Fix Plan

To address the high vulnerability in the required xgrammar version, we need to update to a secure version.

Steps to Update xgrammar Version

• Check the latest secure version of xgrammar on the GitHub advisory page: https://github.com/advisories/GHSA-7rgv-gqhr-fxg3
• Update the requirements/common.txt file to use the secure version of xgrammar:

# Replace the existing xgrammar line with the following
xgrammar==<secure_version>

• Run pip install -r requirements/common.txt to update the xgrammar package
• Verify that the update was successful by checking the xgrammar version:

import pkg_resources
print(pkg_resources.get_distribution('xgrammar').version)

This should print the secure version of xgrammar.

Verification

To verify that the fix worked, check the xgrammar version and ensure it matches the secure version. You can also use tools like pip audit or safety to scan for vulnerabilities in your dependencies.

Extra Tips

• Regularly review your dependencies for vulnerabilities using tools like pip audit or safety.
• Keep your dependencies up-to-date to ensure you have the latest security patches.
• Consider using a dependency management tool like pip-compile to manage your dependencies and ensure consistency across environments.