BentoML

Hi! Are you all aware that BentoML v1.1.11 has a critical security vulnerability? <https://nvd.nist.gov/vuln/detail/CVE-2024-2912> <https://security.snyk.io/vuln/SNYK-PYTHON-BENTOML-6615826> The recommendation from that second link is to "upgrade `bentoml` to version 1.2.5 or higher", but you as know, I'm unable to upgrade to 1.2+ due to the incompatibility with yatai. Do you have any recommendations for how to address this?

Fyi, I was able to reproduce this vulnerability locally. I can see it in 1.2.4, but not in 1.2.15, and _also not in 1.1.11_. So my original statement may have been incorrect, it looks to me like 1.1.11 is not affected.

That’s right, 1.1.x versions are not affected, pickle protocol was an optimization meant to be used only for internal service rpcs but accidentally exposed in external APIs in the initial 1.2 releases.