Skip to content

[SC 10242] Update pytorch version to 2.7.0#368

Merged
AnilSorathiya merged 1 commit intomainfrom
anilsorathiya/sc-10242/fix-vulnerability-in-the-pytorch
May 15, 2025
Merged

[SC 10242] Update pytorch version to 2.7.0#368
AnilSorathiya merged 1 commit intomainfrom
anilsorathiya/sc-10242/fix-vulnerability-in-the-pytorch

Conversation

@AnilSorathiya
Copy link
Contributor

@AnilSorathiya AnilSorathiya commented May 13, 2025

Pull Request Description

What

We are upgrade pytorch version to 2.7.0. The details can be found here https://github.com/validmind/validmind-library/security/dependabot/66

Why

I found a Remote Command Execution (RCE) vulnerability in the PyTorch. When load model using torch.load with weights_only=True, it can still achieve RCE.

How to Test

try list_tests() on jupyterhub
https://validmind.slack.com/archives/C08N7BE86DQ/p1747142576013709

Pull Request Dependencies

External Release Notes

Deployment Notes

Breaking Changes

Screenshots/Videos (Frontend Only)

Checklist

  • PR body describes what, why, and how to test
  • Release notes written
  • Deployment notes written
  • Breaking changes identified
  • Labels applied
  • PR linked to Shortcut
  • Screenshots/videos added (Frontend)
  • Unit tests added (Backend)
  • Tested locally
  • Documentation updated (if required)

Areas Needing Special Review

Additional Notes

@github-actions
Copy link
Contributor

PR Summary

This pull request updates the Python version constraints and several dependencies in the poetry.lock and pyproject.toml files. The changes include:

  1. Python Version Update: The minimum Python version requirement has been updated from >=3.8.1 to >=3.9.0.

  2. Dependency Updates:

    • Updated the version of torch to 2.7.0.
    • Updated various NVIDIA CUDA-related packages to newer versions, such as nvidia-cublas-cu12, nvidia-cuda-cupti-cu12, nvidia-cuda-nvrtc-cu12, nvidia-cuda-runtime-cu12, nvidia-cudnn-cu12, nvidia-cufft-cu12, nvidia-curand-cu12, nvidia-cusolver-cu12, nvidia-cusparse-cu12, nvidia-nccl-cu12, nvidia-nvjitlink-cu12, and nvidia-nvtx-cu12.
    • Added new packages like nvidia-cufile-cu12 and nvidia-cusparselt-cu12.
    • Updated sympy to version 1.14.0.
    • Updated triton to version 3.3.0.
  3. Dependency Removals:

    • Removed dependencies that were specific to Python versions below 3.9, such as astunparse, pkgutil-resolve-name, and importlib-resources.
  4. Marker Adjustments:

    • Adjusted Python version markers for several dependencies to reflect the updated Python version constraints.

These changes aim to ensure compatibility with newer Python versions and improve the performance and capabilities of the project by using updated libraries.

Test Suggestions

  • Verify that the application runs successfully with Python 3.9 and above.
  • Test the functionality of the application with the updated torch library to ensure no breaking changes.
  • Run integration tests to ensure that the updated NVIDIA CUDA-related packages work as expected.
  • Check for any deprecated features or warnings in the updated dependencies.
  • Perform regression testing to ensure that existing features are not broken by the updates.

@AnilSorathiya AnilSorathiya added the internal Not to be externalized in the release notes label May 13, 2025
@AnilSorathiya AnilSorathiya requested a review from cachafla May 13, 2025 15:10
@AnilSorathiya AnilSorathiya merged commit cccc5f0 into main May 15, 2025
9 of 10 checks passed
@AnilSorathiya AnilSorathiya deleted the anilsorathiya/sc-10242/fix-vulnerability-in-the-pytorch branch May 15, 2025 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

internal Not to be externalized in the release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants