Uh oh!
There was an error while loading. Please reload this page.
docs: support NVIDIA 595 and refresh documentation - #524
Conversation
Document NVIDIA 595 support while retaining the CUDA 12.x stack, pin a compatible Sphinx toolchain, repair stale links and warnings, and expand the task, robot, and workspace references.
Uh oh!
There was an error while loading. Please reload this page.
Greptile SummaryThis PR refreshes installation and API documentation, pins the Sphinx toolchain, updates NVIDIA 595 and cuRobo compatibility guidance, and corrects documentation markup and references.
Confidence Score: 3/5The PR should not merge until the documentation installation command stops trusting a plaintext package index, which currently permits dependency substitution and code execution. The newly documented setup path sends pip dependency resolution to an unauthenticated HTTP source and explicitly trusts it, exposing every developer or CI job following the guide to attacker-supplied package content. Files Needing Attention: docs/source/quick_start/docs.md
|
| Filename | Overview |
|---|---|
| docs/source/quick_start/docs.md | Adds a reproducible local documentation workflow, but its project installation command trusts a plaintext package index and enables package-substitution attacks. |
| docs/requirements.txt | Replaces broad documentation dependency requirements with exact Sphinx toolchain pins; no reachable use of the reported vulnerable transitive IDNA API was established. |
| docs/source/conf.py | Updates MyST heading anchors and switches to theme-native navigation options compatible with the pinned documentation theme. |
| docs/source/quick_start/install.md | Documents NVIDIA 595 compatibility and correctly bases cuRobo wheel selection on PyTorch's CUDA runtime rather than the host driver's advertised capability. |
| docs/source/features/workspace_analyzer/samplers.md | Expands sampler documentation and factory examples consistently with the current strategy registrations and constructor interfaces. |
| docs/source/resources/task/index.rst | Adds a detailed task and configuration catalog; no concrete broken reference was established. |
| embodichain/utils/cfg.py | Clarifies configurable decorator API documentation without changing runtime behavior. |
| embodichain/utils/img_utils.py | Expands image utility docstrings without changing implementation behavior. |
Prompt To Fix All With AI
### Issue 1
docs/source/quick_start/docs.md:10-13
**Unauthenticated package installation source**
If a developer or CI job follows this setup command over an attacker-controlled network, pip trusts dependency metadata and artifacts retrieved from the plaintext HTTP index, allowing substituted package content to execute during installation.
**How this was verified:** The documented HTTP package source flows directly into pip installation with transport authentication disabled.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "docs: update GPU compatibility and docum..." | Re-trigger Greptile
| pip install -e ".[gensim]" \ | ||
| --extra-index-url http://pyp.open3dv.site:2345/simple/ \ | ||
| --trusted-host pyp.open3dv.site \ | ||
| --extra-index-url https://download.blender.org/pypi/ |
There was a problem hiding this comment.
Unauthenticated package installation source
If a developer or CI job follows this setup command over an attacker-controlled network, pip trusts dependency metadata and artifacts retrieved from the plaintext HTTP index, allowing substituted package content to execute during installation.
How this was verified: The documented HTTP package source flows directly into pip installation with transport authentication disabled.
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/source/quick_start/docs.md
Line: 10-13
Comment:
**Unauthenticated package installation source**
If a developer or CI job follows this setup command over an attacker-controlled network, pip trusts dependency metadata and artifacts retrieved from the plaintext HTTP index, allowing substituted package content to execute during installation.
**How this was verified:** The documented HTTP package source flows directly into pip installation with transport authentication disabled.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Description
Refresh the installation guide and the broader documentation set for the current EmbodiChain codebase.
torch.version.cudainstead of the host driver's advertised CUDA level.No runtime dependency is added. Documentation build dependencies are pinned for reproducibility.
Related issue: none.
Type of change
Screenshots
Not applicable; this PR changes prose, references, and build configuration without introducing a new visual UI.
Validation
black --check --diff --color ./(914 files unchanged; Black 26.3.1)pytest -q tests/docs(12 passed)python docs/scripts/sync_readme.py --checkgit diff --check-W(API reference excluded because the localdexsim_engineruntime is unavailable)Checklist