Skip to content

[Snyk] Fix for 2 vulnerabilities #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LowinLi wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #85

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docker/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,6 @@ onnxruntime==1.12.1
streamlit==1.13.0
transformers==4.22.2
diffusers==0.4.0
torch==1.10.0+cpu
torch==1.10.0+cpu
protobuf>=6.33.5 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot AI Feb 4, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description shows warnings that multiple dependencies require protobuf but it's "not installed": transformers 4.22.2, streamlit 1.13.0, onnxruntime 1.12.1, and onnx 1.12.0. This suggests that upgrading protobuf to a much newer version (from 3.20.1 to 6.x/5.x) may introduce compatibility issues with these older packages. These packages were released in 2022 and likely expect protobuf 3.x. Before merging, verify that the new protobuf version is compatible with onnx==1.12.0, onnxruntime==1.12.1, streamlit==1.13.0, and transformers==4.22.2, or consider upgrading these dependencies as well.

Copilot uses AI. Check for mistakes.
zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines +8 to +9

Copilot AI Feb 4, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using ">=" for these security-pinned dependencies is inconsistent with the rest of the requirements file, where all other dependencies use exact version pinning with "==". This creates unpredictability in the build environment. Consider using "==" to pin to specific versions (e.g., "protobuf==5.28.3" and "zipp==3.19.1") to maintain consistency and ensure reproducible builds.

Suggested change
protobuf>=6.33.5 # not directly required, pinned by Snyk to avoid a vulnerability
zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
protobuf==6.33.5 # not directly required, pinned by Snyk to avoid a vulnerability
zipp==3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot uses AI. Check for mistakes.
Loading