CVE-2021-29605

Advisory

Mlrun 1.1.0rc6 and prior uses a version of 'TensorFlow' (2.4.1) that has known vulnerabilities.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Main features & enhancements
* **Datastore**: Add Snowflake source, gtopper
* **Datastore**: Add `start_time` and `end_time` to `BigQuerySource` and `SnowflakeSource`, gtopper
* **Datastore**: Add Iguazio application partner attribute, gtopper
* **Projects**: Add/improve methods to the Project class for better usability, yaronha
* **Projects**: Add tag support to `get_artifact_uri()`, yaronha
* **Runtimes**: Add tolerations support, tankilevitch
* **Runtimes**: Mask sensitive data, Hedingber
* **Runtimes**: Add default resources for functions pods, tankilevitch
* **Runtimes**: Add flag to allow printing build logs only on failure, yaronha
* **Feature Store**: Add support for `run_id` on targets, benbd86
* **Feature Store**: Support spark dataframe ingestion, urihoenig
* **Feature Store**: Add option to use online feature service as context manager, tankilevitch
* **Feature Store**: Add validation in target path object creation, benbd86
* **Feature Store**: Performance improvements for preview and hist calculation in Spark engine, theSaarco
* **Feature Store**: Spark aggregations with support for emit-per-event, theSaarco
* **Feature Store**: Preserve all columns in Spark aggregation step, gtopper
* **Feature Store**: Re-enable flush_interval by default, gtopper
* **Model Monitoring**: Increase `batchSize` of the stream trigger in the stream function, katyakats
* **Pipelines**: Enhance kfp pods enrichment with functions and default attributes, tankilevitch
* **Artifacts**: Support artifact tags in project APIs, yaronha
* **Docs**: Doc restructure, jillnogold
* **Docs**: Improve K8s installation guide, george0st
* **Docs**: Add doc about spark operator ingestion, urihoenig
* **Docs**: Enhance `get_offline_features()`'s `with_indexes` docstring, jillnogold
* **Docs**: Add note about column name limitations in feature set aggregations, jillnogold
* **MPIJob**: Add project secrets to mpijobs, theSaarco
* **Dask**: Add project secrets to Dask cluster on deployment, theSaarco
* **Spark**: Support setting different volume mounts for driver and executor and add helper for host path, Hedingber
* **Spark**: Support auto-add of k8s project secrets, theSaarco
* **Builder**: Allow to configure whether push/pull registries are insecure, Hedingber
* **Builder**: Support configuring image name prefix template to enforce, Hedingber
* **Builder**: Assign more function spec attributes to kaniko pod, tankilevitch
* **DB**: Set the default pool size and max overflow to be equal to the API max workers, Hedingber
* **API**: Fix build status endpoint offset calculation, tankilevitch
* **API**: Increase http connection pools maxsize to be equal to number of workers, Hedingber
* **API**: Set default thread pool max workers to 64, Hedingber
* **Nuclio**: Set default nuclio runtime to python 3.7 and bump nuclio-jupyter, Hedingber
* **Nuclio**: Revert default nuclio runtime to python 3.6, Hedingber
* **Nuclio**: Fix git URL resolution, yaronha
* **Nuclio**: Fix base image pull secret assignment, tankilevitch
* **Nuclio**: Fix runtime handling for Nuclio <1.6.0 (doesn't support python:3.7), Hedingber
* **Requirements**: Bump nuclio-jupyter to 0.8.23, tankilevitch
* **Requirements**: Limit click versions to 8.0.x, tankilevitch
* **Requirements**: Downgrade Tensorflow to 2.4.x and Horovod to 0.22.1, Hedingber
* **Requirements**: Bump storey version to 1.0.3, benbd86
* **Requirements**: Bump pip to 22.0.x, Hedingber
* **UI**: [Release notes](https://github.com/mlrun/ui/releases/tag/v1.0.0)


More info can be found in the RCs release notes:

Resources

• https://pypi.org/project/mlrun
• https://pyup.io/changelogs/mlrun/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29605