[Security] Bump nltk, aiohttp, pillow, and datamodel-code-generator (#59249)
Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Juan Pérez de Algaba committed
Sep 30, 2026 at 01:00 UTC
eec2a86b1ed7d76b89f7afe25594acd9b0dd88a1
9 files changed
+44
-23
requirements/common.txt
+2
-2
@@ -15,11 +15,11 @@ protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33
15
protobuf == 7.36.1; platform_machine == "s390x"
16
fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides.
17
starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1
18
-aiohttp >= 3.13.3
18
+aiohttp >= 3.14.3
19
openai >= 2.25.0 # For Responses API with namespace tools
20
pydantic >= 2.12.0
21
prometheus_client >= 0.18.0
22
-pillow # Required for image processing
22
+pillow >= 12.3.0 # Required for image processing
23
prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0
24
tiktoken >= 0.6.0 # Required for DBRX tokenizer
25
lm-format-enforcer == 0.11.3
requirements/test/cpu.txt
+10
-6
@@ -8,7 +8,7 @@ accelerate==1.13.0
8
# via peft
9
aiohappyeyeballs==2.6.1
10
# via aiohttp
11
-aiohttp==3.13.3
11
+aiohttp==3.14.3
12
# via
13
# -r requirements/test/../common.txt
14
# aiohttp-cors
@@ -157,7 +157,7 @@ cupy-cuda12x==13.6.0
157
# via ray
158
cycler==0.12.1
159
# via matplotlib
160
-datamodel-code-generator==0.26.3
160
+datamodel-code-generator==0.79.0
161
# via -r requirements/test/cuda.in
162
dataproperty==1.0.1
163
# via
@@ -173,6 +173,8 @@ decorator==5.1.1
173
# via librosa
174
decord==0.6.0
175
# via -r requirements/test/cuda.in
176
+defusedxml==0.7.1
177
+ # via nltk
178
depyf==0.20.0
179
# via -r requirements/test/../common.txt
180
detect-installer==0.1.0
@@ -533,8 +535,10 @@ networkx==3.2.1
535
# torch
536
ninja==1.13.0
537
# via -r requirements/test/../common.txt
536
-nltk==3.9.1
537
- # via rouge-score
538
+nltk==3.10.3
539
+ # via
540
+ # -r requirements/test/cuda.in
541
+ # rouge-score
542
num2words==0.5.14
543
# via -r requirements/test/cuda.in
544
numba==0.65.0
@@ -655,7 +659,6 @@ packaging==24.2
659
# via
660
# accelerate
661
# black
658
- # datamodel-code-generator
662
# datasets
663
# evaluate
664
# fastparquet
@@ -696,7 +699,7 @@ perceptron==0.1.4
699
# via -r requirements/test/cuda.in
700
perf-analyzer==0.1.0
701
# via genai-perf
699
-pillow==10.4.0
702
+pillow==12.3.0
703
# via
704
# -r requirements/test/../common.txt
705
# genai-perf
@@ -1231,6 +1234,7 @@ types-requests==2.33.0.20260712
1234
typing-extensions==4.15.0
1235
# via
1236
# -r requirements/test/../common.txt
1237
+ # aiohttp
1238
# aiosignal
1239
# albumentations
1240
# alembic
requirements/test/cuda.in
+2
-1
@@ -36,7 +36,8 @@ matplotlib # required for qwen-vl test
36
mistral_common[image,audio] >= 1.11.6 # required for voxtral test
37
num2words # required for smolvlm test
38
open_clip_torch==2.32.0 # Required for nemotron_vl test, Nemotron Parse in test_common.py
39
-datamodel_code_generator # required for minicpm3 test
39
+datamodel_code_generator>=0.64.0 # required for minicpm3 test
40
+nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs
41
lm-eval[api]>=0.4.12 # required for model evaluation test
42
mteb[bm25s]>=2, <3 # required for mteb test
43
transformers==5.17.0
requirements/test/cuda.txt
+11
-6
@@ -8,7 +8,7 @@ accelerate==1.13.0
8
# via peft
9
aiohappyeyeballs==2.6.1
10
# via aiohttp
11
-aiohttp==3.13.3
11
+aiohttp==3.14.3
12
# via
13
# -c requirements/common.txt
14
# -r requirements/test/../common.txt
@@ -170,7 +170,7 @@ cupy-cuda12x==13.6.0
170
# via ray
171
cycler==0.12.1
172
# via matplotlib
173
-datamodel-code-generator==0.26.3
173
+datamodel-code-generator==0.79.0
174
# via -r requirements/test/cuda.in
175
dataproperty==1.0.1
176
# via
@@ -186,6 +186,8 @@ decorator==5.1.1
186
# via librosa
187
decord==0.6.0
188
# via -r requirements/test/cuda.in
189
+defusedxml==0.7.1
190
+ # via nltk
191
depyf==0.20.0
192
# via
193
# -c requirements/common.txt
@@ -567,8 +569,10 @@ networkx==3.2.1
569
# torch
570
ninja==1.13.0
571
# via -r requirements/test/../common.txt
570
-nltk==3.9.1
571
- # via rouge-score
572
+nltk==3.10.3
573
+ # via
574
+ # -r requirements/test/cuda.in
575
+ # rouge-score
576
num2words==0.5.14
577
# via -r requirements/test/cuda.in
578
numba==0.65.0
@@ -743,7 +747,6 @@ packaging==24.2
747
# via
748
# accelerate
749
# black
746
- # datamodel-code-generator
750
# datasets
751
# evaluate
752
# fastparquet
@@ -784,8 +787,9 @@ perceptron==0.1.4
787
# via -r requirements/test/cuda.in
788
perf-analyzer==0.1.0
789
# via genai-perf
787
-pillow==10.4.0
790
+pillow==12.3.0
791
# via
792
+ # -c requirements/common.txt
793
# -r requirements/test/../common.txt
794
# genai-perf
795
# imagehash
@@ -1341,6 +1345,7 @@ typing-extensions==4.15.0
1345
# via
1346
# -c requirements/common.txt
1347
# -r requirements/test/../common.txt
1348
+ # aiohttp
1349
# aiosignal
1350
# albumentations
1351
# alembic
requirements/test/nightly-torch.txt
+1
-1
@@ -26,7 +26,7 @@ matplotlib # required for qwen-vl test
26
mistral_common[image,audio] >= 1.11.6 # required for voxtral test
27
num2words # required for smolvlm test
28
opencv-python-headless >= 4.13.0 # required for video test
29
-datamodel_code_generator # required for minicpm3 test
29
+datamodel_code_generator>=0.64.0 # required for minicpm3 test
30
lm-eval[api]>=0.4.12 # required for model evaluation test
31
mteb[bm25s]>=2, <3 # required for mteb test
32
transformers==5.17.0
requirements/test/rocm.in
+2
-1
@@ -32,7 +32,8 @@ matplotlib # required for qwen-vl test
32
mistral_common[image,audio]>=1.11.6 # required for voxtral test
33
num2words # required for smolvlm test
34
open_clip_torch==2.32.0 # Required for nemotron_vl test, Nemotron Parse in test_common.py
35
-datamodel_code_generator # required for minicpm3 test
35
+datamodel_code_generator>=0.64.0 # required for minicpm3 test
36
+nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs
37
lm-eval[api]>=0.4.12 # required for model evaluation test
38
mteb[bm25s]>=2, <3 # required for mteb test
39
transformers==5.17.0
requirements/test/rocm.txt
+11
-5
@@ -6,7 +6,7 @@ accelerate==1.13.0
6
# via peft
7
aiohappyeyeballs==2.6.1
8
# via aiohttp
9
-aiohttp==3.13.3
9
+aiohttp==3.14.3
10
# via
11
# -c requirements/common.txt
12
# -r requirements/test/../common.txt
@@ -165,7 +165,7 @@ cryptography==46.0.0
165
# pyjwt
166
cycler==0.12.1
167
# via matplotlib
168
-datamodel-code-generator==0.55.0
168
+datamodel-code-generator==0.79.0
169
# via -r requirements/test/rocm.in
170
dataproperty==1.1.0
171
# via
@@ -181,6 +181,8 @@ decorator==5.2.1
181
# via librosa
182
decord==0.6.0
183
# via -r requirements/test/rocm.in
184
+defusedxml==0.7.1
185
+ # via nltk
186
depyf==0.20.0
187
# via
188
# -c requirements/common.txt
@@ -569,8 +571,10 @@ networkx==3.6.1
571
# torch
572
ninja==1.13.0
573
# via -r requirements/test/../common.txt
572
-nltk==3.9.3
573
- # via rouge-score
574
+nltk==3.10.3
575
+ # via
576
+ # -r requirements/test/rocm.in
577
+ # rouge-score
578
num2words==0.5.14
579
# via -r requirements/test/rocm.in
580
numba==0.65.0
@@ -758,8 +762,9 @@ perceptron==0.1.4
762
# via -r requirements/test/rocm.in
763
perf-analyzer==0.1.0
764
# via genai-perf
761
-pillow==12.1.1
765
+pillow==12.3.0
766
# via
767
+ # -c requirements/common.txt
768
# -r requirements/test/../common.txt
769
# genai-perf
770
# imagehash
@@ -1291,6 +1296,7 @@ typing-extensions==4.15.0
1296
# via
1297
# -c requirements/common.txt
1298
# -r requirements/test/../common.txt
1299
+ # aiohttp
1300
# aiosignal
1301
# albumentations
1302
# alembic
requirements/test/xpu.in
+1
@@ -16,6 +16,7 @@ absl-py
16
accelerate
17
arctic-inference
18
lm_eval[api]>=0.4.12
19
+nltk>=3.10.3 # pin transitive rouge-score/lm-eval dep for known GHSAs
20
modelscope<1.38
21
runai-model-streamer[s3,gcs,azure]>=0.15.7
22
tensorizer==2.10.1
requirements/test/xpu.txt
+4
-1
@@ -515,7 +515,9 @@ networkx==3.6.1
515
ninja==1.13.0
516
# via -r requirements/test/../common.txt
517
nltk==3.10.3
518
- # via rouge-score
518
+ # via
519
+ # -r requirements/test/xpu.in
520
+ # rouge-score
521
num2words==0.5.14
522
# via -r requirements/test/xpu.in
523
numba==0.65.0
@@ -671,6 +673,7 @@ pathvalidate==3.3.1
673
# via pytablewriter
674
pillow==12.3.0
675
# via
676
+ # -c requirements/common.txt
677
# -r requirements/test/../common.txt
678
# matplotlib
679
# mistral-common