From c54c8f3105a97bf53aefe3d680fc551a915ef488 Mon Sep 17 00:00:00 2001 From: Kenneth Estanislao Date: Sun, 14 Jun 2026 23:04:25 +0800 Subject: [PATCH] Bump onnx, pillow, protobuf to resolve Dependabot alerts Resolves all 13 open Dependabot advisories (8 high, 5 moderate): - onnx 1.18.0 -> 1.21.0 (6: GHSA-3r9x-f23j-gc73, GHSA-538c-55jv-c5g9, GHSA-hqmj-h5c6-369m, GHSA-q56x-g2fj-4rj6, GHSA-cmw6-hcpp-c6jp, GHSA-p433-9wv8-28xj) - pillow 12.1.1 -> 12.2.0 (5: GHSA-pwv6-vv43-88gr, GHSA-whj4-6x5x-4v2j, GHSA-5xmw-vc9v-4wf2, GHSA-r73j-pqj5-w3x7, GHSA-wjx4-4jcj-g98j) - protobuf 4.25.1 -> 5.29.6 (2: GHSA-8qvm-5x2c-j2w7, GHSA-7gcm-g887-7qv7; the recursion-depth fix has no 4.x release, so 5.x is required) protobuf 5.x caps tensorflow at 2.20.0 (2.21 needs protobuf>=6.31.1), which keeps numpy at 1.26.x, preserving the existing numpy<2 pin. Verified with a pip dry-run resolve and re-scanned the resulting set against OSV (all clean). Co-Authored-By: Claude Opus 4.8 (1M context) --- requirements.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements.txt b/requirements.txt index 3383d46..c8f8b35 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,16 +2,16 @@ numpy>=1.23.5,<2 typing-extensions>=4.8.0 opencv-python==4.10.0.84 cv2_enumerate_cameras==1.1.15 -onnx==1.18.0 +onnx==1.21.0 insightface==0.7.3 psutil==5.9.8 PySide6>=6.7,<7 -pillow==12.1.1 +pillow==12.2.0 tqdm>=4.65.0 onnxruntime-silicon==1.16.3; sys_platform == 'darwin' and platform_machine == 'arm64' onnxruntime-gpu==1.23.2; sys_platform != 'darwin' tensorflow>=2.15.0; sys_platform != 'darwin' tensorflow>=2.15.0; sys_platform == 'darwin' and python_version < '3.13' opennsfw2==0.10.2 -protobuf==4.25.1 +protobuf==5.29.6 pygrabber; sys_platform == 'win32'