From e25da63862e190afbae0b42d5887d1328f69a9a4 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:51:13 +0200 Subject: [PATCH] chore: Update torch to 2.6.0 (CVE-2025-32434 fix) - Bump minimum version from 2.0.0 to 2.6.0 - Fixes RCE vulnerability in torch.load with weights_only=True - Dependabot alert #40 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index 812aebb4..683ebb00 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -20,7 +20,7 @@ pandas>=1.5.0 pydantic>=2.0.0 # 模型 -torch>=2.0.0 +torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True) transformers>=4.48.0 # Security fix: CVE-2024-11393 (Deserialization RCE) huggingface_hub>=0.20.0