[cemililik]

Summary

transformers>=5.3.0 was described as "the CVE fix floor" but still admitted two advisories that reach ForgeLM's own load-and-save path from a Hub repo. This raises the floor to >=5.10.1 (and huggingface_hub to >=1.5.0, which transformers 5.10 requires), pins both in the nightly minimum-versions job, and adds tests that keep the floor from drifting back.

Related issues

Refs #109 — the floor, the nightly pin, the drift test and the traversal regression test. The top-of-range problems the issue also names (the warmup_ratio mapping on 5.15+, the string fsdp form removed in 5.20) are not part of this change, and CVE-2026-80047 (no patched version is listed upstream; ForgeLM does not call the affected custom_generate) still needs tracking.

Changes

Advisory	What it does to ForgeLM	Fixed in
CVE-2026-5241	a LightGlue config.json overrides trust_remote_code: false and runs a Hub repo's module	5.5.0
CVE-2026-9856	a chat_template name in tokenizer_config.json is used as a file name by save_pretrained, so the save in final_model/, GGUF export and merge can write outside the output directory	5.10.0 (yanked on PyPI) → 5.10.1

• pyproject.toml: transformers>=5.10.1,<6.0.0, huggingface_hub>=1.5.0,<2.0.0, with a comment naming the advisories.
• .github/workflows/nightly.yml: the minimum-versions job installs transformers==5.10.1 and huggingface_hub==1.5.0; the "CVE fix floor" comment is accurate again.
• tools/pip_audit_ignores.yaml, the installation page and the supply-chain reference (English and Turkish) no longer imply the 5.3 floor cleared the later advisories.
• CHANGELOG.md, under Changed: environments pinned to transformers 5.3–5.9 must upgrade.

Checked

• 5.10.0 is yanked on PyPI; 5.10.1 is not. transformers 5.10.1 requires huggingface-hub>=1.5.0.
• The traversal reproduction from the issue, offline with a tiny local tokenizer: on 5.3.0 the crafted chat_template name writes outside the save directory; on 5.10.1 and 5.13.0 save_pretrained raises Invalid chat template name.
• The transformers-facing test modules (model, trainer, export, merge, fit-check, data, model card; 443 tests) pass on a 5.10.1 / huggingface_hub 1.5.0 install overlaid on the project venv (torch 2.12, so this does not exercise torch 2.4).

Type

• Bug fix (security floor)
• Dependency

Testing

• tests/test_packaging.py::test_transformers_floor_is_past_cve_2026_5241_and_cve_2026_9856: the declared floor is at least 5.10.1 and does not admit 5.3.0, 5.4.0, 5.9.0 or 5.10.0.
• tests/test_packaging.py::test_nightly_floor_job_pins_the_runtime_dependency_minimums: every name==X the nightly floor job installs equals the >=X floor in pyproject.toml.
• tests/test_model.py::TestChatTemplateNameCannotEscapeTheSaveDirectory: loads a crafted tokenizer through forgelm.model._load_tokenizer, saves it, expects a refusal and no file outside the directory. Fails on transformers 5.3.0, passes on 5.10.1.
• Mutation checks: lowering the floor fails two tests; drifting one nightly pin fails one.
• The full CLAUDE.md gauntlet from a clean worktree of this branch: exit 0.

Not run

The nightly minimum-versions job itself (torch 2.4.0 + the new pins) runs on its schedule after merge; I did not dispatch it.

Checklist

• English and Turkish mirrors updated together
• CHANGELOG entry under [Unreleased]
• Tests added

🤖 Generated with Claude Code

Summary by Sourcery

Raise the Transformers and Hugging Face Hub dependency floors to secure ForgeLM's model loading and saving paths.

Bug Fixes:

• Raise the Transformers dependency floor to 5.10.1 and the Hugging Face Hub floor to 1.5.0 to prevent vulnerable model loading and save-path traversal behavior.

Enhancements:

• Add regression coverage ensuring crafted chat-template names cannot write outside the model output directory.
• Keep the nightly minimum-dependency pins synchronized with the runtime dependency floors.

CI:

• Update the nightly minimum-versions job to test the new security floors.

Documentation:

• Update changelog, installation guidance, and supply-chain documentation to reflect the new dependency floors and required upgrades.

Tests:

• Add packaging checks that enforce the security floor and verify nightly pins do not drift.

[sourcery-ai]

Sorry @cemililik, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 13 hours and 10 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 50 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: f5e25226-cac4-4fe1-9967-1dacbd19ca2f

📥 Commits

Reviewing files that changed from the base of the PR and between 56b4f0d and e8d9683.

📒 Files selected for processing: 10

• .github/workflows/nightly.yml
• CHANGELOG.md
• docs/reference/supply_chain_security-tr.md
• docs/reference/supply_chain_security.md
• docs/usermanuals/en/getting-started/installation.md
• docs/usermanuals/tr/getting-started/installation.md
• pyproject.toml
• tests/test_model.py
• tests/test_packaging.py
• tools/pip_audit_ignores.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Raises ForgeLM’s Transformers security floor to the first installable release past the identified load/save-path advisories, updates the dependent Hub floor and nightly minimum-version pins, synchronizes documentation, and adds tests covering both dependency alignment and the chat-template path-traversal regression.

Sequence diagram for chat-template save-path protection

sequenceDiagram
    participant HubRepo as Hub repo
    participant Loader as forgelm.model._load_tokenizer
    participant Tokenizer as tokenizer
    participant Save as save_pretrained
    participant Output as Save directory

    HubRepo->>Loader: Load crafted tokenizer
    Loader->>Tokenizer: Read tokenizer_config.json
    Tokenizer->>Save: Save tokenizer with chat_template name
    alt transformers 5.10.1+
        Save-->>Tokenizer: Raise Invalid chat template name
        Save-->>Output: Do not write outside directory
    else transformers 5.3.0
        Save->>Output: Write using unsanitized file name
        Save-->>Output: Path can escape save directory
    end

Loading

File-Level Changes

Change	Details	Files
Raise the runtime security floor for Transformers and its Hub dependency, while keeping the nightly minimum-version job aligned with the declared constraints.	Set transformers to >=5.10.1,<6.0.0 and huggingface_hub to >=1.5.0,<2.0.0, documenting the affected advisories and yanked 5.10.0 release. Pin the nightly floor job to transformers 5.10.1 and huggingface_hub 1.5.0. Update changelog, installation guidance, supply-chain references, and audit-ignore comments to reflect the new floor.	pyproject.toml .github/workflows/nightly.yml CHANGELOG.md docs/reference/supply_chain_security.md docs/reference/supply_chain_security-tr.md docs/usermanuals/en/getting-started/installation.md docs/usermanuals/tr/getting-started/installation.md tools/pip_audit_ignores.yaml
Add regression coverage preventing the dependency floor or nightly pin from drifting below the security baseline.	Parse pyproject.toml to assert the Transformers floor excludes vulnerable releases through 5.10.0. Compare every nightly name==version pin against the corresponding project >= floor and require the two security-critical pins. Use a crafted local tokenizer with a traversal chat-template name to verify save_pretrained refuses the name and writes nothing outside the output directory.	tests/test_packaging.py tests/test_model.py

Possibly linked issues

• The transformers>=5.3.0 floor (described as a CVE fix floor) admits CVE-2026-5241 and CVE-2026-9856, and both reach ForgeLM's own load and save path from a Hub repo (CR-A16-009) #109: The PR directly fixes the issue’s vulnerable transformers floor, nightly pin, and traversal regression criterion; other findings remain explicitly unresolved.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sourcery assessment

Approved.

[cemililik]

Superseded by #999: the wave-0 fixes are combined by theme into five pull requests to cut the review load. This branch's commits are included there unchanged apart from the CHANGELOG.md merge; the branch stays on the remote.