intel-analytics / ipex-llm

Accelerate local LLM inference and finetuning (LLaMA, Mistral, ChatGLM, Qwen, Baichuan, Mixtral, Gemma, Phi, MiniCPM, etc.) on Intel XPU (e.g., local PC with iGPU and NPU, discrete GPU such as Arc, Flex and Max); seamlessly integrate with llama.cpp, Ollama, HuggingFace, LangChain, LlamaIndex, GraphRAG, DeepSpeed, vLLM, FastChat, Axolotl, etc.

Apache License 2.0

6.59k stars 1.25k forks source link

need to upgrade dependencies to fix cves #6422

Open glorysdj opened 1 year ago

glorysdj commented 1 year ago

/scala/serving/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1200 Upgrade com.google.protobuf:protobuf-java to version 3.19.6 or later. For example: com.google.protobuf protobuf-java [3.19.6,)

/scala/serving/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1182 snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write org.yaml snakeyaml [1.32,)

/scala/ppml/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/233 Upgrade junit:junit to version 4.13.1 or later. For example: junit junit [4.13.1,)

/scala/ppml/pom.xml

[x] Upgrade com.google.protobuf:protobuf-java to version 3.19.6 or later. For example: com.google.protobuf protobuf-java [3.19.6,)

/scala/orca/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1198 com.google.protobuf protobuf-java [3.19.6,)

/scala/friesian/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1197 com.google.protobuf protobuf-java [3.19.6,)

/scala/friesian/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1183 org.yaml snakeyaml [1.32,)

/scala/friesian/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1190 junit junit [4.13.1,)

/scala/dllib/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1196 com.google.protobuf protobuf-java [3.19.6,)

/scala/pom.xml

[x] https://github.com/intel-analytics/BigDL/security/dependabot/1 org.scala-lang scala-compiler [2.11.12,)

zzti-bsj commented 1 year ago

PR - 6432, Upgrade components to corresponding versions.