CVE-2023-34092

Advisory

Lightning 2.0.4 updates its dependency 'vite' to version '2.9.16' to include a security fix.
https://github.com/Lightning-AI/lightning/commit/7d2a46efa9834c3bb0bc1069df0a2e3a6e855d01

Affected package

Affected versions

Fixed versions

Vulnerability changelog

App

Fixed

- bumped several dependencies to address security vulnerabilities.

---

Fabric

Fixed

- Fixed validation of parameters of `plugins.precision.MixedPrecision` (17687)
- Fixed an issue with HPU imports leading to performance degradation (17788)

---

PyTorch

Changed

- Changes to the `NeptuneLogger` (16761):
* It now supports neptune-client 0.16.16 and neptune >=1.0, and we have replaced the `log()` method with `append()` and `extend()`.
* It now accepts a namespace `Handler` as an alternative to `Run` for the `run` argument. This means that you can call it `NeptuneLogger(run=run["some/namespace"])` to log everything to the `some/namespace/` location of the run.

Fixed

- Fixed validation of parameters of `plugins.precision.MixedPrecisionPlugin` (17687)
- Fixed deriving default map location in `LightningModule.load_from_checkpoint` when there is an extra state (17812)


---

Contributors

akreuzer, awaelchli, borda, jerome-habana, kshitij12345

_If we forgot someone due to not matching commit email with GitHub account, let us know :]_

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34092