fix(pii): bump transformers to 5.5.0 for LightGlue RCE advisory

[waleedlatif1]

Summary

• Bump transformers 5.3.0 → 5.5.0 in apps/pii/requirements-gliner.txt — first patched version for the LightGlue arbitrary-code-execution advisory (Dependabot alerts fix(deps): bump @cerebras/cerebras_cloud_sdk from 1.25.0 to 1.26.0 in /sim #174/[REQUEST] Improve webhook model UX #175, High)
• Bump huggingface_hub 1.3.0 → 1.23.0 — required: transformers 5.5.0 declares huggingface-hub>=1.5.0,<2.0, so bumping transformers alone (as Dependabot's chore(deps): bump transformers from 5.3.0 to 5.5.0 in /apps/pii in the pip group across 1 directory #5645 does) fails pip resolution during the gliner image build
• Alert [REQUEST] Improve webhook model UX #175 against requirements.txt is a dependency-graph artifact (that file has never pinned transformers) and clears once the default branch re-scans
• Supersedes chore(deps): bump transformers from 5.3.0 to 5.5.0 in /apps/pii in the pip group across 1 directory #5645 (targets main, misses the hub floor bump)

Type of Change

• Bug fix

Testing

• Verified the full combined pin set (torch 2.11.0, gliner 0.2.27, transformers 5.5.0, huggingface_hub 1.23.0, presidio 2.2.362, spacy 3.8.14) resolves with pip install --dry-run in a clean venv — tokenizers resolves to 0.22.2 within transformers' >=0.22.0,<=0.23.0 range
• gliner 0.2.27 allows transformers>=4.51.3,<5.7.0 and huggingface_hub>=0.21.4; Dockerfile torch==2.11.0 satisfies transformers' torch>=2.4

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 14, 2026 2:41am

[cursor]

PR Summary

Low Risk
Scoped to GLiNER image dependency pins and an additive Docker build-time inference assert; no runtime auth or data-path changes.

Overview
Security dependency bumps in requirements-gliner.txt: transformers 5.3.0 → 5.5.0 (addresses the LightGlue arbitrary-code-execution advisory) and huggingface_hub 1.3.0 → 1.23.0 so pip resolution satisfies transformers’ minimum hub version during the gliner image build.

Docker build hardening in pii.Dockerfile: after baking GLiNER weights, the build now runs a predict_entities smoke check (sample text + person/location/date labels aligned with GLINER_ENTITY_MAPPING) and fails the image build if those labels are missing—catching cases where a transformers/gliner bump loads the model but stops returning detections.

^{Reviewed by Cursor Bugbot for commit 6dd8465. Configure here.}

[greptile-apps]

Greptile Summary

This PR updates the PII GLiNER image dependencies and adds a build-time inference check.

• Bumps transformers to 5.5.0 for the LightGlue advisory.
• Bumps huggingface_hub to 1.23.0 for dependency resolution.
• Runs a GLiNER smoke inference during the Docker build.
• Requires person, location, and date detections before the image layer succeeds.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/pii/requirements-gliner.txt	Updates the GLiNER-related dependency pins used by the PII image.
docker/pii.Dockerfile	Adds a build-time GLiNER inference check for person, location, and date labels.

_{Reviews (3): Last reviewed commit: "improvement(pii): require date detection..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e6884fa. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6dd8465. Configure here.}