search

IndicoDataSolutions / finetune

Scikit-learn style model finetuning for NLP
https://finetune.indico.io
Mozilla Public License 2.0
703 stars 80 forks source link

[CVE-6662] Update transformers version #786

Closed fitzworkhub closed 11 months ago

fitzworkhub commented 11 months ago

Using latest release from hugging face: https://github.com/huggingface/transformers/releases

pastap commented 11 months ago

do we need to do anything to get a newer version of the library published?

madisonmay commented 11 months ago

@pastap since it's just referenced by hash in custom_v2, I don't think we need to publish a new release:

https://github.com/IndicoDataSolutions/custom_v2/blob/cc89ef5ae6f05e0069ec058bdd11565a8ee491fe/pyproject.toml#L15

pastap commented 11 months ago

andrew, if it's worth it then, you could, before merging, test the customv2 build - see if the CVEs are resolved with this branch hash

fitzworkhub commented 11 months ago

Do I need to do anything else here: finetune = { git = "https://github.com/IndicoDataSolutions/finetune.git", rev = "16ec0742195a9fa167b54a5f77af7f3009c06373"}

I updated the hash but I'm getting this error when trying to update poetry

 Because custom-v2 depends on finetune (0.10.0) @ git+https://github.com/IndicoDataSolutions/finetune.git@16ec0742195a9fa167b54a5f77af7f3009c06373 which depends on transformers (4.25.1), transformers is required.
  So, because custom-v2 depends on transformers (~4.36.2), version solving failed.
pastap commented 11 months ago

You prolly need to update setup.py too https://github.com/IndicoDataSolutions/finetune/blob/development/setup.py#L31