Skip to content

[Snyk] Fix for 4 vulnerabilities #149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 4 vulnerabilities #149

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion responsibleai_vision/requirements-automl.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,5 @@
opencv-python==4.3.0.36
azureml-automl-dnn-vision>=1.47.0
azureml-automl-dnn-vision>=1.47.0
pyasn1>=0.6.2 # not directly required, pinned by Snyk to avoid a vulnerability
torch>=2.10.0 # not directly required, pinned by Snyk to avoid a vulnerability
wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines +3 to +5
Copy link

@gemini-code-assist gemini-code-assist bot Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This change introduces a major version upgrade for torch (from 1.x to >=2.10.0). This is a significant risk and is likely to introduce breaking API changes, which could break existing functionality that depends on torch (e.g., via torchmetrics). Other dependencies in this project, like pydantic and numpy, are carefully pinned to avoid major version upgrades, and the same caution should be applied here. Additionally, pinning transitive dependencies in this file can lead to a fragile dependency setup. The extensive list of warnings in the pull request description indicates that the dependency tree is already inconsistent. Merging these changes without resolving the underlying conflicts will likely break the environment. It is strongly recommended to reject this automated change and instead perform a comprehensive update of dependencies, resolving all conflicts, and thoroughly testing the application.

Loading