Skip to content

fix: update vulnerable runtime dependencies (rhoai-3.4) - #739

Merged
jonburdo merged 1 commit into
red-hat-data-services:rhoai-3.4from
NeriCarcasci:fix/security-dependency-remediations-rhoai-3.4
Sep 17, 2026
Merged

jonburdo merged 1 commit into
red-hat-data-services:rhoai-3.4from
NeriCarcasci:fix/security-dependency-remediations-rhoai-3.4

Conversation

@NeriCarcasci

Copy link
Copy Markdown

Summary

  • update js-yaml and all UI resolutions to 4.3.2
  • constrain sqlparse to 0.6.0 or newer and refresh the AIPCC lock entry
  • constrain GitPython to 3.1.60 or newer; the AIPCC lock resolves 3.1.62

This addresses the active js-yaml denial-of-service issue, the three sqlparse denial-of-service issues, and the GitPython git-directory validation issue in the shipped runtime.

Validation

  • yarn install --immutable --mode=skip-build
  • full AIPCC resolution with uv pip compile for Python 3.12 on x86_64 Linux
  • verified resolved versions: js-yaml 4.3.2, sqlparse 0.6.0, GitPython 3.1.62
  • git diff --check

The existing Yarn peer-dependency warnings are unchanged.

Copilot AI lite review requested due to automatic review settings September 16, 2026 15:04

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@jonburdo jonburdo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one failing test will be fixed by #742

@jonburdo
jonburdo merged commit 5e817b1 into red-hat-data-services:rhoai-3.4 Sep 17, 2026
21 of 25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants