Skip to content

fix(pii): bump transformers to 5.5.0 for LightGlue RCE advisory #5662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
waleedlatif1 wants to merge 3 commits into
base: staging
Choose a base branch
from
+10 −3
Open

fix(pii): bump transformers to 5.5.0 for LightGlue RCE advisory #5662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b3eb3b0
fix(pii): bump transformers to 5.5.0 for LightGlue RCE advisory
waleedlatif1 Jul 14, 2026
e6884fa
improvement(pii): assert real GLiNER inference in the image build
waleedlatif1 Jul 14, 2026
6dd8465
improvement(pii): require date detection in the GLiNER build smoke as…
waleedlatif1 Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/pii/requirements-gliner.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@
# torch is pinned in the Dockerfile instead: the CPU and CUDA targets install
# the same version from different wheel indexes.
gliner==0.2.27
transformers==5.3.0
huggingface_hub==1.3.0
transformers==5.5.0
Comment thread
waleedlatif1 marked this conversation as resolved.
huggingface_hub==1.23.0
9 changes: 8 additions & 1 deletion docker/pii.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,9 +87,16 @@ RUN --mount=type=cache,target=/root/.cache/pip \
# Bake the GLiNER weights at build time (cached layer) so startup never
# touches the network. HF_HUB_OFFLINE makes a missing/overridden
# PII_GLINER_MODEL fail fast at startup instead of silently downloading.
# The predict_entities smoke assert (labels from engines.py's
# GLINER_ENTITY_MAPPING) fails the build if a transformers/gliner bump loads
# the model fine but silently stops returning detections.
ENV HF_HOME=/opt/hf-cache
ARG GLINER_MODEL=urchade/gliner_multi_pii-v1
RUN python -c "from gliner import GLiNER; GLiNER.from_pretrained('${GLINER_MODEL}')" && \
RUN python -c "from gliner import GLiNER; \
model = GLiNER.from_pretrained('${GLINER_MODEL}'); \
ents = model.predict_entities('John Smith flew to Paris on 4 May 2021.', ['person', 'location', 'date']); \
labels = {e['label'] for e in ents}; \
assert {'person', 'location', 'date'} <= labels, f'GLiNER smoke inference failed, got: {ents}'" && \
chmod -R a+rX /opt/hf-cache
ENV HF_HUB_OFFLINE=1

Expand Down
Loading