fix CVE (#417)

* fix CVE * Empty commit to trigger CI * Empty commit message * update * update * update * update * update * update * update * update * update * update * update * update * update * update * update * update * update * This is a null commit * This is a null commit * This is a null commit * update * update * update * update * update * update * update
oap-project · Nov 21, 2024 · 7810e38 · 7810e38
1 parent d4fd70d
commit 7810e38
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/.github/workflows/raydp.yml b/.github/workflows/raydp.yml
@@ -84,6 +84,7 @@ jobs:
           fi
           pip install pyarrow==6.0.1 ray[train] pytest tensorflow==2.13.1 tabulate grpcio-tools wget
           pip install "xgboost_ray[default]<=0.1.13"
+          pip install "xgboost<=2.0.3"
           pip install torchmetrics
       - name: Cache Maven
         uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2

diff --git a/core/pom.xml b/core/pom.xml
@@ -23,7 +23,7 @@
     <commons.text.version>1.10.0</commons.text.version>
     <commons.compress.version>1.26.0</commons.compress.version>
     <rhino.version>1.7.12</rhino.version>
-    <protobuf.version>3.16.3</protobuf.version>
+    <protobuf.version>3.25.5</protobuf.version>
     <ivy.version>2.5.2</ivy.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

diff --git a/python/setup.py b/python/setup.py
@@ -99,7 +99,7 @@ def run(self):
         "pandas >= 1.1.4",
         "psutil",
         "pyarrow >= 4.0.1, <15.0.0",
-        "ray >= 2.1.0",
+        "ray >= 2.1.0, <= 2.38.0",
         "pyspark >= 3.1.1, <=3.5.1",
         "netifaces",
         "protobuf > 3.19.5, <= 3.20.3"