phoenix-oss/llama-stack-mirror
0
0
Fork 1
mirror of https://github.com/meta-llama/llama-stack.git synced 2025-06-28 10:54:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: Bump h11 to 0.16.0 to fix cve-2025-43859 (#2041)

Browse source 
This resolves a new critical severity on h11. See
https://access.redhat.com/security/cve/cve-2025-43859. We should
consider releasing a new patch with this fix.

This was updated via:

```
uv add "h11>=0.16.0"
uv export --frozen --no-hashes --no-emit-project --output-file=requirements.txt
```

Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
This commit is contained in:
Yuan Tang 2025-04-27 14:45:35 -04:00 • committed by GitHub
parent 6cf6791de1
commit 28687b0e85
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
pyproject.toml
View file

@ -38,6 +38,7 @@ dependencies = [
"termcolor", "termcolor",
"tiktoken", "tiktoken",
"pillow", "pillow",
"h11>=0.16.0",
] ]
[project.optional-dependencies] [project.optional-dependencies]

4
requirements.txt
View file

@ -13,8 +13,8 @@ exceptiongroup==1.2.2 ; python_full_version < '3.11'
filelock==3.17.0 filelock==3.17.0
fire==0.7.0 fire==0.7.0
fsspec==2024.12.0 fsspec==2024.12.0
h11==0.14.0 h11==0.16.0
httpcore==1.0.7 httpcore==1.0.9
httpx==0.28.1 httpx==0.28.1
huggingface-hub==0.29.0 huggingface-hub==0.29.0
idna==3.10 idna==3.10

14
uv.lock generated
View file

@ -957,11 +957,11 @@ wheels = [
[[package]] [[package]]
name = "h11" name = "h11"
version = "0.14.0" version = "0.16.0"
source = { registry = "https://pypi.org/simple" } source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/f5/38/3af3d3633a34a3316095b39c8e8fb4853a28a536e55d347bd8d8e9a14b03/h11-0.14.0.tar.gz", hash = "sha256:8f19fbbe99e72420ff35c00b27a34cb9937e902a8b810e2c88300c6f0a3b699d", size = 100418 } sdist = { url = "https://files.pythonhosted.org/packages/01/ee/02a2c011bdab74c6fb3c75474d40b3052059d95df7e73351460c8588d963/h11-0.16.0.tar.gz", hash = "sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1", size = 101250 }
wheels = [ wheels = [
{ url = "https://files.pythonhosted.org/packages/95/04/ff642e65ad6b90db43e668d70ffb6736436c7ce41fcc549f4e9472234127/h11-0.14.0-py3-none-any.whl", hash = "sha256:e3fe4ac4b851c468cc8363d500db52c2ead036020723024a109d37346efaa761", size = 58259 }, { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515 },
] ]
[[package]] [[package]]
@ -988,15 +988,15 @@ wheels = [
[[package]] [[package]]
name = "httpcore" name = "httpcore"
version = "1.0.7" version = "1.0.9"
source = { registry = "https://pypi.org/simple" } source = { registry = "https://pypi.org/simple" }
dependencies = [ dependencies = [
{ name = "certifi" }, { name = "certifi" },
{ name = "h11" }, { name = "h11" },
] ]
sdist = { url = "https://files.pythonhosted.org/packages/6a/41/d7d0a89eb493922c37d343b607bc1b5da7f5be7e383740b4753ad8943e90/httpcore-1.0.7.tar.gz", hash = "sha256:8551cb62a169ec7162ac7be8d4817d561f60e08eaa485234898414bb5a8a0b4c", size = 85196 } sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484 }
wheels = [ wheels = [
{ url = "https://files.pythonhosted.org/packages/87/f5/72347bc88306acb359581ac4d52f23c0ef445b57157adedb9aee0cd689d2/httpcore-1.0.7-py3-none-any.whl", hash = "sha256:a3fff8f43dc260d5bd363d9f9cf1830fa3a458b332856f34282de498ed420edd", size = 78551 }, { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784 },
] ]
[[package]] [[package]]
@ -1379,6 +1379,7 @@ source = { editable = "." }
dependencies = [ dependencies = [
{ name = "blobfile" }, { name = "blobfile" },
{ name = "fire" }, { name = "fire" },
{ name = "h11" },
{ name = "httpx" }, { name = "httpx" },
{ name = "huggingface-hub" }, { name = "huggingface-hub" },
{ name = "jinja2" }, { name = "jinja2" },
@ -1478,6 +1479,7 @@ requires-dist = [
{ name = "datasets", marker = "extra == 'test'" }, { name = "datasets", marker = "extra == 'test'" },
{ name = "fastapi", marker = "extra == 'dev'" }, { name = "fastapi", marker = "extra == 'dev'" },
{ name = "fire" }, { name = "fire" },
{ name = "h11", specifier = ">=0.16.0" },
{ name = "httpx" }, { name = "httpx" },
{ name = "huggingface-hub" }, { name = "huggingface-hub" },
{ name = "jinja2", specifier = ">=3.1.6" }, { name = "jinja2", specifier = ">=3.1.6" },