EveryVoiceTTS / EveryVoiceTTS/EveryVoice
Dependabot alert -> torch Version <= 2.7.1 ( CVE-2025-3730 )
- Dominant language
- Python
- Stars
- 45
- Forks
- 4
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 14
Description
### Bug description
We should upgrade torch to the latest stable version 2.8.0.
2.7.1 was the last version release on that branch.
This will resolve the dependabot vulnerability detected below.
https://github.com/EveryVoiceTTS/EveryVoice/security/dependabot/25
( PyTorch Improper Resource Shutdown or Release vulnerability )
CVE-2025-3730
### How to reproduce the bug
### Error messages and logs
```
# Error messages and logs here please
```
### Environment
Current environment
# Please paste the output of `everyvoice --diagnostic` here
# EveryVoice Diagnostic information
### More info
see : https://nvd.nist.gov/vuln/detail/CVE-2025-3730
Contributor guide
Research direction
Search the repository's dependency declarations for torch and confirm how version 2.7.1 is specified. Update that declaration to stable version 2.8.0, then run the project's available dependency or test checks and verify the Dependabot vulnerability is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, pytorch
- Domain
- machine-learning, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100