updating depset - #61919
updating depset#61919
Conversation
Signed-off-by: elliot-barn <elliot.barnwell@anyscale.com>
![cursor[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
| --hash=sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a \ | ||
| --hash=sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50 | ||
| markupsafe==3.0.2 ; sys_platform != 'win32' \ | ||
| --hash=sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84 |
There was a problem hiding this comment.
Downgraded markupsafe with almost all platform hashes removed
High Severity
markupsafe was downgraded from 3.0.3 to 3.0.2, and the ~90 platform-specific wheel hashes were replaced with a single hash. Since MarkupSafe includes C extensions and produces different wheels per platform/architecture, pip with hash-checking mode (as used by lock files) will fail to install on any platform whose wheel doesn't match this lone hash. This will break installations for nearly all environments.
![gemini-code-assist[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates a dependency, downgrading markupsafe from version 3.0.3 to 3.0.2. My review has identified a critical issue with this downgrade, as version 3.0.2 is a known broken release. Please see the specific comment for details.
| markupsafe==3.0.2 ; sys_platform != 'win32' \ | ||
| --hash=sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84 |
There was a problem hiding this comment.
This change downgrades markupsafe from version 3.0.3 to 3.0.2. However, markupsafe==3.0.2 is a broken release and should not be used. The markupsafe changelog states for version 3.0.2: "This release was not packaged correctly and should not be used. Use 3.0.3 instead."
It is critical to revert this change and continue using markupsafe==3.0.3 to avoid potential build or runtime issues.
2 participants
updating llm batch test depset to resolve dependency compilation error: https://buildkite.com/ray-project/premerge/builds/62664#019d0c41-fbcc-4c68-bcbc-387ded78ee56