fix(deps): clear remaining Dependabot advisories in examples and vscode-extension - #2980
Conversation
…de-extension
Clears the last 10 open Dependabot alerts (all medium/low), leaving the
repo with zero open alerts. Each manifest was re-locked with the toolchain
its own devbox.json provides, then audited against OSV.
- examples/development/python/poetry/{poetry-demo,poetry-pyproject-subdir}:
pytest ^7.2.2 -> ^9.0.3 (GHSA-6w46-j5rx-g56g, tmpdir handling).
pytest 9 requires Python >=3.10, so the python constraint moves from
^3.8 to ^3.10 to make the fix reachable. Both devbox.json files already
use python@latest.
- examples/development/python/pipenv: lock-only refresh; pytest 9.1.1.
- examples/data_science/pytorch/basic-example: lock-only refresh;
torch 2.7.1 -> 2.14.0 (three torch memory-corruption advisories) and
transitive setuptools 80.10.2 -> 84.0.0 (GHSA-h35f-9h28-mq5c).
- vscode-extension: lock-only refresh; serialize-javascript 7.0.4 -> 7.1.1
(GHSA-qj8w-gfj5-8c6v). Also moved ajv 6.12.6 -> 6.15.0 and diff
5.2.0 -> 5.2.2 which `yarn audit` flagged; all within existing ranges.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
|
||
| [[package]] | ||
| name = "nvidia-cublas-cu12" | ||
| version = "12.6.4.1" | ||
| name = "nvidia-cublas" | ||
| version = "13.1.1.3" | ||
| description = "CUBLAS native runtime libraries" | ||
| optional = false | ||
| python-versions = ">=3" | ||
| files = [ | ||
| {file = "nvidia_cublas-13.1.1.3-py3-none-manylinux_2_27_aarch64.whl", hash = "sha256:b7a210458267ac818974c53038fbec2e969d5c99f305ab15c72522fa9f001dd5"}, | ||
| {file = "nvidia_cublas-13.1.1.3-py3-none-manylinux_2_27_x86_64.whl", hash = "sha256:37936a16db8fe4ac1f065c2139360608a543a09275cb1a1af612e08cfa065436"}, | ||
| {file = "nvidia_cublas-13.1.1.3-py3-none-win_amd64.whl", hash = "sha256:b6cdce694e47ff6aadf0a69df1cab6628d696f5ff56e8d16af50309d855fa20f"}, | ||
| ] | ||
|
|
||
| [package.dependencies] | ||
| nvidia-cuda-nvrtc = "*" | ||
|
|
||
| [[package]] | ||
| name = "nvidia-cublas" | ||
| version = "13.7.0.27" | ||
| description = "CUBLAS native runtime libraries" | ||
| optional = false | ||
| python-versions = ">=3" | ||
| files = [ | ||
| {file = "nvidia_cublas_cu12-12.6.4.1-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:08ed2686e9875d01b58e3cb379c6896df8e76c75e0d4a7f7dace3d7b6d9ef8eb"}, | ||
| {file = "nvidia_cublas_cu12-12.6.4.1-py3-none-manylinux_2_27_aarch64.whl", hash = "sha256:235f728d6e2a409eddf1df58d5b0921cf80cfa9e72b9f2775ccb7b4a87984668"}, | ||
| {file = "nvidia_cublas_cu12-12.6.4.1-py3-none-win_amd64.whl", hash = "sha256:9e4fa264f4d8a4eb0cdbd34beadc029f453b3bafae02401e999cf3d5a5af75f8"}, | ||
| {file = "nvidia_cublas-13.7.0.27-py3-none-manylinux_2_27_aarch64.whl", hash = "sha256:39f240346a8bbc6c4f1e3100dcfa2c6d3fe353db513060329ef28cdd43c27f2f"}, | ||
| {file = "nvidia_cublas-13.7.0.27-py3-none-manylinux_2_27_x86_64.whl", hash = "sha256:481adf76a6b7585a7a4cd5f53298589abe207415dd584887751b99baa85491d4"}, | ||
| {file = "nvidia_cublas-13.7.0.27-py3-none-win_amd64.whl", hash = "sha256:15d3963ae9de7292348ced320c849ff27f76b0f433b81589e9eb87f5407841c9"}, | ||
| {file = "nvidia_cublas-13.7.0.27-py3-none-win_arm64.whl", hash = "sha256:4cf58f2c8a4743a2717b0f5c51a90f0d93ada416d71eb3d96b17ca29b7af0106"}, | ||
| ] | ||
|
|
There was a problem hiding this comment.
Bug: duplicate, conflicting [[package]] entries for nvidia-cublas (and two other packages) in this lockfile.
nvidia-cublas appears twice here — once at 13.1.1.3 (L348-361) and again at 13.7.0.27 (L363-374) — with no markers field to disambiguate them. This file is lock-version = "2.0" (generated by Poetry 1.6.1, per the header), which doesn't support package-level markers, so two unmarked entries for the same name are not something poetry lock produces — this looks hand-edited rather than regenerated.
Worse, the newly-added cuda-toolkit package in this same file exactly pins nvidia-cublas = "==13.1.1.3.*" (L62), so the second entry (13.7.0.27) is unreachable/unsatisfiable by anything in the dependency graph.
The same pattern repeats for two more packages in this file:
- (
devbox/examples/data_science/pytorch/basic-example/poetry.lock
Lines 390 to 413 in 3e36737
nvidia-cuda-nvrtc:13.0.88vs13.4.59, whilecuda-toolkitpins==13.0.88.*) - (
devbox/examples/data_science/pytorch/basic-example/poetry.lock
Lines 497 to 520 in 3e36737
nvidia-cusparse:12.6.3.3vs12.8.6.49, whilecuda-toolkitpins==12.6.3.3.*)
This will likely cause poetry lock --check/poetry install to behave inconsistently or fail. Recommend regenerating this lockfile with poetry lock rather than hand-editing it, so each package collapses to a single consistent version.
2 participants
Summary
Follow-up to #2979. Clears the last 10 open Dependabot alerts (8 medium, 2 low) — the repo now has zero open alerts. Each manifest was re-locked using the toolchain its own
devbox.jsonprovides (viadevbox shellenv), then every package in every touched lockfile was audited against OSV: 283 unique packages, 0 advisories.examples/development/python/poetry/poetry-demo7.4.4→9.1.1; python constraint^3.8→^3.10examples/development/python/poetry/poetry-pyproject-subdir/service7.4.4→9.1.1; python constraint^3.8→^3.10examples/development/python/pipenv9.1.1(grpcio1.84.0, etc. moved along)examples/data_science/pytorch/basic-example2.7.1→2.14.0, setuptools80.10.2→84.0.0(transitive)vscode-extension7.0.4→7.1.1Notes
pytest needed the Python floor raised. The tmpdir fix (GHSA-6w46-j5rx-g56g) only exists in 9.0.3+, and pytest 9 requires Python ≥ 3.10, so the two poetry examples'
python = "^3.8"constraint had to move to^3.10for the fix to be reachable. Both examples'devbox.jsonalready installpython@latest, so nothing changes for anyone running them through devbox.pytest = "^7.2.2"→"^9.0.3"is the only other manifest edit in the PR.torch moved to CUDA 13 wheels.
torch = "^2.7.0"already admitted 2.14.0, sopyproject.tomlis untouched, but the Linux extras in the lock shifted fromnvidia-*-cu12to CUDA 13 packages (cuda-toolkit 13.0.3,nvidia-cudnn-cu13, etc.). The wheels bundle their own runtime, so this matters only for driver version on Linux hosts (CUDA 13 needs a 580+ driver). The nixcudatoolkitpinned in that example'sdevbox.lockis 11.7 from an old nixpkgs and was already mismatched with the previous cu12 wheels — I left it alone as it's unrelated to the advisories.Pre-existing, not fixed here: the pytorch example's
poetry installfails on main becausepyproject.tomldeclarespackages = [{include = "devbox_cuda_dev"}]and that directory doesn't exist.poetry install --no-rootworks; I verified torch 2.14.0 imports and runs on CPU that way.vscode-extension: the
resolutionsentry already allowed^7.0.0, so onlyyarn.lockmoved. While there,yarn auditflaggedajv 6.12.6(GHSA-2g4f-4pwh-qvx6) anddiff 5.2.0(GHSA-73rr-hh4g-fpgx); both patches fall inside existing ranges so they were refreshed too.yarn audit --level lowis now clean.How was it tested?
devbox run test(poetry-demo) anddevbox run run_test(poetry-pyproject-subdir): 1 passed each.devbox run run_test(pipenv): runsmain.pysuccessfully.poetry install --no-root+ import/matmul smoke test →torch 2.14.0, numpy 1.26.4, setuptools 84.0.0.yarn install --frozen-lockfile,yarn compile,yarn lint,yarn audit --level low→ 0 vulnerabilities.🤖 Generated with Claude Code