Changelog

Tracking Reid filter release notes

v0.1.16 - 2026-10-22Direct link to v0.1.16 - 2026-10-22

Pin the pillow floor to 13.0.0 on Python 3.11 and above, and drop 3.10 from the grype matrix. Neither changes the published image, and this entry says so because the first draft of it claimed otherwise. On 3.11+ >=10.0.0 already resolved to 13.0.0: the v0.1.15 image published on 21 October was built with pillow-13.0.0-cp314, and main's own scan installs 13.0.0 on the 3.14 leg and passes. The floor is a guard against a future resolver downgrade, nothing more. The only leg that ever installed 12.3.0, which carries GHSA-332p-7hrc-92wf, GHSA-w889-685w-c8fh and GHSA-8g5g-8vmr-9782, is 3.10, and that is also the leg this release leaves on the old floor, because 13.0.0 requires 3.11. Those three advisories therefore stay open on 3.10 and this release does not close them; the matrix change stops scanning that leg rather than fixing it. requires-python still admits 3.10, so a 3.10 install remains exposed.

The DINOv2 weights baked at build time now load offline. Two things were wrong and both had to go. The bake ran without HF_HOME, so the weights went to /root/.cache/huggingface while the filter reads /app/models/hfcache as appuser; ENV HF_HOME before the bake fixes where they land. filter.py also set TRANSFORMERS_CACHE to the same path, and transformers 4.x prefers that variable and treats it as the hub cache directly, with no hub/ subdirectory, so the runtime looked one level above the bake and still reached for HuggingFace. That setdefault is gone; HF_HOME alone gives bake and runtime the same layout. The Wingstop lab node has no outbound internet, which is why that pipeline has been pinned to a custom 0.1.14-offline2 image rather than a published tag. Verified by running the built image with docker run --network none.

Rebuild to pick up the Debian security updates published since the 0.1.14 image was built. No code change: the image is dated and the packages it installs have moved on. libcurl3t64-gnutls, pulled in as a dependency of git, goes from 8.14.1-2+deb13u5 to 8.14.1-2+deb13u7, which closes CVE-2026-8924 and CVE-2026-8927 (both CVSS 9.1, and both reported against the deployed image). Python comes from openfilter-base:py3.14, rebuilt weekly, and moves 3.14.7 -> 3.14.8, closing CVE-2026-19445.

Seven further criticals on this image are marked wont-fix by Debian -- six on libcurl3t64-gnutls and one on libxml2 -- and a rebuild does not move them.

No dependency is bumped alongside it, having checked what a bump would buy. Of the three non-Debian packages carrying fixable advisories, python is the one this release actually moves and it comes from the base rather than from here. ffmpeg (7 high, 6 medium) is not ours to raise: it ships inside the av wheel, which openfilter pins at av~=17.1.0, so it moves when that pin does. transformers (3 high, 1 medium) is held below 5 by this project's own transformers>=4.37.0,<5, and the advisories are fixed only in 5.x -- a major bump under a re-identification model, which is not something to carry in a security rebuild.

Raise the openfilter floor to 1.4.0. This repo sat at >=1.2.1, which the bump cascade skips -- it only moves repos on the previous floor -- so it had been missed for several openfilter releases.
Publish the filter's documentation. The docs sync is release-triggered, so the PUBLISHING_PATH fix merged earlier only takes effect now.

Build the filter image on openfilter-base:py3.14 (was py3.11). The published wheel supports Python 3.14, so the image now ships 3.14. Running on 3.10–3.13 is unaffected.

Add Python 3.13 and 3.14 support: raise the requires-python ceiling to <3.15; the CI test matrix now runs 3.10–3.14.

Build the image on openfilter-base (weekly apt-upgraded python-slim) instead of a stale python:X.Y.Z-slim pin, clearing the OS-package CVEs the pin carried.

Bumped torch to 2.13.0 and setuptools to 83.0.0. torch 2.11–2.12.1 pinned setuptools<82, which conflicted with the setuptools 83 bump; torch 2.13.0 requires setuptools>=77.0.3 with no upper bound, so both land together. Base files use plain torch==2.13.0 (PyPI); the cu126 requirements file tracks torch==2.13.0+cu126 / torchvision==0.28.0+cu126.
Removed the exact opencv-python-headless==4.13.0.90 declaration from the core dependencies. The package has no cv2 imports of its own and opencv already arrives transitively through openfilter, so the pin only constrained a dependency this repo does not use directly. The unversioned entry under [tool.uv.extra-build-dependencies].torchreid is unchanged; it exists for build isolation of the optional osnet extra.
Update the openfilter requirement to >=1.2.1,<2.0.0 (was >=0.1.30,<0.2.0, whose ceiling rejected the whole 1.x line and forced the stale opencv resolution).
Pin the Docker base to python:3.11.12-slim.
Refresh the docker-compose.yaml openfilter utility image tags to 1.2.1 and pin the filter's own image to the release version.
Switch dev-tooling pins to >= ranges.

Addes dinov2 and embedding extraction optmizations, including batch processing and GPU support

Add QUICKSTART.md with Docker Compose, local script, OSNet and TransReID examples
Replace notebook-only .env.example with a Docker Compose–focused template covering all FILTER_* parameters
Rewrite README to remove stale template text and document the filter purpose, output contract, and configuration