Skip to content

[Snyk] Fix for 2 vulnerabilities #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bozza-man wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #183

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion streamlit_airtable/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
streamlit
torch
transformers
airtable-python-wrapper
airtable-python-wrapper
protobuf>=5.29.6 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link

@sentry sentry bot Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Pinning the protobuf version without pinning its dependent packages like streamlit and transformers creates a fragile dependency set that may break during future installations.
Severity: MEDIUM

Suggested Fix

To ensure stable builds, pin the versions of the direct dependencies in requirements.txt. For example, add version specifiers for streamlit and transformers that are known to be compatible with protobuf>=5.29.6. Alternatively, use a dependency management tool like Poetry or pip-tools to lock the entire dependency tree.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: streamlit_airtable/requirements.txt#L5

Potential issue: The change introduces a version constraint for the `protobuf` package
(`>=5.29.6`) in `requirements.txt`. However, the direct dependencies that rely on
`protobuf`, such as `streamlit` and `transformers`, remain unpinned. This creates a
fragile dependency set. A future installation could pull newer versions of `streamlit`
or `transformers` that have a conflicting `protobuf` requirement, leading to dependency
resolution failures and preventing the application from being installed.

Did we get this right? 👍 / 👎 to inform future reviews.

zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability