From ef874a943f3565101ca5733f9f28f9a58f48fd84 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:58:12 +0200 Subject: [PATCH] chore: Update pydantic to 2.4.0 (CVE-2024-3772 fix) - Bump minimum version from 2.0.0 to 2.4.0 - Fixes ReDoS vulnerability via crafted email strings - Dependabot alert #24 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index ba50ca86..a88b6204 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -19,7 +19,7 @@ vllm>=0.18.0 # Security fix: CVE-2026-22778 (RCE via JPEG2000 heap overflow) + # Data processing numpy>=1.26.0 pandas>=1.5.0 -pydantic>=2.0.0 +pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email) # Models torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True)