LCORE-1568: Bump llama-stack to 0.6.0, fix transitive CVEs#195
Open
are-ces wants to merge 5 commits into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR refreshes dependency pins and generated hash/wheel lock files, adds OpenTelemetry build pins and ChangesDependency and Build Configuration Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
559f620 to
3a3c767
Compare
are-ces
changed the title
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
3a3c767 to
0babbe6
Compare
are-ces
changed the title
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
0babbe6 to
4ba2894
Compare
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
4ba2894 to
08d6eb7
Compare
Update llama-stack, llama-stack-api, and llama-stack-client from 0.5.0 to 0.6.0. Fix transitive dependency CVEs: - python-multipart 0.0.22 → 0.0.29 (CVE-2026-40347, CVE-2026-42561) - pyopenssl 25.3.0 → 26.2.0 (requires oci bump to 2.176.0) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
08d6eb7 to
68e9e92
Compare
Pin torch (2.9.1) and torchvision (0.24.1) to RHOAI 3.3 cpu-ubi9 so both share the same ABI — fixes RuntimeError "operator torchvision::nms does not exist" in downstream CPU image consumers. Pin starlette==1.1.0 in pyproject.toml and both override files to address CVE in starlette <1.1.0. Regenerate all Konflux requirement files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pin rpds-py to 0.30.0 (available on RHOAI 3.3) to avoid building 2026.5.1 from source which requires Cargo 1.85+ (edition2024). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
are-ces
force-pushed
the
bump-llama-stack-0.6.0
branch
from
53cba96 to
a695b66
Compare
RHOAI torch-2.9.1-4 now declares triton==3.5.1; pip check fails with the previous triton==3.5.0 pin. Update overrides, arch-specific hash files, and both generation scripts to use RHOAI triton-3.5.1-2 wheels. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.konflux/requirements.overrides.txt:
- Line 31: The override pin "starlette==1.1.0" is likely incorrect/unavailable;
update the override in .konflux/requirements.overrides.txt by either removing
the hard pin and using a permissive constraint (e.g., "starlette>=1.1.0") or
changing it to a concrete RHOAI-available version (e.g., match versions found in
uv.lock like 1.2.0), and add a brief comment justifying a strict pin if you must
keep it (compatibility/CVE); ensure this aligns with the dependency that pulls
starlette (llama-stack==0.6.0) and re-run dependency resolution/lockfile to
verify consistency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: cd6b70fe-1c6b-48e8-99f1-b83e6aecaf9a
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (19)
.konflux/requirements-build.cuda.txt.konflux/requirements-build.txt.konflux/requirements.hashes.source.cuda.txt.konflux/requirements.hashes.source.txt.konflux/requirements.hashes.wheel.cpu.aarch64.txt.konflux/requirements.hashes.wheel.cpu.x86_64.txt.konflux/requirements.hashes.wheel.cuda.txt.konflux/requirements.hashes.wheel.pypi.cuda.aarch64.txt.konflux/requirements.hashes.wheel.pypi.cuda.base.txt.konflux/requirements.hashes.wheel.pypi.cuda.x86_64.txt.konflux/requirements.hashes.wheel.pypi.txt.konflux/requirements.hashes.wheel.txt.konflux/requirements.overrides.cuda.txt.konflux/requirements.overrides.txt.tekton/rag-tool-pull-request.yaml.tekton/rag-tool-push.yamlpyproject.tomlscripts/konflux_requirements.shscripts/konflux_requirements_cuda.sh
💤 Files with no reviewable changes (2)
- .konflux/requirements.hashes.wheel.pypi.txt
- .konflux/requirements.hashes.wheel.cuda.txt
✅ Files skipped from review due to trivial changes (4)
- .konflux/requirements.hashes.wheel.pypi.cuda.aarch64.txt
- .konflux/requirements.hashes.wheel.pypi.cuda.base.txt
- .konflux/requirements.hashes.source.txt
- .konflux/requirements-build.txt
🚧 Files skipped from review as they are similar to previous changes (4)
- .tekton/rag-tool-push.yaml
- .konflux/requirements.hashes.source.cuda.txt
- pyproject.toml
- .konflux/requirements.hashes.wheel.cpu.x86_64.txt
| docling-core==2.74.0 | ||
| tiktoken==0.12.0 | ||
| urllib3==2.7.0 | ||
| starlette==1.1.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if starlette is a dependency of llama-stack packages
echo "Checking llama-stack dependencies for starlette..."
rg -i "starlette" pyproject.toml uv.lock
# Check RHOAI index for starlette availability
echo -e "\nChecking RHOAI index for starlette 1.1.0..."
curl -sf "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.3/cpu-ubi9/simple/starlette/" | grep -o 'starlette-1\.1\.0[^"]*' | head -3Repository: lightspeed-core/rag-content
Length of output: 1751
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== overrides file (lines 1-120) =="
nl -ba .konflux/requirements.overrides.txt | sed -n '1,120p'
echo
echo "== overrides file: starlette pins =="
rg -n "starlette(==|>=|<=|~=|!=)" .konflux/requirements.overrides.txt || true
echo
echo "== uv.lock: all starlette entries (context) =="
rg -n "name = \"starlette\"|sse-starlette|starlette>=" uv.lock | head -200
echo
echo "== uv.lock: distinct starlette versions =="
python3 - <<'PY'
import re, pathlib
text = pathlib.Path("uv.lock").read_text(errors="ignore")
vers = set()
# matches: name = "starlette", version = "x.y.z" OR starlette-x.y.z... style
for m in re.finditer(r'name = "starlette".{0,200}?version = "([^"]+)"', text, re.S):
vers.add(m.group(1))
# fallback: look for starlette-<ver>- in artifact urls
for m in re.finditer(r'starlette-([0-9]+\.[0-9]+\.[0-9]+)', text):
vers.add(m.group(1))
print("versions:", sorted(vers))
PY
echo
echo "== search for llama-stack version and any starlette mention in repo =="
rg -n "llama-stack|starlette" pyproject.toml .konflux -S || true
echo
echo "== re-run RHOAI check with more visible output and error handling =="
set +e
curl -sS -f "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.3/cpu-ubi9/simple/starlette/" | head -50
echo
echo "exit_code=$?"Repository: lightspeed-core/rag-content
Length of output: 167
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== overrides file (first 160 lines, with line numbers via awk) =="
awk '{printf "%4d\t%s\n", NR, $0}' .konflux/requirements.overrides.txt | sed -n '1,160p'
echo
echo "== overrides file: starlette pins =="
rg -n "starlette(==|>=|<=|~=|!=)" .konflux/requirements.overrides.txt || true
echo
echo "== uv.lock: starlette-related entries (first 200 matches) =="
rg -n "name = \"starlette\"|name = \"sse-starlette\"|starlette>=" uv.lock | head -200
echo
echo "== uv.lock: starlette versions (parsed) =="
python3 - <<'PY'
import re, pathlib
p = pathlib.Path("uv.lock")
txt = p.read_text(errors="ignore")
vers = set()
# direct starlette entry like: name = "starlette" ... version = "x.y.z"
for m in re.finditer(r'name = "starlette"[\s\S]{0,400}?version = "([^"]+)"', txt):
vers.add(m.group(1))
# artifact URLs like: .../starlette-1.2.0-...
for m in re.finditer(r'starlette-([0-9]+\.[0-9]+\.[0-9]+)', txt):
vers.add(m.group(1))
print("versions:", ", ".join(sorted(vers)) if vers else "none found")
PY
echo
echo "== search for llama-stack and starlette mentions in repo (top hits) =="
rg -n "llama-stack|starlette" pyproject.toml .konflux -S || true
echo
echo "== RHOAI check: starlette-1.1.0 (print first 20 lines of response or error) =="
set +e
curl -sS -f "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.3/cpu-ubi9/simple/starlette/" \
| head -20
echo
echo "exit_code=$?"Repository: lightspeed-core/rag-content
Length of output: 5971
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== uv.lock: llama-stack / api / client sections (context around starlette requirements) =="
# Print a limited window around each llama-stack-related "name" occurrence
for pat in 'name = "llama-stack"' 'name = "llama-stack-api"' 'name = "llama-stack-client"'; do
echo
echo "-- matches for: $pat"
rg -n "$pat" uv.lock | head -20 | cut -d: -f1 | while read -r line; do
start=$((line-40))
end=$((line+120))
echo
echo "## uv.lock lines $start-$end"
sed -n "${start},${end}p" uv.lock
done
done
echo
echo "== uv.lock: any explicit starlette version constraints near llama-stack-related stanzas =="
rg -n "llama-stack|llama-stack-api|llama-stack-client" uv.lock | head -50 | cut -d: -f1 | head -10 | while read -r line; do
start=$((line-60))
end=$((line+160))
echo
echo "## uv.lock lines $start-$end"
sed -n "${start},${end}p" uv.lock | rg -n "starlette|sse-starlette|llama-stack" || true
doneRepository: lightspeed-core/rag-content
Length of output: 50384
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== uv.lock: starlette stanzas (name/version) - first 30 matches =="
rg -n '^name = "starlette"$' -n uv.lock | head -30 | cut -d: -f1 | while read -r line; do
start=$((line-2))
end=$((line+10))
echo
echo "-- around line $line"
sed -n "${start},${end}p" uv.lock
done
echo
echo "== uv.lock: does it contain starlette-1.1.0 anywhere? =="
rg -n "starlette-1\.1\.0" uv.lock || true
echo
echo "== RHOAI simple/starlette/ contains starlette-1.1.0? =="
curl -sS "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.3/cpu-ubi9/simple/starlette/" \
| rg -n "starlette-1\.1\.0" || true
echo
echo "== RHOAI simple/starlette/ all starlette versions present (limited) =="
curl -sS "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.3/cpu-ubi9/simple/starlette/" \
| rg -o "starlette-[0-9]+\.[0-9]+\.[0-9]+" \
| sort -u | head -30Repository: lightspeed-core/rag-content
Length of output: 1191
Revisit starlette==1.1.0 override pin (likely mismatched / unjustified)
uv.lockcontainsstarletteversions like 1.2.0, but there’s nostarlette==1.1.0entry.- The RHOAI wheel index listing for
starlettedoes not includestarlette-1.1.0(response shows only versions like 0.46.2 / 0.50.0 / 0.51.0 / 0.52.1). llama-stack==0.6.0depends onstarlettewithout pinning, while this repo’s constraint is onlystarlette>=1.1.0, so the specific1.1.0pin needs a concrete reason (compat/CVE) or should be changed to a RHOAI-available version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.konflux/requirements.overrides.txt at line 31, The override pin
"starlette==1.1.0" is likely incorrect/unavailable; update the override in
.konflux/requirements.overrides.txt by either removing the hard pin and using a
permissive constraint (e.g., "starlette>=1.1.0") or changing it to a concrete
RHOAI-available version (e.g., match versions found in uv.lock like 1.2.0), and
add a brief comment justifying a strict pin if you must keep it
(compatibility/CVE); ensure this aligns with the dependency that pulls starlette
(llama-stack==0.6.0) and re-run dependency resolution/lockfile to verify
consistency.
Transitive dependency via docling 2.73.1 resolved to lxml 6.0.2, which is vulnerable. Add direct constraint and bump lock to 6.1.1. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bump llama-stack, llama-stack-api, and llama-stack-client from 0.5.0 to 0.6.0.
llama-stack 0.5.0 introduced vulnerable transitive dependencies. This PR bumps llama-stack to 0.6.0 and explicitly pins the affected transitive deps to patched versions:
Also fixes:
triton==3.5.1in METADATA;pip checkfails with triton 3.5.0. Updated overrides, arch-specific hash files, and both generation scripts to use RHOAI triton-3.5.1-2 wheels.Updated transitive dependencies:
Changes
pyproject.toml:llama-stack{,-api,-client}==0.6.0,python-multipart>=0.0.27,pyopenssl>=26.0.0,idna>=3.15,lxml>=6.1.0uv.lock: Updated all packagesType of change
Tools used to create PR
Related Tickets & Documents
Checklist before requesting a review
Testing
make konflux-requirementsSummary by CodeRabbit