Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump up pytorch-lightning version to 1.6.0 or higher #193

Merged
merged 17 commits into from
Apr 8, 2022

Conversation

samet-akcay
Copy link
Contributor

Description

  • Current version of pytorch_lightning library has vulnerability to code injection (code read from environment variables started with PL_ could be evaluated.)

    • bump up pytorch-lightning version to 1.6.0 would avoid this vulnerability.
  • Fixes Fix the pytorch_lightning env vars vulnerability #191

Changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Checklist

  • My code follows the pre-commit style and check guidelines of this project.
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing tests pass locally with my changes

@samet-akcay samet-akcay requested a review from djdameln April 8, 2022 14:09
@@ -68,7 +69,7 @@ def _add_images(
for log_to in module.hparams.project.log_images_to:
if log_to in loggers.AVAILABLE_LOGGERS:
# check if logger object is same as the requested object
if log_to in logger_type and module.logger is not None:
if log_to in logger_type and module.logger is not None and isinstance(module.logger, ImageLoggerBase):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain why this is needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is to silence mypy. Some typings have changed in pl 1.6, causing some mypy issues.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, so no functional changes to the visualizer callback then

@samet-akcay samet-akcay mentioned this pull request Apr 8, 2022
11 tasks
@samet-akcay samet-akcay merged commit ce00b50 into development Apr 8, 2022
@samet-akcay samet-akcay deleted the fix/sa/pytorch-lightning-vulnerability branch April 8, 2022 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Fix the pytorch_lightning env vars vulnerability
2 participants