Skip to content

Commit aff2a3c

Browse files
nabinchhanabinchha
authored
Update vulnerable dependencies using workspace security constraints (#105)
* fix(deps): remediate October vulnerability findings Signed-off-by: Nabin Mulepati <nmulepati@nvidia.com> * fix(deps): follow upstream transitive dependency guidance Signed-off-by: Nabin Mulepati <nmulepati@nvidia.com> * docs: keep security follow-up in PR description Signed-off-by: Nabin Mulepati <nmulepati@nvidia.com> * fix(ddp): scaffold plugins with patched DataDesigner minimum Signed-off-by: Nabin Mulepati <nmulepati@nvidia.com> --------- Signed-off-by: Nabin Mulepati <nmulepati@nvidia.com>
1 parent 5656961 commit aff2a3c

10 files changed

Lines changed: 257 additions & 186 deletions

File tree

‎devtools/ddp/tests/test_catalog.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -831,8 +831,8 @@ def test_main_includes_template_plugin() -> None:
831831
"specifier": ">=3.10",
832832
},
833833
"data_designer": {
834-
"requirement": "data-designer>=0.9.4",
835-
"specifier": ">=0.9.4",
834+
"requirement": "data-designer>=0.9.7",
835+
"specifier": ">=0.9.7",
836836
"marker": None,
837837
},
838838
},

‎devtools/ddp/tests/test_catalog_config.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ def test_repository_catalog_config_uses_expected_nvidia_defaults() -> None:
8686
)
8787
assert config.package_assets_release_tag == "ddp-package-assets"
8888
assert config.release_ref_template == "{package}/v{version}"
89-
assert config.default_data_designer_requirement == "data-designer>=0.9.4"
89+
assert config.default_data_designer_requirement == "data-designer>=0.9.7"
9090
assert config.author_name == "NVIDIA Corporation"
9191

9292

‎devtools/ddp/tests/test_scaffold.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from data_designer.plugins.plugin import PluginType
1919

2020
from ddp import catalog, scaffold
21+
from ddp.catalog_config import load_catalog_config
2122

2223
EXPECTED_FILE_TREE = {
2324
"CODEOWNERS",
@@ -144,6 +145,21 @@ def test_scaffolded_plugins_import_and_validate(
144145
assert issubclass(plugin_module.plugin.impl_cls, Processor)
145146

146147

148+
@pytest.mark.parametrize("plugin_type", ["column-generator", "seed-reader", "processor"])
149+
def test_scaffold_uses_repository_security_floor(plugin_type: str) -> None:
150+
"""Keep generated plugins on the DataDesigner release containing the CA fix."""
151+
repo_root = Path(__file__).resolve().parents[3]
152+
pyproject = scaffold.generate_pyproject(
153+
package_name="data-designer-sample-plugin",
154+
slug="sample-plugin",
155+
import_name="data_designer_sample_plugin",
156+
catalog_config=load_catalog_config(repo_root),
157+
spec=scaffold.scaffold_spec_for_type(plugin_type),
158+
)
159+
160+
assert '"data-designer>=0.9.7"' in pyproject
161+
162+
147163
def test_scaffold_uses_external_catalog_config_in_generated_files(
148164
tmp_path: Path,
149165
monkeypatch: pytest.MonkeyPatch,

‎plugins/data-designer-docx/pyproject.toml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ version = "0.1.0"
77
description = "Data Designer processor plugin that renders generated rows as Microsoft Word documents"
88
requires-python = ">=3.10"
99
dependencies = [
10-
"data-designer>=0.9.4",
11-
"click>=8.3.3,<9",
12-
"lxml>=6.1.1,<7",
13-
"urllib3>=2.8.0,<3",
10+
"data-designer>=0.9.7",
1411
"python-docx>=1.1.0",
1512
]
1613
license = "Apache-2.0"

‎plugins/data-designer-github/pyproject.toml‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,7 @@ version = "0.1.0"
77
description = "GitHub and local git repository seed reader for Data Designer"
88
requires-python = ">=3.10"
99
dependencies = [
10-
# Security floors for transitive dependencies installed with DataDesigner.
11-
"click>=8.3.3,<9",
12-
"cryptography>=50.0.0,<51",
13-
"data-designer>=0.9.4",
14-
"idna>=3.18",
15-
"lxml>=6.1.1,<7",
16-
"mcp>=1.29.0,<2",
17-
"pillow>=12.3.0",
18-
"pyjwt>=2.15.1,<3",
19-
"python-multipart>=0.0.32",
20-
"starlette>=1.4.1",
21-
"urllib3>=2.8.0,<3",
10+
"data-designer>=0.9.7",
2211
]
2312
license = "Apache-2.0"
2413
readme = "README.md"

‎plugins/data-designer-nemotron-indic-translation/pyproject.toml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ version = "0.1.0"
77
description = "Document translation (with optional windowing for long documents and deterministic script remapping) plugin for Nemotron Indic-language pretraining data"
88
requires-python = ">=3.10"
99
dependencies = [
10-
"data-designer>=0.9.4",
11-
"click>=8.3.3,<9",
12-
"lxml>=6.1.1,<7",
13-
"urllib3>=2.8.0,<3",
10+
"data-designer>=0.9.7",
1411
# tokenizers, not transformers: windowed translation only needs token counts for window
1512
# sizing, and transformers 5.x demands huggingface-hub>=1.5, which conflicts with older
1613
# pinned hub versions in some deployment containers. tokenizers 0.22's bound is

‎plugins/data-designer-retrieval-sdg/pyproject.toml‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,23 @@ version = "0.3.0"
77
description = "Retriever SDG toolkit with Data Designer extensions, a multi-step QA generation pipeline, CLI, and Automodel-compatible data conversion"
88
requires-python = ">=3.10"
99
dependencies = [
10-
"data-designer>=0.9.4",
11-
"click>=8.3.3,<9",
12-
"lxml>=6.1.1,<7",
13-
"urllib3>=2.8.0,<3",
14-
"filelock>=3.20,<4",
10+
# ReadWriteLock was introduced in 3.20.4; fixed 4.x requires Python 3.11.
11+
"filelock>=3.20,<3.20.4; python_version < '3.11'",
12+
"filelock>=4.2.1,<5; python_version >= '3.11'",
13+
"data-designer>=0.9.7",
1514
"tokenizers>=0.22,<0.24",
1615
"transformers>=5.17,<6",
1716
"jinja2>=3.1.6,<4",
18-
# Data Designer permits older transitive releases that are excluded by the
19-
# workspace security constraints. Publish the same floors for consumers.
20-
"anyio>=4.14.2,<5",
21-
"mcp>=1.29.0,<2",
22-
"nltk>=3.10.3,<3.11",
17+
"nltk>=3.10.4,<3.11",
2318
# Pydantic 2.14 breaks CliApp.run in the supported pydantic-settings releases.
2419
"pydantic>=2.9.2,<2.14",
2520
"pydantic-settings>=2.14,<3",
2621
"pyyaml>=6.0",
2722
"pyarrow>=24.0.0,<25",
28-
"pillow>=12.3.0",
29-
"starlette>=1.4.1,<2",
23+
# Pillow 13 fixes the reported image-parser CVEs but requires Python 3.11.
24+
# Python 3.10 remains supported with unresolved Pillow findings.
25+
"pillow>=12.3.0; python_version < '3.11'",
26+
"pillow>=13.0.0; python_version >= '3.11'",
3027
]
3128
license = "Apache-2.0"
3229
readme = "README.md"

‎plugins/data-designer-template/pyproject.toml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ version = "0.1.0"
77
description = "Template Data Designer plugin — text transform column generator"
88
requires-python = ">=3.10"
99
dependencies = [
10-
"data-designer>=0.9.4",
11-
"click>=8.3.3,<9",
12-
"lxml>=6.1.1,<7",
13-
"urllib3>=2.8.0,<3",
10+
"data-designer>=0.9.7",
1411
]
1512
license = "Apache-2.0"
1613
readme = "README.md"

‎pyproject.toml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,22 @@ members = [
2121
package = false
2222
required-version = ">=0.7.10"
2323
constraint-dependencies = [
24+
"certifi>=2026.10.19",
25+
# ReadWriteLock was introduced in 3.20.4; fixed 4.x requires Python 3.11.
26+
"filelock>=3.20,<3.20.4; python_version < '3.11'",
27+
"filelock>=4.2.1,<5; python_version >= '3.11'",
28+
"fsspec>=2026.6.0",
2429
"anyio>=4.14.2,<5",
2530
"click>=8.3.3,<9",
2631
"cryptography>=50.0.0,<51",
2732
"idna>=3.18",
2833
"lxml>=6.1.1,<7",
29-
"mcp>=1.29.0,<2",
30-
"nltk>=3.10.3,<3.11",
31-
"pillow>=12.3.0",
34+
"mcp>=1.30.0,<2",
35+
"nltk>=3.10.4,<3.11",
36+
# Pillow 13 fixes the reported image-parser CVEs but requires Python 3.11.
37+
# Python 3.10 remains supported with unresolved Pillow findings.
38+
"pillow>=12.3.0; python_version < '3.11'",
39+
"pillow>=13.0.0; python_version >= '3.11'",
3240
"pyarrow>=24.0.0,<25",
3341
"pyjwt>=2.15.1,<3",
3442
"python-multipart>=0.0.32",
@@ -46,7 +54,7 @@ package-index-url = "https://nvidia-nemo.github.io/DataDesignerPlugins/simple/"
4654
package-assets-url = "https://github.com/NVIDIA-NeMo/DataDesignerPlugins/releases/download/ddp-package-assets/"
4755
package-assets-release-tag = "ddp-package-assets"
4856
release-ref-template = "{package}/v{version}"
49-
default-data-designer-requirement = "data-designer>=0.9.4"
57+
default-data-designer-requirement = "data-designer>=0.9.7"
5058
author-name = "NVIDIA Corporation"
5159

5260
[tool.ruff]

0 commit comments

Comments
 (0)