Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support for spacy-transformers version v1.3.4 #12

Open
kashitaka opened this issue Mar 22, 2024 · 0 comments
Open

support for spacy-transformers version v1.3.4 #12

kashitaka opened this issue Mar 22, 2024 · 0 comments

Comments

@kashitaka
Copy link

Hi there, thanks for providing this package.

While using this package indirectly via ja-ginza-electra, I got a github's dependabot error that transformers version cannot be upgraded more than 4.26.0 which contains vulnerability.

According to this NVD page, transformers less than 4.36.0 has a severity 8.8 High vulnerability.

The latest version of spacy-transformers already supports transformers version up to 4.36.X, but ginza-transformers seems to support spacy-transformers up to 1.1.X (code)

So, what I expect is I need this package to support spacy-transformer v1.3.4 so that we can use transformers more than 4.36.0, which has been fixed a high severity security issue. Thanks,

For reference, here's the output of poetry show --tree command:

ja-ginza-electra 5.1.3
├── ginza-transformers >=0.4.0,<0.5.0
│   └── spacy-transformers >=1.1.2,<1.2.0 
│       └── transformers >=3.4.0,<4.26.0
ncaq added a commit to ncaq/ginza-transformers that referenced this issue Sep 20, 2024
Why
===

transformers have Critical severity vulnerability.
[transformers has a Deserialization of Untrusted Data vulnerability · CVE-2023-6730 · GitHub Advisory Database](GHSA-3863-2447-669p)
It is patched in `transformers v4.36.0`.
`spacy-transformers v1.3.4` use `transformers v4.36.0`.
[Release v1.3.4 · explosion/spacy-transformers](https://github.com/explosion/spacy-transformers/releases/tag/v1.3.4)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant