Skip to content

chore(deps): bump Brotli to 1.2.1 for CVE-2026-111497 #635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
amrit110 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

chore(deps): bump Brotli to 1.2.1 for CVE-2026-111497 #635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0d41653
chore(deps): bump Brotli to 1.2.1 for CVE-2026-111497
amrit110 Oct 24, 2026
819b5f1
fix(deps): clear pip-audit failures in run-code-check
amrit110 Oct 25, 2026
1bedcb1
test(smoke): update APFL expected eval metrics for the upgraded lock
amrit110 Oct 25, 2026
c9679b6
test(smoke): update APFL expected client training metrics
amrit110 Oct 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions .github/workflows/static_code_checks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,12 +54,78 @@ jobs:
# PYSEC-2025-217 is a transformers vulnerability without a fix yet.
# PYSEC-2026-73 is a keras vulnerability fixed in 3.13, but this requires upgrade the python version, which
# we will defer for now.
# The advisories below have no fixed version installable under this project's pins, so they are deferred
# with the same reasoning as above:
# - cryptography (PYSEC-2026-3552/3553/3554, GHSA-537c-gmf6-5ccf) and protobuf (PYSEC-2026-1805): fixes
# need cryptography>=48 and protobuf>=5.29.6, but flwr 1.18 requires cryptography<45 and protobuf<5.
# - datasets (PYSEC-2026-3716) and fsspec (PYSEC-2026-4217): fixes need datasets 5.0.1, but the dev group
# pins datasets<3 and flwr-datasets requires datasets<5; datasets 2.x caps fsspec at 2024.6.1.
# - pillow (13.0.0), filelock (4.2.1) and keras (PYSEC-2026-2324/2547/3856, 3.13.2+) fixes all require
# Python>=3.11, while this project is pinned to Python 3.10.
# - transformers (PYSEC-2026-2289/2290/3929/4174): fixes are only in 5.x (deferred, see above) or none yet.
ignore-vulns: |
CVE-2026-26007
CVE-2026-34073
CVE-2026-1839
PYSEC-2025-217
PYSEC-2026-73
PYSEC-2026-3552
PYSEC-2026-3553
PYSEC-2026-3554
GHSA-537c-gmf6-5ccf
PYSEC-2026-1805
PYSEC-2026-3716
PYSEC-2026-4217
CVE-2026-112906
CVE-2026-112907
CVE-2026-112913
CVE-2026-112914
CVE-2026-112937
CVE-2026-112940
PYSEC-2026-2324
PYSEC-2026-2547
PYSEC-2026-3856
PYSEC-2026-2289
PYSEC-2026-2290
PYSEC-2026-3929
PYSEC-2026-4174
CVE-2026-112390
CVE-2026-112391
CVE-2026-112392
CVE-2026-112393
CVE-2026-112395
CVE-2026-112396
CVE-2026-112397
CVE-2026-112398
CVE-2026-112399
CVE-2026-112400
CVE-2026-112401
CVE-2026-112402
CVE-2026-112404
CVE-2026-112405
CVE-2026-112406
CVE-2026-112891
CVE-2026-112892
CVE-2026-112893
CVE-2026-112894
CVE-2026-112895
CVE-2026-112896
CVE-2026-112897
CVE-2026-112899
CVE-2026-112900
CVE-2026-112901
CVE-2026-114501
CVE-2026-96636
CVE-2026-96637
CVE-2026-96638
CVE-2026-96639
CVE-2026-96640
CVE-2026-96641
CVE-2026-96642
CVE-2026-96643
CVE-2026-96644
CVE-2026-96778
GHSA-78g4-xqwv-q3g8


# Deleting some temporary files and useless folders to free up space
Expand Down
58 changes: 29 additions & 29 deletions tests/smoke_tests/apfl_client_metrics.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,57 +2,57 @@
"rounds": {
"1": {
"fit_round_metrics": {
"train - personal - accuracy": 0.60938,
"train - global - accuracy": 0.6078,
"train - local - accuracy": 0.4797
"train - personal - accuracy": 0.60625,
"train - global - accuracy": 0.60625,
"train - local - accuracy": 0.47656
},
"fit_round_losses": {
"backward": 1.4428,
"global": 1.3272,
"backward": 1.44501,
"global": 1.33127,
"local": 1.63674
},
"eval_round_metrics": {
"val - personal - accuracy": 0.52433,
"val - global - accuracy": 0.5331,
"val - local - accuracy": 0.49900
"val - personal - accuracy": 0.52189,
"val - global - accuracy": 0.52878,
"val - local - accuracy": 0.50644
},
"eval_round_loss": 1.57742
"eval_round_loss": 1.56820
},
"2": {
"fit_round_metrics": {
"train - personal - accuracy": 0.78281,
"train - global - accuracy": 0.79687,
"train - local - accuracy": 0.74688
"train - personal - accuracy": 0.77656,
"train - global - accuracy": 0.79844,
"train - local - accuracy": 0.73125
},
"fit_round_losses": {
"backward": 0.67673,
"global": 0.68586,
"local": 0.79693
"backward": 0.67997,
"global": 0.73669,
"local": 0.82620
},
"eval_round_metrics": {
"val - personal - accuracy": 0.74322,
"val - global - accuracy": 0.72833,
"val - local - accuracy": 0.69956
"val - personal - accuracy": 0.74722,
"val - global - accuracy": 0.76500,
"val - local - accuracy": 0.68956
},
"eval_round_loss": 0.85188
"eval_round_loss": 0.84102
},
"3": {
"fit_round_metrics": {
"train - personal - accuracy": 0.82656,
"train - global - accuracy": 0.85625,
"train - local - accuracy": 0.81094
"train - personal - accuracy": 0.81563,
"train - global - accuracy": 0.84219,
"train - local - accuracy": 0.80156
},
"fit_round_losses": {
"backward": 0.60156,
"global": 0.54568,
"local": 0.75705
"backward": 0.60081,
"global": 0.56094,
"local": 0.73777
},
"eval_round_metrics": {
"val - personal - accuracy": 0.78300,
"val - global - accuracy": 0.75322,
"val - local - accuracy": 0.74700
"val - personal - accuracy": 0.80667,
"val - global - accuracy": 0.78544,
"val - local - accuracy": 0.81022
},
"eval_round_loss": 0.72138
"eval_round_loss": 0.63707
}
}
}
24 changes: 12 additions & 12 deletions tests/smoke_tests/apfl_server_metrics.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,27 +2,27 @@
"rounds": {
"1": {
"eval_round_metrics_aggregated": {
"val - personal - accuracy": 0.52433,
"val - global - accuracy": 0.5331,
"val - local - accuracy": 0.4990
"val - personal - accuracy": 0.52189,
"val - global - accuracy": 0.52878,
"val - local - accuracy": 0.50644
},
"val - loss - aggregated": 1.57742
"val - loss - aggregated": 1.56820
},
"2": {
"eval_round_metrics_aggregated": {
"val - personal - accuracy": 0.74322,
"val - global - accuracy": 0.72833,
"val - local - accuracy": 0.69955
"val - personal - accuracy": 0.74722,
"val - global - accuracy": 0.76500,
"val - local - accuracy": 0.68956
},
"val - loss - aggregated": 0.85188
"val - loss - aggregated": 0.84102
},
"3": {
"eval_round_metrics_aggregated": {
"val - personal - accuracy": 0.78300,
"val - global - accuracy": 0.75322,
"val - local - accuracy": 0.74700
"val - personal - accuracy": 0.80667,
"val - global - accuracy": 0.78544,
"val - local - accuracy": 0.81022
},
"val - loss - aggregated": 0.72138
"val - loss - aggregated": 0.63707
}
}
}
Loading
Loading