[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/ruff-pre-commit: v0.15.16 → v0.15.20

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
torch	2.11.0	CVE-2025-3000 / GHSA-rrmf-rvhw-rf47	No fix available on PyPI

Why this cannot be auto-fixed

CVE-2025-3000 is a critical memory corruption vulnerability in torch.jit.script. According to the OSV advisory, all versions up to and including the latest release (2.12.0) are still affected (last_affected: 2.12.0). A fix requires the upstream PyTorch maintainers to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

Recommended next steps

1. Monitor the GHSA-rrmf-rvhw-rf47 advisory for a patch release
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the vulnerability is resolved.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
torch	2.11.0	CVE-2025-3000	No fix version listed by pip-audit

Why this cannot be auto-fixed

The vulnerability CVE-2025-3000 affects torch.jit.script and was found in PyTorch 2.6.0 (memory corruption). pip-audit reports this for torch 2.11.0 but lists no fix version in its output. The OSV advisory (CVE-2025-3000) uses a GIT commit range rather than a PyPI version range, which means there is no clearly identified patched PyPI release that resolves this vulnerability.

Recommended next steps

1. Monitor the vulnerability advisory for a patch release on PyPI
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced or if the usage of torch.jit.script can be avoided

This PR will not be auto-merged until the vulnerability is resolved.