From f720892fdcdac4ed47435c5b5832e5444044179e Mon Sep 17 00:00:00 2001 From: Sonic Shih Date: Wed, 29 Jul 2026 07:40:42 +0800 Subject: [PATCH] fix(security): update tract ONNX dependency --- rust_hft/Cargo.lock | 86 ++++++++++++++----- .../strategy-framework/infer-onnx/Cargo.toml | 2 +- 2 files changed, 64 insertions(+), 24 deletions(-) diff --git a/rust_hft/Cargo.lock b/rust_hft/Cargo.lock index dfc183eb4..a9a449495 100644 --- a/rust_hft/Cargo.lock +++ b/rust_hft/Cargo.lock @@ -2048,7 +2048,7 @@ dependencies = [ "hashbrown 0.16.1", "memmap2", "regex", - "safetensors", + "safetensors 0.7.0", "serde", "textdistance", ] @@ -2174,7 +2174,7 @@ dependencies = [ "rand 0.9.4", "rand_distr 0.5.1", "rayon", - "safetensors", + "safetensors 0.7.0", "thiserror 2.0.18", "yoke", "zip 7.2.0", @@ -2213,7 +2213,7 @@ version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766" dependencies = [ - "nom", + "nom 7.1.3", ] [[package]] @@ -4849,7 +4849,7 @@ dependencies = [ "byteorder", "crossbeam-channel", "flate2", - "nom", + "nom 7.1.3", "num-traits", ] @@ -7472,6 +7472,24 @@ dependencies = [ "minimal-lexical", ] +[[package]] +name = "nom" +version = "8.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405" +dependencies = [ + "memchr", +] + +[[package]] +name = "nom-language" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2de2bc5b451bfedaef92c90b8939a8fff5770bdcc1fafd6239d086aab8fa6b29" +dependencies = [ + "nom 8.0.0", +] + [[package]] name = "ntapi" version = "0.4.3" @@ -7827,6 +7845,12 @@ version = "1.0.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" +[[package]] +name = "pastey" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec" + [[package]] name = "percent-encoding" version = "2.3.2" @@ -9284,6 +9308,16 @@ version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f" +[[package]] +name = "safetensors" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "172dd94c5a87b5c79f945c863da53b2ebc7ccef4eca24ac63cca66a41aab2178" +dependencies = [ + "serde", + "serde_json", +] + [[package]] name = "safetensors" version = "0.7.0" @@ -10838,9 +10872,9 @@ dependencies = [ [[package]] name = "tract-core" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7b5347639690871b124593a8c8903f1f369531498b8abaebd18eb5c58163971" +checksum = "3f0674154b96abb73f8bdade9e6b6e22fa65f4e13da8d84c0659bd7d3c4739b9" dependencies = [ "anyhow", "anymap3", @@ -10855,7 +10889,7 @@ dependencies = [ "num-complex", "num-integer", "num-traits", - "paste", + "pastey", "rustfft", "smallvec", "tract-data", @@ -10864,9 +10898,9 @@ dependencies = [ [[package]] name = "tract-data" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0a3f476a1804e05708e9bc5e2d29dcab82bad531e357d3d14d7da80fbba0b6d" +checksum = "5a0972068b06792ef536df873857854c41109aefa3ad90432e09b0b6549e7523" dependencies = [ "anyhow", "downcast-rs", @@ -10875,9 +10909,11 @@ dependencies = [ "half", "itertools 0.12.1", "lazy_static", + "libm", "maplit", "ndarray 0.16.1", - "nom", + "nom 8.0.0", + "nom-language", "num-integer", "num-traits", "parking_lot", @@ -10888,9 +10924,9 @@ dependencies = [ [[package]] name = "tract-hir" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dca047ba1151fe3446fb0194d4b6ddb9ae8f361337c47a267870c53605fbafb" +checksum = "fe50ad4a84553a75c2eeba7b705ff32f862d7e4bdb5892397b4560ec59d1627d" dependencies = [ "derive-new 0.5.9", "log", @@ -10899,9 +10935,9 @@ dependencies = [ [[package]] name = "tract-linalg" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb8e0703eb53ef1bbf77050ff261675818dd5f0d6c27044c6e48ede9b845f9e0" +checksum = "a7b582f6ef2dcf32a78f043bbbb93ebc54af247c95cd5d18d5f8b36af47a273e" dependencies = [ "byteorder", "cc", @@ -10916,8 +10952,7 @@ dependencies = [ "liquid-derive", "log", "num-traits", - "paste", - "rayon", + "pastey", "scan_fmt", "smallvec", "time", @@ -10928,14 +10963,19 @@ dependencies = [ [[package]] name = "tract-nnef" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72cb88a4367ec2c695610223cf886f01fc1deb5c9a82c7a74b1a5d32dc0b1466" +checksum = "d4c317f94210bdfc0b81913965c7d7439d401527cc8d9bbc85fffbb59b09af5c" dependencies = [ "byteorder", "flate2", + "liquid", + "liquid-core", "log", - "nom", + "nom 8.0.0", + "nom-language", + "safetensors 0.6.2", + "serde_json", "tar", "tract-core", "walkdir", @@ -10943,9 +10983,9 @@ dependencies = [ [[package]] name = "tract-onnx" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f5830aa672b2aa4dc98a97a36e5988eaf77b3ecee65e2601619588d2ca557008" +checksum = "30cf71aa3c8a2ca05258ee0750e428cf2d0e8a38781ccd2ab9a0900551684c2b" dependencies = [ "bytes", "derive-new 0.5.9", @@ -10961,9 +11001,9 @@ dependencies = [ [[package]] name = "tract-onnx-opl" -version = "0.21.10" +version = "0.22.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "121d3d224c806ba3d941f4bb50943ad33b59d1da5ae704d0e4e76d2808221f96" +checksum = "a34a0c0d726b7adc04e3ae956fa1e091ac6a33d4b9bc52ef678108c5445efb7d" dependencies = [ "getrandom 0.2.17", "log", diff --git a/rust_hft/strategy-framework/infer-onnx/Cargo.toml b/rust_hft/strategy-framework/infer-onnx/Cargo.toml index 2ba42bca9..422b3a90b 100644 --- a/rust_hft/strategy-framework/infer-onnx/Cargo.toml +++ b/rust_hft/strategy-framework/infer-onnx/Cargo.toml @@ -9,5 +9,5 @@ anyhow = "1" hex = { workspace = true } ndarray = "0.15" sha2 = { workspace = true } -tract-onnx = "0.21" +tract-onnx = "0.22.2" tracing = "0.1"