[None][infra] Vulnerability fix by yuanjingx87 · Pull Request #19909 · NVIDIA/TensorRT-LLM

yuanjingx87 · 2026-10-06T23:16:46Z

Dev Engineer Review

constraints.txt updates the JupyterLab, Jupyter Server, and Notebook vulnerability floors and adds an urllib3 floor. docker/common/install_etcd.sh updates etcd to v3.7.2. docker/common/install_mooncake.sh pins yalantinglibs to tag 0.5.5. requirements.txt removes the version pin for datasets, allowing dependency resolution to select a version. jenkins/current_image_tags.properties updates five Docker image tags to build suffix 202610082043-19909.

CI results are mixed. Pipeline #66 failed for commit 4e0a579; pipeline #72 succeeded for 1431a10. Both were marked “Partly Tested.” The NGC container scan and pipeline #78 failed for a2ad969, as did its Docker image build and pipeline #84. Failure details are not included in the supplied comments. A run with --disable-fail-fast was triggered for 2fd4653, but no completion status is provided.

QA Engineer Review

No test changes.

Per-File QA Perspective

constraints.txt: Verify dependency resolution with the updated vulnerability floors.
docker/common/install_etcd.sh: Verify the script downloads and installs etcd v3.7.2 for supported architectures.
docker/common/install_mooncake.sh: Verify the script checks out yalantinglibs tag 0.5.5 and builds and installs it successfully.
requirements.txt: Verify that the unpinned datasets dependency resolves to a compatible version.
jenkins/current_image_tags.properties: Verify that the updated tags refer to the intended Docker images and are available to CI workflows.

Description

Vulnerability fixing

Test Coverage

PR Checklist

Please review the following before submitting your PR:

PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.
PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.
Test cases are provided for new code paths (see test instructions)
If PR introduces API changes, an appropriate PR label is added - either api-compatible or api-breaking. For api-breaking, include BREAKING in the PR title.
Any new dependencies have been scanned for license and vulnerabilities
CODEOWNERS updated if ownership changes
Documentation updated as needed
Update tava architecture diagram if there is a significant design change in PR.
The reviewers assigned automatically/manually are appropriate for the PR.
Please check this after reviewing the above items as appropriate for this PR.

GitHub Bot Help

To see a list of available CI bot commands, please comment /bot help.

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-06T23:18:26Z

/bot run --stage-list "NGC-Container-Scaning"

coderabbitai · 2026-10-06T23:20:16Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/TensorRT-LLM/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9ebef286-3242-401f-923e-9cc8509a6d2c

📥 Commits

Reviewing files that changed from the base of the PR and between 2fd4653 and db9fcc7.

📒 Files selected for processing (1)

jenkins/current_image_tags.properties

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

Python constraints update advisory minimum versions for JupyterLab, Jupyter Server, Notebook, and urllib3. The datasets requirement is no longer version-pinned. Docker installation scripts update the etcd version and the yalantinglibs checkout tag. Five Jenkins image references use a new tag suffix.

Changes

Python dependency requirements

Layer / File(s)	Summary
Update Python dependency requirements `constraints.txt`, `requirements.txt`	The constraints remove previous Jupyter Server and Notebook pins and add or update advisory minimum versions for JupyterLab, Jupyter Server, Notebook, and urllib3. The requirements file changes `datasets==3.1.0` to an unversioned requirement.

Docker dependency versions

Layer / File(s)	Summary
Update Docker dependency versions `docker/common/install_etcd.sh`, `docker/common/install_mooncake.sh`	The etcd version changes from `v3.7.1` to `v3.7.2`. The `yalantinglibs` clone checks out tag `0.5.5` instead of the repository default branch.

Jenkins image tags

Layer / File(s)	Summary
Update Jenkins image tags `jenkins/current_image_tags.properties`	Five image references change their suffix from `202609210610-19345` to `202610082043-19909`. Image names and platform-specific tag components remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to db9fc

No confirmed issue blocks merging. The new image tags’ publication status remains unverified.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check		The description includes the required headings and checklist, but it only states "Vulnerability fixing" and provides no specific vulnerability details, solution summary, or test coverage.	Describe the affected vulnerabilities and the changes that address them, including the dependency pins and other updates. Add the relevant test or CI results, including any failed or incomplete pipeline runs and their resolution.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title follows the required format and accurately identifies the primary change as a vulnerability fix.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

tensorrt-cicd · 2026-10-06T23:26:08Z

PR_Github #76445 [ run ] triggered by Bot. Commit: 4e0a579 Link to invocation

tensorrt-cicd · 2026-10-07T04:39:15Z

PR_Github #76445 [ run ] completed with state FAILURE. Commit: 4e0a579
/LLM/release-1.3/L0_MergeRequest_PR pipeline #66 (Partly Tested) completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-07T07:34:53Z

/bot run --stage-list "NGC-Container-Scaning"

tensorrt-cicd · 2026-10-07T07:43:16Z

PR_Github #76519 [ run ] triggered by Bot. Commit: 1431a10 Link to invocation

tensorrt-cicd · 2026-10-07T09:36:00Z

PR_Github #76519 [ run ] completed with state SUCCESS. Commit: 1431a10
/LLM/release-1.3/L0_MergeRequest_PR pipeline #72 (Partly Tested) completed with status: 'SUCCESS'

CI Report

Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-07T18:00:26Z

/bot run --stage-list "NGC-Container-Scaning"

tensorrt-cicd · 2026-10-07T18:08:53Z

PR_Github #76577 [ run ] triggered by Bot. Commit: a2ad969 Link to invocation

tensorrt-cicd · 2026-10-08T00:38:41Z

PR_Github #76577 [ run ] completed with state FAILURE. Commit: a2ad969
/LLM/release-1.3/L0_MergeRequest_PR pipeline #78 (Partly Tested) completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

yuanjingx87 · 2026-10-08T01:19:32Z

/bot run --stage-list "Build-Docker-Images"

tensorrt-cicd · 2026-10-08T01:28:02Z

PR_Github #76632 [ run ] triggered by Bot. Commit: a2ad969 Link to invocation

tensorrt-cicd · 2026-10-08T07:19:06Z

PR_Github #76632 [ run ] completed with state FAILURE. Commit: a2ad969
/LLM/release-1.3/L0_MergeRequest_PR pipeline #84 (Partly Tested) completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

yuanjingx87 · 2026-10-08T09:03:05Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-08T09:11:16Z

PR_Github #76710 [ run ] triggered by Bot. Commit: 2fd4653 Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-08T21:48:35Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-08T21:56:36Z

PR_Github #76798 [ run ] triggered by Bot. Commit: db9fcc7 Link to invocation

tensorrt-cicd · 2026-10-08T21:59:41Z

PR_Github #76710 [ run ] completed with state ABORTED. Commit: 2fd4653

Link to invocation

yuanjingx87 · 2026-10-09T21:20:59Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-09T21:27:43Z

PR_Github #77032 [ run ] triggered by Bot. Commit: 245a06b Link to invocation

tensorrt-cicd · 2026-10-10T01:10:25Z

PR_Github #77032 [ run ] completed with state FAILURE. Commit: 245a06b
/LLM/release-1.3/L0_MergeRequest_PR pipeline #140 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

yuanjingx87 · 2026-10-10T04:21:08Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-10T04:29:11Z

PR_Github #77085 [ run ] triggered by Bot. Commit: 245a06b Link to invocation

tensorrt-cicd · 2026-10-10T05:24:10Z

PR_Github #77085 [ run ] completed with state SUCCESS. Commit: 245a06b
/LLM/release-1.3/L0_MergeRequest_PR pipeline #148 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-11T17:00:11Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-11T17:07:55Z

PR_Github #77162 [ run ] triggered by Bot. Commit: e4f5433 Link to invocation

tensorrt-cicd · 2026-10-11T20:32:06Z

PR_Github #77162 [ run ] completed with state SUCCESS. Commit: e4f5433
/LLM/release-1.3/L0_MergeRequest_PR pipeline #152 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

mikeiovine

Stamp on behalf of runtime devs, delegating proper review to @NVIDIA/trt-llm-oss-compliance; please ping me if you think this is not accurate

github-actions · 2026-10-12T15:37:24Z

Automatically added "ci: full pre-merge approved" because this PR has satisfied the required GitHub review approvals. Unresolved review conversations and other required checks remain independent merge requirements.

yuanjingx87 · 2026-10-12T16:52:14Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-12T17:00:17Z

PR_Github #77305 [ run ] triggered by Bot. Commit: e4f5433 Link to invocation

tensorrt-cicd · 2026-10-12T19:35:19Z

PR_Github #77305 [ run ] completed with state SUCCESS. Commit: e4f5433
/LLM/release-1.3/L0_MergeRequest_PR pipeline #167 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

yuanjingx87 · 2026-10-12T19:41:23Z

/bot run --disable-fail-fast

tensorrt-cicd · 2026-10-12T19:50:05Z

PR_Github #77320 [ run ] triggered by Bot. Commit: e4f5433 Link to invocation

tensorrt-cicd · 2026-10-12T21:13:50Z

PR_Github #77320 [ run ] completed with state SUCCESS. Commit: e4f5433
/LLM/release-1.3/L0_MergeRequest_PR pipeline #168 completed with status: 'SUCCESS'

CI Report

Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 · 2026-10-12T21:33:18Z

/bot skip --comment "CI has passed before the comment adjustment"

tensorrt-cicd · 2026-10-12T21:39:32Z

PR_Github #77341 [ skip ] triggered by Bot. Commit: d331674 Link to invocation

tensorrt-cicd · 2026-10-12T21:55:23Z

PR_Github #77341 [ skip ] completed with state SUCCESS. Commit: d331674
Skipping testing for commit d331674

Link to invocation

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

Vulnerability fix

4e0a579

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 requested review from a team as code owners October 6, 2026 23:16

yuanjingx87 requested review from mlefeb01 and mzweilz October 6, 2026 23:16

github-actions Bot assigned yuanjingx87 Oct 6, 2026

yuanjingx87 requested a review from tburt-nv October 6, 2026 23:17

mzweilz approved these changes Oct 7, 2026

View reviewed changes

Pin yalantinglibs to 0.5.5 in the Mooncake install

1431a10

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

Unpin dataset version

a2ad969

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

Update CI images

db9fcc7

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 force-pushed the user/yuanjingx/vulnerability_fix branch from 2fd4653 to db9fcc7 Compare October 8, 2026 21:44

yuanjingx87 requested review from BowenFu and QiJune October 9, 2026 21:20

Fix tests that break due to datasets upgrade

e4f5433

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 force-pushed the user/yuanjingx/vulnerability_fix branch from 245a06b to e4f5433 Compare October 11, 2026 16:59

weiminwang-nv mentioned this pull request Oct 12, 2026

[None][infra] Pin yalantinglibs to 0.5.5 in install_mooncake.sh #20149

Closed

1 task done

chzblych approved these changes Oct 12, 2026

View reviewed changes

Comment thread constraints.txt Outdated

mikeiovine approved these changes Oct 12, 2026

View reviewed changes

trtllm-agent added the ci: full pre-merge approved label Oct 12, 2026

Update container image tag in constraint.txt comment

d331674

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

yuanjingx87 merged commit 03d50f6 into NVIDIA:release/1.3 Oct 12, 2026
8 checks passed

yuanjingx87 added a commit to yuanjingx87/TensorRT-LLM that referenced this pull request Oct 12, 2026

[None][infra] Vulnerability fix (NVIDIA#19909)

49a33e0

Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>

Conversation

yuanjingx87 commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dev Engineer Review

QA Engineer Review

Per-File QA Perspective

Description

Test Coverage

PR Checklist

GitHub Bot Help

Uh oh!

yuanjingx87 commented Oct 6, 2026

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

tensorrt-cicd commented Oct 6, 2026

Uh oh!

tensorrt-cicd commented Oct 7, 2026

Uh oh!

yuanjingx87 commented Oct 7, 2026

Uh oh!

tensorrt-cicd commented Oct 7, 2026

Uh oh!

tensorrt-cicd commented Oct 7, 2026

Uh oh!

yuanjingx87 commented Oct 7, 2026

Uh oh!

tensorrt-cicd commented Oct 7, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

yuanjingx87 commented Oct 8, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

yuanjingx87 commented Oct 8, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

yuanjingx87 commented Oct 8, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

tensorrt-cicd commented Oct 8, 2026

Uh oh!

yuanjingx87 commented Oct 9, 2026

Uh oh!

tensorrt-cicd commented Oct 9, 2026

Uh oh!

tensorrt-cicd commented Oct 10, 2026

Uh oh!

yuanjingx87 commented Oct 10, 2026

Uh oh!

tensorrt-cicd commented Oct 10, 2026

Uh oh!

tensorrt-cicd commented Oct 10, 2026

Uh oh!

yuanjingx87 commented Oct 11, 2026

Uh oh!

tensorrt-cicd commented Oct 11, 2026

Uh oh!

tensorrt-cicd commented Oct 11, 2026

Uh oh!

Uh oh!

mikeiovine left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

yuanjingx87 commented Oct 12, 2026

Uh oh!

tensorrt-cicd commented Oct 12, 2026

Uh oh!

yuanjingx87 commented Oct 6, 2026 •

edited

Loading

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading