Request: [spacy-transformers] add support for 'transformers' v5.3.0 to resolve vulnerability
- Dominant language
- Python
- Stars
- 33.9k
- Forks
- 4.7k
- Avg merge
- 3m
- Merged PRs (30d)
- 1
Description
### Summary
`transformers` prior to version `5.3.0` is being flagged by security-scanner tools (in our case `trivy`) as having [vulnerability](https://avd.aquasec.com/nvd/2026/cve-2026-4372) `CVE-2026-4372 | HIGH | HuggingFace transformers vulnerable to remote code execution`. This is fixed in version `5.3.0`.
The latest version of `spacy-transformers` constrains `transformers` to `>=3.4.0,<4.53.3`.
### Request
Add support for `transformers v5.3.0` to `spacy-transformers`.
I have found a fork that bumped the version all the way to version `5.5.3` [here](https://github.com/explosion/spacy-transformers/compare/master...echolabsai:spacy-transformers:new-hf-transformers-compat?diff=unified&w) (just for reference).
Contributor guide
Research direction
Start with the current spacy-transformers dependency constraint, which limits transformers to below 4.53.3, and compare the referenced fork's compatibility changes. Confirm that transformers v5.3.0 is supported and that the reported CVE is no longer flagged by the security scanner.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- huggingface, python
- Domain
- machine-learning
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100