Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-vllm for openSUSE:Factory checked in at 2026-10-18 22:54:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-vllm (Old) and /work/SRC/openSUSE:Factory/.python-vllm.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-vllm" Sun Oct 18 22:54:26 2026 rev:13 rq:1386032 version:0.32.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-vllm/python-vllm.changes 2026-10-15 12:20:56.639085877 +0200 +++ /work/SRC/openSUSE:Factory/.python-vllm.new.3698736/python-vllm.changes 2026-10-18 22:54:56.955208381 +0200 @@ -1,0 +2,25 @@ +Sun Oct 18 17:29:11 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.32.0: + * New POST /v1/systemone endpoint for structured decisions; + generic hf tool-call and reasoning parsers + * NVFP4/FP8 KV cache on more GPUs; Model Runner V2 default + on ROCm; new models EmbeddingGemma 2, MiniCPM-V 4.7, + Nemotron 3.5 ASR + * CVE-2026-73560: chat-template resource exhaustion, now + bounded by VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT + (GHSA-4hhp-h66f-j5j7); tokenizer max_token_id and P2P ZMQ + fixes (GHSA-q97c-p368-75c4, GHSA-frvg-qw88-hww9) + * Breaking: Python 3.10 dropped; CORS origins restricted; + transformers>=5.16.1,<5.20.0, tokenizers>=0.23.2; + mamba_cache_mode "all" and cascade attention removed + * Many more fixes and improvements; see upstream's release + notes for the full list +- Drop fix-CVE-2026-105775.patch as obsolete: upstream removed + mamba_cache_mode "all" (#58997); keep carrying + fix-CVE-2026-105922.patch (upstream PR #57762 still open) +- Dependency floors follow upstream: setuptools>=78.1.1, + transformers>=5.16.1, tokenizers>=0.23.2, aiohttp>=3.14.3, + pillow>=12.3.0, requests>=2.33.0, filelock>=3.20.3 + +------------------------------------------------------------------- Old: ---- fix-CVE-2026-105775.patch vllm-0.31.0.tar.gz New: ---- vllm-0.32.0.tar.gz ----------(Old B)---------- Old: notes for the full list - Drop fix-CVE-2026-105775.patch as obsolete: upstream removed mamba_cache_mode "all" (#58997); keep carrying ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-vllm.spec ++++++ --- /var/tmp/diff_new_pack.pNVpzM/_old 2026-10-18 22:55:01.768410556 +0200 +++ /var/tmp/diff_new_pack.pNVpzM/_new 2026-10-18 22:55:01.769410598 +0200 @@ -48,7 +48,7 @@ %define acl_version 52.6.0 %bcond_without libalternatives Name: python-vllm%{psuffix} -Version: 0.31.0 +Version: 0.32.0 Release: 0 Summary: A high-throughput and memory-efficient inference and serving engine for LLMs License: Apache-2.0 @@ -70,10 +70,8 @@ Patch1: vllm-cpu-disable-rust-frontend.patch # PATCH-FIX-UPSTREAM vllm-thinking-budget-scan-cursor.patch boo#1280982 [email protected] -- CVE-2026-92365: resume the thinking-budget marker search from a cursor so a generation is not quadratic in its own length Patch2: vllm-thinking-budget-scan-cursor.patch -# PATCH-FIX-UPSTREAM fix-CVE-2026-105775.patch https://github.com/vllm-project/vllm/pull/57278 (unmerged as of 2026-10-15, rebased onto 0.31.0) -- CVE-2026-105775: keep the mamba block size a multiple of the chunk size so the "all" write-back reads states off chunk ends; DROP as obsolete when updating past the upstream removal of mamba_cache_mode "all" (#58997) -Patch3: fix-CVE-2026-105775.patch -# PATCH-FIX-UPSTREAM fix-CVE-2026-105922.patch https://github.com/vllm-project/vllm/pull/57762 (open/unmerged as of 2026-10-15, rebased onto 0.31.0) -- CVE-2026-105922: treat prompt-embedding positions as invalid token IDs so penalty kernels do not index stale CPU token buffer contents -Patch4: fix-CVE-2026-105922.patch +# PATCH-FIX-UPSTREAM fix-CVE-2026-105922.patch https://github.com/vllm-project/vllm/pull/57762 (open/unmerged as of 2026-10-18, rebased onto 0.32.0) -- CVE-2026-105922: treat prompt-embedding positions as invalid token IDs so penalty kernels do not index stale CPU token buffer contents +Patch3: fix-CVE-2026-105922.patch BuildRequires: %{python_module Jinja2} # Runtime modules imported eagerly by "import vllm" (needed for the %%check smoke test). BuildRequires: %{python_module cachetools} @@ -83,7 +81,7 @@ BuildRequires: %{python_module psutil} BuildRequires: %{python_module pyproject-metadata} BuildRequires: %{python_module regex} -BuildRequires: %{python_module setuptools >= 77.0.3} +BuildRequires: %{python_module setuptools >= 78.1.1} # setup.py imports setuptools_rust unconditionally at module top even though the # Rust frontend build itself is disabled (see vllm-cpu-disable-rust-frontend.patch). BuildRequires: %{python_module setuptools-rust >= 1.9.0} @@ -106,9 +104,9 @@ # the target project. Carry floors at the version upstream actually asks for # instead; vllm-relax-cpu-requirements.patch relaxes the same pins in the wheel # metadata so the RPM dependencies and the dist-info agree. -Requires: python-Pillow +Requires: python-Pillow >= 12.3.0 Requires: python-PyYAML -Requires: python-aiohttp >= 3.13.3 +Requires: python-aiohttp >= 3.14.3 Requires: python-anthropic >= 0.71.0 Requires: python-blake3 Requires: python-cachetools @@ -124,7 +122,7 @@ Requires: python-depyf >= 0.20.0 Requires: python-einops Requires: python-fastapi >= 0.133.0 -Requires: python-filelock >= 3.16.1 +Requires: python-filelock >= 3.20.3 Requires: python-huggingface-hub >= 1.31.0 Requires: python-ijson Requires: python-jsonschema >= 4.23.0 @@ -173,14 +171,14 @@ Requires: python-python-json-logger Requires: python-pyzmq >= 25.0.0 Requires: python-regex -Requires: python-requests >= 2.26.0 +Requires: python-requests >= 2.33.0 Requires: python-safetensors >= 0.6.2 Requires: python-sentencepiece Requires: python-setproctitle Requires: python-six >= 1.16.0 Requires: python-starlette >= 1.0.1 Requires: python-tiktoken >= 0.6.0 -Requires: python-tokenizers >= 0.21.1 +Requires: python-tokenizers >= 0.23.2 # The default flavour is pure Python and only uses torch's Python API. The cpu # flavour additionally links the compiled kernels against libtorch, and that # coupling is already expressed by the automatic libtorch.so / libtorch_cpu.so / @@ -189,7 +187,7 @@ # there and only makes the package uninstallable until it is bumped by hand. Requires: python-torch >= 2.12.0 Requires: python-tqdm -Requires: python-transformers >= 5.10.4 +Requires: python-transformers >= 5.16.1 Requires: python-typing_extensions >= 4.10 Requires: python-watchfiles Requires: python-xgrammar >= 0.2.1 @@ -201,8 +199,8 @@ BuildRequires: %{python_module torch-devel >= 2.12.0} BuildRequires: cmake >= 3.26 BuildRequires: gcc-c++ -BuildRequires: libnuma-devel BuildRequires: ninja +BuildRequires: pkgconfig(numa) # torch's own Caffe2Config.cmake does find_package(Protobuf) and hard-fails # without it, so find_package(Torch) needs protobuf present at build time. BuildRequires: pkgconfig(protobuf) @@ -320,10 +318,6 @@ # Import smoke test validating the package and its metadata load. # Full model/serving tests need model weights and are out of scope here. %python_expand $python -c "import vllm; print(vllm.__version__)" -# Regression test for CVE-2026-105775 (CPU-marked, needs only pytest+torch): -# run it when pytest is already in the build root; no test-only -# BuildRequires are added for it. -%python_expand if $python -c "import pytest" 2>/dev/null; then $python -m pytest tests/v1/core/test_mamba_block_size_alignment.py; fi # The CUDA penalties test from fix-CVE-2026-105922 # (tests/v1/worker/test_gpu_penalties.py) is carried-not-run: it needs a # CUDA device, which OBS build roots do not have. ++++++ vllm-0.31.0.tar.gz -> vllm-0.32.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-vllm/vllm-0.31.0.tar.gz /work/SRC/openSUSE:Factory/.python-vllm.new.3698736/vllm-0.32.0.tar.gz differ: char 5, line 1 ++++++ vllm-relax-cpu-requirements.patch ++++++ --- /var/tmp/diff_new_pack.pNVpzM/_old 2026-10-18 22:55:01.849413958 +0200 +++ /var/tmp/diff_new_pack.pNVpzM/_new 2026-10-18 22:55:01.852414084 +0200 @@ -1,11 +1,11 @@ --- a/requirements/cpu.txt +++ b/requirements/cpu.txt -@@ -1,30 +1,13 @@ +@@ -1,29 +1,13 @@ # Common dependencies -r common.txt --setuptools==77.0.3 # this version can reuse CMake build dir -+setuptools>=77.0.3 # this version can reuse CMake build dir +-setuptools==78.1.1 # this version can reuse CMake build dir; >=78.1.1 for GHSA-5rjg-fvgr-3xxf ++setuptools>=78.1.1 # this version can reuse CMake build dir; >=78.1.1 for GHSA-5rjg-fvgr-3xxf -numba == 0.65.0 # Required for N-gram speculative decoding +numba >= 0.65.0 # Required for N-gram speculative decoding @@ -27,7 +27,6 @@ -intel-openmp==2024.2.1; platform_machine == "x86_64" - -# triton-cpu, only for x86_64 CPUs --triton @ https://github.com/triton-lang/triton-cpu/releases/download/v3.8.0/triton-3.8.0+cpu-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl ; platform_machine == "x86_64" and python_version == "3.10" -triton @ https://github.com/triton-lang/triton-cpu/releases/download/v3.8.0/triton-3.8.0+cpu-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl ; platform_machine == "x86_64" and python_version == "3.11" -triton @ https://github.com/triton-lang/triton-cpu/releases/download/v3.8.0/triton-3.8.0+cpu-cp312-abi3-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl ; platform_machine == "x86_64" and python_version >= "3.12" +torch>=2.12.0; platform_machine == "x86_64" or platform_machine == "s390x" or platform_machine == "aarch64" @@ -41,20 +40,20 @@ tqdm blake3 py-cpuinfo --transformers >= 5.10.4, < 5.18.0 -+transformers >= 5.10.4 +-transformers >= 5.16.1, < 5.20.0 ++transformers >= 5.16.1 huggingface_hub >= 1.31.0 # Required for the `huggingface_hub.utils.httpx` re-export - tokenizers >= 0.21.1 # Required for fast incremental detokenization. + tokenizers >= 0.23.2 # Required for fast incremental detokenization. safetensors >= 0.6.2 # MXFP4/MXFP6 dtype support (F8_E8M0, F4) added in 0.6.0: https://github.com/huggingface/safetensors/pull/611 protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.*; platform_machine != "s390x" protobuf == 7.36.1; platform_machine == "s390x" -fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides. +fastapi[standard] >= 0.133.0 # First version supporting Starlette 1.0. starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1 - aiohttp >= 3.13.3 + aiohttp >= 3.14.3 openai >= 2.25.0 # For Responses API with namespace tools @@ -22,11 +22,11 @@ - pillow # Required for image processing + pillow >= 12.3.0 # Required for image processing prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0 tiktoken >= 0.6.0 # Required for DBRX tokenizer -lm-format-enforcer == 0.11.3 @@ -62,16 +61,16 @@ llguidance >= 1.7.0, < 1.8.0; platform_machine == "x86_64" or platform_machine == "arm64" or platform_machine == "aarch64" or platform_machine == "ppc64le" or platform_machine == "s390x" -outlines_core == 0.2.14 -lark == 1.2.2 --xgrammar == 0.2.7; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" +-xgrammar == 0.2.8; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" +outlines_core >= 0.2.14 +lark >= 1.2.2 +xgrammar >= 0.2.1; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" typing_extensions >= 4.10 - filelock >= 3.16.1 # need to contain https://github.com/tox-dev/filelock/pull/317 + filelock >= 3.20.3 # need to contain https://github.com/tox-dev/filelock/pull/317; GHSA floor partial-json-parser # used for parsing partial JSON outputs @@ -39,8 +39,8 @@ six>=1.16.0; python_version > '3.11' # transitive dependency of pandas that needs to be the latest version for python 3.12 - setuptools>=77.0.3,<81.0.0; python_version > '3.11' # Setuptools is used by triton, we need to ensure a modern version is installed for 3.12+ so that it does not try to import distutils, which was removed in 3.12 + setuptools>=78.1.1,<81.0.0; python_version > '3.11' # used by triton; >=78.1.1 for GHSA-5rjg-fvgr-3xxf (83.x needed for GHSA-h35f-9h28-mq5c deferred) einops # Required for Qwen2-VL. -compressed-tensors == 0.17.0 # required for compressed-tensors -depyf==0.20.0 # required for profiling and debugging with compilation config
