Update deps to address vulnerability

[heyselbi]

Motivation

Address high vulnerability Closes: https://issues.redhat.com/browse/RHOAIENG-4329 and https://issues.redhat.com/browse/RHOAIENG-4936 CVE info: https://www.cve.org/CVERecord?id=CVE-2024-27318 and https://www.cve.org/CVERecord?id=CVE-2024-27319

From SNYK report: Detailed paths Introduced through: text-generation-server@0.1.0 › onnx@1.15.0 Introduced through: text-generation-server@0.1.0 › optimum@1.17.1 › onnx@1.15.0 Security information Factors contributing to the scoring: Snyk: CVSS 7.5 - High Severity

NVD: Not available. NVD has not yet published its analysis. Why are the scores different? Learn how Snyk evaluates vulnerability scores Overview onnx is an Open Neural Network Exchange

Affected versions of this package are vulnerable to Directory Traversal due to unsafe path manipulation in external_data_helper.py. An attacker can traverse up the directory tree from a base path to expose files outside the intended working directory. This is a bypass for the previously reported CVE-2022-25882.

[Describe why this change is needed]

Modifications

[Describe the code changes]

Result

[Describe how the changes affects existing behavior and how to test it]

Related Issues

[Resolves #123]

[heyselbi]

Hi @njhill, it still says "waiting for status to be reported" for the tests to run :confused:

[joerunde]

Huh, yeah dunno why that got stuck