search

SeldonIO / seldon-core

An MLOps framework to package, deploy, monitor and manage thousands of production machine learning models
https://www.seldon.io/tech/products/core/
Other
4.35k stars 831 forks source link

Upgrade V1 Python microservice Cryptography Package #5471

Open mwm5945 opened 6 months ago

mwm5945 commented 6 months ago

The crpytography package has released a new major version, which includes vulnerability fixes. Consumers of the microservice are unable to upgrade their own dependencies as it conflicts with the version Seldon allows.

Describe the bug

This line restricts the version of cryptography that can be installed: https://github.com/SeldonIO/seldon-core/blob/60ffac4ea06e74b3de02ccd245df73a673f21c16/python/setup.py#L41

To reproduce

Attempt to install seldon-core with cryptography==42.x.x, i.e. 

❯ cat requirements.txt
seldon-core==1.18.1
cryptography==42.0.5
❯ pip install -r requirements.txt
... <omitted package collection for brevity> 
INFO: pip is looking at multiple versions of seldon-core to determine which version is compatible with other requirements. This could take a while.
ERROR: Cannot install -r requirements.txt (line 1) and cryptography==42.0.5 because these package versions have conflicting dependencies.

The conflict is caused by:
    The user requested cryptography==42.0.5
    seldon-core 1.18.1 depends on cryptography<41.1 and >=39.0.1

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

Expected behaviour

Latest patched version of cryptography package can be used.

mg515 commented 3 months ago

Any update on this @mwm5945 ?

mwm5945 commented 3 months ago

Nope 🤷‍♂️On Jun 11, 2024, at 9:57 AM, miha g @.***> wrote: Any update on this @mwm5945 ?

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.***>

mg515 commented 3 months ago

Since there are security concerns with cryptography<42.0.0, I think we should go for the update within Seldon V1. Do we know why the hard pin is there in the first place? Breaking changes?