You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "aglinxinyuan (via GitHub)" <gi...@apache.org> on 2026/07/07 07:49:07 UTC
[PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
aglinxinyuan opened a new pull request, #6219:
URL: https://github.com/apache/texera/pull/6219
### What changes were proposed in this PR?
Bumps the **non-Linux** `torch` pin in `amber/operator-requirements.txt` from `2.12.0` to `2.12.1`.
`torch` is flagged by **CVE-2025-3000** / [GHSA-rrmf-rvhw-rf47](https://github.com/advisories/GHSA-rrmf-rvhw-rf47) — a `torch.jit.script` memory-corruption (segfault when compiling a scripted class with a list attribute; CVSS 5.3, affected range `<= 2.12.0`, no upstream patched version). Only the non-Linux pin was in range; the Linux x86_64 line was already at `2.12.1+cpu`.
| Platform | Before | After |
| --- | --- | --- |
| Linux x86_64 | `2.12.1+cpu` | `2.12.1+cpu` (unchanged) |
| macOS / Windows / other | `2.12.0` (flagged) | `2.12.1` |
Because the advisory's upper bound is `2.12.0`, `2.12.1` sits out of range and clears the alert — the same reason the Linux line was never flagged despite "patched version: none".
Notes:
- `2.12.1` has the same cp312 wheel matrix as `2.12.0` (`win_amd64`, `macosx_*_arm64`) — a patch-level move with no platform-coverage change.
- [`amber/LICENSE-binary-python`](amber/LICENSE-binary-python) already records `torch==2.12.1` (generated from the Linux resolution), so there is **no license-binary drift**.
- `torch.jit.script` is never called in Texera; `torch` is only a transitive runtime dependency of `transformers` (the HuggingFace operators). The vulnerable path is unreachable, so this is dependency hygiene to clear the Dependabot alert rather than a fix for a reachable exploit.
### Any related issues, documentation, discussions?
Closes #6218
Advisory: [GHSA-rrmf-rvhw-rf47](https://github.com/advisories/GHSA-rrmf-rvhw-rf47) / [CVE-2025-3000](https://nvd.nist.gov/vuln/detail/CVE-2025-3000)
### How was this PR tested?
Dependency-only change; no code paths are altered. Verified:
- `torch==2.12.1` cp312 wheels exist on PyPI for `win_amd64` and `macosx_*_arm64` (same matrix as `2.12.0`), so the non-Linux resolution stays installable.
- `2.12.1 > 2.12.0`, so the pin exits the CVE-2025-3000 `<= 2.12.0` affected range and Dependabot no longer flags it.
- `amber/LICENSE-binary-python` already lists `torch==2.12.1`, so the binary-license check needs no update.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Opus 4.8 [1M context])
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan merged PR #6219:
URL: https://github.com/apache/texera/pull/6219
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6219:
URL: https://github.com/apache/texera/pull/6219#issuecomment-4901522425
<!-- texera-benchmarks-comment -->
## ⚠️ Benchmark changes need a look
🟢 2 better · 🔴 9 worse · ⚪ 4 noise (<±5%) · 0 without baseline
> Compared against main `2182314` benchmarked on **this same runner**, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.
[Dashboard](https://apache.github.io/texera/dev/bench/) · [Run](https://github.com/apache/texera/actions/runs/28850431730)
| | config | throughput | MB/s | latency | max Δ latest / 7d |
|---|---|---:|---:|---:|---:|
| 🔴 | bs=10 sw=10 sl=64 | 300 | 0.183 | 33,519/42,662/42,662 us | 🔴 +20.7% / 🔴 +177.6% |
| 🔴 | bs=100 sw=10 sl=64 | 684 | 0.418 | 146,009/164,087/164,087 us | 🔴 +13.3% / 🔴 +53.5% |
| 🔴 | bs=1000 sw=10 sl=64 | 791 | 0.483 | 1,267,317/1,370,554/1,370,554 us | 🔴 +10.1% / 🔴 +34.4% |
<details><summary>Baseline details</summary>
Latest main `2182314` from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---:|---:|---:|---:|---:|
| bs=10 sw=10 sl=64 | throughput | 300 tuples/sec | 338 tuples/sec | 776.68 tuples/sec | -11.2% | -61.4% |
| bs=10 sw=10 sl=64 | MB/s | 0.183 MB/s | 0.206 MB/s | 0.474 MB/s | -11.2% | -61.4% |
| bs=10 sw=10 sl=64 | p50 | 33,519 us | 27,775 us | 12,599 us | +20.7% | +166.1% |
| bs=10 sw=10 sl=64 | p95 | 42,662 us | 40,703 us | 15,370 us | +4.8% | +177.6% |
| bs=10 sw=10 sl=64 | p99 | 42,662 us | 40,703 us | 18,723 us | +4.8% | +127.9% |
| bs=100 sw=10 sl=64 | throughput | 684 tuples/sec | 751 tuples/sec | 994.07 tuples/sec | -8.9% | -31.2% |
| bs=100 sw=10 sl=64 | MB/s | 0.418 MB/s | 0.458 MB/s | 0.607 MB/s | -8.7% | -31.1% |
| bs=100 sw=10 sl=64 | p50 | 146,009 us | 128,854 us | 100,754 us | +13.3% | +44.9% |
| bs=100 sw=10 sl=64 | p95 | 164,087 us | 175,568 us | 106,898 us | -6.5% | +53.5% |
| bs=100 sw=10 sl=64 | p99 | 164,087 us | 175,568 us | 113,210 us | -6.5% | +44.9% |
| bs=1000 sw=10 sl=64 | throughput | 791 tuples/sec | 857 tuples/sec | 1,027 tuples/sec | -7.7% | -23.0% |
| bs=1000 sw=10 sl=64 | MB/s | 0.483 MB/s | 0.523 MB/s | 0.627 MB/s | -7.6% | -22.9% |
| bs=1000 sw=10 sl=64 | p50 | 1,267,317 us | 1,150,633 us | 979,814 us | +10.1% | +29.3% |
| bs=1000 sw=10 sl=64 | p95 | 1,370,554 us | 1,340,601 us | 1,019,689 us | +2.2% | +34.4% |
| bs=1000 sw=10 sl=64 | p99 | 1,370,554 us | 1,340,601 us | 1,049,906 us | +2.2% | +30.5% |
</details>
<details><summary>Raw CSV</summary>
```csv
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,666.59,200,128000,300,0.183,33518.65,42661.97,42661.97
1,100,10,64,20,2923.53,2000,1280000,684,0.418,146009.29,164087.03,164087.03
2,1000,10,64,20,25280.36,20000,12800000,791,0.483,1267316.79,1370553.76,1370553.76
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #6219:
URL: https://github.com/apache/texera/pull/6219#issuecomment-4901472149
### :warning: JUnit XML file not found
The CLI was unable to find any JUnit XML files to upload.
For more help, visit our [troubleshooting guide](https://docs.codecov.com/docs/test-analytics#troubleshooting).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan commented on PR #6219:
URL: https://github.com/apache/texera/pull/6219#issuecomment-4909841219
I will open a separate PR for backporting to 1.2 after this is merged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps, pyamber): bump non-Linux torch pin to 2.12.1 (CVE-2025-3000) [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6219:
URL: https://github.com/apache/texera/pull/6219#issuecomment-4901403715
<!-- texera-reviewer-suggestion -->
### Automated Reviewer Suggestions
Based on the `git blame` history of the changed files, we recommend the following reviewers:
- **Contributors with relevant context:** `@Yicong-Huang`
You can notify them by mentioning `@Yicong-Huang` in a comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org