diff --git a/requirements/build/cpu.txt b/requirements/build/cpu.txt index 5a03960e56..7f2f4c7914 100644 --- a/requirements/build/cpu.txt +++ b/requirements/build/cpu.txt @@ -1,7 +1,7 @@ cmake>=3.26.1 ninja packaging>=24.2 -setuptools==77.0.3 # this version can reuse CMake build dir +setuptools==78.1.1 # this version can reuse CMake build dir; >=78.1.1 for GHSA-5rjg-fvgr-3xxf setuptools-scm>=8 setuptools-rust>=1.9.0 torch==2.13.0+cpu; platform_machine == "x86_64" or platform_machine == "s390x" or platform_machine == "aarch64" diff --git a/requirements/build/cuda.txt b/requirements/build/cuda.txt index d9d68022b3..3cc83287bc 100644 --- a/requirements/build/cuda.txt +++ b/requirements/build/cuda.txt @@ -2,7 +2,7 @@ cmake>=3.26.1 ninja packaging>=24.2 -setuptools>=77.0.3,<81.0.0 +setuptools>=78.1.1,<81.0.0 setuptools-scm>=8 setuptools-rust>=1.9.0 torch==2.13.0 diff --git a/requirements/build/rock.txt b/requirements/build/rock.txt index ae4697e612..5ca5ada2af 100644 --- a/requirements/build/rock.txt +++ b/requirements/build/rock.txt @@ -9,7 +9,7 @@ torchaudio==2.11.0+rocm7.14.0 triton==3.7.1+git0263a6a6.rocm7.14.0 cmake>=3.26.1,<4 packaging>=26.2 -setuptools>=77.0.3,<80.0.0 +setuptools>=78.1.1,<80.0.0 setuptools-scm>=8 setuptools-rust>=1.9.0 wheel diff --git a/requirements/build/rocm.txt b/requirements/build/rocm.txt index aedfa66ab0..3c9b6c1796 100644 --- a/requirements/build/rocm.txt +++ b/requirements/build/rocm.txt @@ -9,7 +9,7 @@ torchaudio==2.11.0+rocm7.14.0 triton==3.7.1+git0263a6a6 cmake>=3.26.1,<4 packaging>=26.2 -setuptools>=77.0.3,<80.0.0 +setuptools>=78.1.1,<80.0.0 setuptools-scm>=8 setuptools-rust>=1.9.0 wheel diff --git a/requirements/build/rust.txt b/requirements/build/rust.txt index f507deb803..93dba7b378 100644 --- a/requirements/build/rust.txt +++ b/requirements/build/rust.txt @@ -1,5 +1,5 @@ # Dependencies for building Rust artifacts through setuptools-rust. -setuptools>=77.0.3,<81.0.0 +setuptools>=78.1.1,<81.0.0 setuptools-scm>=9.2.0 setuptools-rust>=1.9.0 wheel diff --git a/requirements/build/tpu.txt b/requirements/build/tpu.txt index 1a791a633f..d9f03cb104 100644 --- a/requirements/build/tpu.txt +++ b/requirements/build/tpu.txt @@ -1,7 +1,7 @@ --extra-index-url https://download.pytorch.org/whl/cpu cmake>=3.26.1 ninja -setuptools>=77.0.3,<81.0.0 +setuptools>=78.1.1,<81.0.0 setuptools-scm>=8 setuptools-rust>=1.9.0 torch==2.13.0+cpu diff --git a/requirements/common.txt b/requirements/common.txt index 669efc4900..eec3c050bc 100644 --- a/requirements/common.txt +++ b/requirements/common.txt @@ -3,7 +3,7 @@ cachetools psutil sentencepiece # Required for LLaMA tokenizer. numpy -requests >= 2.26.0 +requests >= 2.33.0 tqdm blake3 py-cpuinfo @@ -28,7 +28,7 @@ outlines_core == 0.2.14 lark == 1.2.2 xgrammar == 0.2.8; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" typing_extensions >= 4.10 -filelock >= 3.16.1 # need to contain https://github.com/tox-dev/filelock/pull/317 +filelock >= 3.20.3 # need to contain https://github.com/tox-dev/filelock/pull/317; GHSA floor partial-json-parser # used for parsing partial JSON outputs jsonschema >= 4.23.0 # required for MiniMax M3 tool schema validation pyzmq >= 25.0.0 @@ -37,7 +37,7 @@ mistral_common[image] >= 1.11.6 opencv-python-headless >= 4.13.0 # required for video IO pyyaml six>=1.16.0; python_version > '3.11' # transitive dependency of pandas that needs to be the latest version for python 3.12 -setuptools>=77.0.3,<81.0.0; python_version > '3.11' # Setuptools is used by triton, we need to ensure a modern version is installed for 3.12+ so that it does not try to import distutils, which was removed in 3.12 +setuptools>=78.1.1,<81.0.0; python_version > '3.11' # used by triton; >=78.1.1 for GHSA-5rjg-fvgr-3xxf (83.x needed for GHSA-h35f-9h28-mq5c deferred) einops # Required for Qwen2-VL. compressed-tensors == 0.17.0 # required for compressed-tensors depyf==0.20.0 # required for profiling and debugging with compilation config diff --git a/requirements/cpu.txt b/requirements/cpu.txt index b4867a0ff3..191ed26ae0 100644 --- a/requirements/cpu.txt +++ b/requirements/cpu.txt @@ -1,7 +1,7 @@ # Common dependencies -r common.txt -setuptools==77.0.3 # this version can reuse CMake build dir +setuptools==78.1.1 # this version can reuse CMake build dir; >=78.1.1 for GHSA-5rjg-fvgr-3xxf numba == 0.65.0 # Required for N-gram speculative decoding diff --git a/requirements/rocm.txt b/requirements/rocm.txt index 85b196e401..cd7a114721 100644 --- a/requirements/rocm.txt +++ b/requirements/rocm.txt @@ -13,7 +13,7 @@ peft pytest-asyncio tensorizer==2.10.1 packaging>=24.2 -setuptools>=77.0.3,<80.0.0 +setuptools>=78.1.1,<80.0.0 setuptools-scm>=8 setuptools-rust>=1.9.0 runai-model-streamer[s3,gcs,azure]==0.15.7 diff --git a/requirements/test/cpu.txt b/requirements/test/cpu.txt index df685200f3..11fc2991ed 100644 --- a/requirements/test/cpu.txt +++ b/requirements/test/cpu.txt @@ -33,8 +33,9 @@ annotated-types==0.7.0 # via pydantic anthropic==0.112.0 # via -r requirements/test/../common.txt -anyio==4.14.1 +anyio==4.14.2 # via + # -r requirements/test/cuda.in # anthropic # httpx # httpx2 @@ -71,8 +72,10 @@ azure-storage-blob==12.28.0 # via runai-model-streamer-azure backoff==2.2.1 # via -r requirements/test/cuda.in -black==24.10.0 - # via datamodel-code-generator +black==26.5.1 + # via + # -r requirements/test/cuda.in + # datamodel-code-generator blake3==1.0.9 # via -r requirements/test/../common.txt blobfile==3.0.0 @@ -147,8 +150,9 @@ coverage==7.10.6 # via pytest-cov cramjam==2.9.0 # via fastparquet -cryptography==46.0.5 +cryptography==50.0.1 # via + # -r requirements/test/cuda.in # azure-identity # azure-storage-blob # msal @@ -239,17 +243,20 @@ fastrlock==0.8.2 # via cupy-cuda12x fastsafetensors==0.3.3 # via -r requirements/test/cuda.in -filelock==3.16.1 +filelock==4.0.7 # via # -r requirements/test/../common.txt # blobfile # datasets # huggingface-hub + # python-discovery # ray # torch # virtualenv -fonttools==4.55.0 - # via matplotlib +fonttools==4.66.1 + # via + # -r requirements/test/cuda.in + # matplotlib frozendict==2.4.6 # via einx frozenlist==1.5.0 @@ -314,16 +321,20 @@ h11==0.16.0 # httpcore # httpcore2 # uvicorn -h2==4.3.0 - # via httpx +h2==4.4.1 + # via + # -r requirements/test/cuda.in + # httpx harfile==0.5.0 # via schemathesis hf-xet==1.6.0 # via huggingface-hub hiredis==3.0.0 # via tensorizer -hpack==4.1.0 - # via h2 +hpack==4.2.0 + # via + # -r requirements/test/cuda.in + # h2 html2text==2025.4.15 # via gpt-oss httpcore==1.0.9 @@ -345,7 +356,9 @@ httpx==0.27.2 # perceptron # schemathesis httpx2==2.12.0 - # via mcp + # via + # -r requirements/test/cuda.in + # mcp huggingface-hub==1.31.0 # via # -r requirements/test/../common.txt @@ -468,13 +481,16 @@ lm-format-enforcer==0.11.3 # via -r requirements/test/../common.txt loguru==0.7.3 # via compressed-tensors -lxml==5.3.0 +lxml==6.1.3 # via + # -r requirements/test/cuda.in # blobfile # gpt-oss # sacrebleu -mako==1.3.10 - # via alembic +mako==1.4.3 + # via + # -r requirements/test/cuda.in + # alembic markdown-it-py==3.0.0 # via rich markupsafe==3.0.1 @@ -505,14 +521,15 @@ more-itertools==10.5.0 # via lm-eval mpmath==1.3.0 # via sympy -msal==1.34.0 +msal==1.39.0 # via # azure-identity # msal-extensions msal-extensions==1.3.1 # via azure-identity -msgpack==1.1.0 +msgpack==1.2.3 # via + # -r requirements/test/cuda.in # librosa # ray msgspec==0.21.1 @@ -649,8 +666,10 @@ opentelemetry-semantic-conventions-ai==0.4.13 # via -r requirements/test/../common.txt optuna==3.6.1 # via genai-perf -orjson==3.11.5 - # via genai-perf +orjson==3.12.0 + # via + # -r requirements/test/cuda.in + # genai-perf oss-harmony==0.0.11 # via -r requirements/test/../common.txt outlines-core==0.2.14 @@ -677,6 +696,7 @@ packaging==24.2 # statsmodels # transformers # typepy + # virtualenv pandas==2.2.3 # via # datasets @@ -687,7 +707,7 @@ pandas==2.2.3 # statsmodels partial-json-parser==0.2.1.1.post7 # via -r requirements/test/../common.txt -pathspec==0.12.1 +pathspec==1.1.1 # via black pathvalidate==3.2.1 # via pytablewriter @@ -769,12 +789,14 @@ py-cpuinfo==9.0.0 # via -r requirements/test/../common.txt py-spy==0.4.0 # via ray -pyarrow==23.0.0 +pyarrow==25.0.1 # via + # -r requirements/test/cuda.in # datasets # genai-perf -pyasn1==0.6.1 +pyasn1==0.6.4 # via + # -r requirements/test/cuda.in # pyasn1-modules # rsa pyasn1-modules==0.4.2 @@ -821,13 +843,17 @@ pydantic-extra-types==2.10.5 # fastapi # mistral-common pydantic-settings==2.14.2 - # via fastapi -pygments==2.18.0 # via + # -r requirements/test/cuda.in + # fastapi +pygments==2.21.0 + # via + # -r requirements/test/cuda.in # pytest # rich -pyjwt==2.11.0 +pyjwt==2.15.1 # via + # -r requirements/test/cuda.in # mcp # msal pyparsing==3.2.0 @@ -872,6 +898,8 @@ python-dateutil==2.9.0.post0 # matplotlib # pandas # typepy +python-discovery==1.6.1 + # via virtualenv python-dotenv==1.2.2 # via # pydantic-settings @@ -880,10 +908,13 @@ python-json-logger==4.1.0 # via -r requirements/test/../common.txt python-multipart==0.0.32 # via + # -r requirements/test/cuda.in # fastapi # mcp python-rapidjson==1.20 # via tritonclient +pytokens==0.4.1 + # via black pytrec-eval-terrier==0.5.7 # via mteb pytz==2024.2 @@ -933,7 +964,7 @@ regex==2026.2.28 # sacrebleu # tiktoken # transformers -requests==2.32.3 +requests==2.34.2 # via # -r requirements/test/../common.txt # azure-core @@ -1036,7 +1067,7 @@ sentry-sdk==2.63.0 # via fastapi-cloud-cli setproctitle==1.3.7 # via -r requirements/test/../common.txt -setuptools==77.0.3 +setuptools==80.10.2 # via # -r requirements/test/../common.txt # model-hosting-container-standards @@ -1284,8 +1315,9 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2024.2 # via pandas -urllib3==2.2.3 +urllib3==2.8.0 # via + # -r requirements/test/cuda.in # blobfile # botocore # docker @@ -1305,8 +1337,10 @@ uvloop==0.22.1 # via uvicorn vector-quantize-pytorch==1.21.2 # via -r requirements/test/cuda.in -virtualenv==20.31.2 - # via ray +virtualenv==21.14.0 + # via + # -r requirements/test/cuda.in + # ray vocos==0.1.0 # via -r requirements/test/cuda.in watchfiles==1.2.0 @@ -1317,8 +1351,10 @@ wcwidth==0.2.13 # via ftfy websockets==16.0 # via uvicorn -werkzeug==3.1.3 - # via schemathesis +werkzeug==3.1.9 + # via + # -r requirements/test/cuda.in + # schemathesis word2number==1.1 # via lm-eval wrapt==1.17.2 diff --git a/requirements/test/cuda.in b/requirements/test/cuda.in index 87d67fa9ff..d96bff8804 100644 --- a/requirements/test/cuda.in +++ b/requirements/test/cuda.in @@ -80,3 +80,27 @@ datasets>=3.3.0,<=3.6.0 openpyxl # required for perf comparison excel report plotly # required for perf comparison html report + +# Dependabot GHSA floors for transitive test deps (excl. dependabot.yml ignores: +# torch/torchvision/xformers/lm-format-enforcer/compressed-tensors/ray/lm-eval). +# Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp. +urllib3>=2.7.0 +cryptography>=50.0.0 +pyjwt>=2.13.0 +pyasn1>=0.6.4 +python-multipart>=0.0.31 +anyio>=4.14.2 +httpx2>=2.12.0 +werkzeug>=3.1.6 +mako>=1.3.12 +black>=26.3.1 +msgpack>=1.2.1 +lxml>=6.1.0 +pyarrow>=23.0.1 +orjson>=3.11.6 +hpack>=4.2.0 +h2>=4.4.1 +pydantic-settings>=2.14.2 +virtualenv>=20.36.1 +fonttools>=4.60.2 +pygments>=2.20.0 diff --git a/requirements/test/cuda.txt b/requirements/test/cuda.txt index a3ff938b55..cebfd726d5 100644 --- a/requirements/test/cuda.txt +++ b/requirements/test/cuda.txt @@ -36,8 +36,9 @@ anthropic==0.112.0 # via # -c requirements/common.txt # -r requirements/test/../common.txt -anyio==4.14.1 +anyio==4.14.2 # via + # -r requirements/test/cuda.in # anthropic # httpx # httpx2 @@ -76,8 +77,10 @@ azure-storage-blob==12.28.0 # via runai-model-streamer-azure backoff==2.2.1 # via -r requirements/test/cuda.in -black==24.10.0 - # via datamodel-code-generator +black==26.5.1 + # via + # -r requirements/test/cuda.in + # datamodel-code-generator blake3==1.0.9 # via -r requirements/test/../common.txt blobfile==3.0.0 @@ -154,8 +157,9 @@ coverage==7.10.6 # via pytest-cov cramjam==2.9.0 # via fastparquet -cryptography==46.0.5 +cryptography==50.0.1 # via + # -r requirements/test/cuda.in # azure-identity # azure-storage-blob # msal @@ -257,18 +261,21 @@ fastsafetensors==0.3.3 # via # -c requirements/cuda.txt # -r requirements/test/cuda.in -filelock==3.16.1 +filelock==4.0.7 # via # -c requirements/common.txt # -r requirements/test/../common.txt # blobfile # datasets # huggingface-hub + # python-discovery # ray # torch # virtualenv -fonttools==4.55.0 - # via matplotlib +fonttools==4.66.1 + # via + # -r requirements/test/cuda.in + # matplotlib frozendict==2.4.6 # via einx frozenlist==1.5.0 @@ -333,16 +340,20 @@ h11==0.16.0 # httpcore # httpcore2 # uvicorn -h2==4.3.0 - # via httpx +h2==4.4.1 + # via + # -r requirements/test/cuda.in + # httpx harfile==0.5.0 # via schemathesis hf-xet==1.6.0 # via huggingface-hub hiredis==3.0.0 # via tensorizer -hpack==4.1.0 - # via h2 +hpack==4.2.0 + # via + # -r requirements/test/cuda.in + # h2 html2text==2025.4.15 # via gpt-oss httpcore==1.0.9 @@ -364,7 +375,9 @@ httpx==0.27.2 # perceptron # schemathesis httpx2==2.12.0 - # via mcp + # via + # -r requirements/test/cuda.in + # mcp huggingface-hub==1.31.0 # via # -c requirements/common.txt @@ -497,13 +510,16 @@ lm-format-enforcer==0.11.3 # -r requirements/test/../common.txt loguru==0.7.3 # via compressed-tensors -lxml==5.3.0 +lxml==6.1.3 # via + # -r requirements/test/cuda.in # blobfile # gpt-oss # sacrebleu -mako==1.3.10 - # via alembic +mako==1.4.3 + # via + # -r requirements/test/cuda.in + # alembic markdown-it-py==3.0.0 # via rich markupsafe==3.0.1 @@ -539,14 +555,15 @@ more-itertools==10.5.0 # via lm-eval mpmath==1.3.0 # via sympy -msal==1.34.0 +msal==1.39.0 # via # azure-identity # msal-extensions msal-extensions==1.3.1 # via azure-identity -msgpack==1.1.0 +msgpack==1.2.3 # via + # -r requirements/test/cuda.in # librosa # ray msgspec==0.21.1 @@ -733,8 +750,10 @@ opentelemetry-semantic-conventions-ai==0.4.13 # -r requirements/test/../common.txt optuna==3.6.1 # via genai-perf -orjson==3.11.5 - # via genai-perf +orjson==3.12.0 + # via + # -r requirements/test/cuda.in + # genai-perf oss-harmony==0.0.11 # via # -c requirements/common.txt @@ -765,6 +784,7 @@ packaging==24.2 # statsmodels # transformers # typepy + # virtualenv pandas==2.2.3 # via # datasets @@ -775,7 +795,7 @@ pandas==2.2.3 # statsmodels partial-json-parser==0.2.1.1.post7 # via -r requirements/test/../common.txt -pathspec==0.12.1 +pathspec==1.1.1 # via black pathvalidate==3.2.1 # via pytablewriter @@ -862,12 +882,14 @@ py-cpuinfo==9.0.0 # via -r requirements/test/../common.txt py-spy==0.4.0 # via ray -pyarrow==23.0.0 +pyarrow==25.0.1 # via + # -r requirements/test/cuda.in # datasets # genai-perf -pyasn1==0.6.1 +pyasn1==0.6.4 # via + # -r requirements/test/cuda.in # pyasn1-modules # rsa pyasn1-modules==0.4.2 @@ -915,13 +937,17 @@ pydantic-extra-types==2.10.5 # fastapi # mistral-common pydantic-settings==2.14.2 - # via fastapi -pygments==2.18.0 # via + # -r requirements/test/cuda.in + # fastapi +pygments==2.21.0 + # via + # -r requirements/test/cuda.in # pytest # rich -pyjwt==2.11.0 +pyjwt==2.15.1 # via + # -r requirements/test/cuda.in # mcp # msal pyparsing==3.2.0 @@ -966,6 +992,8 @@ python-dateutil==2.9.0.post0 # matplotlib # pandas # typepy +python-discovery==1.6.1 + # via virtualenv python-dotenv==1.2.2 # via # pydantic-settings @@ -974,10 +1002,13 @@ python-json-logger==4.1.0 # via -r requirements/test/../common.txt python-multipart==0.0.32 # via + # -r requirements/test/cuda.in # fastapi # mcp python-rapidjson==1.20 # via tritonclient +pytokens==0.4.1 + # via black pytrec-eval-terrier==0.5.7 # via mteb pytz==2024.2 @@ -1028,7 +1059,7 @@ regex==2026.2.28 # sacrebleu # tiktoken # transformers -requests==2.32.3 +requests==2.34.2 # via # -c requirements/common.txt # -r requirements/test/../common.txt @@ -1133,7 +1164,7 @@ sentry-sdk==2.63.0 # via fastapi-cloud-cli setproctitle==1.3.7 # via -r requirements/test/../common.txt -setuptools==77.0.3 +setuptools==80.10.2 # via # -c requirements/common.txt # -r requirements/test/../common.txt @@ -1395,8 +1426,9 @@ typing-inspection==0.4.2 # pydantic-settings tzdata==2024.2 # via pandas -urllib3==2.2.3 +urllib3==2.8.0 # via + # -r requirements/test/cuda.in # blobfile # botocore # docker @@ -1416,8 +1448,10 @@ uvloop==0.22.1 # via uvicorn vector-quantize-pytorch==1.21.2 # via -r requirements/test/cuda.in -virtualenv==20.31.2 - # via ray +virtualenv==21.14.0 + # via + # -r requirements/test/cuda.in + # ray vocos==0.1.0 # via -r requirements/test/cuda.in watchfiles==1.2.0 @@ -1428,8 +1462,10 @@ wcwidth==0.2.13 # via ftfy websockets==16.0 # via uvicorn -werkzeug==3.1.3 - # via schemathesis +werkzeug==3.1.9 + # via + # -r requirements/test/cuda.in + # schemathesis word2number==1.1 # via lm-eval wrapt==1.17.2 diff --git a/requirements/test/rocm.in b/requirements/test/rocm.in index 42c2b38d0f..d8baae6c5c 100644 --- a/requirements/test/rocm.in +++ b/requirements/test/rocm.in @@ -80,6 +80,29 @@ datasets>=3.3.0,<=3.6.0 openpyxl # required for perf comparison excel report plotly # required for perf comparison html report +# Dependabot GHSA floors for transitive test deps (excl. dependabot.yml ignores). +# Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp. +urllib3>=2.7.0 +cryptography>=50.0.0 +pyjwt>=2.13.0 +pyasn1>=0.6.4 +python-multipart>=0.0.31 +anyio>=4.14.2 +httpx2>=2.12.0 +werkzeug>=3.1.6 +mako>=1.3.12 +black>=26.3.1 +msgpack>=1.2.1 +lxml>=6.1.0 +pyarrow>=23.0.1 +orjson>=3.11.6 +hpack>=4.2.0 +h2>=4.4.1 +pydantic-settings>=2.14.2 +virtualenv>=20.36.1 +fonttools>=4.60.2 +pygments>=2.20.0 + # ROCm-specific extras (not in CUDA cuda.in) rapidfuzz # torchgeo also pulled in `lightning` transitively; disabled for the same diff --git a/requirements/test/rocm.txt b/requirements/test/rocm.txt index 41234d29fd..3714afaf9d 100644 --- a/requirements/test/rocm.txt +++ b/requirements/test/rocm.txt @@ -33,8 +33,9 @@ anthropic==0.93.0 # via # -c requirements/common.txt # -r requirements/test/../common.txt -anyio==4.13.0 +anyio==4.14.2 # via + # -r requirements/test/rocm.in # anthropic # httpx # httpx2 @@ -76,7 +77,9 @@ backoff==2.2.1 bitsandbytes==0.50.0 # via -r requirements/test/rocm.in black==26.3.1 - # via datamodel-code-generator + # via + # -r requirements/test/rocm.in + # datamodel-code-generator blake3==1.0.8 # via -r requirements/test/../common.txt blobfile==3.0.0 @@ -107,7 +110,7 @@ certifi==2026.2.25 # httpx # requests # sentry-sdk -cffi==1.17.1 +cffi==2.1.1 # via # cryptography # soundfile @@ -156,8 +159,9 @@ coverage==7.13.5 # via pytest-cov cramjam==2.11.0 # via fastparquet -cryptography==46.0.0 +cryptography==50.0.1 # via + # -r requirements/test/rocm.in # azure-identity # azure-storage-blob # google-auth @@ -258,7 +262,9 @@ filelock==3.25.2 # torch # virtualenv fonttools==4.62.1 - # via matplotlib + # via + # -r requirements/test/rocm.in + # matplotlib frozendict==2.4.7 # via einx frozenlist==1.8.0 @@ -326,16 +332,20 @@ h11==0.16.0 # httpcore # httpcore2 # uvicorn -h2==4.3.0 - # via httpx +h2==4.4.1 + # via + # -r requirements/test/rocm.in + # httpx harfile==0.5.0 # via schemathesis hf-xet==1.6.0 # via huggingface-hub hiredis==3.3.1 # via tensorizer -hpack==4.1.0 - # via h2 +hpack==4.2.0 + # via + # -r requirements/test/rocm.in + # h2 html2text==2025.4.15 # via gpt-oss httpcore==1.0.9 @@ -357,7 +367,9 @@ httpx==0.27.2 # perceptron # schemathesis httpx2==2.12.0 - # via mcp + # via + # -r requirements/test/rocm.in + # mcp huggingface-hub==1.31.0 # via # -c requirements/common.txt @@ -492,13 +504,16 @@ logistro==2.0.1 # kaleido loguru==0.7.3 # via compressed-tensors -lxml==6.0.2 +lxml==6.1.3 # via + # -r requirements/test/rocm.in # blobfile # gpt-oss # sacrebleu -mako==1.3.10 - # via alembic +mako==1.4.3 + # via + # -r requirements/test/rocm.in + # alembic markdown-it-py==4.0.0 # via rich markupsafe==3.0.3 @@ -538,14 +553,15 @@ more-itertools==10.8.0 # lm-eval mpmath==1.3.0 # via sympy -msal==1.35.1 +msal==1.39.0 # via # azure-identity # msal-extensions msal-extensions==1.3.1 # via azure-identity -msgpack==1.1.2 +msgpack==1.2.3 # via + # -r requirements/test/rocm.in # librosa # ray msgspec==0.21.0 @@ -705,6 +721,7 @@ optuna==3.6.1 # via genai-perf orjson==3.11.7 # via + # -r requirements/test/rocm.in # genai-perf # kaleido oss-harmony==0.0.11 @@ -843,10 +860,13 @@ py-spy==0.4.1 # via ray pyarrow==23.0.1 # via + # -r requirements/test/rocm.in # datasets # genai-perf -pyasn1==0.6.3 - # via pyasn1-modules +pyasn1==0.6.4 + # via + # -r requirements/test/rocm.in + # pyasn1-modules pyasn1-modules==0.4.2 # via google-auth pybase64==1.4.3 @@ -889,14 +909,18 @@ pydantic-extra-types==2.11.1 # via # fastapi # mistral-common -pydantic-settings==2.13.1 - # via fastapi -pygments==2.19.2 +pydantic-settings==2.15.0 # via + # -r requirements/test/rocm.in + # fastapi +pygments==2.21.0 + # via + # -r requirements/test/rocm.in # pytest # rich -pyjwt==2.12.1 +pyjwt==2.15.1 # via + # -r requirements/test/rocm.in # mcp # msal pyparsing==3.3.2 @@ -949,8 +973,9 @@ python-dotenv==1.2.2 # uvicorn python-json-logger==4.1.0 # via -r requirements/test/../common.txt -python-multipart==0.0.26 +python-multipart==0.0.32 # via + # -r requirements/test/rocm.in # fastapi # mcp python-rapidjson==1.23 @@ -1007,7 +1032,7 @@ regex==2026.2.28 # sacrebleu # tiktoken # transformers -requests==2.32.5 +requests==2.34.2 # via # -c requirements/common.txt # -r requirements/test/../common.txt @@ -1347,8 +1372,9 @@ typing-inspection==0.4.2 # mcp # pydantic # pydantic-settings -urllib3==2.6.3 +urllib3==2.8.0 # via + # -r requirements/test/rocm.in # blobfile # botocore # docker @@ -1369,7 +1395,9 @@ uvloop==0.22.1 vector-quantize-pytorch==1.28.0 # via -r requirements/test/rocm.in virtualenv==21.2.0 - # via ray + # via + # -r requirements/test/rocm.in + # ray vocos==0.1.0 # via -r requirements/test/rocm.in watchfiles==1.1.1 @@ -1381,7 +1409,9 @@ wcwidth==0.6.0 websockets==16.0 # via uvicorn werkzeug==3.1.6 - # via schemathesis + # via + # -r requirements/test/rocm.in + # schemathesis word2number==1.1 # via lm-eval wrapt==2.1.2 diff --git a/requirements/test/xpu.in b/requirements/test/xpu.in index a5e7470d6d..28fdf8aacd 100644 --- a/requirements/test/xpu.in +++ b/requirements/test/xpu.in @@ -61,3 +61,23 @@ opentelemetry-semantic-conventions-ai>=0.4.1 cohere_melody>=0.11.1 # required for cohere command reasoning/tool parser tests cohere>=7.0.0 # required for cohere chat v2 api tests (protocol/serving import cohere.types) + +# Dependabot GHSA floors for transitive test deps (excl. dependabot.yml ignores). +urllib3>=2.7.0 +cryptography>=50.0.0 +pyjwt>=2.13.0 +pyasn1>=0.6.4 +python-multipart>=0.0.31 +anyio>=4.14.2 +httpx2>=2.12.0 +werkzeug>=3.1.6 +mako>=1.3.12 +msgpack>=1.2.1 +lxml>=6.1.0 +pyarrow>=23.0.1 +orjson>=3.11.6 +hpack>=4.2.0 +h2>=4.4.1 +pydantic-settings>=2.14.2 +fonttools>=4.60.2 +pygments>=2.20.0 diff --git a/requirements/test/xpu.txt b/requirements/test/xpu.txt index b2a6eb6da1..d6aa92f210 100644 --- a/requirements/test/xpu.txt +++ b/requirements/test/xpu.txt @@ -33,6 +33,7 @@ anthropic==0.122.0 # -r requirements/test/../common.txt anyio==4.14.2 # via + # -r requirements/test/xpu.in # anthropic # httpx # httpx2 @@ -130,6 +131,7 @@ coverage==7.15.4 # via pytest-cov cryptography==50.0.0 # via + # -r requirements/test/xpu.in # azure-identity # azure-storage-blob # google-auth @@ -219,7 +221,9 @@ filelock==3.32.3 # modelscope # torch fonttools==4.64.0 - # via matplotlib + # via + # -r requirements/test/xpu.in + # matplotlib frozenlist==1.8.0 # via # aiohttp @@ -270,17 +274,23 @@ h11==0.16.0 # httpcore # httpcore2 # uvicorn +h2==4.4.1 + # via -r requirements/test/xpu.in harfile==0.5.0 # via schemathesis hf-xet==1.6.0 # via huggingface-hub hiredis==3.4.1 # via tensorizer +hpack==4.2.0 + # via + # -r requirements/test/xpu.in + # h2 html2text==2025.4.15 # via gpt-oss httpcore==1.0.9 # via httpx -httpcore2==2.10.0 +httpcore2==2.13.1 # via httpx2 httptools==0.8.0 # via uvicorn @@ -293,8 +303,9 @@ httpx==0.28.1 # fastapi-cloud-cli # huggingface-hub # model-hosting-container-standards -httpx2==2.10.0 +httpx2==2.13.1 # via + # -r requirements/test/xpu.in # mcp # openai huggingface-hub==1.31.0 @@ -311,6 +322,8 @@ huggingface-hub==1.31.0 # transformers humanize==4.16.0 # via runai-model-streamer +hyperframe==6.1.0 + # via h2 hypothesis==6.165.10 # via # hypothesis-graphql @@ -441,14 +454,18 @@ loguru==0.7.3 # via compressed-tensors lxml==6.1.1 # via + # -r requirements/test/xpu.in # blobfile # gpt-oss # sacrebleu +mako==1.4.3 + # via -r requirements/test/xpu.in markdown-it-py==4.2.0 # via rich markupsafe==3.0.3 # via # jinja2 + # mako # werkzeug matplotlib==3.11.1 # via -r requirements/test/xpu.in @@ -495,7 +512,9 @@ msal==1.38.0 msal-extensions==1.3.1 # via azure-identity msgpack==1.2.1 - # via librosa + # via + # -r requirements/test/xpu.in + # librosa msgspec==0.21.1 # via -r requirements/test/../common.txt mteb==2.19.4 @@ -638,6 +657,8 @@ opentelemetry-semantic-conventions-ai==0.5.1 # -c requirements/common.txt # -r requirements/test/../common.txt # -r requirements/test/xpu.in +orjson==3.12.0 + # via -r requirements/test/xpu.in oss-harmony==0.0.11 # via # -c requirements/common.txt @@ -730,9 +751,13 @@ psutil==7.2.2 py-cpuinfo==9.0.0 # via -r requirements/test/../common.txt pyarrow==25.0.1 - # via datasets + # via + # -r requirements/test/xpu.in + # datasets pyasn1==0.6.4 - # via pyasn1-modules + # via + # -r requirements/test/xpu.in + # pyasn1-modules pyasn1-modules==0.4.2 # via google-auth pybase64==1.5.0 @@ -774,15 +799,19 @@ pydantic-extra-types==2.11.1 # fastapi # mistral-common pydantic-settings==2.15.0 - # via fastapi + # via + # -r requirements/test/xpu.in + # fastapi pyelftools==0.33 # via triton-xpu pygments==2.21.0 # via + # -r requirements/test/xpu.in # pytest # rich pyjwt==2.13.0 # via + # -r requirements/test/xpu.in # mcp # msal pyparsing==3.3.2 @@ -832,6 +861,7 @@ python-json-logger==4.2.0 # via -r requirements/test/../common.txt python-multipart==0.0.32 # via + # -r requirements/test/xpu.in # fastapi # mcp pytrec-eval-terrier==0.5.10 @@ -1193,6 +1223,7 @@ umf==1.1.0 # torch urllib3==2.7.0 # via + # -r requirements/test/xpu.in # blobfile # botocore # docker @@ -1218,7 +1249,9 @@ wcwidth==0.8.3 websockets==17.0.1 # via uvicorn werkzeug==3.1.8 - # via schemathesis + # via + # -r requirements/test/xpu.in + # schemathesis word2number==1.1 # via lm-eval xgrammar==0.2.8 diff --git a/requirements/xpu.txt b/requirements/xpu.txt index fd5b3214f0..d9d0f3080f 100644 --- a/requirements/xpu.txt +++ b/requirements/xpu.txt @@ -8,7 +8,7 @@ cmake>=3.26.1 packaging>=24.2 setuptools-scm>=8 setuptools-rust>=1.9.0 -setuptools>=77.0.3,<81.0.0 +setuptools>=78.1.1,<81.0.0 wheel jinja2>=3.1.6 datasets # for benchmark scripts diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 6c1a8fe727..99878a52ab 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -379,7 +379,7 @@ dependencies = [ "getrandom 0.2.17", "instant", "pin-project-lite", - "rand 0.8.5", + "rand 0.8.6", "tokio", ] @@ -493,6 +493,15 @@ dependencies = [ "alloc-stdlib", ] +[[package]] +name = "bs58" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4" +dependencies = [ + "tinyvec", +] + [[package]] name = "bstr" version = "1.12.1" @@ -2174,10 +2183,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359" dependencies = [ "jiff-static", + "jiff-tzdb-platform", "log", "portable-atomic", "portable-atomic-util", "serde_core", + "windows-sys 0.61.2", ] [[package]] @@ -2191,6 +2202,21 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "jiff-tzdb" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e" + +[[package]] +name = "jiff-tzdb-platform" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8" +dependencies = [ + "jiff-tzdb", +] + [[package]] name = "jobserver" version = "0.1.34" @@ -3039,7 +3065,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" dependencies = [ "phf_shared", - "rand 0.8.5", + "rand 0.8.6", ] [[package]] @@ -3379,9 +3405,9 @@ checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f" [[package]] name = "pyo3" -version = "0.28.3" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12" +checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b" dependencies = [ "libc", "once_cell", @@ -3393,18 +3419,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.28.3" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e" +checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9" dependencies = [ "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.28.3" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e" +checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327" dependencies = [ "libc", "pyo3-build-config", @@ -3412,9 +3438,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.28.3" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813" +checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -3424,22 +3450,21 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.28.3" +version = "0.29.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb" +checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952" dependencies = [ "heck", "proc-macro2", - "pyo3-build-config", "quote", "syn 2.0.117", ] [[package]] name = "pythonize" -version = "0.28.0" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b79f670c9626c8b651c0581011b57b6ba6970bb69faf01a7c4c0cfc81c43f95" +checksum = "6ec376e1216e0c929a74964ce2020012a1a39f32d80e78aa688721219ea7fb89" dependencies = [ "pyo3", "serde", @@ -3475,9 +3500,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" dependencies = [ "libc", "rand_chacha 0.3.1", @@ -3899,9 +3924,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.9" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", @@ -4276,15 +4301,17 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.18.0" +version = "3.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f" +checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a" dependencies = [ "base64 0.22.1", + "bs58", "chrono", "hex", "indexmap 1.9.3", "indexmap 2.13.0", + "jiff", "schemars 0.9.0", "schemars 1.2.1", "serde_core", @@ -4295,9 +4322,9 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.18.0" +version = "3.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65" +checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46" dependencies = [ "darling 0.23.0", "proc-macro2", @@ -4973,6 +5000,12 @@ dependencies = [ "serde_json", ] +[[package]] +name = "tinyvec" +version = "1.13.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" + [[package]] name = "tls-listener" version = "0.11.2" @@ -5549,7 +5582,7 @@ dependencies = [ "getopts", "log", "phf_codegen", - "rand 0.8.5", + "rand 0.8.6", ] [[package]] diff --git a/rust/Cargo.toml b/rust/Cargo.toml index e0d3708daa..39f4ab1a57 100644 --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -78,8 +78,8 @@ prometheus-client-derive-encode = "0.5.0" prost = "0.14.3" prost-types = "0.14.3" protox = "0.9.1" -pyo3 = "0.28.3" -pythonize = "0.28.0" +pyo3 = "0.29.0" +pythonize = "0.29.0" rand = "0.9.2" rand_distr = "0.5.1" rayon = "1.11.0" @@ -97,7 +97,7 @@ serde_default = "0.2.0" serde_json = { version = "1.0.145", features = ["preserve_order"] } serde_repr = "0.1.20" serde_tuple = "1.1.3" -serde_with = "3.18.0" +serde_with = "3.21.0" serial_test = { version = "3.2.0", features = ["file_locks"] } sha2 = "0.10.9" smallvec = "1.15.1"