fix CVE (#417)

* fix CVE

* Empty commit to trigger CI

* Empty commit message

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* This is a null commit

* This is a null commit

* This is a null commit

* update

* update

* update

* update

* update

* update

* update

Author: minmingzhu

.github/workflows/raydp.yml

@@ -84,6 +84,7 @@ jobs:
           fi
           pip install pyarrow==6.0.1 ray[train] pytest tensorflow==2.13.1 tabulate grpcio-tools wget
           pip install "xgboost_ray[default]<=0.1.13"
+          pip install "xgboost<=2.0.3"
           pip install torchmetrics
       - name: Cache Maven
         uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2

core/pom.xml

@@ -23,7 +23,7 @@
     <commons.text.version>1.10.0</commons.text.version>
     <commons.compress.version>1.26.0</commons.compress.version>
     <rhino.version>1.7.12</rhino.version>
-    <protobuf.version>3.16.3</protobuf.version>
+    <protobuf.version>3.25.5</protobuf.version>
     <ivy.version>2.5.2</ivy.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

python/setup.py

@@ -99,7 +99,7 @@ def run(self):
         "pandas >= 1.1.4",
         "psutil",
         "pyarrow >= 4.0.1, <15.0.0",
-        "ray >= 2.1.0",
+        "ray >= 2.1.0, <= 2.38.0",
         "pyspark >= 3.1.1, <=3.5.1",
         "netifaces",
         "protobuf > 3.19.5, <= 3.20.3"