[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1#17
Conversation
…educe vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Code Review
This pull request adds the zipp package to the test requirements to address a vulnerability. The reviewer recommends pinning this dependency to an exact version (==3.19.1) instead of a minimum version (>=3.19.1) to ensure reproducible test environments and maintain consistency with other dependencies in the file.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| google-cloud-storage==2.9.0 | ||
| pytest-xdist==3.3.0 | ||
| pytest==9.0.3; python_version >= "3.10" | ||
| zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
To ensure reproducible test environments and prevent unexpected issues from future releases, it is recommended to pin dependencies to an exact version (using ==) rather than a minimum version (using >=), consistent with the other dependencies in this file.
zipp==3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
dataflow/gpu-examples/pytorch-minimal/requirements-test.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.
Summary by cubic
Upgrade
zippto >=3.19.1 in dataflow/gpu-examples/pytorch-minimal/requirements-test.txt to fix a security issue and avoid installing vulnerable versions during tests. Addresses SNYK-PYTHON-ZIPP-7430899.Written for commit aada31c. Summary will update on new commits.