GHSA-fgcw-684q-jj6 is scoped too broadly as transformers < 5.5.0 because LightGlue, the class introducing the vulnerability, was not implemented until 5.2.0 (see https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619). As a result, software relying on transformers 4.x (and below) are erroneously flagged by scanners as containing this critical vulnerability and in many cases blocked from deployment. Instead, the scope should be at maximum >= 5.2.0, < 5.5.0. PR #8812 should address this issue.
GHSA-fgcw-684q-jj6 is scoped too broadly as
transformers < 5.5.0because LightGlue, the class introducing the vulnerability, was not implemented until 5.2.0 (see https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619). As a result, software relying ontransformers4.x (and below) are erroneously flagged by scanners as containing this critical vulnerability and in many cases blocked from deployment. Instead, the scope should be at maximum>= 5.2.0, < 5.5.0. PR #8812 should address this issue.