chore(deps): bump demo_data pins to clear Dependabot alerts#69
Merged
Conversation
transformers 5.2.0 -> 5.13.1 (CVE-2026-4372 / GHSA-29pf-2h5f-8g72, RCE, patched in 5.3.0) torch 2.12.0 -> 2.13.0 (CVE-2025-3000 / GHSA-rrmf-rvhw-rf47, vulnerable range <= 2.12.0) These pins are demo/scan fixtures only and are never installed by the project, but keeping them current avoids open Dependabot alerts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the pinned versions in
demo_data/requirements.txt— the demo/scan fixture file thataisbom scan ./demo_dataparses. These dependencies are never installed by the project, but the old pins keep Dependabot alerts open on the default branch:transformers5.2.0 → 5.13.1 — clears alert chore(deps): bump typer from 0.21.1 to 0.24.0 #33 (CVE-2026-4372 / GHSA-29pf-2h5f-8g72, high, RCE, patched in 5.3.0)torch2.12.0 → 2.13.0 — clears alert chore(deps): bump transformers from 4.57.3 to 5.2.0 #31 (CVE-2025-3000 / GHSA-rrmf-rvhw-rf47, low; vulnerable range is<= 2.12.0, no official patched version listed)Why bump fixture pins at all
Dependabot alerts follow the auto-detected dependency graph and can't exclude fixture paths, so stale pins here generate a new alert for every future CVE against these packages. Current versions keep the demo identical in behavior (the scanner demos dependency extraction, not CVE matching) while eliminating the recurring alert noise on a public security-tool repo.
Verification
Ran
aisbom scan ./demo_datalocally — the generated SBOM picks uptorch 2.13.0andtransformers 5.13.1, and the mock-malware CRITICAL detection (exit code 2) still works as expected.Not addressed here
Alerts #32/#34 claim the same packages exist in
poetry.lock— they never have (verified across full git history). Those are dependency-graph mis-attributions and will be dismissed as inaccurate separately.🤖 Generated with Claude Code