From 66b237bf4035b556c44d31f047a5392be6d9345e Mon Sep 17 00:00:00 2001 From: Yoav Katz Date: Sun, 20 Sep 2026 10:08:33 +0300 Subject: [PATCH] fix: upgrade vulnerable deps in TORR benchmark requirements Remediates the Dependabot alerts tracked in #1978. All three alerted packages were pinned to vulnerable versions in the ToRR benchmark requirements file, the only manifest in the repo that still pinned them below the patched releases: - scikit-learn 1.2.0 -> >=1.5.0 (CVE-2024-5206, medium) Sensitive data leakage in TfidfVectorizer.stop_words_ - py7zr 0.20.6 -> >=1.1.3 (CVE-2026-23879 high, CVE-2026-55195, CVE-2026-55206 medium) arbitrary file write, decompression bomb DoS, and quadratic complexity DoS in PackInfo._read() - accelerate 0.34.2 -> >=1.15.0 (CVE-2026-69112, medium) CVE-2026-69112 has no patched release upstream; 1.15.0 is the latest available, and unitxt does not call the affected load_checkpoint_and_dispatch path directly, reaching accelerate only via transformers device_map. Bumping keeps the pin off the flagged 0.34.2 and picks the fix up automatically once released. Lower bounds are used instead of exact pins so future security patches are picked up without another manual bump, consistent with the style adopted for torch/transformers/protobuf in #1968. Verified the full requirements set still resolves with `uv pip compile --python-version 3.10`, yielding scikit-learn 1.7.2, py7zr 1.1.3 and accelerate 1.15.0 with no conflicts. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Yoav Katz --- prepare/benchmarks/torr/requirements.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/prepare/benchmarks/torr/requirements.txt b/prepare/benchmarks/torr/requirements.txt index ddf538a6a4..3cc4b47531 100644 --- a/prepare/benchmarks/torr/requirements.txt +++ b/prepare/benchmarks/torr/requirements.txt @@ -1,7 +1,7 @@ torch>=2.10.0 transformers>=4.53.0,<5.0.0 datasets==2.21.0 -scikit-learn==1.2.0 +scikit-learn>=1.5.0 scipy==1.15.2 sentence-transformers==3.0.1 evaluate==0.4.0 @@ -12,10 +12,10 @@ seaborn==0.13.0 protobuf>=5.29.6 rouge-score==0.1.2 sacrebleu[ko,ja]==2.3.1 -py7zr==0.20.6 +py7zr>=1.1.3 logzero==1.7.0 einops==0.7.0 -accelerate==0.34.2 +accelerate>=1.15.0 retry==0.9.2 ibm-watsonx-ai==1.3.0 requests>=2.32.4