From 55fa8ad1d1fc166b3aafc464b47bd359756f594c Mon Sep 17 00:00:00 2001
From: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:30:31 +0000
Subject: [PATCH 1/2] [None][fix] Exclude vulnerable filelock releases

Signed-off-by: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
---
 requirements.txt                 | 3 +++
 security_scanning/pyproject.toml | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index c28777256f21..bdd8f81f2f10 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,8 @@
 --extra-index-url https://download.pytorch.org/whl/cu132
 -c constraints.txt
+# Patched filelock requires Python 3.11; 3.20.3 predates the affected lock implementations.
+filelock==3.20.3; python_version < "3.11"
+filelock>=4.2.1; python_version >= "3.11"
 accelerate>=1.7.0
 build
 colored
diff --git a/security_scanning/pyproject.toml b/security_scanning/pyproject.toml
index 4559cd0e6ed9..71cfab374222 100644
--- a/security_scanning/pyproject.toml
+++ b/security_scanning/pyproject.toml
@@ -91,7 +91,8 @@ dependencies = [
     "cache-dit (>=1.3.5)",
     "msgpack (>=1.2.4,<2.0.0)",
     "uvloop (>=0.19.0,<0.23.0)",
-    "mooncake-transfer-engine-cuda13 (==0.3.13)"
+    "mooncake-transfer-engine-cuda13 (==0.3.13)",
+    "filelock (==3.20.3)"
 ]
 
 

From aa0cb7d9a04eeab214faf02c5b8ff318438569f6 Mon Sep 17 00:00:00 2001
From: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:40:03 +0000
Subject: [PATCH 2/2] [None][doc] Clarify Python-specific filelock constraints

Signed-off-by: Yuxian Qiu <142763828+yuxianq@users.noreply.github.com>
---
 requirements.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index bdd8f81f2f10..83bb055558cf 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,7 @@
 --extra-index-url https://download.pytorch.org/whl/cu132
 -c constraints.txt
-# Patched filelock requires Python 3.11; 3.20.3 predates the affected lock implementations.
+# filelock 4.2.1 requires Python 3.11+. Pin Python 3.10 to 3.20.3 to exclude
+# vulnerable releases 3.20.4 through 4.2.0; newer Python can use 4.2.1 or later.
 filelock==3.20.3; python_version < "3.11"
 filelock>=4.2.1; python_version >= "3.11"
 accelerate>=1.7.0