From 6da50c1bb2a05259e15413ca132564064680d2c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 12 Jul 2026 12:35:59 -0700 Subject: [PATCH 1/2] python3Packages.bentoml: mark insecure (cherry picked from commit d634535db18fdab6b85e768e3c3b7db247d6a53f) --- pkgs/development/python-modules/bentoml/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix index 99703c943757..07dab66f838d 100644 --- a/pkgs/development/python-modules/bentoml/default.nix +++ b/pkgs/development/python-modules/bentoml/default.nix @@ -248,6 +248,14 @@ buildPythonPackage { description = "Build Production-Grade AI Applications"; homepage = "https://github.com/bentoml/BentoML"; changelog = "https://github.com/bentoml/BentoML/releases/tag/${src.tag}"; + knownVulnerabilities = [ + "CVE-2026-27905" + "CVE-2026-33744" + "CVE-2026-35043" + "CVE-2026-35044" + "CVE-2026-44345" + "CVE-2026-44346" + ]; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ happysalada From f3c5338d8812ed80e1dacc0e7447d94b696a85f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 12 Jul 2026 12:57:02 -0700 Subject: [PATCH 2/2] openllm: mark insecure (cherry picked from commit 895f7deddc7515f5c094c8af312a274e3f90e570) --- pkgs/by-name/op/openllm/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/op/openllm/package.nix b/pkgs/by-name/op/openllm/package.nix index d197e40c8dd3..321e25db6daa 100644 --- a/pkgs/by-name/op/openllm/package.nix +++ b/pkgs/by-name/op/openllm/package.nix @@ -64,6 +64,9 @@ python3Packages.buildPythonApplication (finalAttrs: { description = "Run any open-source LLMs, such as Llama 3.1, Gemma, as OpenAI compatible API endpoint in the cloud"; homepage = "https://github.com/bentoml/OpenLLM"; changelog = "https://github.com/bentoml/OpenLLM/releases/tag/${finalAttrs.src.tag}"; + knownVulnerabilities = [ + "CVE-2026-15035" + ]; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ happysalada