-
Notifications
You must be signed in to change notification settings - Fork 26.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use mkstemp
to replace deprecated mktemp
#23372
Conversation
The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html).
The documentation is not available anymore as the PR was closed or merged. |
Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for updating this!
Hi @sgugger /@amyeroberts, Can you please add this patch in huntr report. Thanks. |
@ready-research Should be done now! |
Is this change going to be included in a release soon? |
* Use `mkstemp` to replace deprecated `mktemp` The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html). * Update src/transformers/utils/hub.py Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com> --------- Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
* Use `mkstemp` to replace deprecated `mktemp` The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html). * Update src/transformers/utils/hub.py Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com> --------- Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
This is being reported as having the fix for https://nvd.nist.gov/vuln/detail/CVE-2023-2800 Is there an estimate on the time to release? |
You can install HF from the commit ID with the fix this way: $ pip install --no-cache-dir git+https://github.com/huggingface/transformers.git@80ca924 and you should have:
|
Do we have any ETA when will we release this security fix? |
As indicated on the page, v4.30.0 (released last week) contains the fix. |
* Use `mkstemp` to replace deprecated `mktemp` The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html). * Update src/transformers/utils/hub.py Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com> --------- Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
The
tempfile.mktemp
function is deprecated due to security issues.What does this PR do?
Fixes Tempfile issue disclosed in huntr.
Before submitting
Pull Request section?
to it if that's the case.
documentation guidelines, and
here are tips on formatting docstrings.
Who can review?
Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.
@sgugger Can you please review these changes and approve this fix? Thanks.