build(hooks): update pre-commit hooks

[DRL-NextGen]

Updated pre-commit hooks

Hook	From	To
ruff-pre-commit	0.15.20	0.16.1
codespell	2.4.2	2.4.3
uv-pre-commit	0.11.26	0.12.1
markdownlint-cli2	0.23.0	0.23.2
tombi-pre-commit	1.2.0	1.2.6

[DRL-NextGen]

Checks Summary

Last run: 2026-08-05T14:06:27.494Z

Mend Unified Agent vulnerability scan found 7 vulnerabilities:

Severity	Identifier	Package	Details	Fix
🔺 High	CVE-2026-65918	torchvision-0.26.0-cp312-cp312-manylinux_2_28_x86_64.whl	PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul... PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.	Not Available
🔺 High	CVE-2026-58659	lightning-2.6.5-py3-none-any.whl	PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerabi... PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.	Not Available
🔺 High	CVE-2025-14920	transformers-5.14.1-py3-none-any.whl	Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vu... Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25423.	Not Available
🔷 Medium	CVE-2026-65920	diffusers-0.39.0-py3-none-any.whl	Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _g... Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.	Not Available
🔷 Medium	CVE-2025-3000	torch-2.11.0-cp312-cp312-manylinux_2_28_x86_64.whl	A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function to... A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.	torch - 2.13.0
🔷 Medium	CVE-2026-59890	setuptools-80.10.2-py3-none-any.whl	setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python... setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.	Upgrade to version setuptools - 83.0.0,setuptools - 83.0.0,https://github.com/pypa/setuptools.git - 83.0.0
🔸 Low	CVE-2025-63396	torch-2.11.0-cp312-cp312-manylinux_2_28_x86_64.whl	An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.prof... An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).	Not Available