Skip to content

[Snyk] Fix for 4 vulnerabilities #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 4 vulnerabilities #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Pillow==10.3.0
protobuf==4.23.4
sacremoses==0.1.1
scikit-learn==1.5.0
sentencepiece==0.2.0
sentencepiece==0.2.1
tqdm==4.66.4
werkzeug==3.0.2
xgboost==2.0.3
Expand Down Expand Up @@ -51,4 +51,6 @@ pyyaml==6.0.1
timm==1.0.7
torchmetrics==1.4.0
pycocotools==2.0.7
sentence-transformers==3.0.1
sentence-transformers==3.0.1
torch>=2.10.0 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version specifier for torch appears to be incorrect. Version 2.10.0 does not exist on PyPI, which will cause the installation to fail.

Based on the Snyk vulnerability details (SNYK-PYTHON-TORCH-10332644, SNYK-PYTHON-TORCH-10332645), the fix is available in versions 2.1.0 and newer. The intended requirement was likely torch>=2.1.0.

This corrected version would also be compatible with pytorch==2.3.0, which is installed via Conda in the Dockerfile.

torch>=2.1.0 # not directly required, pinned by Snyk to avoid a vulnerability

wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines 51 to +56
Copy link
Copy Markdown

@entelligence-ai-pr-reviews entelligence-ai-pr-reviews Bot Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correctness: Installation will fail: torch>=2.10.0 does not exist (latest stable is ~2.0-2.3). Replace with a real PyTorch version that addresses the Snyk vulnerability (e.g., torch>=2.0.1,<2.4.0).

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

File: requirements.txt, Lines 54-55

Problem: The dependency `torch>=2.10.0` specifies a non-existent PyTorch version (PyTorch 2.10.0 does not exist). This will cause pip installation to fail and conflicts with other dependencies like sentence-transformers, torchmetrics, and timm.

Fix Instructions:
1. Check the Snyk vulnerability report to identify the actual vulnerable PyTorch versions
2. Replace `torch>=2.10.0` with a valid version constraint that:
   - Addresses the security vulnerability
   - Is compatible with sentence-transformers==3.0.1, torchmetrics==1.4.0, and timm==1.0.7
   - Uses an existing PyTorch version (e.g., `torch>=2.0.1,<2.4.0` or similar)
3. Test the installation with `pip install -r requirements.txt` to verify compatibility
4. If uncertain about the correct version, check sentence-transformers 3.0.1 documentation for PyTorch compatibility requirements
✨ Committable Code Suggestion

💡 This is a one-click fix! Click "Commit suggestion" to apply this change directly to your branch.

Suggested change
timm==1.0.7
torchmetrics==1.4.0
pycocotools==2.0.7
sentence-transformers==3.0.1
\ No newline at end of file
sentence-transformers==3.0.1
torch>=2.10.0 # not directly required, pinned by Snyk to avoid a vulnerability
wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability
pyyaml==6.0.1
timm==1.0.7
torchmetrics==1.4.0
pycocotools==2.0.7
sentence-transformers==3.0.1
torch>=2.0.1,<2.4.0 # not directly required, pinned by Snyk to avoid a vulnerability
wheel>=0.46.2 # not directly required, pinned by Snyk to avoid a vulnerability

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version specifier for wheel appears to be incorrect. Version 0.46.2 does not exist on PyPI (the latest is 0.43.0), which will cause the installation to fail.

The Snyk vulnerability SNYK-PYTHON-WHEEL-15053866 is fixed in version 0.43.0. The requirement should be updated to wheel>=0.43.0 to resolve the issue.

wheel>=0.43.0 # not directly required, pinned by Snyk to avoid a vulnerability

Loading