chore: detached mode for serve (#46) * chore: detached mode for serve * fix

[jiaoew1991]

No description provided.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​axios@​1.13.5
	pypi/​ray@​2.48.0
	maven/​com.fasterxml.jackson.core/​jackson-annotations@​2.13.5
	maven/​com.fasterxml.jackson.core/​jackson-core@​2.13.5
	maven/​com.fasterxml.jackson.core/​jackson-databind@​2.13.5
	maven/​com.google.code.gson/​gson@​2.10.1
	maven/​com.google.protobuf/​protobuf-java@​4.27.1
	maven/​io.grpc/​grpc-services@​1.56.0
	maven/​io.ray/​ray-runtime@​2.47.0
	maven/​net.sf.py4j/​py4j@​0.10.9.2
	maven/​org.apache.commons/​commons-compress@​1.26.0
	maven/​org.apache.commons/​commons-lang3@​3.9
	maven/​io.grpc/​grpc-netty@​1.56.0
	maven/​org.xerial.snappy/​snappy-java@​1.1.10.4
	maven/​org.apache.ivy/​ivy@​2.5.2
	cargo/​tokio@​1.49.0
	maven/​javax.annotation/​javax.annotation-api@​1.3.2
	pypi/​setuptools@​80.10.2
	pypi/​setuptools@​82.0.0
	pypi/​psycopg@​3.3.2
	pypi/​grpcio@​1.78.0
	pypi/​grpcio@​1.76.0
	pypi/​grpcio@​1.80.0
	pypi/​pyspark@​3.5.6
	pypi/​pyspark@​4.1.1
	pypi/​pytest-rerunfailures@​16.4
	pypi/​pytest-rerunfailures@​16.1
	pypi/​ray@​2.54.0
	maven/​com.fasterxml.jackson.module/​jackson-module-jaxb-annotations@​2.13.5
	cargo/​object_store@​0.11.2
	npm/​react-router-dom@​6.30.3
	npm/​@​types/​react-dom@​18.3.7
	pypi/​pandas@​2.3.3
See 96 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Ray's New Token Authentication is Disabled By Default CVE: GHSA-gx77-xgc2-4888 Ray's New Token Authentication is Disabled By Default (CRITICAL) Affected versions: <= 2.52.0 Patched version: No patched versions From: engine/pyproject.toml → pypi/ray@2.48.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/ray@2.48.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE: GHSA-q279-jhrf-cc6v Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack (CRITICAL) Affected versions: < 2.52.0 Patched version: 2.52.0 From: engine/pyproject.toml → pypi/ray@2.48.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/ray@2.48.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Ray has arbitrary code execution via jobs submission API CVE: GHSA-6wgj-66m2-xxp2 Ray has arbitrary code execution via jobs submission API (CRITICAL) Affected versions: <= 2.49.2 Patched version: No patched versions From: engine/pyproject.toml → pypi/ray@2.48.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/ray@2.48.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/anvil-rs/Cargo.lock → cargo/tokio@1.49.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.49.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/url@2.5.8 → cargo/writeable@0.6.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.google.guava:guava is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/com.google.guava/guava@31.1-android ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.guava/guava@31.1-android. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.google.guava:guava is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/com.google.guava/guava@31.1-android ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.guava/guava@31.1-android. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.google.protobuf:protobuf-java is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/raydp/java/raydp-main/pom.xml → maven/com.google.protobuf/protobuf-java@4.27.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.google.protobuf/protobuf-java@4.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven commons-io:commons-io is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/commons-io/commons-io@2.15.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/commons-io/commons-io@2.15.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/io.netty/netty-codec@4.1.87.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.87.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/io.netty/netty-codec@4.1.87.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.87.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/io.netty/netty-codec@4.1.87.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.87.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/io.netty/netty-codec@4.1.87.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.87.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.netty/netty-codec@4.1.94.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.94.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.netty/netty-codec@4.1.94.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.94.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-codec is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.netty/netty-codec@4.1.94.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-codec@4.1.94.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven io.netty:netty-common is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.grpc/grpc-netty@1.56.0 → maven/io.netty/netty-common@4.1.87.Final ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/io.netty/netty-common@4.1.87.Final. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven net.java.dev.jna:jna is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.ray/ray-runtime@2.47.0 → maven/net.java.dev.jna/jna@5.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/net.java.dev.jna/jna@5.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.apache.commons:commons-text is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/raydp/java/raydp-main/pom.xml → maven/org.apache.commons/commons-text@1.10.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.commons/commons-text@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.apache.logging.log4j:log4j-api is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/io.ray/ray-api@2.47.0 → maven/org.apache.logging.log4j/log4j-api@2.17.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.logging.log4j/log4j-api@2.17.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.xerial.snappy:snappy-java is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: lib/raydp/java/raydp-main/pom.xml → maven/org.xerial.snappy/snappy-java@1.1.10.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.xerial.snappy/snappy-java@1.1.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm es-module-lexer is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/_internal/webui/frontend/package-lock.json → npm/@ant-design/charts@2.6.7 → npm/es-module-lexer@2.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm es-module-lexer is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/_internal/webui/frontend/package-lock.json → npm/@ant-design/charts@2.6.7 → npm/es-module-lexer@2.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm gl-matrix is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/_internal/webui/frontend/package-lock.json → npm/@ant-design/charts@2.6.7 → npm/gl-matrix@3.4.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/gl-matrix@3.4.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/_internal/webui/frontend/package-lock.json → npm/@ant-design/charts@2.6.7 → npm/webpack@5.105.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.105.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi fastapi is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/pyproject.toml → pypi/fastapi@0.128.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/fastapi@0.128.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi fastapi is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: engine/pyproject.toml → pypi/fastapi@0.128.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/fastapi@0.128.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 742 more rows in the dashboard

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 14 total unresolved issues (including 13 from previous reviews).

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Shutdown kills registry handle
  • Added registry recreation after shutdown in detached mode to prevent stale handle when manager is reconnected.

Or push these changes by commenting:

@cursor push 26ddc617ca

Preview (26ddc617ca)

diff --git a/engine/_internal/serve/manager.py b/engine/_internal/serve/manager.py
--- a/engine/_internal/serve/manager.py
+++ b/engine/_internal/serve/manager.py
@@ -468,7 +468,18 @@
         except Exception as e:
             logger.warning(f"Error killing registry: {e}")
 
+        # In detached mode, recreate registry so manager remains functional if reconnected
         if self._detached:
+            actor_options: dict[str, Any] = {
+                "name": REGISTRY_ACTOR_NAME,
+                "lifetime": "detached",
+                "namespace": SERVE_NAMESPACE,
+            }
+            self._registry = ray.remote(ModelRegistry).options(**actor_options).remote()  # type: ignore[assignment]
+            ray.get(self._registry.start.remote())  # type: ignore[union-attr]
+            logger.info("ModelRegistry recreated for detached mode")
+
+        if self._detached:
             killed = 0
             for actor_info in ray.util.list_named_actors(all_namespaces=True):
                 if actor_info.get("namespace") != SERVE_NAMESPACE:

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit d37852c. Configure here.}

[cursor]

Shutdown kills registry handle

High Severity

In detached mode, shutdown() calls ray.kill on the ModelRegistry actor but keeps the detached ModelServiceManager alive (the orphan sweep explicitly skips MANAGER_ACTOR_NAME). The manager still holds the old registry handle, so a later ModelServiceManager.connect() followed by deploy_model or worker spawn talks to a dead registry and inference deployment breaks after teardown.

 

^{Reviewed by Cursor Bugbot for commit d37852c. Configure here.}