Skip to content

Security/fuyu#41320

Merged
molbap merged 1 commit intomainfrom
fuyu_security
Oct 3, 2025
Merged

Security/fuyu#41320
molbap merged 1 commit intomainfrom
fuyu_security

Conversation

@molbap
Copy link
Copy Markdown
Contributor

@molbap molbap commented Oct 3, 2025

What does this PR do?

Remove a reference to a compromised github repo.

For reference, all conversion scripts are excluded from releases.

def remove_conversion_scripts():
"""
Delete the scripts that convert models from older, unsupported formats. We don't want to include these
in release wheels because they often have to open insecure file types (pickle, Torch .bin models). This results in
vulnerability scanners flagging us and can cause compliance issues for users with strict security policies.
"""
model_dir = Path(PATH_TO_MODELS)
for conversion_script in list(model_dir.glob("**/convert*.py")):
conversion_script.unlink()

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Oct 3, 2025

[For maintainers] Suggested jobs to run (before merge)

run-slow: fuyu

Copy link
Copy Markdown
Collaborator

@ydshieh ydshieh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@molbap molbap enabled auto-merge (squash) October 3, 2025 14:09
@molbap molbap merged commit 5abfa43 into main Oct 3, 2025
17 checks passed
@molbap molbap deleted the fuyu_security branch October 3, 2025 14:13
@HuggingFaceDocBuilderDev
Copy link
Copy Markdown

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

yuchenxie4645 pushed a commit to yuchenxie4645/transformers that referenced this pull request Oct 4, 2025
remove reference to compromised repo
AhnJoonSung pushed a commit to AhnJoonSung/transformers that referenced this pull request Oct 12, 2025
remove reference to compromised repo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants