bump ray to latest version 2.42 #4887
Conversation
|
Job PR-4887-f1ca608 is done. |
Update Ray min version to 2.41.0 to address security vulnerabilities Critical security vulnerabilities (CVE-2023-48022, CVE-2024-57000) affect Ray versions up to 2.40.0. To mitigate these issues, the minimum required version is updated to 2.41.0. More details: - CVE-2023-48022: GHSA-6wgj-66m2-xxp2 - CVE-2024-57000: GHSA-xg2h-7cxj-3gvh
core/setup.py
Outdated
| ], | ||
| "raytune": [ | ||
| "pyarrow>=15.0.0", # cap Pyarrow to fix source installation - https://github.com/autogluon/autogluon/issues/4519 | ||
| "ray[default,tune]>=2.10.0,<2.41", # sync with common/src/autogluon/common/utils/try_import.py | ||
| "ray[default,tune]>=2.41.0,<2.43", # sync with common/src/autogluon/common/utils/try_import.py |
There was a problem hiding this comment.
Seems the CVE is withdrawn, unsure if that means the lower bound bump isn't necessary anymore? GHSA-xg2h-7cxj-3gvh
There was a problem hiding this comment.
I'm not sure if the cve was removed because it was a duplicate of the older cve. However, I don't know if versions up to 2.40 are still affected.
|
Job PR-4887-819568f is done. |
|
I took a look at the CVE, I think it is a disputed CVE that might impact all versions of ray but is considered outside the scope of ray by the developers. For now, I don't think any CVE points to the current versions we use, so I've recommended keeping the |
|
Job PR-4887-bbf85d7 is done. |
Issue #, if available:
Closes: #4883
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.