[23.11] mlflow: 2.7.0 -> 2.12.1 #289835
[23.11] mlflow: 2.7.0 -> 2.12.1 #289835
Conversation
veprbl
added
the
1.severity: security
There was a problem hiding this comment.
The changes looks pretty big for 23.11, it might be preferable to backport the fix directly. mlflow/mlflow@432b8cc applies cleanly on top of the 2.7.0.
The commit message should start with python3Packages.mlflow to trigger OfBorg.
|
@LeSuisse the list of different vulnerabilities is pretty long. If you can contribute a PR, that's always welcome. |
|
Yeah OK I did not see https://huntr.com/repos/mlflow/mlflow and they do not mention all the security issues in their release notes... I might take a look to see if we can only backport the sec fixes but it will likely have to wait this week end. If the bump to 2.10.2 is considered safe enough to be backported the PR should be rewritten to cherry-pack the patches from |
|
Yeah I don't particularly like it, but there are an awful lot of security issues spread across several releases.
|
|
I guess the other option is |
|
So I took a closer look but even identifying the related PR/commits is a PITA. Some valid reports are flagged as duplicate and link to other non public reports :/ At this point I do not think attempting to backports the fixes is a viable option. |
|
We can always deal with regressions later. |
|
I don't think the python package update would bring breakage, but we could instead restrict update to only apply to mlflow-server. |
|
Updating the version in the stable release seems reasonable, given how much of a pain backporting is in this instance. |
|
Result of 2 packages failed to build:
62 packages built:
|
(cherry picked from commit 6e2a59e)
(cherry picked from commit f51256c)
(cherry picked from commit c50477a)
Security updates and also fixes build issue: - packaging<24 not satisfied by version 24.0 https://github.com/mlflow/mlflow/releases/tag/v2.11.2 https://github.com/mlflow/mlflow/releases/tag/v2.11.3 (cherry picked from commit c2b0bf3)
(cherry picked from commit b09e4d3)
LeSuisse
changed the title
|
Cherry-picked patches to bump to 2.12.1. Too many security patches that are not always mentioned (and it seems the Huntr.com page that was the best places to identify most of them is not available anymore). 2.12.1 release notes mentions:
|
|
Result of 64 packages built:
|
|
Thanks for the merge, please ping me if a regression is spotted and will see what we can do. Clearly it is not an easy package to maintain. |
|
A bit late but nixpkgs-review is happy on Linux x86_64 Result of 64 packages built:
|
Description of changes
Backport of #289834
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.