CalvinBackup/remove-ai-watermarks
1
0
Fork 0
mirror of https://github.com/wiltodelta/remove-ai-watermarks.git synced 2026-08-07 06:28:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(release): v0.16.0

Browse Source
This commit is contained in:
Victor Kuznetsov
2026-07-21 18:35:04 -07:00
parent 008319c6a5
commit 3a659ededc
5 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/release-and-distribution.md
+2 -1
View File
@@ -35,4 +35,5 @@ The standing `uv-secure` gate in `maintain.sh` is clean; this is the changelog o
- **idna** bumped 3.11 -> 3.16, fixing GHSA-65pc-fj4g-8rjx.
- **aiohttp** bumped 3.13.5 -> 3.14.0 via `uv lock --upgrade-package aiohttp`, fixing GHSA-hg6j-4rv6-33pg + GHSA-jg22-mg44-37j8.
- **basicsr** Dependabot alert GHSA-86w8-vhw6-q9qq is resolved by removal: the experimental `restore` extra was retired and basicsr is no longer anywhere in the dependency tree.
- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, vulnerable `<= 2.12.0`) is **dismissed as `not_used`** (2026-06-10): torch is a transitive dep of the optional `gpu` extra only, the codebase never calls `torch.jit` (grep-verified), and **no patched torch version exists** (`first_patched_version` is null), so at the time it could not be closed by an upgrade. **Superseded 2026-07-20:** a patched **torch 2.13.0** now exists and the alert range moved to `<= 2.12.1`, so the "no patched version" half of that reasoning is gone -- the alert is open again and needs either a bump or a re-dismissal on the `not_used` grounds alone. See the open-items table in `docs/verification-plan.md`.
- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, alert range `<= 2.12.1`) was dismissed `not_used` on 2026-06-10 (torch is a transitive dep of the optional `gpu` extra only and the codebase never calls `torch.jit`) and **resolved by upgrade on 2026-07-21**: the lock carries torch **2.13.0**, above the patched floor, so `uv-secure` is clean. If the GitHub alert has not auto-closed on the lock bump, close it manually as fixed.
- **setuptools** bumped 81.0.0 -> 83.0.0 (2026-07-21), fixing PYSEC-2026-3447.
docs/verification-plan.md
+4 -7
View File
@@ -930,13 +930,10 @@ detector change, never on its own.
### Dependency alert
`GHSA-rrmf-rvhw-rf47` (torch, `torch.jit.script` memory corruption) is open again and
**the reason it was dismissed no longer holds**. It was dismissed `not_used` on 2026-06-10
partly because no patched version existed; a patched **torch 2.13.0** now does, and the
current alert range is `<= 2.12.1`. `docs/release-and-distribution.md` still says "no
patched torch version exists -- do not re-triage it", which is now stale. Either bump torch
(it is transitive from the optional `gpu` extra) or re-dismiss on the remaining grounds
(the codebase never calls `torch.jit`, grep-verified) and correct that note.
RESOLVED 2026-07-21. `GHSA-rrmf-rvhw-rf47` (torch, `torch.jit.script` memory corruption,
alert range `<= 2.12.1`) is closed by the torch **2.13.0** bump (the lock already carried it;
`uv-secure` no longer flags torch). The Dependabot alert itself may still need a manual
close in the GitHub UI if it has not auto-resolved on the lock bump.
### Where detection work should go next