fix(deps): bump torch to 2.13.0 for GHSA-rrmf-rvhw-rf47

[theCyberTech]

• Force torch>=2.13.0 via override-dependencies so the transitive docling/unstructured stack picks up the CVE-2025-3000 / GHSA-rrmf-rvhw-rf47 fix (torch 2.12.0 → 2.13.0, torchvision 0.27.0 → 0.28.0)
• Remove the now-unnecessary GHSA-rrmf-rvhw-rf47 pip-audit ignore from CI and pre-commit
• Refresh the chromadb ignore comment: CVE-2026-45829 is still unfixed on PyPI (fix merged upstream in [BUG](security): block trust_remote_code in SentenceTransformer embedding function kwargs chroma-core/chroma#7237, no release past 1.5.9); CrewAI only uses embedded PersistentClient, not the vulnerable HTTP server
• Dependabot PR chore(deps): bump chromadb from 1.1.1 to 1.5.9 in the security-updates group across 1 directory #6029 (chromadb → 1.5.9) does not clear GHSA-f4j7-r4q5-qw2c — advisory still marks <=1.5.9 as affected with no patched version

  

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ca7f2d87-9c24-46dd-b66a-8e5684910fbd

📥 Commits

Reviewing files that changed from the base of the PR and between 094b94e and 01644d7.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/vulnerability-scan.yml
• .pre-commit-config.yaml
• pyproject.toml

💤 Files with no reviewable changes (1)

• .pre-commit-config.yaml

---

📝 Walkthrough

Walkthrough

The PR removes the Torch vulnerability ignore, requires torch>=2.13.0, and expands documentation for the retained ChromaDB exception.

Changes

Security policy updates

Layer / File(s)	Summary
Torch enforcement and audit policy pyproject.toml, .github/workflows/vulnerability-scan.yml, .pre-commit-config.yaml	The uv configuration documents the Torch advisory and requires torch>=2.13.0. Vulnerability checks stop ignoring the Torch advisory. The ChromaDB exception remains with expanded context.
Suggested reviewers: joaomdmoura, lorenzejay

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Torch security upgrade and the specific vulnerability it addresses.
Description check	✅ Passed	The description directly explains the Torch override, vulnerability ignore removal, and ChromaDB advisory comment update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-dependabot-security-alerts-81a4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.