IBM / unitxt / 37196919318

78%

push

github

fix: upgrade vulnerable dependencies in TORR benchmark requirements (#1979)

fix: upgrade vulnerable deps in TORR benchmark requirements

Remediates the Dependabot alerts tracked in #1978. All three alerted
packages were pinned to vulnerable versions in the ToRR benchmark
requirements file, the only manifest in the repo that still pinned them
below the patched releases:

- scikit-learn 1.2.0 -> >=1.5.0 (CVE-2024-5206, medium)
  Sensitive data leakage in TfidfVectorizer.stop_words_
- py7zr 0.20.6 -> >=1.1.3 (CVE-2026-23879 high, CVE-2026-55195,
  CVE-2026-55206 medium) arbitrary file write, decompression bomb DoS,
  and quadratic complexity DoS in PackInfo._read()
- accelerate 0.34.2 -> >=1.15.0 (CVE-2026-69112, medium)

CVE-2026-69112 has no patched release upstream; 1.15.0 is the latest
available, and unitxt does not call the affected
load_checkpoint_and_dispatch path directly, reaching accelerate only
via transformers device_map. Bumping keeps the pin off the flagged
0.34.2 and picks the fix up automatically once released.

Lower bounds are used instead of exact pins so future security patches
are picked up without another manual bump, consistent with the style
adopted for torch/transformers/protobuf in #1968.

Verified the full requirements set still resolves with
`uv pip compile --python-version 3.10`, yielding scikit-learn 1.7.2,
py7zr 1.1.3 and accelerate 1.15.0 with no conflicts.

Signed-off-by: Yoav Katz <katz@il.ibm.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2785 of 4018 branches covered (69.31%)

Branch coverage included in aggregate %.

10974 of 13550 relevant lines covered (80.99%)

0.81 hits per line