Hugging Face Transformers: Patch release v5.22.2

Source available — automated, not human-reviewed

Component: transformers · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-06.

Compatibility not verified — check source notes

$ python -m pip install 'transformers==5.22.2'

📄 .MD

🔧 Bug Fixes 2

⚡ Executive Summary (TL;DR)

This patch addresses security vulnerabilities in Jinja sandboxing and fixes distributed computing device handling. The updates resolve internal issues without requiring user code changes.

Visit Hugging Face Transformers Official Site ↗ Official Release Source ↗ All Hugging Face Transformers Releases 📡 Hugging Face Transformers RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Review applications using Jinja templates or distributed NCCL training for potential security or device assignment impacts.

📊 Product & Engineering Leads

Security and distributed training reliability improvements support safer model deployment workflows.

⚙️ DevOps & Security

Verify CI/CD pipelines with distributed training workloads after checking NCCL device assignment behavior.

🔧 Bug Fixes & Patches (2)

Hardened Jinja sandboxing to prevent potential template injection attacks
Fixed device_id assignment in distributed NCCL contexts to apply only when appropriate

📄 View Raw Release Notes (Original Developer Log)

# Patch release v5.22.2 Some in between patch for security and distributed fixes. See the included commits :hugs: - [Distributed] Set device_id only for NCCL (#50281) by @michaelbenayoun and @3outeille - Harden our Jinja sandboxing (#50431) by @Rocketknight1 **Full Changelog**: https://github.com/huggingface/transformers/compare/v5.22.1...v5.22.2

← Older Version Hugging Face Transformers v5.22.1

Newer Version → Latest Tracked Version ✓