scvi-tools
scvi-tools copied to clipboard
lightning dependency critical CVE - Update dependency list, especially for conda which is pinned below the CVE patch
conda package feedstock has a lightning
package dependency of "lightning >=2.0,<2.1" which is different from the pypi dependency of "lightning>=2.0".
lightning
has a a critical level of CVE reported https://github.com/advisories/GHSA-mr7h-w2qc-ffc2, with a patch in version 2.3.3. Recommend bumping the dependency for scvi-tools before v1.2 (#2889) after testing.
The pip package may automatically pick up the latest version of lightning
. However, the conda package installer is preventing it from being installed
## snippet of environment.yaml
- python=3.11
- lightning>=2.3.3
- scvi-tools=1.1
## generating a conda-lock file
conda-lock --mamba --kind lock -p linux-64 -f environment.yml --with-cuda 12.4 --lockfile ./tmp/conda-lock.yml
└─ scvi-tools 1.1** is not installable because it requires
└─ lightning >=2.0,<2.1 , which conflicts with any installable versions previously reported.
This is expected because:
conda search scvi-tools=1.1.5 --info -c conda-forge
Loading channels: done
scvi-tools 1.1.5 pyhd8ed1ab_0
-----------------------------
file name : scvi-tools-1.1.5-pyhd8ed1ab_0.conda
name : scvi-tools
version : 1.1.5
build : pyhd8ed1ab_0
build number: 0
size : 224 KB
license : BSD-3-Clause
subdir : noarch
url : https://conda.anaconda.org/conda-forge/noarch/scvi-tools-1.1.5-pyhd8ed1ab_0.conda
md5 : e019ce59ca342c17768f579857b6d48a
timestamp : 2024-07-01 01:09:48 UTC
dependencies:
- anndata >=0.7.5
- docrep >=0.3.2
- flax >=0.4.0
- h5py >=2.9.0
- jax >=0.4.4
- jaxlib >=0.4.3
- lightning >=2.0,<2.1
- ml-collections >=0.1.1
- mudata >=0.1.2
- numpy >=1.17.0
- numpyro >=0.12.1
- openpyxl >=3.0
- optax
- pandas >=1.0
- pyro-ppl >=1.6.0
- python >=3.9
- pytorch >=1.8.0
- rich >=12.0.0
- scikit-learn >=0.21.2
- sparse >=0.14.0
- torchmetrics >=0.11.0
- tqdm >=4.56.0
- xarray >=2023.2.0
matching the lightning
version which is present at https://github.com/conda-forge/scvi-tools-feedstock/blob/main/recipe/meta.yaml
Versions:
scvi-tools: 1.1.5