Skip to content

Conversation

@eschcam
Copy link
Contributor

@eschcam eschcam commented Jul 23, 2025

What changes were proposed in this pull request?

Upgrading the following Python dependnecies:

  • black 23.12.1 to 24.3.0
  • mlflow 2.3.1 to 3.1.0
  • numpy 1.21 to 1.22
  • protobuf 5.29.1 to 5.29.5
  • pyarrow 11.0.0 to 17.0.0

Why are the changes needed?

The above dependencies were out of date and contained vulnerabilities

Does this PR introduce any user-facing change?

No

How was this patch tested?

Passed CI tests

Was this patch authored or co-authored using generative AI tooling?

No

@eschcam
Copy link
Contributor Author

eschcam commented Jul 23, 2025

The large number of changes mainly comes from reformatting the python files as part of updating black

@bjornjorgensen
Copy link
Contributor

FYI #45647

@bjornjorgensen
Copy link
Contributor

try to make it easy for those that needs to check and merge it.
take one thing at the time, like protobuf seams to be a ok thing to update.
for those docker files that have like 3.5 at the name are for the 3.5 branch.
And don't updated min version, we try to keep them old as long as we can. it's a check for the minimum version we can have.

@eschcam eschcam force-pushed the dev-python-update branch from bc1d07e to 8d4ac26 Compare July 25, 2025 10:35
@eschcam
Copy link
Contributor Author

eschcam commented Jul 25, 2025

FYI #45647

It looks like this may have been reverted at some point

@eschcam eschcam force-pushed the dev-python-update branch from 8d4ac26 to f0ec7b8 Compare July 29, 2025 11:15
@eschcam
Copy link
Contributor Author

eschcam commented Jul 29, 2025

try to make it easy for those that needs to check and merge it. take one thing at the time, like protobuf seams to be a ok thing to update. for those docker files that have like 3.5 at the name are for the 3.5 branch. And don't updated min version, we try to keep them old as long as we can. it's a check for the minimum version we can have.

Do you want me to split this into a pull request per dependency?

@bjornjorgensen
Copy link
Contributor

try to make it easy for those that needs to check and merge it. take one thing at the time, like protobuf seams to be a ok thing to update. for those docker files that have like 3.5 at the name are for the 3.5 branch. And don't updated min version, we try to keep them old as long as we can. it's a check for the minimum version we can have.

Do you want me to split this into a pull request per dependency?

Yes, have one PR for each.
Start with protobuf I think there is a CVE for that. Make the PR and a jira ticket for that.

@eschcam eschcam closed this Jul 30, 2025
@eschcam eschcam deleted the dev-python-update branch July 30, 2025 10:46
@eschcam eschcam restored the dev-python-update branch July 30, 2025 10:46
@eschcam eschcam deleted the dev-python-update branch August 1, 2025 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants