Repository navigation
ModelGate 5.0.4 is a follow-up dependency patch. uv.lock moves filelock from 3.32.5 to 4.2.1, fixing GHSA-567q-5qvw-pf92, GHSA-9vhv-jxww-xfm5 and GHSA-v4x8-3wr5-3wq8 (rated high), the three advisories that 5.0.3 held back because their only fix is a new major version. Nothing else moved: the lockfile diff is the filelock entry and modelgate's own version, web/package-lock.json is untouched, and serving code is unchanged apart from the version that /healthz and OpenAPI report.
torch 2.14.0 is the only locked package that requires filelock, with no version bound, and modelgate's own code does not import it. The torch wheel check made for the spoofline 5.1.1 release, a scan of the Python sources in the locked torch 2.14.0 macOS wheel, found only FileLock, BaseFileLock and Timeout imported from filelock. filelock's changelog puts the 4.0.0 break in the SoftReadWriteLock on-disk protocol, with validation and fixes from 4.0.1 to 4.2.1, and 4.2.1 needs Python 3.11 or later, where modelgate runs on 3.12; SAY-5/rankfault already locks filelock 4.2.1 beside torch 2.14.0 with green CI. CI on the merge commit c8dad28 installed filelock 4.2.1 with torch 2.14.0+cpu and passed the test job (lint, 183 tests, the compose contract and the load test with a mid-run swap, 1,800 of 1,800 requests with 0 dropped) and the web job (type-check, self check and bundle).