Skip to content

Fix OpenVINO notebook dependency vulnerabilities - #533

Merged
morteza89 merged 2 commits into
mainfrom
vulnerabilities-fixed
Aug 25, 2026
Merged

Fix OpenVINO notebook dependency vulnerabilities#533
morteza89 merged 2 commits into
mainfrom
vulnerabilities-fixed

Conversation

@morteza89

Copy link
Copy Markdown
Contributor

this is for vulnerability fixes.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the isolated Python environments used by the hello-npu and gpu-device OpenVINO notebook samples to address dependency vulnerability findings by raising minimum versions and regenerating the uv.lock files accordingly.

Changes:

  • Raise minimum versions / add explicit constraints for Jupyter components and related dependencies (e.g., jupyterlab, jupyter-server, tornado, mistune, pillow, setuptools).
  • Regenerate uv.lock files to reflect resolved versions (including new transitive additions like jupyter-builder) and updated artifact hashes/URLs.
  • Keep the two notebook environments aligned on the same minimum security baselines for shared Jupyter/runtime packages.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File Description
openvino_notebooks/hello-npu/pyproject.toml Adds/raises minimum dependency versions for notebook runtime packages to address vulnerabilities.
openvino_notebooks/hello-npu/uv.lock Lockfile regeneration reflecting upgraded Jupyter stack and related dependency versions/artifacts.
openvino_notebooks/gpu-device/pyproject.toml Aligns GPU notebook environment dependency minimums with updated secure baselines.
openvino_notebooks/gpu-device/uv.lock Lockfile regeneration reflecting upgraded Jupyter stack and related dependency versions/artifacts.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@morteza89
morteza89 merged commit b6c9357 into main Aug 25, 2026
3 checks passed
@morteza89
morteza89 deleted the vulnerabilities-fixed branch August 25, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants