LCORE-2506: PyArrow CVE fix#1920
Merged
Merged
Conversation
Contributor
WalkthroughThis pull request updates the pinned version of PyArrow from 23.0.0 to 23.0.1 in the Konflux wheel requirements lock file, with corresponding SHA256 hashes regenerated to match the new release. ChangesDependency version update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.konflux/requirements.hashes.wheel.txt:
- Around line 139-143: The override and wheel-hash requirement pins for pyarrow
are out of sync: .konflux/requirements.overrides.txt pins pyarrow==23.0.0 while
.konflux/requirements.hashes.wheel.txt pins pyarrow==23.0.1; update
.konflux/requirements.overrides.txt to pyarrow==23.0.1 and then run the
regeneration flow (invoke scripts/konflux_requirements.sh or run make
konflux-requirements) so the wheel hash file is rebuilt and the pinned version
and hashes in requirements.hashes.wheel.txt match the override.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6de370e1-c37d-4681-9f49-1f2a999636f5
📒 Files selected for processing (1)
.konflux/requirements.hashes.wheel.txt
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: Pyright
- GitHub Check: list_outdated_dependencies
- GitHub Check: E2E Tests for Lightspeed Evaluation job
- GitHub Check: E2E: library mode / ci / group 3
- GitHub Check: bandit
- GitHub Check: build-pr
- GitHub Check: Pylinter
- GitHub Check: integration_tests (3.13)
- GitHub Check: integration_tests (3.12)
- GitHub Check: spectral
- GitHub Check: mypy
- GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-on-pull-request
- GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-0-6-on-pull-request
Comment on lines
+139
to
+143
| pyarrow==23.0.1 \ | ||
| --hash=sha256:c00b052ccfb5b904e77f0ca0472723936903d8dc7d1964504a9489c7212a47fc \ | ||
| --hash=sha256:c1fb462a14714f87a6c2d56d0ce938769e38206130231af669722f13eda5b612 \ | ||
| --hash=sha256:c4302f07a0e9d212d42b5b89be8745b5a22ae970209189271387d91e45b6ec4e \ | ||
| --hash=sha256:fb062054b2ba4c84d3b607f64c8e7ae65fced4f20016602773da4b7481d162a9 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the version mismatch between overrides and hashes
echo "=== PyArrow pin in overrides.txt ==="
grep -n "pyarrow==" .konflux/requirements.overrides.txt
echo -e "\n=== PyArrow version in hashes file ==="
grep -n "^pyarrow==" .konflux/requirements.hashes.wheel.txt
echo -e "\n=== Do they match? ==="
OVERRIDE_VERSION=$(grep "pyarrow==" .konflux/requirements.overrides.txt | sed 's/.*==//;s/[[:space:]]*$//')
HASH_VERSION=$(grep "^pyarrow==" .konflux/requirements.hashes.wheel.txt | sed 's/.*==//;s/[[:space:]]*$//')
if [ "$OVERRIDE_VERSION" = "$HASH_VERSION" ]; then
echo "✓ Versions match: pyarrow==$OVERRIDE_VERSION"
else
echo "✗ VERSION MISMATCH: overrides=$OVERRIDE_VERSION vs hashes=$HASH_VERSION"
exit 1
fiRepository: lightspeed-core/lightspeed-stack
Length of output: 274
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Inspect scripts/konflux_requirements.sh for overrides usage ==="
if [ -f scripts/konflux_requirements.sh ]; then
sed -n '1,200p' scripts/konflux_requirements.sh | nl -ba
echo
echo "---- Search within script for requirements.overrides.txt / requirements.hashes.wheel.txt ----"
rg -n "requirements\.overrides\.txt|hashes\.wheel\.txt|pip compile|uv pip compile|override" scripts/konflux_requirements.sh || true
else
echo "Missing: scripts/konflux_requirements.sh" >&2
fi
echo
echo "=== Inspect Tekton pipeline for hashes usage ==="
if [ -f .tekton/lightspeed-stack-pull-request.yaml ]; then
sed -n '1,200p' .tekton/lightspeed-stack-pull-request.yaml | nl -ba
echo
echo "---- Search within Tekton for requirements.hashes.wheel.txt ----"
rg -n "requirements\.hashes\.wheel\.txt|prefetch|pip|uv pip" .tekton/lightspeed-stack-pull-request.yaml || true
else
echo "Missing: .tekton/lightspeed-stack-pull-request.yaml" >&2
fiRepository: lightspeed-core/lightspeed-stack
Length of output: 205
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Locate and inspect scripts/konflux_requirements.sh ==="
if [ -f scripts/konflux_requirements.sh ]; then
echo "Found scripts/konflux_requirements.sh"
wc -l scripts/konflux_requirements.sh
echo "--- First 200 lines ---"
sed -n '1,200p' scripts/konflux_requirements.sh | cat -n
echo
echo "--- Search patterns in scripts/konflux_requirements.sh ---"
rg -n "requirements\.overrides\.txt|requirements\.hashes\.wheel\.txt|pip compile|uv pip compile|override" scripts/konflux_requirements.sh || true
else
echo "Missing scripts/konflux_requirements.sh" >&2
echo "--- Listing scripts/ (if exists) ---"
ls -la scripts 2>/dev/null || true
fi
echo
echo "=== Inspect .tekton/lightspeed-stack-pull-request.yaml (if exists) ==="
if [ -f .tekton/lightspeed-stack-pull-request.yaml ]; then
wc -l .tekton/lightspeed-stack-pull-request.yaml
echo "--- First 220 lines ---"
sed -n '1,220p' .tekton/lightspeed-stack-pull-request.yaml | cat -n
echo
echo "--- Search patterns in .tekton/lightspeed-stack-pull-request.yaml ---"
rg -n "requirements\.hashes\.wheel\.txt|prefetch|pip|uv pip" .tekton/lightspeed-stack-pull-request.yaml || true
else
echo "Missing .tekton/lightspeed-stack-pull-request.yaml" >&2
echo "--- Listing .tekton/ (if exists) ---"
ls -la .tekton 2>/dev/null || true
fiRepository: lightspeed-core/lightspeed-stack
Length of output: 21034
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show pyarrow pin in .konflux/requirements.overrides.txt ==="
rg -n "^\s*pyarrow==|pyarrow==" .konflux/requirements.overrides.txt
echo
echo "Context:"
sed -n '1,200p' .konflux/requirements.overrides.txt | nl -ba | sed -n '1,220p' || true
echo
echo "=== Show pyarrow entries in .konflux/requirements.hashes.wheel.txt ==="
rg -n "^pyarrow==" .konflux/requirements.hashes.wheel.txt
echo
echo "Context around first pyarrow== match:"
LINE=$(rg -n "^pyarrow==" .konflux/requirements.hashes.wheel.txt | head -n1 | cut -d: -f1)
START=$((LINE-5))
END=$((LINE+10))
sed -n "${START},${END}p" .konflux/requirements.hashes.wheel.txt | cat -nRepository: lightspeed-core/lightspeed-stack
Length of output: 1500
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search Tekton for konflux_requirements.sh / requirements.overrides.txt usage ==="
rg -n "konflux_requirements\.sh|requirements\.overrides\.txt|requirements\.no_hashes\.txt" .tekton/lightspeed-stack-pull-request.yaml || true
echo
echo "=== Search repo for konflux_requirements.sh invocation (lightweight) ==="
rg -n "konflux_requirements\.sh" . || trueRepository: lightspeed-core/lightspeed-stack
Length of output: 285
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search for requirements.overrides.txt usage across .tekton ==="
rg -n "requirements\.overrides\.txt" .tekton || true
echo
echo "=== Search for requirements.hashes.wheel.txt usage across repo ==="
rg -n "requirements\.hashes\.wheel\.txt" . | head -n 50 || true
echo
echo "=== Search for requirements.overrides.txt usage across repo (lightweight) ==="
rg -n "requirements\.overrides\.txt" . | head -n 50 || trueRepository: lightspeed-core/lightspeed-stack
Length of output: 792
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search .tekton for regeneration steps (make, konflux_requirements, requirements.no_hashes) ==="
rg -n "make (|$)|konflux_requirements\.sh|requirements\.no_hashes\.txt|requirements\.source\.txt|requirements\.wheel\.txt" .tekton || true
echo
echo "=== Search workflows/scripts for invoking make targets around konflux requirements ==="
rg -n "konflux_requirements\.sh|requirements\.overrides\.txt|requirements\.hashes\.wheel\.txt" .github .gitlab ci scripts deploy Makefile || trueRepository: lightspeed-core/lightspeed-stack
Length of output: 912
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Show Containerfile snippet around requirements.hashes.wheel.txt install ==="
sed -n '50,100p' deploy/lightspeed-stack/Containerfile | cat -n
echo
echo "=== Show README section describing requirements.hashes.wheel.txt ==="
sed -n '1380,1440p' README.md | cat -nRepository: lightspeed-core/lightspeed-stack
Length of output: 5730
Align PyArrow pins between requirements.overrides.txt and requirements.hashes.wheel.txt
.konflux/requirements.overrides.txt pins pyarrow==23.0.0 (line 12), while .konflux/requirements.hashes.wheel.txt pins pyarrow==23.0.1 (lines 139-143). scripts/konflux_requirements.sh uses the overrides file to generate the wheel list and then regenerates requirements.hashes.wheel.txt, so re-running make konflux-requirements would likely revert the wheel hashes back to 23.0.0.
Update requirements.overrides.txt to pyarrow==23.0.1 and regenerate the Konflux requirements (so the pinned versions/hashes match).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.konflux/requirements.hashes.wheel.txt around lines 139 - 143, The override
and wheel-hash requirement pins for pyarrow are out of sync:
.konflux/requirements.overrides.txt pins pyarrow==23.0.0 while
.konflux/requirements.hashes.wheel.txt pins pyarrow==23.0.1; update
.konflux/requirements.overrides.txt to pyarrow==23.0.1 and then run the
regeneration flow (invoke scripts/konflux_requirements.sh or run make
konflux-requirements) so the wheel hash file is rebuilt and the pinned version
and hashes in requirements.hashes.wheel.txt match the override.
16 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
LCORE-2506: PyArrow CVE fix
Type of change
Tools used to create PR
Related Tickets & Documents
Summary by CodeRabbit