[clang][analyzer] Update python dependency versions #143433
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Sarnie, Nick <[email protected]>
llvmbot
added
clang
Member
|
@llvm/pr-subscribers-clang @llvm/pr-subscribers-clang-static-analyzer-1 Author: Nick Sarnie (sarnex) ChangesWe need to make sure we aren't vulnerable to PYSEC-2020-73 and PYSEC-2019-41. Full diff: https://github.com/llvm/llvm-project/pull/143433.diff 1 Files Affected:
diff --git a/clang/utils/analyzer/requirements.txt b/clang/utils/analyzer/requirements.txt
index 8ae8bc88ac191..ed09161e5902e 100644
--- a/clang/utils/analyzer/requirements.txt
+++ b/clang/utils/analyzer/requirements.txt
@@ -1,6 +1,6 @@
graphviz
humanize
matplotlib
-pandas
-psutil
+pandas>=1.0.4
+psutil>=5.6.6
seaborn
|
isuckatcs
approved these changes
Jun 9, 2025
Contributor
|
Are there other vulns affecting the other deps? Or more recent vulns we should know about the deps you would touch here? |
Member
Author
|
For this specific |
steakhal
approved these changes
Jun 9, 2025
Contributor
steakhal
left a comment
steakhal
left a comment
There was a problem hiding this comment.
Thanks for the patch. Merge it at your convinience.
Member
Author
|
Thanks for the quick reviews! |
sarnex
added a commit
to intel/llvm
that referenced
this pull request
Jun 10, 2025
Fixes some vulnerability warnings. I've [submitted](llvm/llvm-project#143433) this upstream too, but ideally we can fix the warnings here first. Signed-off-by: Sarnie, Nick <[email protected]>
tomtor
pushed a commit
to tomtor/llvm-project
that referenced
this pull request
Jun 14, 2025
We need to make sure we aren't vulnerable to [PYSEC-2020-73](https://osv.dev/vulnerability/PYSEC-2020-73) and [PYSEC-2019-41](https://osv.dev/vulnerability/PYSEC-2019-41). Signed-off-by: Sarnie, Nick <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We need to make sure we aren't vulnerable to PYSEC-2020-73 and PYSEC-2019-41.