add opencv-python to requirements.txt#2061
add opencv-python to requirements.txt#2061guozijn wants to merge 1 commit intoProject-MONAI:mainfrom
Conversation
WalkthroughThe pull request adds Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
detection/requirements.txt (1)
5-5: Pin opencv-python to a specific version for reproducibility and security.The detection/requirements.txt file uses mixed version pinning (itk>=5.2 is pinned, while opencv-python and others are not). More importantly, recent security vulnerabilities in opencv-python require careful version management:
- CVE-2025-53644 (heap buffer write) affects opencv-python versions 4.10.0 and 4.11.0; fixed in 4.12.0+
- CVE-2024-1417 (heap buffer overflow) requires updating to a patched version
- CVE-2023-4863 (libwebp bundled in wheels) is mitigated in opencv-python 4.8.1.78+
Consider pinning to a known-safe version (e.g.,
opencv-python>=4.13.0.92) to ensure reproducibility and prevent accidental installation of vulnerable versions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@detection/requirements.txt` at line 5, Update the unpinned dependency "opencv-python" in detection/requirements.txt to a specific safe version to ensure reproducibility and mitigate known CVEs (e.g., replace "opencv-python" with "opencv-python>=4.13.0.92" or a fixed "opencv-python==4.13.0.92"); edit the requirements line for "opencv-python" so the installer cannot pull vulnerable releases and document the chosen version in the file comment or changelog.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@detection/requirements.txt`:
- Line 5: Update the unpinned dependency "opencv-python" in
detection/requirements.txt to a specific safe version to ensure reproducibility
and mitigate known CVEs (e.g., replace "opencv-python" with
"opencv-python>=4.13.0.92" or a fixed "opencv-python==4.13.0.92"); edit the
requirements line for "opencv-python" so the installer cannot pull vulnerable
releases and document the chosen version in the file comment or changelog.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 85e9eb5f-a2bb-4704-826a-b28a7db1ee9b
📒 Files selected for processing (1)
detection/requirements.txt
Summary by CodeRabbit