Skip to content

Commit 0360d50

Browse files
authored
[cye/wandb-fix] Fix WandB issue. (#530)
## Summary - `wandb>=0.19.1`: `wandb` Path validation bug has been fixed [between 0.19.0 and 0.19.1](wandb/wandb@v0.19.0...v0.19.1). - Specifically, this commit / PR: [chore: allow pathlib.Path's for path-related Settings](wandb/wandb@2f11cc7) - CVE "Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto" is fixed in `0.19.1` as well. Two birds, one stone. (Was never a "true" vuln.) ## Details - Resolves this NVBug for [CVE GHSA-v778-237x-gjrc](GHSA-v778-237x-gjrc): https://nvbugspro.nvidia.com/bug/5010582 - WandB PR: wandb/wandb#9069 (comment) - Slack Threads - `Path` Validation Issue: https://nvidia.slack.com/archives/C074Z808N05/p1733418209959769 and https://nvidia-external.slack.com/archives/C016YA15HB3/p1733439699068689 - WandB CVE: https://nvidia.slack.com/archives/C074Z808N05/p1734047115497109 ## Usage - N/A ## Testing - CI Pipelines - https://prod.blsm.nvidia.com/bionemo-external-bionemo-fw/job/branch_pipeline/533/ - https://prod.blsm.nvidia.com/bionemo-external-bionemo-fw/job/pr_pipeline/1220/
1 parent 9906960 commit 0360d50

File tree

2 files changed

+1
-1
lines changed

2 files changed

+1
-1
lines changed

requirements-cve.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ Werkzeug>=3.0.3
77
nltk>=3.9.1
88
pillow>=10.3.0
99
tornado>=6.4.2
10+
wandb>=0.19.1 # Addresses CVE GHSA-v778-237x-gjrc

requirements-test.txt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,3 @@ awscli==1.33.33
88
nbval==0.11.0
99
# For NvFaidx equivalence tests
1010
pyfaidx==0.8.1.3
11-
wandb<0.19.0 # temporary pin: https://nvidia.slack.com/archives/C074Z808N05/p1733418209959769

0 commit comments

Comments
 (0)