Skip to content

fix(deps): Update dependency deepspeed to v0.15.1 [SECURITY]#46

Open
williaby wants to merge 1 commit into
mainfrom
renovate/pypi-deepspeed-vulnerability
Open

fix(deps): Update dependency deepspeed to v0.15.1 [SECURITY]#46
williaby wants to merge 1 commit into
mainfrom
renovate/pypi-deepspeed-vulnerability

Conversation

@williaby

@williaby williaby commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package Change Age Confidence
deepspeed (source) ==0.14.5 → ==0.15.1 age confidence

Impact

  • ✅ Patch update: bug fixes and security patches only
  • ✅ No breaking changes

Acceptance Criteria

  • All CI checks pass

Testing

  • CI gates pass (tests, lint, type checking, security scan)

Notes

DeepSpeed Remote Code Execution Vulnerability

CVE-2024-43497 / GHSA-8cp5-3rf8-8gfh

More information

Details

DeepSpeed Remote Code Execution Vulnerability

Severity

  • CVSS Score: 8.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DeepSpeed Remote Code Execution Vulnerability

CVE-2024-43497 / GHSA-8cp5-3rf8-8gfh / PYSEC-2024-109

More information

Details

DeepSpeed Remote Code Execution Vulnerability

Severity

  • CVSS Score: 8.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

CVE-2024-43497 / GHSA-8cp5-3rf8-8gfh / PYSEC-2024-109

More information

Details

DeepSpeed Remote Code Execution Vulnerability

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

deepspeedai/DeepSpeed (deepspeed)

v0.15.1: Patch release

Compare Source

What's Changed

New Contributors

Full Changelog: deepspeedai/DeepSpeed@v0.15.0...v0.15.1

v0.15.0: DeepSpeed v0.15.0

Compare Source

What's Changed

New Contributors

Full Changelog: deepspeedai/DeepSpeed@v0.14.5...v0.15.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot AI review requested due to automatic review settings May 29, 2026 05:07
@williaby

williaby commented May 29, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: DeQA-Score/uv.lock
Command failed: uv lock --upgrade-package deepspeed
Using CPython 3.11.15 interpreter at: /opt/containerbase/tools/python/3.11.15/bin/python3
  × No solution found when resolving dependencies for split (markers:
  │ (python_full_version == '3.11.*' and platform_machine != 'aarch64'
  │ and sys_platform == 'linux') or (python_full_version == '3.11.*' and
  │ platform_python_implementation != 'CPython' and sys_platform == 'linux')):
  ╰─▶ Because deepspeed==0.15.1 depends on pydantic>=2.0.0 and
      deqa-score[train] depends on deepspeed==0.15.1, we can conclude that
      deqa-score[train] depends on pydantic>=2.0.0.
      And because your project depends on pydantic>=1,<2 and your project
      requires deqa-score[train], we can conclude that your project's
      requirements are unsatisfiable.

@coderabbitai

coderabbitai Bot commented May 29, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@williaby, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 57 minutes and 6 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c31fd144-b896-4486-9c5d-3296fe818034

📥 Commits

Reviewing files that changed from the base of the PR and between c7e7593 and 7c9151c.

📒 Files selected for processing (1)
  • DeQA-Score/pyproject.toml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/pypi-deepspeed-vulnerability

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented May 29, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@sonarqubecloud

sonarqubecloud Bot commented May 29, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI reviewed May 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the deepspeed training dependency from 0.14.5 to 0.15.1 to address CVE-2024-43497 (Remote Code Execution).

Changes:

  • Bump deepspeed from ==0.14.5 to ==0.15.1 in the train optional-dependencies group.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@socket-security

socket-security Bot commented May 29, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedtorch@​2.0.1762510010070
Addedtransformers@​4.36.17260100100100
Addedsetuptools@​82.0.17310010010070
Addedscipy@​1.15.37610010010070
Addedscipy@​1.17.17610010010070
Addedwandb@​0.25.075100100100100
Addedsentencepiece@​0.1.998985100100100
Addedtorchvision@​0.15.291100100100100
Addedscikit-learn@​1.2.29399100100100
Addedurllib3@​2.7.097100100100100
Addeduvicorn@​0.41.098100100100100
Addedtimm@​0.6.1399100100100100
Addedstarlette@​0.50.010099100100100
Addedrequests@​2.34.299100100100100
Addedruff@​0.15.5100100100100100
Addedtokenizers@​0.15.0100100100100100
Addedruff@​0.15.15100100100100100
Addedshortuuid@​1.0.13100100100100100

View full report

@socket-security

socket-security Bot commented May 29, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: PyTorch: pypi torch`.load` with `weights_only=True` leads to remote code execution

CVE: GHSA-53q9-r3pm-6pq6 PyTorch: torch.load with weights_only=True leads to remote code execution (CRITICAL)

Affected versions: < 2.6.0

Patched version: 2.6.0

From: DeQA-Score/pyproject.toml → pypi/torch@2.0.1

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/torch@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@williaby