Skip to content

Conversation

@tot-ra
Copy link

@tot-ra tot-ra commented Jun 21, 2025

snyk-top-banner

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

  • requirements.jetson.txt
⚠️ Warning
tensorboard 2.11.2 requires protobuf, which is not installed.
tensorboard 2.11.2 has requirement setuptools>=41.0.0, but you have setuptools 40.5.0.
requests 2.31.0 requires urllib3, which is not installed.
ddtrace 2.0.2 requires protobuf, which is not installed.
ddtrace 2.0.2 has requirement psutil~=5.8, but you have psutil 7.0.0.

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect

@github-actions
Copy link

Given the provided diff and the context, the following are the identified items.

Importance File Path Line Number(s) Comment
🔴 requirements.jetson.txt 32, 33 Dependencies protobuf>=4.25.8 and urllib3>=2.5.0 were added to avoid vulnerabilities. Ensure that these versions are compatible with other dependencies and the overall project.
🟢 requirements.jetson.txt 32, 33 Consider adding comments describing why these dependencies were specifically pinned to these versions for future reference.
🟠 requirements.jetson.txt 1-33 Regularly updating dependencies can help improve the performance and security of your application. Consider setting up a system to keep track of dependency updates.
🟡 requirements.jetson.txt N/A Ensure consistency in commenting style. Some dependencies have comments explaining their use while others don't. It would be helpful to maintain a uniform style.
🔴 N/A N/A The warning indicates that protobuf is not installed while it's required by tensorboard and ddtrace. Also requests requires urllib3 which is not installed. These need to be fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants