mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
30 lines
1.2 KiB
Plaintext
30 lines
1.2 KiB
Plaintext
# rembg is pinned to 2.0.69. The patched 2.0.75 (GHSA: server SSRF/CORS +
|
|
# custom-model path traversal) pulls numpy>=2.3, scipy>=1.16 and
|
|
# scikit-image>=0.26 -- a numpy 2.x closure that is incompatible with this
|
|
# numpy==1.26.4-locked stack (realesrgan 0.3.0 and codeformer-pip 0.0.4 break
|
|
# on numpy 2.x). Both advisories are unreachable here: rembg is used purely as
|
|
# a library (we never run `rembg s`), and new_session() only ever receives
|
|
# allowlisted model names (remove_bg.py ALLOWED_MODELS), never user paths.
|
|
rembg[cpu]==2.0.69
|
|
realesrgan==0.3.0
|
|
paddleocr[doc-parser]>=3.4.0,<3.5.0
|
|
paddlepaddle>=3.0.0,<3.1.0
|
|
mediapipe>=0.10.21
|
|
onnxruntime==1.20.1
|
|
numpy==1.26.4
|
|
Pillow==12.3.0
|
|
opencv-python-headless==4.10.0.84
|
|
codeformer-pip==0.0.4
|
|
|
|
# OpenTelemetry: enables the innermost sidecar.<script> span when
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT is set (enterprise distributed_tracing). Pure-Python,
|
|
# no numpy/scipy deps, so safe for the numpy==1.26.4-locked stack.
|
|
opentelemetry-api==1.28.2
|
|
opentelemetry-sdk==1.28.2
|
|
opentelemetry-exporter-otlp-proto-http==1.28.2
|
|
|
|
# Keep protobuf on a patched 5.x release. OpenTelemetry 1.27.x pinned
|
|
# opentelemetry-proto to protobuf<5, which left the resolver on vulnerable
|
|
# protobuf 4.25.9 (PYSEC-2026-1805).
|
|
protobuf==5.29.6
|