nangsontay
diff --git a/‎pyproject.toml‎
Lines changed: 2 additions & 0 deletions b/‎pyproject.toml‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎uv.lock‎
Lines changed: 38 additions & 25 deletions b/‎uv.lock‎
Lines changed: 38 additions & 25 deletions
@@ -332,6 +332,8 @@ constraint-dependencies = [
     "lxml-html-clean>=0.4.5",
     # CVE-2026-54293 (High) — transitive via rouge-score/lm-eval; fix at 3.10.0
     "nltk>=3.10.0",
+    # CVE-2026-5241 (High) — direct optional dep for proxy/ml/voice; fix at 5.5.0
+    "transformers>=5.5.0",
 ]
 
 # Pin the project's package index to public PyPI. Without this, `uv lock`
Original file line number	Diff line number	Diff line change
`@@ -332,6 +332,8 @@ constraint-dependencies = [`
`332`	`332`	`"lxml-html-clean>=0.4.5",`
`333`	`333`	`# CVE-2026-54293 (High) — transitive via rouge-score/lm-eval; fix at 3.10.0`
`334`	`334`	`"nltk>=3.10.0",`
	`335`	`+ # CVE-2026-5241 (High) — direct optional dep for proxy/ml/voice; fix at 5.5.0`
	`336`	`+ "transformers>=5.5.0",`
`335`	`337`	`]`
`336`	`338`
`337`	`339`	# Pin the project's package index to public PyPI. Without this, `uv lock`