <elay.aharoni.ext@nokia.com>

This change allows KFP UI to fallback to UI host namespace when no namespaces are provided when referencing the artifact object store provider secret, in default kubeflow deployments this namespace is simply "kubeflow", however the user can customize this behavior by providing the environment variable "SERVER_NAMESPACE" to the KFP UI deployment. Further more, this change addresses a bug that caused URL parse to fail when parsing endpoints without a protocol, this will support such endpoint types as <ip>:<port> for object store endpoints, as is the case in the default kfp deployment manifests. Signed-off-by: Humair Khan <HumairAK@users.noreply.github.com>

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…1178) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…eflow#11179) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

* remove driver logs from executor These logs congest the executor runtime logs making it difficult for the user to differentiate between logs. The driver logs are unnecessary here and can be removed to reduce this clutter. Signed-off-by: Humair Khan <HumairAK@users.noreply.github.com> * remove duplicate emissary call in executor As per the initial inline dev comment, argo podspecpatch did not add the emissary call, and had to be manualy added. This was fixed a couple of argo versions back. However, as a result executor pod makes double calls to the executor, which as a consequence also results in superflous logs. This change removes the additional call to emissary to resolve this. Signed-off-by: Humair Khan <HumairAK@users.noreply.github.com> --------- Signed-off-by: Humair Khan <HumairAK@users.noreply.github.com>

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

* add gcpc modules tests to gha Signed-off-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com> * remove run-all-gcpc-modules test driver script Signed-off-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com> * fix path under gcpc modules tests github action Signed-off-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com> * upgrade ubuntu base image Signed-off-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com> * upgrade python version to 3.9 Signed-off-by: Amanpreet Singh Bedi <amanpreetsinghbedi23@gmail.com> --------- Signed-off-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com> Signed-off-by: Amanpreet Singh Bedi <amanpreetsinghbedi23@gmail.com> Co-authored-by: Amanpreet Singh Bedi <amanpreet.bedi@zscaler.com>

Signed-off-by: Diego Lovison <diegolovison@gmail.com>

* Loosening kubernetes dependency constraint Signed-off-by: egeucak <egeucak75@hotmail.com> * added setuptools in test script Signed-off-by: egeucak <egeucak75@hotmail.com> --------- Signed-off-by: egeucak <egeucak75@hotmail.com>

Signed-off-by: ddalvi <ddalvi@redhat.com>

) Signed-off-by: Jan Staněk <jan@jstanek.cz> Co-authored-by: Jan Staněk <jan.stanek2@firma.seznam.cz>

…1182) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

…ow#11191) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899

champon1020 and others added 30 commits March 12, 2024 18:47

feat(components): Add CMEK support to AutoSxS pipeline

8ccd7a1

PiperOrigin-RevId: 615498240

feat(components): Update _LLM_EVAL_VERSION to v0.6

1b65da4

PiperOrigin-RevId: 615562899

chore(components): update container image of endpoint batch predict c…

8015528

…omponent for vulnerability patch PiperOrigin-RevId: 615593420

chore(backend): Update kfp driver and launcher images (kubeflow#10561)

a0f3815

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

fix(components): Add relevant component and pipeline inputs/outputs t…

2abe91e

…o support creating ModelEvaluations as part of the AutoSxS Metrics component PiperOrigin-RevId: 615675169

feat(components): Release Forecasting training pipelines to V1 namespace

ab549ef

PiperOrigin-RevId: 615914679

chore(release): bumped version to 2.1.0

4d90770

feat(components): Add location validation to preview.llm.rlhf_pipeline

361c16f

PiperOrigin-RevId: 616229944

Revert "chore(release): bumped version to 2.1.0"

140d51a

This reverts commit 4d90770.

chore(components): Testing fix

54e15de

PiperOrigin-RevId: 616240307

fix(samples): Update resource_spec, retry, secret samples to v2 pipel…

a9a433c

…ines (kubeflow#9876) * Update resource_spec, retry, secret samples to v2 pipelines * Update resource_spec, retry, secret samples to v2 pipelines

fix: Modified the comment/text for pipeline_version_id (kubeflow#10581)

0f3d17d

Signed-off-by: Achyut Madhusudan <amadhusu@redhat.com>

chore(components): Update AutoSxS and RLHF image tags

30878e3

PiperOrigin-RevId: 616895855

chore: Update api-generator to use golang 1.20 (kubeflow#10580)

ba3f663

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

fix(docs): make full version dropdown show on all KFP SDK docs versio…

d3e2de4

…ns (kubeflow#10577) Signed-off-by: connor-mccarthy <mccarthy.connor.james@gmail.com>

feat(components): Implement new component to preprocess and validate …

0ece6d0

…inputs for rlhf PiperOrigin-RevId: 617285265

chore(components): GCPC 2.11.0 Release

196ca48

PiperOrigin-RevId: 617287233

fix(components): Fix missing pipeline parameters

5c06ab4

PiperOrigin-RevId: 617579452

chore: Update release image (kubeflow#10599)

a7b580e

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

fix(components): Remove the unused resolve_candidate_columns from fun…

a42ded1

…ction_based PiperOrigin-RevId: 617802429

fix: Modified the swagger json files according to the modified proto …

cc971c9

…files. (kubeflow#10591) Signed-off-by: Achyut Madhusudan <amadhusu@redhat.com>

feat(components): Copy text generation eval and text classification e…

6ce3dc5

…vak pipelines from preview to v1 PiperOrigin-RevId: 618017914

docs(components): internal

0d68a7f

PiperOrigin-RevId: 618313694

chore(release): bumped version to 2.1.0

f328f0b

feat(components): Report TensorBoard metrics for `preview.llm.rlhf_pi…

3d8069b

…peline` in real time PiperOrigin-RevId: 618924675

fix(metadata envoy): upgrade envoy and config from 1.12 to 1.27 (kube…

96aaad9

…flow#10589) Signed-off-by: Rentaro Matsukata <freefood89@users.noreply.github.com>

gregsheremeta and others added 29 commits August 23, 2024 19:52

docs:fixing broken links in readme (kubeflow#11108)

a3adf94

Signed-off-by: Fiona Waters <fiwaters6@gmail.com>

Fix: Basic sample tests - sequential is flaky (kubeflow#11138)

e1d172b

Signed-off-by: Diego Lovison <diegolovison@gmail.com>

chore: Wrapped "Failed GetContextByTypeAndName" error for better trou…

7c7ff12

…bleshooting (kubeflow#11098) Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

chore(components): Update AutoSxS and RLHF image tags

0d098db

Signed-off-by: Michael Hu <humichael@google.com> PiperOrigin-RevId: 668536503

test: Improvements to wait_for_pods function (kubeflow#11162)

1c7954d

Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

chore: Added DCO link to PR template (kubeflow#11176)

4c955f4

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

chore(backend): Update driver and launcher licenses (kubeflow#11177)

f075d0c

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore(backend): update driver and launcher default images (kubeflow#1…

344ea02

…1178) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore: Add instructions for releasing driver and launcher images (kub…

bd76229

…eflow#11179) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

test: Fixed kfp-runtime-tests to run on master branch (kubeflow#11158)

01ad460

Signed-off-by: hbelmiro <helber.belmiro@gmail.com>

chore: add PaulinaPacyna and ouadakarim as reviewers (kubeflow#11180)

a34552a

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

fix(sdk): Kfp support for pip trusted host (kubeflow#11151)

3efa029

Signed-off-by: Diego Lovison <diegolovison@gmail.com>

chore: Remove unwanted Frontend test files (kubeflow#10973)

c7f8729

Signed-off-by: ddalvi <ddalvi@redhat.com>

fix(ui): fixes empty string value in pipeline parameters (kubeflow#11175

e9c77ec

) Signed-off-by: Jan Staněk <jan@jstanek.cz> Co-authored-by: Jan Staněk <jan.stanek2@firma.seznam.cz>

chore(backend): update driver and launcher default images (kubeflow#1…

b69c1b6

…1182) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore(release): bumped version to 2.3.0

4467df5

chore: Update RELEASE.md to remove obsolete instructions (kubeflow#11183

3897764

) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore: Release kfp-pipeline-spec 0.4.0 (kubeflow#11189)

2481193

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore: release kfp-kubernetes 1.3.0 (kubeflow#11190)

3af8b64

Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

chore: update kfp-kubernetes release scripts and instructions (kubefl…

d3aa837

…ow#11191) Signed-off-by: Chen Sun <chensun@users.noreply.github.com>

Merge remote-tracking branch 'upstream-kubeflow-pipelines/master'

f2a7310

fix: sdk/python/requirements.txt to reduce vulnerabilities

85f2b4b

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899

VaniHaripriya force-pushed the master branch from 2d860af to a8fbbd2 Compare September 11, 2024 21:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #227

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #227

VaniHaripriya commented Sep 9, 2024

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #227

Are you sure you want to change the base?

[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #227

Conversation

VaniHaripriya commented Sep 9, 2024

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):