[Snyk] Security upgrade torch from 2.1.2 to 2.7.1 #8

nn6n · 2025-06-10T18:53:06Z

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

eval_mm/vlmevalkit/requirements.txt

⚠️

Warning

transformers 4.30.2 requires safetensors, which is not installed.
moviepy 2.2.1 has requirement numpy>=1.25.0, but you have numpy 1.21.3.
gradio 3.34.0 requires ffmpy, which is not installed.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.
Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-TORCH-9634167

gemini-code-assist

Summary of Changes

Hello @nn6n, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This PR is an automated security fix initiated by Snyk. Its primary purpose is to upgrade the torch dependency to a version that mitigates a reported vulnerability, ensuring the project uses a more secure version of this critical library. The change is limited to updating the version constraint in the project's requirements file.

Highlights

Security Upgrade: This pull request was automatically generated by Snyk to address a security vulnerability by upgrading the torch dependency.
Dependency Version Bump: The minimum required version for the torch package has been updated from 2.0.1 to 2.7.1 in the requirements file.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configureGemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request, automatically generated by Snyk, aims to enhance security by upgrading the torch dependency. The change involves updating the version constraint in eval_mm/vlmevalkit/requirements.txt from torch>=2.0.1 to torch>=2.7.1, effectively targeting an upgrade from an existing version around 2.1.2 to 2.7.1.

My review focuses on the following critical aspects:

Comprehensive Testing: The version bump for torch is substantial. It is imperative to conduct thorough end-to-end testing to ensure that this upgrade does not introduce any breaking changes, performance regressions, or unexpected behavior in your application.
Dependency Ecosystem Health: The pull request description itself includes important warnings about potential issues with other dependencies (transformers requiring safetensors, moviepy's numpy version requirement, and gradio needing ffmpy). These warnings should be carefully investigated and addressed. Upgrading a core library like torch can sometimes expose or exacerbate underlying issues in the dependency tree. Resolving these will be crucial for the overall stability of the project.

While the security benefits of this upgrade are clear, diligent testing and a holistic review of related dependencies are essential before merging.

gemini-code-assist · 2025-06-10T18:54:13Z

eval_mm/vlmevalkit/requirements.txt

@@ -22,7 +22,7 @@ sty
 tabulate
 tiktoken
 timeout-decorator
-torch>=2.0.1
+torch>=2.7.1


This upgrade to torch>=2.7.1 is a positive step for security.

Given the significant version jump (from a previous constraint of >=2.0.1 and an effective version likely around 2.1.2 as indicated in the PR title), please ensure thorough testing across all relevant functionalities. This will help confirm compatibility and prevent any unexpected regressions or breaking changes introduced by the new torch version.

Additionally, it's crucial to review and address any dependency conflicts or issues that may arise or become more prominent with this upgrade. Pay close attention to the warnings provided in the pull request description regarding other packages (like transformers, moviepy, gradio). Ensuring all dependencies are compatible and their requirements are met is key to maintaining a stable and functional environment post-upgrade.

fix: eval_mm/vlmevalkit/requirements.txt to reduce vulnerabilities

e901c81

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-TORCH-9634167

gemini-code-assist bot reviewed Jun 10, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Security upgrade torch from 2.1.2 to 2.7.1 #8

[Snyk] Security upgrade torch from 2.1.2 to 2.7.1 #8

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

[Snyk] Security upgrade torch from 2.1.2 to 2.7.1 #8

Are you sure you want to change the base?

[Snyk] Security upgrade torch from 2.1.2 to 2.7.1 #8

Uh oh!

Conversation

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

Uh oh!

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

Choose a reason for hiding this comment

Code Review

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!