[Aikido] Fix 7 security issues in transformers, urllib3, pyarrow and 3 more

[aikido-autofix]

Upgrade dependencies to fix critical RCE in transformers, DoS vulnerabilities in urllib3, use-after-free in pyarrow, and insecure temp file handling in requests.

✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-4372	HIGH	[transformers] A malicious config.json file can execute arbitrary Python code when loading a model via AutoModelForCausalLM.from_pretrained(), bypassing the trust_remote_code security mechanism. This remote code execution vulnerability exploits unfiltered deserialization of configuration attributes during standard model loading.
CVE-2026-44432	HIGH	[urllib3] Improper decompression handling allows attackers to trigger excessive resource consumption (CPU and memory) by forcing full decompression of highly compressed HTTP responses during partial reads or drain operations.
CVE-2026-44431	MEDIUM	[urllib3] is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
CVE-2026-25087	HIGH	[pyarrow] Use-after-free vulnerability in Arrow C++ IPC file reader with pre-buffering enabled when processing variadic buffers, potentially causing denial of service through crashes or memory corruption.
CVE-2026-25645	MEDIUM	[requests] The extract_zipped_paths() utility function uses predictable filenames when extracting zip archives to the temp directory, allowing local attackers to pre-create malicious files that get loaded instead of legitimate ones, resulting in arbitrary code execution.
CVE-2026-4539	LOW	[pygments] A regular expression denial of service (ReDoS) vulnerability exists in the AdlLexer function that can be exploited locally to cause inefficient processing and potential denial of service. The vulnerability requires local access to trigger the malicious input against the vulnerable regex pattern.
CVE-2026-45409	LOW	[idna] A denial-of-service vulnerability exists where specially crafted inputs with repeated Unicode characters cause excessive processing time in domain name validation. Enforcing a 253-character length limit before processing mitigates the issue.

🤖 Remediation details

Fix security vulnerabilities in transformers, urllib3, pyarrow, requests, pygments, and idna

Short summary

This PR remediates security vulnerabilities in six packages: transformers, urllib3, pyarrow, requests, pygments, and idna. One direct dependency spec was tightened in the root pyproject.toml (pyarrow), and the remaining five packages were resolved to patched versions via lockfile-only upgrades. All resolved versions are reflected in uv.lock.

transformers

transformers is a transitive dependency introduced by sentence-transformers, which is declared as a direct dev dependency under [project.optional-dependencies] dev. No manifest edit was required; running uv lock --upgrade-package transformers (alongside sentence-transformers) was sufficient to advance the resolved version from 5.1.0 to 5.13.0, satisfying the ≥5.3.0 patched floor.

urllib3

urllib3 is a transitive dependency reached through multiple chains (via botocore from boto3, and via requests from langfuse and tiktoken). All parent packages already declared ranges permitting 2.7.0, so a lockfile-only upgrade with uv lock --upgrade-package urllib3 was sufficient to advance the resolved version from 2.6.3 to 2.7.0.

pyarrow

pyarrow is a direct dependency in pyproject.toml with the spec >=15.0.0. Because the existing lower bound permitted versions below the patched floor of 23.0.1, the spec was updated to >=23.0.1 to enforce the minimum safe version. The resolver then selected 24.0.0 in uv.lock.

requests

requests is a transitive dependency pulled in by langfuse, tiktoken, and opentelemetry-exporter-otlp-proto-http. All parent packages already allowed requests>=2.33.0, so a lockfile-only upgrade with uv lock --upgrade-package requests advanced the resolved version from 2.32.5 to 2.34.2 without any manifest change.

pygments

pygments is a transitive dependency introduced by rich, which is a direct dependency. rich already declared pygments>=2.13.0,<3.0.0, which permits 2.20.0, so a lockfile-only upgrade with uv lock --upgrade-package pygments was sufficient to advance the resolved version from 2.19.2 to 2.20.0.

idna

idna is a transitive dependency reached through several chains (via anyio and httpx from langfuse and openai, and via requests from langfuse and tiktoken). All parent packages already permitted idna>=3.15, so a lockfile-only upgrade with uv lock --upgrade-package idna advanced the resolved version from 3.11 to 3.18.

Version changes

Package	From	To	Why updated
transformers	5.1.0	5.13.0	Transitive CVE fix (via sentence-transformers); lockfile upgrade
urllib3	2.6.3	2.7.0	Transitive CVE fix (via botocore, requests); lockfile upgrade
pyarrow	>=15.0.0 → 22.0.0 resolved	>=23.0.1 → 24.0.0 resolved	Direct CVE fix; spec lower bound raised in pyproject.toml
requests	2.32.5	2.34.2	Transitive CVE fix (via langfuse, tiktoken); lockfile upgrade
pygments	2.19.2	2.20.0	Transitive CVE fix (via rich); lockfile upgrade
idna	3.11	3.18	Transitive CVE fix (via anyio, httpx, requests); lockfile upgrade
sentence-transformers	5.2.2	5.6.0	Transitive update to allow transformers≥5.3.0
huggingface-hub	1.4.0	1.22.0	Pulled in by transformers/sentence-transformers upgrade
safetensors	0.7.0	0.8.0	Pulled in by transformers/sentence-transformers upgrade
hf-xet	1.2.0	1.5.1	Pulled in by huggingface-hub upgrade
click	8.3.1	8.4.2	Pulled in by sentence-transformers/typer upgrade
typer	— (typer-slim 0.21.1)	0.26.8	Replacement for typer-slim; pulled in by sentence-transformers upgrade
typer-slim	0.21.1	removed	Replaced by typer as part of sentence-transformers upgrade
annotated-doc	—	0.0.4	New transitive dependency added by sentence-transformers upgrade

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #144