Repository navigation
[None][fix] Exclude vulnerable filelock releases - #21071
Conversation
|
/bot run |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
 |
| Layer / File(s) | Summary |
|---|---|
Update filelock dependency declarations requirements.txt, security_scanning/pyproject.toml |
requirements.txt selects filelock==3.20.3 below Python 3.11 and filelock>=4.2.1 for Python 3.11 and later. The security scanning dependencies pin filelock to 3.20.3. |
Priority:
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Bug fix
Possibly related PRs
- NVIDIA/TensorRT-LLM#21034: This PR includes the same
filelockconstraints inrequirements.txtandsecurity_scanning/pyproject.tomland addresses the same dependency behavior.
Merge Risk: 
aa0cb
-
This change excludes vulnerable filelock releases through version constraints in the root requirements and the security-scanning project. The lockfile is refreshed separately by the repository's automated process. No merge-blocking risk remains beyond the CI and scan requalification the author already notes.
Pre-merge checks: 
-
Check name Status Explanation Title check The title follows the required format and clearly states that vulnerable filelock releases are excluded. Description check The description explains the issue, solution, affected versions, implementation details, test coverage, known lockfile limitation, and checklist status. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
PR_Github #80783 [ run ] triggered by Bot. Commit: |
|
/bot run |
|
PR_Github #80785 [ run ] triggered by Bot. Commit: |
|
PR_Github #80783 [ run ] completed with state |
Signed-off-by: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
Signed-off-by: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
21eb9be to
aa0cb7d
Compare
|
/bot run |
|
PR_Github #80803 [ run ] triggered by Bot. Commit: |
|
PR_Github #80785 [ run ] completed with state |
|
Automatically added "ci: full pre-merge approved" because this PR has satisfied the required GitHub review approvals. Unresolved review conversations and other required checks remain independent merge requirements. |
|
PR_Github #80803 [ run ] completed with state
|
|
/bot run --disable-fail-fast |
|
PR_Github #80915 [ run ] triggered by Bot. Commit: |
|
PR_Github #80915 [ run ] completed with state
|
|
/bot run --disable-fail-fast |
|
PR_Github #81031 [ run ] triggered by Bot. Commit: |
|
PR_Github #81031 [ run ] completed with state
|
|
/bot run --disable-fail-fast |
|
PR_Github #81165 [ run ] triggered by Bot. Commit: |
|
PR_Github #81165 [ run ] completed with state Resource maintenance in LLM/main/L0_Test-x86_64-Single-GPU #9099: L40S-PyTorch-2 is temporarily paused due to Kubernetes agent provisioning and node issues.
|
|
/bot run --disable-fail-fast |
|
PR_Github #81283 [ run ] triggered by Bot. Commit: |
|
PR_Github #81283 [ run ] completed with state Resource maintenance in LLM/main/L0_Test-x86_64-Single-GPU #9623: L40S-PyTorch-2 is temporarily paused due to Kubernetes agent provisioning and node issues.
|
|
/bot run --disable-fail-fast |
|
PR_Github #81348 [ run ] triggered by Bot. Commit: |
|
PR_Github #81348 [ run ] completed with state Resource maintenance in LLM/main/L0_Test-x86_64-Single-GPU #4162: L40S-PyTorch-2 is temporarily paused due to Kubernetes agent provisioning and node issues. |
Description
The promotion scan reports vulnerable
filelock==4.1.0on otherwise unrelated PRs. This PR constrains runtime requirements and the scan dependency declaration to exclude the affected releases for CVE-2026-112906, CVE-2026-112914, CVE-2026-112937, and CVE-2026-112940, as reported on PR #19395.Extract the dependency fix from Tanmay Verma's commit 0296d569 in #21034 into a dedicated PR so it can merge independently and unblock affected PRs.
The version constraints preserve TensorRT-LLM's Python 3.10 minimum while excluding all reported affected versions:
>=4.1.0,<4.2.1>=3.20.4,<4.2.1filelock==3.20.3. This release predates all four affected ranges. The patched 4.2.1 release requires Python 3.11+, so Python 3.10 cannot use it. The exact pin prevents the resolver from selecting a newer vulnerable release.filelock>=4.2.1. Version 4.2.1 is the first release fixing all four reported CVEs. A minimum version allows subsequent compatible releases.filelock==3.20.3. The existing scan generator evaluates markers using a hardcoded Python 3.10 target, then removes the markers before adding dependencies to Poetry. Consequently, the scan manifest selects the Python 3.10 branch even though its project metadata declares>=3.10,<3.13.security_scanning/poetry.lockis excluded from this PR and remains identical tomain. It still recordsfilelock==4.1.0, so it is stale against the updated scan dependency declaration and requires separate regeneration before a scan using that lockfile can reflect the fix. The PR changes onlyrequirements.txtandsecurity_scanning/pyproject.toml.The existing scan-generation behavior covers the Python 3.10 branch only; scanning both branches would require preserving the markers or generating separate manifests.
Test Coverage
mainat94348c4de6eb5526b0743b9e1c365506eb70868c. Before/after patch audit confirms that only the requested lockfile changes were dropped; both dependency declarations and the explanatory comment are preserved.security_scanning/poetry.lockis byte-for-byte identical tomain, runtime requirements are identical to the previous PR head, and all new upstream scan dependencies are retained.git diff --check: passed.poetry check --lock: reports a stale lockfile, as expected with the generated lockfile excluded. Lockfile consistency is not claimed for this revision.Prior validation of the unchanged runtime constraints resolved wheels for Python 3.10 (3.20.3) and Python 3.11 (4.2.4), and passed cross-process FileLock exclusion/release checks for both versions on Python 3.12. Full TensorRT-LLM/GPU tests were not run because this rebase only changes dependency configuration. CI and the vulnerability scan must be requalified on the updated head.
PR Checklist
GitHub Bot Help
To see available CI bot commands, comment
/bot help.Dev Engineer Review
requirements.txtselectsfilelock==3.20.3for Python versions below 3.11 andfilelock>=4.2.1for Python 3.11 and later.security_scanning/pyproject.tomlpinsfilelock==3.20.3.security_scanning/poetry.lockis unchanged and still recordsfilelock==4.1.0. The scanning dependency declaration and lockfile are therefore inconsistent; regenerate the lockfile before relying on scans that use it.git diff --check.poetry check --lockreports a stale lockfile. Full TensorRT-LLM/GPU tests were not run, and CI and vulnerability-scan qualification remain pending. Review severity counts are unavailable.QA Engineer Review
No test changes.
Per-File QA Perspective
requirements.txt: Verify dependency resolution on Python 3.10 and Python 3.11+; the selectedfilelockconstraint changes by Python version.security_scanning/pyproject.toml: Verify scan dependency resolution. Itsfilelock==3.20.3declaration does not match the unchangedsecurity_scanning/poetry.lockentry.