From c1243da802cac5c4d8d08012faa8ca30f34c1712 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:51:31 +0200 Subject: [PATCH] chore: Update torch to 2.6.0 (CVE-2025-32434, CVE-2024-31580 fix) - Bump minimum version from 2.0.0 to 2.6.0 - Fixes CVE-2025-32434: RCE vulnerability in torch.load with weights_only=True - Fixes CVE-2024-31580: Heap buffer overflow (DoS) in vararg_functions.cpp - Dependabot alerts #40 and #26 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index 683ebb00..bff0fe34 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -12,7 +12,7 @@ opencompass==0.5.1 setuptools<75 # uv venv 不自带, opencompass 依赖 pkg_resources # 推理加速（可选，TRL 支持 0.10.2-0.12.0） -vllm>=0.12.0 +vllm>=0.18.0 # Security fix: CVE-2026-27893 (Hardcoded trust_remote_code RCE) # 数据处理 numpy>=1.26.0