langgenius/dify-official-plugins
1
0
Fork 0
mirror of https://github.com/langgenius/dify-official-plugins.git synced 2026-07-21 17:45:23 -04:00
Code Issues 54 Packages Projects Releases Wiki Activity

security: upgrade version of sagemaker in models/sagemaker to mitigate vulnerability #735

New Issue
Closed
opened 2026-02-16 10:20:20 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 10:20:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @QuantumGhost on GitHub (Oct 17, 2025).

Originally assigned to: @QuantumGhost on GitHub.

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

The current version of sagemaker-python-sdk used by the langgenius/sagemaker is ~=2.253.1, which is affected by CVE-2025-0508.

Upgrade to sagemaker~=2.253.1 to mitigate this vulnerability.

P.S. I have tried to upgrade the sagemaker SDK to the newest version. However, due to dependency conflicts, it's not possible to satisfy the version constraints. I used UV to resolve the compatible version.

details:

╰─▶ Because only the following versions of dify-plugin are available:
        dify-plugin<=0.5.0
        dify-plugin>0.6.0
    and dify-plugin==0.5.0 depends on packaging>=25.0, we can conclude that
    dify-plugin>=0.5.0 depends on packaging>=25.0.
    And because sagemaker==2.253.1 depends on packaging>=23.0,<25 and only
    sagemaker<=2.253.1 is available, we can conclude that dify-plugin>=0.5.0
    and sagemaker>=2.253.1 are incompatible.
    And because you require dify-plugin>=0.5.0 and sagemaker>=2.253.1, we
    can conclude that your requirements are unsatisfiable.


    hint: `sagemaker` was requested with a pre-release marker (e.g.,
    sagemaker>2.253.1,<2.254.dev0), but pre-releases weren't enabled (try:
    `--prerelease=allow`)

2. Additional context or comments

No response

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @QuantumGhost on GitHub (Oct 17, 2025). Originally assigned to: @QuantumGhost on GitHub. ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify-official-plugins/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. The current version of sagemaker-python-sdk used by the [langgenius/sagemaker](https://github.com/langgenius/dify-official-plugins/blob/main/models/sagemaker/) is `~=2.253.1`, which is affected by CVE-2025-0508. Upgrade to `sagemaker~=2.253.1` to mitigate this vulnerability. P.S. I have tried to upgrade the sagemaker SDK to the newest version. However, due to dependency conflicts, it's not possible to satisfy the version constraints. I used UV to resolve the compatible version. details: ``` ╰─▶ Because only the following versions of dify-plugin are available: dify-plugin<=0.5.0 dify-plugin>0.6.0 and dify-plugin==0.5.0 depends on packaging>=25.0, we can conclude that dify-plugin>=0.5.0 depends on packaging>=25.0. And because sagemaker==2.253.1 depends on packaging>=23.0,<25 and only sagemaker<=2.253.1 is available, we can conclude that dify-plugin>=0.5.0 and sagemaker>=2.253.1 are incompatible. And because you require dify-plugin>=0.5.0 and sagemaker>=2.253.1, we can conclude that your requirements are unsatisfiable. hint: `sagemaker` was requested with a pre-release marker (e.g., sagemaker>2.253.1,<2.254.dev0), but pre-releases weren't enabled (try: `--prerelease=allow`) ``` ### 2. Additional context or comments _No response_ ### 3. Can you help us with this feature? - [x] I am interested in contributing to this feature.
yindo added the enhancementdependencies labels 2026-02-16 10:20:20 -05:00
yindo closed this issue 2026-02-16 10:20:20 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
bug
bug
dependencies
documentation
enhancement
good first issue
invalid
pull-request
Mirrored from GitHub Pull Request
 question
stale
No Label dependencies enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-official-plugins#735
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?