mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
rembg 2.0.75 pulls in numpy>=2.3.0 which conflicts with our pinned numpy==1.26.4 and would break the entire AI dependency chain. The two rembg CVEs (SSRF + path traversal) are in its server/CLI components which we don't use; they're already in the pip-audit ignore list.