explosion / explosion/spaCy

Request: [spacy-transformers] add support for 'transformers' v5.3.0 to resolve vulnerability

Open
#13,989 0 comments 4 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
33.9k
Forks
4.7k
Avg merge
3m
Merged PRs (30d)
1

Description

### Summary

`transformers` prior to version `5.3.0` is being flagged by security-scanner tools (in our case `trivy`) as having [vulnerability](https://avd.aquasec.com/nvd/2026/cve-2026-4372) `CVE-2026-4372 | HIGH | HuggingFace transformers vulnerable to remote code execution`. This is fixed in version `5.3.0`.

The latest version of `spacy-transformers` constrains `transformers` to `>=3.4.0,<4.53.3`.

### Request
Add support for `transformers v5.3.0` to `spacy-transformers`.

I have found a fork that bumped the version all the way to version `5.5.3` [here](https://github.com/explosion/spacy-transformers/compare/master...echolabsai:spacy-transformers:new-hf-transformers-compat?diff=unified&w) (just for reference).

Contributor guide

Open the contributing guide

Research direction

Start with the current spacy-transformers dependency constraint, which limits transformers to below 4.53.3, and compare the referenced fork's compatibility changes. Confirm that transformers v5.3.0 is supported and that the reported CVE is no longer flagged by the security scanner.

Written by the indexing model from the issue text.

Assessment

Tech stack
huggingface, python
Domain
machine-learning
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.