From 46720b30b62b6483a3d9ae14b73ff213d76c157c Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 2 Apr 2026 22:50:10 +0200
Subject: [PATCH] chore: Update transformers to 4.48.0 (CVE-2024-11393 fix)

- Bump minimum version from 4.40.0 to 4.48.0
- Fixes Deserialization of Untrusted Data RCE vulnerability
- Dependabot alert #29
---
 rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt
index 15b8b9f5..812aebb4 100644
--- a/rdagent/scenarios/rl/autorl_bench/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt
@@ -21,7 +21,7 @@ pydantic>=2.0.0
 
 # 模型
 torch>=2.0.0
-transformers>=4.40.0
+transformers>=4.48.0  # Security fix: CVE-2024-11393 (Deserialization RCE)
 huggingface_hub>=0.20.0
 
 # Web 服务