Fix SSRF in Vesta ImageEncoder URL fetch (CWE-918) - #5239
Merged
Conversation
corey-byrne
previously approved these changes
Jul 28, 2026
Test Results for batch-score-ci444 tests 441 ✅ 25s ⏱️ Results for commit 31ee8a2. ♻️ This comment has been updated with latest results. |
This reverts commit 44f54d3.
The batch-score-ci gate installs tests/requirements.txt on ubuntu-latest with setup-python '>=3.10', which now resolves to Python 3.13. With the fully unpinned requirements, pip backtracks the transitive azureml-dataprep dependency (pulled by mltable): versions <=4.14 require the unmaintained dotnetcore2 package (no Python 3.11+ support) and 5.1-5.3 require azureml-dataprep-native<42 (no cp313 wheel), so the resolver exhausts all candidates and fails with "Cannot install azureml-dataprep because these package versions have conflicting dependencies". Floor azureml-dataprep at 5.4.0 (the first release requiring azureml-dataprep-native>=42, which ships cp313 wheels); mltable already caps it below 5.5.0, so pip resolves to 5.4.5. Verified with a Linux / Python 3.13 cross-platform pip resolution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5d7ff447-f036-4f73-b4c8-3ff37826cf02
Run the legacy suite on Python 3.10 and update compatibility points for current aiohttp, tiktoken, traceback, and setuptools behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The batch_score_llm component spec was removed with the deprecated component sources, so skip its e2e suite before shared xdist fixtures attempt registration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Delete the batch_score_llm e2e suite and remove its Azure provisioning, CI invocation, markers, and test-only SDK dependencies. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Mock validate_auth while asserting the factory invokes it so unit CI no longer depends on credentials removed with the deprecated e2e setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
corey-byrne
approved these changes
Jul 29, 2026
vizhur
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[Icm 842332167] Fix SSRF in Vesta ImageEncoder URL fetch (CWE-918)- #5239