Security: Outbound HTTP request at import time without timeout

[tomaioo]

Summary

Security: Outbound HTTP request at import time without timeout

Problem

Severity: Low | File: inference/core/__init__.py:L20

The package performs a network call to GitHub during import/version check and does not set a timeout. This can block startup indefinitely in constrained networks and can be abused for availability degradation (slow or hung connections).

Solution

Set a short timeout (e.g., requests.get(..., timeout=3)) and ensure failures are non-blocking. Consider deferring the check to a background task only.

Changes

• inference/core/__init__.py (modified)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}