open-rag-eval (>=0.2.4, <=0.3.0) potentially affected by CVE-2026-9856 via transformers (4.50.2)

transformers PYPI version 4.50.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - open-rag-eval =0.2.4, =0.3.0 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...