From e393339cbe382de45e9a21fc27f4c54e1fbce0cf Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:00:18 +0200 Subject: [PATCH] chore: Document transformers CVE-2025-3263 is already fixed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add comment explaining transformers >=4.53.0 is already safe (CVE fixed in >=4.51.0) - Dependabot alert #35 is false positive due to missing lockfile - No version change needed - current specification is already secure Security Status: - CVE-2025-3263: Fixed in transformers >=4.51.0, current spec >=4.53.0 ✓ - CVE-2024-11393: Fixed in current version ✓ - CVE-2025-3264/3933/2099/6051: Fixed in current version ✓ Note: Without a lockfile (pip-tools/uv/poetry), Dependabot cannot determine the installed version and raises alerts based on the requirement spec alone. --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index a1d2a8c0..f5273094 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -22,6 +22,8 @@ pandas>=1.5.0 pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email) # Models +# Security: transformers >=4.51.0 fixes CVE-2025-3263 (ReDoS in get_configuration_file) +# Current spec (>=4.53.0) is already safe. Dependabot alert is false positive due to missing lockfile. torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True) transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051 (ReDoS) huggingface_hub>=0.20.0