## Summary
`Security audit` on main fails in `pip scan-packages :: hf-stack` and
`pip scan-packages :: studio` (run 38811240332 on 565630c6b4). Two new
upstream releases moved reviewed findings out of the baseline:
- **unsloth-zoo 2026.10.6** changed several files whose entries are
pinned to a file digest (`vision_utils.py`, `compiler.py`,
`vllm_utils.py`, `mlx/speculative.py`,
`temporary_patches/moe_utils.py`), changed the matched lines in
`mlx/decision.py` and `mlx/loader.py`, and added a new site in
`vllm_gdn_replayssm.py`.
- **transformers 5.20.0** shifted the `while True:` generator in
`testing_utils.py`, which the scanner reads as a polling loop.
No product change caused this; it is the expected churn of evidence-hash
and file-digest keyed entries on a new release, same as #13143, #13472
and #13701.
## Review
I diffed every flagged zoo file between 2026.10.5 (last baselined) and
2026.10.6. The added lines that touch the matched patterns are:
- `mx.eval(...)` MLX array evaluation calls and `model.eval()`
(decision.py, loader.py, speculative.py)
- reads of feature flags (`UNSLOTH_MOE_LORA_PAD_ALWAYS`,
`VLLM_MLA_DISABLE`, `UNSLOTH_VLLM_ONLINE_FP8`, `UNSLOTH_VLLM_REPLAYSSM`,
`VLLM_USE_V2_MODEL_RUNNER`, `UNSLOTH_VLLM_MERGED_ROLLOUT_RESTORE`)
- the `unsloth_fsdp_unshard` import and calls in the compiler header
(zoo #1766)
- the `mask_out_tokens` argument in `vision_utils.py`; the env and IMDS
hits there are still the SSRF guard that lists metadata hosts in order
to block them
- `vllm_gdn_replayssm._edit_method`, which recompiles a vLLM method from
its own `inspect.getsource` text after a textual edit, the same pattern
as the other vLLM patchers
None adds network access, subprocess use, encoded payloads or a new
destination.
The transformers hit is `evaluate_side_effect_factory` in
`testing_utils.py`, a test helper that yields the last value forever
(`while True: yield side_effect_values[-1]`). It was baselined at three
earlier line numbers already.
## Change
Ten entries appended to `scripts/scan_packages_baseline.json`, taken
from `scan_packages.py --write-baseline` over the two failing shards and
filtered to the flagged keys. Nothing is removed, so the older releases
stay covered, and pins carry over: every entry whose site was pinned
before is pinned to the 2026.10.6 file digest. The new
`vllm_gdn_replayssm.py` site is pinned too, since what it execs is
decided by the edit tables and source lookup elsewhere in the file, and
`tests/security/test_scan_packages.py` now requires that pin in both
context-dependent pin tests.
Excluded on purpose: the local run also flagged `multiprocess`, which
comes from a Python-version-specific wheel this host resolves and CI
does not.
## Testing
- Both shards rescanned locally against the new baseline: no unbaselined
unsloth-zoo or transformers finding remains.
- The baseline diff is additions only (10 entries).
- `tests/security/test_scan_packages.py`: 152 passed. Removing the new
pin makes
`test_context_dependent_unsloth_zoo_findings_are_digest_pinned` and
`test_context_dependent_unsloth_zoo_pins_reopen_on_other_file_changes`
fail.
ec411c3f74