diff --git a/pyproject.toml b/pyproject.toml index 2e3b915af..5222118ec 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -22,12 +22,12 @@ conflicts = [ # CVE floors for transitive deps we don't declare directly. click is pulled in # via transformers -> typer; 8.3.2 carries PYSEC-2026-2132 (fixed in 8.3.3). # setuptools is pulled in via pbr/torch; 82.0.1 carries PYSEC-2026-3447 (fixed -# in 83.0.0). +# in 83.0.0) and 83.0.0 carries GHSA-xmj3-9gf7-h52w (fixed in 84.1.0). # fsspec (datasets) and multidict (aiohttp) require fixes for CVE-2026-104851 # and CVE-2026-104874, respectively. constraint-dependencies = [ "click>=8.3.3", - "setuptools>=83.0.0", + "setuptools>=84.1.0", "fsspec>=2026.6.0", "multidict>=6.9.1", ] @@ -138,9 +138,10 @@ dev = [ # every resolution fork. Because bfcl conflicts with this extra (see # [tool.uv].conflicts), these floors force uv to fork filelock/virtualenv: # patched here, pinned only inside the bfcl fork. Closes CVE-2025-68146 / - # CVE-2026-22701 (filelock) and CVE-2026-22702 (virtualenv). - "filelock>=3.20.3", - "virtualenv==21.14.9", + # CVE-2026-22701 / CVE-2026-112907 / CVE-2026-112913 / CVE-2026-112940 + # (filelock) and CVE-2026-22702 / CVE-2026-113713 (virtualenv). + "filelock>=4.2.1", + "virtualenv==21.14.10", # pip is pulled in transitively (pip-audit -> pip-api -> pip); force past # PYSEC-2026-3721 (fixed in 26.2), which otherwise fails `uv run pip-audit`. "pip==26.2", diff --git a/uv.lock b/uv.lock index 644e69c55..a2f3d265a 100644 --- a/uv.lock +++ b/uv.lock @@ -53,7 +53,7 @@ constraints = [ { name = "click", specifier = ">=8.3.3" }, { name = "fsspec", specifier = ">=2026.6.0" }, { name = "multidict", specifier = ">=6.9.1" }, - { name = "setuptools", specifier = ">=83.0.0" }, + { name = "setuptools", specifier = ">=84.1.0" }, ] [[package]] @@ -378,7 +378,7 @@ wheels = [ [package.optional-dependencies] filecache = [ - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" } }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" } }, ] [[package]] @@ -731,7 +731,7 @@ source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "dill" }, { name = "filelock", version = "3.20.0", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-bfcl'" }, - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-dev' or extra == 'extra-18-inference-endpoint-performance' or extra == 'extra-18-inference-endpoint-test' or extra != 'extra-18-inference-endpoint-bfcl'" }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-dev' or extra == 'extra-18-inference-endpoint-performance' or extra == 'extra-18-inference-endpoint-test' or extra != 'extra-18-inference-endpoint-bfcl'" }, { name = "fsspec", extra = ["http"] }, { name = "httpx" }, { name = "huggingface-hub" }, @@ -981,7 +981,7 @@ wheels = [ [[package]] name = "filelock" -version = "3.25.2" +version = "4.2.4" source = { registry = "https://pypi.org/simple" } resolution-markers = [ "python_full_version >= '3.14' and platform_machine == 'x86_64' and sys_platform == 'linux'", @@ -993,9 +993,9 @@ resolution-markers = [ "python_full_version < '3.14' and platform_machine == 'x86_64' and sys_platform == 'darwin'", "python_full_version < '3.14' and platform_machine == 'arm64' and sys_platform == 'darwin'", ] -sdist = { url = "https://files.pythonhosted.org/packages/94/b8/00651a0f559862f3bb7d6f7477b192afe3f583cc5e26403b44e59a55ab34/filelock-3.25.2.tar.gz", hash = "sha256:b64ece2b38f4ca29dd3e810287aa8c48182bbecd1ae6e9ae126c9b35f1382694", size = 40480, upload-time = "2026-03-11T20:45:38.487Z" } +sdist = { url = "https://files.pythonhosted.org/packages/d8/28/3893324bcadf8f89b1616637468d766af3f625008c0735bf704fdfa86617/filelock-4.2.4.tar.gz", hash = "sha256:c6d8663535e1650ee430507b4ffbac7b464dd64b7647ea0112a9f406499d163d", size = 652444, upload-time = "2026-10-19T01:57:51.001Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a4/a5/842ae8f0c08b61d6484b52f99a03510a3a72d23141942d216ebe81fefbce/filelock-3.25.2-py3-none-any.whl", hash = "sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70", size = 26759, upload-time = "2026-03-11T20:45:37.437Z" }, + { url = "https://files.pythonhosted.org/packages/e0/1b/5e74289a1878e666bb4b65fe5805a04cafcac2aa5f519ef1ead67ef91c56/filelock-4.2.4-py3-none-any.whl", hash = "sha256:301241438c57936ef93f4243a94f2559022268bfcf9b375a9a72eb0f8db8358e", size = 162475, upload-time = "2026-10-19T01:57:49.419Z" }, ] [[package]] @@ -1301,7 +1301,7 @@ version = "1.10.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "filelock", version = "3.20.0", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-bfcl'" }, - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-dev' or extra == 'extra-18-inference-endpoint-performance' or extra == 'extra-18-inference-endpoint-test' or extra != 'extra-18-inference-endpoint-bfcl'" }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" }, marker = "extra == 'extra-18-inference-endpoint-dev' or extra == 'extra-18-inference-endpoint-performance' or extra == 'extra-18-inference-endpoint-test' or extra != 'extra-18-inference-endpoint-bfcl'" }, { name = "fsspec" }, { name = "hf-xet" }, { name = "httpx" }, @@ -1398,7 +1398,7 @@ bfcl = [ { name = "soundfile" }, ] dev = [ - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" } }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" } }, { name = "line-profiler" }, { name = "myst-parser" }, { name = "pip" }, @@ -1455,7 +1455,7 @@ requires-dist = [ { name = "datasets", specifier = "==5.0.1" }, { name = "duckdb", specifier = "==1.5.1" }, { name = "evaluate", marker = "extra == 'rouge'", specifier = "==0.4.6" }, - { name = "filelock", marker = "extra == 'dev'", specifier = ">=3.20.3" }, + { name = "filelock", marker = "extra == 'dev'", specifier = ">=4.2.1" }, { name = "hdrhistogram", specifier = "==0.10.3" }, { name = "httptools", specifier = "==0.7.1" }, { name = "httpx", marker = "extra == 'bfcl'", specifier = "==0.28.1" }, @@ -1507,7 +1507,7 @@ requires-dist = [ { name = "typing-extensions", specifier = "==4.15.0" }, { name = "urllib3", specifier = "==2.8.0" }, { name = "uvloop", specifier = "==0.22.1" }, - { name = "virtualenv", marker = "extra == 'dev'", specifier = "==21.14.9" }, + { name = "virtualenv", marker = "extra == 'dev'", specifier = "==21.14.10" }, { name = "websocket-client", specifier = "==1.9.0" }, ] provides-extras = ["sql", "dev", "test", "performance", "rouge", "bfcl"] @@ -3023,7 +3023,7 @@ name = "python-discovery" version = "1.6.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" } }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" } }, ] sdist = { url = "https://files.pythonhosted.org/packages/0c/57/250bd238b966cece44328235eb85290045d059265fdaf7527a3a958123db/python_discovery-1.6.1.tar.gz", hash = "sha256:cf87d3627dfb4412437fdd5b13eae402607722998d21567993aedbc59b23c15e", size = 84338, upload-time = "2026-09-18T01:31:53.971Z" } wheels = [ @@ -3513,11 +3513,11 @@ wheels = [ [[package]] name = "setuptools" -version = "83.0.0" +version = "84.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/34/26/f5d29e25ffdb535afef2d35cdb55b325298f96debd670da4c325e08d70f4/setuptools-83.0.0.tar.gz", hash = "sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef", size = 1154254, upload-time = "2026-07-04T15:31:22.699Z" } +sdist = { url = "https://files.pythonhosted.org/packages/70/b3/c19426f783614d625699a4b247faf628ea9ab1db228674491767b417f9e1/setuptools-84.2.1.tar.gz", hash = "sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc", size = 1230289, upload-time = "2026-10-20T19:01:37.742Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5d/40/e1e72872c6354b306daef1703549e8e83b4d43cfea356311bf722a043752/setuptools-83.0.0-py3-none-any.whl", hash = "sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3", size = 1008090, upload-time = "2026-07-04T15:31:20.885Z" }, + { url = "https://files.pythonhosted.org/packages/ef/55/6dc6d6bb953bdfc52519a0059592c52b6e3b8ad51cf8256dffceb55b0610/setuptools-84.2.1-py3-none-any.whl", hash = "sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2", size = 876263, upload-time = "2026-10-20T19:01:35.678Z" }, ] [[package]] @@ -4164,18 +4164,18 @@ wheels = [ [[package]] name = "virtualenv" -version = "21.14.9" +version = "21.14.10" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "distlib" }, - { name = "filelock", version = "3.25.2", source = { registry = "https://pypi.org/simple" } }, + { name = "filelock", version = "4.2.4", source = { registry = "https://pypi.org/simple" } }, { name = "packaging" }, { name = "platformdirs" }, { name = "python-discovery" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d0/04/2f69ba1207ce59630ecea8ebfdaf5c8f9a14726f2408ccd145a18d1ef619/virtualenv-21.14.9.tar.gz", hash = "sha256:4d1bee354cd81c820da3bee56e38be3426490f8d1fc54e10ea5b2072ebad8ef8", size = 5500672, upload-time = "2026-10-17T16:09:42.345Z" } +sdist = { url = "https://files.pythonhosted.org/packages/36/ce/7136eeccc4ff32c06c3b523745af49c5cf6b2e95635d88ae8519a6f4d25b/virtualenv-21.14.10.tar.gz", hash = "sha256:f733501a49404c91b5bb1d34d107073b8f4b93a9a1ddb7e9a950eb8ce60f38ad", size = 5501185, upload-time = "2026-10-17T17:31:55.115Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/64/e5/9a3918219745e8bdd64fe0fd9a2d7ce4fffde9268fbc791634b7d4779de9/virtualenv-21.14.9-py3-none-any.whl", hash = "sha256:ac51744da66ae56ff814b087d65096c94de698ec520adc624b108b679655809b", size = 5494452, upload-time = "2026-10-17T16:09:40.584Z" }, + { url = "https://files.pythonhosted.org/packages/1f/83/6fb5c79de3fe1f174c5c7f0f7bb79e3fd7a464b14871f7abfdb66dd10396/virtualenv-21.14.10-py3-none-any.whl", hash = "sha256:bf4a0f9671731d097e017e41280aa05e1e1adcd536b0e804fceb3179947ad50e", size = 5494519, upload-time = "2026-10-17T17:31:53.082Z" }, ] [[package]]