fix: bump colab base to 20260716 to remediate image-scanning CVEs - #1557
Open
KeijiBranshi wants to merge 1 commit into
Open
fix: bump colab base to 20260716 to remediate image-scanning CVEs#1557KeijiBranshi wants to merge 1 commit into
KeijiBranshi wants to merge 1 commit into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Bumps the Colab base image from release-colab-external-images_20260514-060047_RC00 to release-colab-external-images_20260716-060051_RC00. Package versions picked up from the new base include torch 2.10 -> 2.11, torchvision 0.25 -> 0.26, gradio 5.50 -> 6.20, langsmith 0.7.34 -> 0.10.2, gitpython 3.1.47 -> 3.1.51, pyjwt 2.12.1 -> 2.13.0, python-multipart 0.0.26 -> 0.0.32, litellm 1.82.4 -> 1.85.7, wandb 0.26.1 -> 0.28.0, and rsync 3.2.7-0ubuntu0.22.04.4 -> .22.04.6. Repo-side changes needed alongside the bump: - torchcodec 0.10.0 -> 0.11.0, to stay compatible with torch 2.11. - pillow>=12.2 and urllib3>=2.7, since the new base still ships pillow 11.3 and urllib3 2.5. Both resolve cleanly with no conflicts. - Stop installing git-lfs via apt. The base image ships git-lfs 3.7.1 built with Go 1.26, and Ubuntu's git-lfs 3.0.2 package was overwriting it with an older build from Go 1.18. Both CPU and GPU images build clean with --no-cache. Test suite not yet run.
KeijiBranshi
force-pushed
the
keijibranshi/chore/update-colab-base-20260716
branch
from
August 18, 2026 21:12
f112bdd to
06962a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the Colab base image from release-colab-external-images_20260514-060047_RC00 to release-colab-external-images_20260716-060051_RC00, which clears 20 of the 32 P1 image-scanning CVEs blocking b/548519812.
The bump alone resolves:
Also stops
apt-get install -y git-lfs. The base image ships a working git-lfs 3.7.1 built with go1.26.0, but Ubuntu's git-lfs 3.0.2 package was overwriting it with a go1.18.1 build, which is what the GO_STDLIB scanners were actually flagging. Without this the base bump would not have fixed those findings.Pins pillow>=12.2 (b/541575345) and urllib3>=2.7 (b/541071828); the new base still ships pillow 11.3 and urllib3 2.5. Both resolve cleanly with no conflicts.
torchcodec is bumped 0.10.0 -> 0.11.0 because the new base ships torch 2.11, and torchcodec must stay compatible with the torch version.
Remaining open, all base/upstream-owned with no clean fix from this Dockerfile: npm minimatch/tar (bundled in node v20.19.0), netty 4.1.118.Final, zookeeper 3.9.3 and jackson-core 2.12.7 shaded in hadoop-client-runtime (pyspark 4.0.3 jars), and jupyterlab 3.6.8 (capped by our jupyter-lsp==1.5.1 pin, b/276358430).
Both CPU and GPU images build clean with --no-cache. Test suite not yet run.