From 9947ea392829fd0370a9e293af9a4b5746f2008d Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Wed, 29 Apr 2026 16:20:35 +0200 Subject: [PATCH] chore(deps): bump setuptools >=78.1.1 to fix GHSA-8g6x-3r52-4m6c --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index 08a2ecdb..3fb21d28 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -9,7 +9,7 @@ peft>=0.18.1 # Evaluation opencompass==0.5.1 -setuptools<75 # uv venv doesn't include, opencompass depends on pkg_resources +setuptools>=78.1.1 # Security fix: GHSA-8g6x-3r52-4m6c (path traversal in PackageIndex.download, arbitrary file write/RCE) # Inference acceleration (optional, TRL supports 0.10.2-0.12.0) # Security: Version >=0.14.0 fixes CVE-2026-22807 (RCE via auto_map dynamic module loading)