Fix 3 issues flagged across 3 files

[begininvoke]

A scan flagged a few things in this repository. This changes 3 files — one item each, described below.

1. pytorch/Embedding/m3e_base/requirements.txt, around line 2

The CVE describes a deserialization flaw in Hugging Face Transformers' MobileViTV2 handling, allowing remote code execution if a malicious configuration file is processed. This is a genuine high‑risk vulnerability in transformers <4.48.0, requiring code execution in the user's context. The fix is to upgrade to the patched version.

Update transformers to version 5.10.0 to address multiple high severity CVEs reported by Trivy. This single-line version bump resolves all known advisories while preserving the rest of the dependencies.

For reference: rule CVE-2024-11392. Rated high.

2. pytorch/Embedding/bge_m3/requirements.txt, around line 3

The transformers library version 4.44.0 has a vulnerability (CVE-2026-5241) where LightGlue's model loading process improperly respects the trust_remote_code flag from untrusted config.json, allowing arbitrary code execution when loading a malicious model. This poses a high risk of credential theft, lateral movement, and persistence in environments like inference servers, notebooks, and CI/CD pipelines. Upgrading to version 5.5.0 or later mitigates this issue.

Update transformers to version 5.10.0 to resolve two high‑severity CVEs.

For reference: rule CVE-2026-5241. Rated high.

3. pytorch/Embedding/bge_reranker_large/requirements.txt, around line 3

CVE‑2024‑11393 is a deserialization vulnerability in Hugging Face Transformers (versions ≤4.44.0) that allows untrusted model files to be deserialized without validation. An attacker can craft a malicious model file that, when loaded, executes arbitrary code in the context of the current user. Exploitation requires user interaction (e.g., opening a malicious file or visiting a page), but the impact is remote code execution with the privileges of the application, posing a high risk.

Upgrade transformers from 4.44.0 to 5.3.0 to address two high‑severity CVEs (CVE‑2024‑11393 and CVE‑2026‑4372).

For reference: rule CVE-2024-11393. Rated high.

Take or leave whichever parts are useful. If this is not the right approach, closing is fine.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.