# AutoRL-Bench Dependencies
# conda environment: Python 3.10

# RL Training (core)
trl>=0.27.0
accelerate>=1.0.0
datasets>=3.0.0
peft>=0.18.1

# Evaluation
opencompass==0.5.1
setuptools<75  # uv venv doesn't include, opencompass depends on pkg_resources

# Inference acceleration (optional, TRL supports 0.10.2-0.12.0)
# Security: Version >=0.14.0 fixes CVE-2026-22807 (RCE via auto_map dynamic module loading)
# Current spec (>=0.18.0) is already safe. Dependabot alert is false positive due to missing lockfile.
vllm>=0.18.0  # Security fix: CVE-2026-22778 (RCE via JPEG2000 heap overflow) + CVE-2026-27893

# Data processing
numpy>=1.26.0
pandas>=1.5.0
pydantic>=2.4.0  # Security fix: CVE-2024-3772 (ReDoS via crafted email)

# Models
# Security: transformers >=4.51.0 fixes CVE-2025-3263 (ReDoS in get_configuration_file)
# Security: transformers >=4.50.0 fixes CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer)
# Security: transformers >=4.52.1 fixes CVE-2025-3777 (URL validation bypass via username injection)
# Current spec (>=4.53.0) is already safe. Dependabot alerts are false positives due to missing lockfile.
# Security: torch >=2.7.1 fixes CVE-2025-2953 (DoS in mkldnn_max_pool2d) - current spec >=2.8.0 is safe
torch>=2.8.0  # Security fix: CVE-2025-32434 (torch.load RCE), CVE-2025-3730 (DoS in ctc_loss), CVE-2025-2953 (DoS in mkldnn_max_pool2d)
transformers>=4.53.0  # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051/1194/6638 (ReDoS), CVE-2025-3777 (URL validation)
huggingface_hub>=0.20.0

# Web services
flask
flask-cors

# Tools
loguru
requests
pyyaml
