Security: transformers CVEs and migration to 5.x

Current State

• Version: transformers>=4.57.2,<5.0.0 → resolved to 4.57.6
• Constraint rationale (from pyproject.toml): "CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports"

How transformers is used in OGX

1. Directly: src/ogx/providers/inline/inference/sentence_transformers/sentence_transformers.py:245

   • AutoModelForCausalLM + AutoTokenizer for loading reranker models (Qwen3-Reranker)
   • Used for tokenization and inference in the rerank provider

2. Indirectly: via sentence-transformers>=5.6.0

   • Used for embedding models (e.g., nomic-ai/nomic-embed-text-v1.5)
   • The HybridCache import issue likely originates from sentence-transformers

CVEs on the advisory list

High severity

CVE	Advisory	Affected component
CVE-2026-9856	GHSA-xrqw-3rrv-vx5w	save_pretrained path traversal via chat template names
CVE-2026-5241	GHSA-fgcw-684q-jj6r	Arbitrary code execution in LightGlue model loading path
CVE-2026-4372	GHSA-29pf-2h5f-8g72	Remote code execution in transformers

Moderate severity

CVE	Advisory	Affected component
CVE-2026-1839	GHSA-69w3-r845-3855	Arbitrary code execution in Trainer class
CVE-2025-6921	GHSA-4w7r-h757-3r74	ReDoS in AdamWeightDecay optimizer
CVE-2025-6051	GHSA-rcv9-qm8p-9p6j	ReDoS in transformers
CVE-2025-6638	GHSA-59p9-h35m-wg4g	ReDoS through MarianTokenizer

Blocking issue: 5.x migration

The constraint <5.0.0 was added because "5.x breaks HybridCache imports". This is likely a breaking change in `sentence-transformers's internal usage of transformers internals, not a direct ogx dependency.

Investigation needed

1. What specific HybridCache import breaks and whether we can work around it with a shim
2. Whether CVE-2026-4372 impacts ogx's usage path (reranker + embedding model loading)