From eec2a86b1ed7d76b89f7afe25594acd9b0dd88a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20P=C3=A9rez=20de=20Algaba?= <124347725+jperezdealgaba@users.noreply.github.com> Date: Wed, 30 Sep 2026 01:00:36 +0200 Subject: [PATCH] [Security] Bump nltk, aiohttp, pillow, and datamodel-code-generator (#59249) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Juan Pérez de Algaba Co-authored-by: Cursor --- requirements/common.txt | 4 ++-- requirements/test/cpu.txt | 16 ++++++++++------ requirements/test/cuda.in | 3 ++- requirements/test/cuda.txt | 17 +++++++++++------ requirements/test/nightly-torch.txt | 2 +- requirements/test/rocm.in | 3 ++- requirements/test/rocm.txt | 16 +++++++++++----- requirements/test/xpu.in | 1 + requirements/test/xpu.txt | 5 ++++- 9 files changed, 44 insertions(+), 23 deletions(-) diff --git a/requirements/common.txt b/requirements/common.txt index 1958173fd7..669efc4900 100644 --- a/requirements/common.txt +++ b/requirements/common.txt @@ -15,11 +15,11 @@ protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33 protobuf == 7.36.1; platform_machine == "s390x" fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides. starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1 -aiohttp >= 3.13.3 +aiohttp >= 3.14.3 openai >= 2.25.0 # For Responses API with namespace tools pydantic >= 2.12.0 prometheus_client >= 0.18.0 -pillow # Required for image processing +pillow >= 12.3.0 # Required for image processing prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0 tiktoken >= 0.6.0 # Required for DBRX tokenizer lm-format-enforcer == 0.11.3 diff --git a/requirements/test/cpu.txt b/requirements/test/cpu.txt index e8dd282121..df685200f3 100644 --- a/requirements/test/cpu.txt +++ b/requirements/test/cpu.txt @@ -8,7 +8,7 @@ accelerate==1.13.0 # via peft aiohappyeyeballs==2.6.1 # via aiohttp -aiohttp==3.13.3 +aiohttp==3.14.3 # via # -r requirements/test/../common.txt # aiohttp-cors @@ -157,7 +157,7 @@ cupy-cuda12x==13.6.0 # via ray cycler==0.12.1 # via matplotlib -datamodel-code-generator==0.26.3 +datamodel-code-generator==0.79.0 # via -r requirements/test/cuda.in dataproperty==1.0.1 # via @@ -173,6 +173,8 @@ decorator==5.1.1 # via librosa decord==0.6.0 # via -r requirements/test/cuda.in +defusedxml==0.7.1 + # via nltk depyf==0.20.0 # via -r requirements/test/../common.txt detect-installer==0.1.0 @@ -533,8 +535,10 @@ networkx==3.2.1 # torch ninja==1.13.0 # via -r requirements/test/../common.txt -nltk==3.9.1 - # via rouge-score +nltk==3.10.3 + # via + # -r requirements/test/cuda.in + # rouge-score num2words==0.5.14 # via -r requirements/test/cuda.in numba==0.65.0 @@ -655,7 +659,6 @@ packaging==24.2 # via # accelerate # black - # datamodel-code-generator # datasets # evaluate # fastparquet @@ -696,7 +699,7 @@ perceptron==0.1.4 # via -r requirements/test/cuda.in perf-analyzer==0.1.0 # via genai-perf -pillow==10.4.0 +pillow==12.3.0 # via # -r requirements/test/../common.txt # genai-perf @@ -1231,6 +1234,7 @@ types-requests==2.33.0.20260712 typing-extensions==4.15.0 # via # -r requirements/test/../common.txt + # aiohttp # aiosignal # albumentations # alembic diff --git a/requirements/test/cuda.in b/requirements/test/cuda.in index 271cdba155..87d67fa9ff 100644 --- a/requirements/test/cuda.in +++ b/requirements/test/cuda.in @@ -36,7 +36,8 @@ matplotlib # required for qwen-vl test mistral_common[image,audio] >= 1.11.6 # required for voxtral test num2words # required for smolvlm test open_clip_torch==2.32.0 # Required for nemotron_vl test, Nemotron Parse in test_common.py -datamodel_code_generator # required for minicpm3 test +datamodel_code_generator>=0.64.0 # required for minicpm3 test +nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs lm-eval[api]>=0.4.12 # required for model evaluation test mteb[bm25s]>=2, <3 # required for mteb test transformers==5.17.0 diff --git a/requirements/test/cuda.txt b/requirements/test/cuda.txt index b7711a10cf..a3ff938b55 100644 --- a/requirements/test/cuda.txt +++ b/requirements/test/cuda.txt @@ -8,7 +8,7 @@ accelerate==1.13.0 # via peft aiohappyeyeballs==2.6.1 # via aiohttp -aiohttp==3.13.3 +aiohttp==3.14.3 # via # -c requirements/common.txt # -r requirements/test/../common.txt @@ -170,7 +170,7 @@ cupy-cuda12x==13.6.0 # via ray cycler==0.12.1 # via matplotlib -datamodel-code-generator==0.26.3 +datamodel-code-generator==0.79.0 # via -r requirements/test/cuda.in dataproperty==1.0.1 # via @@ -186,6 +186,8 @@ decorator==5.1.1 # via librosa decord==0.6.0 # via -r requirements/test/cuda.in +defusedxml==0.7.1 + # via nltk depyf==0.20.0 # via # -c requirements/common.txt @@ -567,8 +569,10 @@ networkx==3.2.1 # torch ninja==1.13.0 # via -r requirements/test/../common.txt -nltk==3.9.1 - # via rouge-score +nltk==3.10.3 + # via + # -r requirements/test/cuda.in + # rouge-score num2words==0.5.14 # via -r requirements/test/cuda.in numba==0.65.0 @@ -743,7 +747,6 @@ packaging==24.2 # via # accelerate # black - # datamodel-code-generator # datasets # evaluate # fastparquet @@ -784,8 +787,9 @@ perceptron==0.1.4 # via -r requirements/test/cuda.in perf-analyzer==0.1.0 # via genai-perf -pillow==10.4.0 +pillow==12.3.0 # via + # -c requirements/common.txt # -r requirements/test/../common.txt # genai-perf # imagehash @@ -1341,6 +1345,7 @@ typing-extensions==4.15.0 # via # -c requirements/common.txt # -r requirements/test/../common.txt + # aiohttp # aiosignal # albumentations # alembic diff --git a/requirements/test/nightly-torch.txt b/requirements/test/nightly-torch.txt index cebf3b782b..256683967e 100644 --- a/requirements/test/nightly-torch.txt +++ b/requirements/test/nightly-torch.txt @@ -26,7 +26,7 @@ matplotlib # required for qwen-vl test mistral_common[image,audio] >= 1.11.6 # required for voxtral test num2words # required for smolvlm test opencv-python-headless >= 4.13.0 # required for video test -datamodel_code_generator # required for minicpm3 test +datamodel_code_generator>=0.64.0 # required for minicpm3 test lm-eval[api]>=0.4.12 # required for model evaluation test mteb[bm25s]>=2, <3 # required for mteb test transformers==5.17.0 diff --git a/requirements/test/rocm.in b/requirements/test/rocm.in index ffe72643aa..42c2b38d0f 100644 --- a/requirements/test/rocm.in +++ b/requirements/test/rocm.in @@ -32,7 +32,8 @@ matplotlib # required for qwen-vl test mistral_common[image,audio]>=1.11.6 # required for voxtral test num2words # required for smolvlm test open_clip_torch==2.32.0 # Required for nemotron_vl test, Nemotron Parse in test_common.py -datamodel_code_generator # required for minicpm3 test +datamodel_code_generator>=0.64.0 # required for minicpm3 test +nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs lm-eval[api]>=0.4.12 # required for model evaluation test mteb[bm25s]>=2, <3 # required for mteb test transformers==5.17.0 diff --git a/requirements/test/rocm.txt b/requirements/test/rocm.txt index 3581e5fea9..41234d29fd 100644 --- a/requirements/test/rocm.txt +++ b/requirements/test/rocm.txt @@ -6,7 +6,7 @@ accelerate==1.13.0 # via peft aiohappyeyeballs==2.6.1 # via aiohttp -aiohttp==3.13.3 +aiohttp==3.14.3 # via # -c requirements/common.txt # -r requirements/test/../common.txt @@ -165,7 +165,7 @@ cryptography==46.0.0 # pyjwt cycler==0.12.1 # via matplotlib -datamodel-code-generator==0.55.0 +datamodel-code-generator==0.79.0 # via -r requirements/test/rocm.in dataproperty==1.1.0 # via @@ -181,6 +181,8 @@ decorator==5.2.1 # via librosa decord==0.6.0 # via -r requirements/test/rocm.in +defusedxml==0.7.1 + # via nltk depyf==0.20.0 # via # -c requirements/common.txt @@ -569,8 +571,10 @@ networkx==3.6.1 # torch ninja==1.13.0 # via -r requirements/test/../common.txt -nltk==3.9.3 - # via rouge-score +nltk==3.10.3 + # via + # -r requirements/test/rocm.in + # rouge-score num2words==0.5.14 # via -r requirements/test/rocm.in numba==0.65.0 @@ -758,8 +762,9 @@ perceptron==0.1.4 # via -r requirements/test/rocm.in perf-analyzer==0.1.0 # via genai-perf -pillow==12.1.1 +pillow==12.3.0 # via + # -c requirements/common.txt # -r requirements/test/../common.txt # genai-perf # imagehash @@ -1291,6 +1296,7 @@ typing-extensions==4.15.0 # via # -c requirements/common.txt # -r requirements/test/../common.txt + # aiohttp # aiosignal # albumentations # alembic diff --git a/requirements/test/xpu.in b/requirements/test/xpu.in index 08a81cd20d..a5e7470d6d 100644 --- a/requirements/test/xpu.in +++ b/requirements/test/xpu.in @@ -16,6 +16,7 @@ absl-py accelerate arctic-inference lm_eval[api]>=0.4.12 +nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs modelscope<1.38 runai-model-streamer[s3,gcs,azure]>=0.15.7 tensorizer==2.10.1 diff --git a/requirements/test/xpu.txt b/requirements/test/xpu.txt index 2bcd3664c1..b2a6eb6da1 100644 --- a/requirements/test/xpu.txt +++ b/requirements/test/xpu.txt @@ -515,7 +515,9 @@ networkx==3.6.1 ninja==1.13.0 # via -r requirements/test/../common.txt nltk==3.10.3 - # via rouge-score + # via + # -r requirements/test/xpu.in + # rouge-score num2words==0.5.14 # via -r requirements/test/xpu.in numba==0.65.0 @@ -671,6 +673,7 @@ pathvalidate==3.3.1 # via pytablewriter pillow==12.3.0 # via + # -c requirements/common.txt # -r requirements/test/../common.txt # matplotlib # mistral-common