mirror of
https://github.com/hanzo-ml/kserve.git
synced 2026-10-30 20:53:49 +00:00
47 lines
1.7 KiB
TOML
47 lines
1.7 KiB
TOML
[project]
|
|
authors = [
|
|
{name = "The KServe Authors", email = "[email protected]"},
|
|
{name = "The KServe Authors", email = "[email protected]"},
|
|
]
|
|
license = {text = "https://github.com/kserve/kserve/blob/master/LICENSE"}
|
|
requires-python = "<3.13,>=3.10"
|
|
dependencies = [
|
|
"aiohttp<4.0.0,>=3.10.0",
|
|
"requests<3.0.0,>=2.32.2",
|
|
"google-cloud-storage<3.0.0,>=2.14.0",
|
|
"azure-storage-blob<13.0.0,>=12.20.0",
|
|
"azure-storage-file-share<13.0.0,>=12.16.0",
|
|
"azure-identity<2.0.0,>=1.15.0",
|
|
"boto3<2.0.0,>=1.29.0",
|
|
"huggingface-hub[hf-transfer]>=0.32.0",
|
|
"hf-xet>=1.5.0",
|
|
"dulwich>=0.21.0",
|
|
"cryptography>=46.0.5", # CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
|
|
# CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
|
|
# Pinning because it is a transitive dependency.
|
|
"pyjwt>=2.12.0",
|
|
# CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
|
|
# Pinning because it is a transitive dependency.
|
|
"pyasn1>=0.6.3",
|
|
# CVE-2026-21226 Azure Core is vulnerable to deserialization of untrusted data
|
|
# Pinning because it is a transitive dependency.
|
|
"azure-core>=1.38.0"
|
|
]
|
|
name = "kserve-storage"
|
|
version = "0.19.0"
|
|
readme = "README.md"
|
|
description = "KServe Storage Handler. This module is responsible to download the models from the provided source"
|
|
classifiers = [
|
|
"Intended Audience :: Developers",
|
|
"Programming Language :: Python :: 3",
|
|
"License :: OSI Approved :: Apache Software License",
|
|
"Operating System :: OS Independent",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
confidential = ["jwcrypto>=1.5.0"]
|
|
|
|
[project.scripts]
|
|
kserve-decrypt = "kserve_storage.confidential.cli:main"
|
|
|