Bump cryptography 50.0.0 + aiohttp 3.14.3 in visual-retrieval-colpali (3 Mend HIGH CVEs)

[odosk]

⚠️ This PR was created by an AI assistant (Claude). Please review all changes carefully before merging.

Once approved, please merge it — this is an automated dependency-update PR and merging is the final step that closes out the linked Mend/Jira findings.

Summary

Bumps cryptography and aiohttp in visual-retrieval-colpali/src/legacy-requirements.txt to the first releases that patch three Mend HIGH findings. Two other CVEs Mend reports against this repo have no released upstream fix and are documented below rather than papered over.

Changed Files

visual-retrieval-colpali/src/legacy-requirements.txt

• cryptography: 48.0.1 → 50.0.0
• aiohttp: 3.14.1 → 3.14.3

CVEs Addressed

Verified against OSV.dev:

Package	CVE(s)	Severity	Fix version reached
cryptography	CVE-2026-69247	HIGH	50.0.0
cryptography	CVE-2026-69249	HIGH	49.0.0 (reached via 50.0.0)
aiohttp	CVE-2026-69244	HIGH	3.14.3

• CVE-2026-69247 — PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing. OSV: introduced 44.0.0, fixed 50.0.0.
• CVE-2026-69249 — duplicate self-signed intermediates cause exponential path-building. OSV: fixed 49.0.0.
• CVE-2026-69244 — out-of-bounds heap read in the C HTTP response parser error path on a malformed chunked response. OSV: fixed 3.14.3.

Both packages are transitive and bounded only from below, so neither bump violates a declared range:

pyvespa 1.2.4         → cryptography>=48.0.1        (floor only)
fsspec / datasets     → aiohttp!=4.0.0a0,!=4.0.0a1  (excludes alphas only)

⚠️ Cannot fix in this PR

Package	CVE	Severity	Reason
sentence-transformers @ 5.5.1	CVE-2026-68770	CRITICAL	No fixed release exists. The flaw is the or os.path.exists(model_name_or_path) short-circuit in import_module_class (sentence_transformers/util/misc.py), which satisfies the trust gate for any local path. That clause is still present in the current 5.6.1 release, carrying an explicit upstream TODO(v6.0): remove the 'or os.path.exists(...)' short-circuit ... requiring trust_remote_code for local custom code (#3801). Upstream has deprecated it with a FutureWarning and deferred removal to v6.0, so bumping to 5.6.1 would be a no-op for this CVE. Tracking upstream issue: huggingface/sentence-transformers#3801.
torchvision @ 0.28.0	CVE-2026-65918	HIGH	No fixed release exists. The advisory states "through 0.28.0, fixed in commit 4e05dc2" — the fix is committed upstream but unreleased; 0.28.0 is still the newest version on PyPI. Source file is reverse-image-search/script/requirements.txt (torchvision>=0.20.0), which already floats to latest. Re-check on the next torchvision release.
transformers	CVE-2025-14920	HIGH	Believed a Mend false positive — see below.

⚠️ Likely false positives — please report to Mend

Mend artifact	Why this is incorrect (summary)	Full evidence
transformers CVE-2025-14920	Advisory is bounded at last_affected 4.54.1; every transformers pin in this repo is far newer (5.12.0).	Detail below.

CVE-2025-14920 in transformers — the ZDI advisory is bounded at last_affected: 4.54.1. This repo pins transformers==5.12.0 in visual-retrieval-colpali/pyproject.toml and transformers>=5.0.0 in reverse-image-search/script/requirements.txt; neither can resolve into the affected range. The same finding has been raised and dismissed on ten other Vespa repos. Suggested improvement for Mend: honour the advisory's last_affected bound instead of reporting every transformers artifact regardless of version.

Implementation Notes

Why these two pins were edited directly rather than recompiling. legacy-requirements.txt is a uv pip compile output, so the normal move is to regenerate it. That is currently impossible — visual-retrieval-colpali/pyproject.toml no longer resolves:

$ uv pip compile pyproject.toml
  × No solution found when resolving dependencies:
  ╰─▶ ... sentence-transformers>=3.2.0,<=3.4.1 depends on transformers>=4.41.0,<5.0.0
      and vidore-benchmark>=5.0.0 depends on sentence-transformers>=3.0.1,<4.0.0,
      we can conclude that vidore-benchmark>=5.0.0 depends on transformers>=4.34.0,<5.0.0.
      And because visual-retrieval-colpali depends on
      vidore-benchmark[interpretability]>=5.0.0 and transformers==5.12.0, we
      can conclude that your requirements are unsatisfiable.

Editing the two pins in place matches how this file has actually been maintained — Renovate has landed five surgical single-pin security bumps to it (pillow, httplib2, setuptools, torch, pyasn1).

⚠️ Two pre-existing problems worth a follow-up (not introduced here)

Both were found while validating this change and need an owner decision; neither is caused by this PR:

1. pyproject.toml is unsatisfiable (output above). transformers==5.12.0 conflicts with the vidore-benchmark>=5.0.0,<5.1.0 → sentence-transformers<4.0.0 → transformers<5.0.0 chain. Until this is reconciled the documented uv install path in the README cannot work, and the file can never be regenerated.
2. legacy-requirements.txt is itself unsatisfiable, independently of this PR. Verified on unmodified master:

   × No solution found: colpali-engine>=0.3.17 depends on torch>=2.2.0,<2.12.0
     ... And because you require torch==2.13.0, your requirements are unsatisfiable.
   

   Renovate's torch → 2.13.0 security bump moved it past colpali-engine's ceiling. So pip install -r src/legacy-requirements.txt (the path the README gives for the HuggingFace space) already fails on master today.

This PR deliberately does not attempt to fix either — both need a real dependency-set decision (pin vidore-benchmark lower, drop it, or move off colpali-engine 0.3.x), which is out of scope for a CVE bump.

Pre-existing CI failure (not caused by this PR)

test / htmlproofer (workflow Link checker) fails on this PR and on unmodified master — six consecutive failures on master from 2026-08-03 through 2026-08-05. The cause is a dead external link, unrelated to this change:

Checking 307 external links
For the Links > External check, the following failures were found:
  External link https://www.shad4fasthtml.com/ failed (status code 404)
HTML-Proofer found 1 failure!

Left alone deliberately: fixing an unrelated dead doc link does not belong in a CVE bump.

Verification

• OSV.dev queried per package for each CVE; fix versions above are fixed events from those records, not Mend's claim
• pyvespa / fsspec / datasets requires_dist inspected on PyPI to confirm no upper bound is crossed
• uv pip install --dry-run -r src/legacy-requirements.txt run in a python:3.10-slim container on both unmodified master and this branch — identical failure on each, confirming this change neither introduces nor worsens the pre-existing conflict
• No test suite was run: the app's dependency set cannot be installed at all (see above), so there is nothing runnable to exercise
• Re-run the Mend scan after merge to confirm the three listed CVEs clear