Hi there, thanks for providing this package.
While using this package indirectly via ja-ginza-electra, I got a github's dependabot error that transformers version cannot be upgraded more than 4.26.0 which contains vulnerability.
According to this NVD page, transformers less than 4.36.0 has a severity 8.8 High vulnerability.
The latest version of spacy-transformers already supports transformers version up to 4.36.X, but ginza-transformers seems to support spacy-transformers up to 1.1.X (code)
So, what I expect is I need this package to support spacy-transformer v1.3.4 so that we can use transformers more than 4.36.0, which has been fixed a high severity security issue. Thanks,
For reference, here's the output of poetry show --tree command:
ja-ginza-electra 5.1.3
├── ginza-transformers >=0.4.0,<0.5.0
│ └── spacy-transformers >=1.1.2,<1.2.0
│ └── transformers >=3.4.0,<4.26.0
Hi there, thanks for providing this package.
While using this package indirectly via
ja-ginza-electra, I got a github's dependabot error thattransformersversion cannot be upgraded more than 4.26.0 which contains vulnerability.According to this NVD page, transformers less than 4.36.0 has a severity 8.8 High vulnerability.
The latest version of
spacy-transformersalready supportstransformersversion up to 4.36.X, butginza-transformersseems to supportspacy-transformersup to 1.1.X (code)So, what I expect is I need this package to support
spacy-transformerv1.3.4 so that we can usetransformersmore than 4.36.0, which has been fixed a high severity security issue. Thanks,For reference, here's the output of
poetry show --treecommand: