Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove dependency on future #2063

Closed
AndreasBergmeier6176 opened this issue Jan 9, 2023 · 1 comment
Closed

Remove dependency on future #2063

AndreasBergmeier6176 opened this issue Jan 9, 2023 · 1 comment
Assignees
Labels
security triaged Issue has been reviewed and triaged

Comments

@AndreasBergmeier6176
Copy link
Contributor

🐛 Describe the bug

There is an advisory due to the future package: GHSA-v3c5-jqr6-7qm8
It seems to me like the future package serves no purpose anymore. See discussion in PythonCharmers/python-future#612.
Is it possible to solve the security problem by just removing the dependency on future and doing a new serve release?

In our project executing poetry show --tree --why future we get the output:

torchserve 0.6.1 TorchServe is a tool for serving neural net models for inference
└── future *

Error logs

See above links.

Installation instructions

poetry

Model Packaing

NA

config.properties

NA

Versions

0.6.1

Repro instructions

NA

Possible Solution

Perhaps remove future line from dependencies.

@msaroufim msaroufim added security triaged Issue has been reviewed and triaged labels Jan 9, 2023
@msaroufim
Copy link
Member

Yeah this makes sense, we are doing a security centric release next so this is timely

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security triaged Issue has been reviewed and triaged
Projects
None yet
Development

No branches or pull requests

3 participants