Skip to content

Fix vulnerable Python dependencies - #490

Open
morteza89 wants to merge 1 commit into
mainfrom
fix-dependabot-alerts
Open

Fix vulnerable Python dependencies#490
morteza89 wants to merge 1 commit into
mainfrom
fix-dependabot-alerts

Conversation

@morteza89

Copy link
Copy Markdown

No description provided.

@morteza89
morteza89 requested review from praveenkk123 and a lite review from Copilot August 5, 2026 22:10

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Python (and Pixi) dependency versions across several demos/projects in the repo to address vulnerable/outdated packages, along with some incidental formatting and small runtime-behavior changes in Streamlit apps.

Changes:

  • Bump versions for common Python dependencies (e.g., torch, gitpython, jupyterlab, setuptools, aiohttp, langchain ecosystem) across multiple pyproject.toml/requirements.txt files.
  • Update Pixi tooling configuration (Pixi version + pixi.toml structure/dependencies) for the Automated Prompt Engineering sample.
  • Minor code formatting updates in Streamlit apps; additionally, several exception handlers were changed to catch BaseException.

Reviewed changes

Copilot reviewed 12 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
Video-Description-Generation-Query-Retrieval/st_video_rag_demo.py Formatting tweaks; exception handling changed (now catches BaseException in a couple places).
Video-Description-Generation-Query-Retrieval/pyproject.toml Dependency version bumps (gitpython/torch/jupyterlab/setuptools).
Text-Summarizer-Browser-Plugin/requirements.txt Dependency updates/additions (sentence-transformers, langchain_chroma, chromadb, transformers).
LLM/src/st_rag_chat.py Formatting-only changes (whitespace/spacing).
LLM/rag/requirements.txt LangChain-related dependency upgrades.
LLM/PyTorch/pyproject.toml Dependency version bumps; remove gtts; bump aiohttp/jupyterlab/setuptools.
Genre-driven-storytelling/pyproject.toml Dependency version bumps (jupyterlab/setuptools).
Finetune_Image_Captioning/pyproject.toml Dependency version bumps (aiohttp/jupyterlab/setuptools).
Automated-Prompt-Engineering/tools/pixi_settings.ps1 Pixi version bump.
Automated-Prompt-Engineering/tools/pixi_settings.env Pixi version bump.
Automated-Prompt-Engineering/pixi.toml Pixi config updated (workspace/dependencies adjusted).
AI-Upscaling-With-NPU/pyproject.toml Dependency version bumps (jupyterlab/notebook/setuptools).
AI-Upscaling-With-NPU/NPU_Upscaling_demo.py Formatting tweaks; multiple exception handlers changed to catch BaseException.
Suppressed comments (3)

AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:188

  • Avoid catching BaseException in Streamlit apps (it can intercept rerun/stop and KeyboardInterrupt/SystemExit). Catch Exception (or a specific OpenVINO error) when reading GPU properties.
        except BaseException:
            info['gpu_name'] = "Unknown GPU"

AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:280

  • These BaseException handlers may swallow Streamlit rerun/stop control-flow exceptions and make the sidebar render inconsistently. Use Exception (or narrower OpenVINO exceptions) for property probing.
                        except BaseException:
                            try:
                                prop_val = core.get_property("GPU", prop_key)
                            except BaseException:
                                prop_val = "N/A"

AI-Upscaling-With-NPU/NPU_Upscaling_demo.py:855

  • Catching BaseException around ffmpeg conversion can swallow KeyboardInterrupt/SystemExit and Streamlit control exceptions. Limit this to the errors you expect from subprocess execution (e.g., CalledProcessError / FileNotFoundError) before falling back to the AVI output.
    except BaseException:
        output_path = temp_output

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +343 to 344
except BaseException:
return {}
Comment on lines +726 to 727
except BaseException:
st.error("❌ Ollama Offline")
Comment on lines +181 to 182
except BaseException:
info['npu_name'] = "Unknown NPU"
Comment on lines +250 to 254
except BaseException:
try:
prop_val = core.get_property("NPU", prop_key)
except:
except BaseException:
prop_val = "N/A"
Comment on lines +852 to 853
except BaseException:
pass
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants