You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While using this package indirectly via ja-ginza-electra, I got a github's dependabot error that transformers version cannot be upgraded more than 4.26.0 which contains vulnerability.
According to this NVD page, transformers less than 4.36.0 has a severity 8.8 High vulnerability.
The latest version of spacy-transformers already supports transformers version up to 4.36.X, but ginza-transformers seems to support spacy-transformers up to 1.1.X (code)
So, what I expect is I need this package to support spacy-transformer v1.3.4 so that we can use transformers more than 4.36.0, which has been fixed a high severity security issue. Thanks,
For reference, here's the output of poetry show --tree command:
Why
===
transformers have Critical severity vulnerability.
[transformers has a Deserialization of Untrusted Data vulnerability · CVE-2023-6730 · GitHub Advisory Database](GHSA-3863-2447-669p)
It is patched in `transformers v4.36.0`.
`spacy-transformers v1.3.4` use `transformers v4.36.0`.
[Release v1.3.4 · explosion/spacy-transformers](https://github.com/explosion/spacy-transformers/releases/tag/v1.3.4)
Hi there, thanks for providing this package.
While using this package indirectly via
ja-ginza-electra
, I got a github's dependabot error thattransformers
version cannot be upgraded more than 4.26.0 which contains vulnerability.According to this NVD page, transformers less than 4.36.0 has a severity 8.8 High vulnerability.
The latest version of
spacy-transformers
already supportstransformers
version up to 4.36.X, butginza-transformers
seems to supportspacy-transformers
up to 1.1.X (code)So, what I expect is I need this package to support
spacy-transformer
v1.3.4 so that we can usetransformers
more than 4.36.0, which has been fixed a high severity security issue. Thanks,For reference, here's the output of
poetry show --tree
command:The text was updated successfully, but these errors were encountered: