Fix vulnerable Python dependencies - #490
Open
morteza89 wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates Python (and Pixi) dependency versions across several demos/projects in the repo to address vulnerable/outdated packages, along with some incidental formatting and small runtime-behavior changes in Streamlit apps.
Changes:
- Bump versions for common Python dependencies (e.g., torch, gitpython, jupyterlab, setuptools, aiohttp, langchain ecosystem) across multiple
pyproject.toml/requirements.txtfiles. - Update Pixi tooling configuration (Pixi version +
pixi.tomlstructure/dependencies) for the Automated Prompt Engineering sample. - Minor code formatting updates in Streamlit apps; additionally, several exception handlers were changed to catch
BaseException.
Reviewed changes
Copilot reviewed 12 out of 19 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| Video-Description-Generation-Query-Retrieval/st_video_rag_demo.py | Formatting tweaks; exception handling changed (now catches BaseException in a couple places). |
| Video-Description-Generation-Query-Retrieval/pyproject.toml | Dependency version bumps (gitpython/torch/jupyterlab/setuptools). |
| Text-Summarizer-Browser-Plugin/requirements.txt | Dependency updates/additions (sentence-transformers, langchain_chroma, chromadb, transformers). |
| LLM/src/st_rag_chat.py | Formatting-only changes (whitespace/spacing). |
| LLM/rag/requirements.txt | LangChain-related dependency upgrades. |
| LLM/PyTorch/pyproject.toml | Dependency version bumps; remove gtts; bump aiohttp/jupyterlab/setuptools. |
| Genre-driven-storytelling/pyproject.toml | Dependency version bumps (jupyterlab/setuptools). |
| Finetune_Image_Captioning/pyproject.toml | Dependency version bumps (aiohttp/jupyterlab/setuptools). |
| Automated-Prompt-Engineering/tools/pixi_settings.ps1 | Pixi version bump. |
| Automated-Prompt-Engineering/tools/pixi_settings.env | Pixi version bump. |
| Automated-Prompt-Engineering/pixi.toml | Pixi config updated (workspace/dependencies adjusted). |
| AI-Upscaling-With-NPU/pyproject.toml | Dependency version bumps (jupyterlab/notebook/setuptools). |
| AI-Upscaling-With-NPU/NPU_Upscaling_demo.py | Formatting tweaks; multiple exception handlers changed to catch BaseException. |
Suppressed comments (3)
AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:188
- Avoid catching BaseException in Streamlit apps (it can intercept rerun/stop and KeyboardInterrupt/SystemExit). Catch Exception (or a specific OpenVINO error) when reading GPU properties.
except BaseException:
info['gpu_name'] = "Unknown GPU"
AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:280
- These BaseException handlers may swallow Streamlit rerun/stop control-flow exceptions and make the sidebar render inconsistently. Use Exception (or narrower OpenVINO exceptions) for property probing.
except BaseException:
try:
prop_val = core.get_property("GPU", prop_key)
except BaseException:
prop_val = "N/A"
AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:855
- Catching BaseException around ffmpeg conversion can swallow KeyboardInterrupt/SystemExit and Streamlit control exceptions. Limit this to the errors you expect from subprocess execution (e.g., CalledProcessError / FileNotFoundError) before falling back to the AVI output.
except BaseException:
output_path = temp_output
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+343
to
344
| except BaseException: | ||
| return {} |
Comment on lines
+726
to
727
| except BaseException: | ||
| st.error("❌ Ollama Offline") |
Comment on lines
+181
to
182
| except BaseException: | ||
| info['npu_name'] = "Unknown NPU" |
Comment on lines
+250
to
254
| except BaseException: | ||
| try: | ||
| prop_val = core.get_property("NPU", prop_key) | ||
| except: | ||
| except BaseException: | ||
| prop_val = "N/A" |
Comment on lines
+852
to
853
| except BaseException: | ||
| pass |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.