Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend orjson dependency allowed range with excluded versions #1501

Merged
merged 3 commits into from
Jul 4, 2024

Conversation

steinitzu
Copy link
Collaborator

Description

Extends the orjson version range to allow >=3.6.7,<4 with some known problematic versions excluded

Segafault bug introduced in 3.9.11 seems to be fixed in 3.9.15 ijl/orjson#459 (comment)

Another crashing bug mentioned in changelog introduced in 3.10.1 (and fixed in 3.10.2) so I'm excluding that version too https://github.com/ijl/orjson/blob/7b081e10768a44699f6f7231521b1803c3dfdd87/CHANGELOG.md#fixed

This is within lanchain's range as well:

$ pipdeptree -p langchain|grep orjson
│   │   ├── orjson [required: >=3.9.14,<4.0.0, installed: 3.10.5]

Related Issues

Additional Context

#1469

Copy link

netlify bot commented Jun 20, 2024

Deploy Preview for dlt-hub-docs ready!

Name Link
🔨 Latest commit 6f345bb
🔍 Latest deploy log https://app.netlify.com/sites/dlt-hub-docs/deploys/6686ad9384f7360008def8ea
😎 Deploy Preview https://deploy-preview-1501--dlt-hub-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@rudolfix
Copy link
Collaborator

@steinitzu that's right. there were more bugs introduced later and fixed. if we see any problems with orjson in the future I'll remove it from dlt

rudolfix
rudolfix previously approved these changes Jun 23, 2024
Copy link
Collaborator

@rudolfix rudolfix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@rudolfix rudolfix mentioned this pull request Jun 23, 2024
@rudolfix rudolfix self-assigned this Jun 24, 2024
@rudolfix rudolfix added the sprint Marks group of tasks with core team focus at this moment label Jun 26, 2024
@rudolfix rudolfix merged commit e55bb0e into devel Jul 4, 2024
52 checks passed
@rudolfix rudolfix deleted the fix/orjson-dependency-constraints branch July 4, 2024 15:53
@rudolfix rudolfix removed the sprint Marks group of tasks with core team focus at this moment label Aug 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

CVE in orjson < 3.9.15 and orjson pinned to <=3.9.10 in dlt
2 participants