Repository navigation
Commit 80b3359
authored
pixi lockfiles: relock to patched Python (CVE-2026-115557) (#3303)
Raise the Python versions locked in all six pixi workspaces to the
releases that reject the compromised eMudhra intermediate CAs via the
ssl module (CVE-2026-115557):
3.12.15 -> 3.12.16
3.14.8 / 3.14.9 -> 3.14.10
3.15.1 -> 3.15.2
The six workspaces and their environment roles:
pixi.lock (root): lint / ruff env
3.14.8 -> 3.15.2 (no python pin; picks latest)
cuda_pathfinder/pixi.lock: source-build test env + docs
3.14.8 -> 3.15.2 (default/cu12/cu13 test envs)
3.12.15 -> 3.12.16 (docs: python = "3.12.*")
cuda_bindings_13/pixi.lock: source-build test env + docs
3.14.8 -> 3.14.10 (cu12/cu13/default: python build-variants 3.14.*)
3.12.15 -> 3.12.16 (docs: python = "3.12.*")
3.15.1 -> 3.15.2 (pixi-build source-package host envs: python = "*")
cuda_core/pixi.lock: source-build test env + docs
3.14.8 -> 3.14.10 (cu12/cu13/default/docs/samples/numba-mlir envs)
3.12.15 -> 3.12.16 (numba-classic: python = "3.12.*")
3.15.1 -> 3.15.2 (pixi-build source-package host envs: python = "*")
benchmarks/cuda_core/pixi.lock: wheel + source bench env
3.14.8 / 3.14.9 -> 3.14.10 (python = "3.14.*")
benchmarks/cuda_bindings/pixi.lock: wheel + source bench env
3.14.8 / 3.14.9 -> 3.14.10 (python = "3.14.*")
3.15.1 -> 3.15.2 (pixi-build source-package host env: python = "*")
Method: pixi update --no-install python in each workspace (pixi 0.83.0,
no general refresh per the lockfile maintenance pause in ci/README.md).
The benchmark workspaces required a temporary [workspace.build-variants]
python = ["3.14.*"] entry to reconcile the runtime python = "3.14.*"
constraint with the in-tree source packages; the entry was reverted.
The three source-package host-env entries (python_abi 3.15.*) were
updated by direct metadata substitution with hashes verified against the
conda-forge repodata.
Residual: cpython-3.12.15 and cpython-3.14.8 (noarch: generic, no ssl
module) remain; they are ABI-stable companion packages that do not run
user code and carry no ssl exposure.
Refs NVIDIA-dev/cuda-python-private#745
Closes the "Relock the six pixi.lock files" item in the checklist.1 parent 026f513 commit 80b3359
6 files changed
Lines changed: 1453 additions & 1811 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments