Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-sglang for openSUSE:Factory checked in at 2026-10-20 12:37:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-sglang (Old) and /work/SRC/openSUSE:Factory/.python-sglang.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-sglang" Tue Oct 20 12:37:29 2026 rev:8 rq:1386108 version:0.5.22 Changes: -------- --- /work/SRC/openSUSE:Factory/python-sglang/python-sglang.changes 2026-10-12 22:08:16.548945099 +0200 +++ /work/SRC/openSUSE:Factory/.python-sglang.new.3698736/python-sglang.changes 2026-10-20 12:38:13.309274221 +0200 @@ -1,0 +2,35 @@ +Sun Oct 18 17:38:41 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.5.22: + * Diffusion and image: HunyuanImage-3.0 support, LLaDA-Image + BF16 generation and editing, faster LTX-2 guidance and video + output, Z-Image shared-block autotune at both token scales + * Memory and kernels: unified memory pool without transfer + waits, HiCache stabilization, heterogeneous-TP hybrid SWA KV + transfer, KV cache sharding for the DSA indexer, TileLang + FP8 KV cache on CUDA + * Models: DeepSeek V4 prefill with interleave context + parallelism and breakable CUDA graphs, LoRA for the + NemotronH Nano VL V2 family, GLM-5.3-Flash and Kimi K3 + updates, XPU backend upgrade to PyTorch 2.14 with decode + context parallelism + * Runtime: work around a CPython fork deadlock in the CPU + preprocess pool, Helion MTP verification, exposed + sglang.api.v1 types for the new api-codegen generator + * CVE-2026-110807 (boo#1285675): this package is not affected + by the session_params denial of service; the session_id / + session_params mutual-exclusion and type guards the fix adds + are already present in 0.5.21 and unchanged in 0.5.22 + * Drop sglang-grpc-system-protoc.patch: upstream removed the + sglang-grpc build.rs and its protoc-bin-vendored dependency + * Add sglang-api-codegen-system-protoc.patch: same system- + protoc treatment for the new sglang-api-codegen generator + crate, so no prebuilt protoc binaries land in vendor.tar.zst + * The 30343 redaction now also covers the internal_states + readback: 0.5.22 folds the full resolved server args into it, + which would otherwise re-expose the keys through /server_info + * Refresh vendor.tar.zst; new linked Rust crates are foldhash + (Zlib) and tonic-prost (MIT), reflected in License + * Transformers floor moves to >= 5.19.0 with the upstream pin + +------------------------------------------------------------------- Old: ---- sglang-0.5.21.tar.gz sglang-grpc-system-protoc.patch New: ---- sglang-0.5.22.tar.gz sglang-api-codegen-system-protoc.patch ----------(Old B)---------- Old: are already present in 0.5.21 and unchanged in 0.5.22 * Drop sglang-grpc-system-protoc.patch: upstream removed the sglang-grpc build.rs and its protoc-bin-vendored dependency ----------(Old E)---------- ----------(New B)---------- New: sglang-grpc build.rs and its protoc-bin-vendored dependency * Add sglang-api-codegen-system-protoc.patch: same system- protoc treatment for the new sglang-api-codegen generator ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-sglang.spec ++++++ --- /var/tmp/diff_new_pack.wVCcKG/_old 2026-10-20 12:38:22.770670837 +0200 +++ /var/tmp/diff_new_pack.wVCcKG/_new 2026-10-20 12:38:22.772670921 +0200 @@ -17,7 +17,7 @@ Name: python-sglang -Version: 0.5.21 +Version: 0.5.22 Release: 0 Summary: Fast serving framework for large language models # Legal-Review-Notice: sgl-model-gateway and CUDA AOT kernels @@ -29,13 +29,14 @@ # against vendor.tar.zst. Re-derived with cargo tree --offline -e normal # over those crates: BSD-2-Clause from numpy; BSD-3-Clause from # subtle/matchit; Unicode-3.0 from icu_*/unicode-ident; ISC from -# rustls-webpki/untrusted; CDLA-Permissive-2.0 from webpki-roots. +# rustls-webpki/untrusted; CDLA-Permissive-2.0 from webpki-roots; +# Zlib from foldhash (via hashbrown). # option-ext (MPL-2.0) reaches only sglang-server, but its sources ride # along in vendor.tar.zst, which in the src.rpm satisfies MPL-2.0 ยง3.2. # r-efi offers LGPL-2.1-or-later but is UEFI-target-only and absent from # the Linux graph. sglang-server itself is not built: the CPU Python # runtime does not use it and it drags in the whole dynamo stack. -License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0 +License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0 AND Zlib URL: https://github.com/sgl-project/sglang Source0: https://github.com/sgl-project/sglang/archive/refs/tags/v%{version}.tar.gz#/sglang-%{version}.tar.gz Source1: vendor.tar.zst @@ -46,11 +47,11 @@ Patch1: sglang-cpu-triton-stub.patch # PATCH-FIX-OPENSUSE sglang-cpu-rust-exts.patch -- build setuptools-rust PyO3 extensions (mm, grpc) from the CPU pyproject Patch2: sglang-cpu-rust-exts.patch -# PATCH-FIX-OPENSUSE sglang-grpc-system-protoc.patch -- use system protoc instead of protoc-bin-vendored -Patch3: sglang-grpc-system-protoc.patch +# PATCH-FIX-OPENSUSE sglang-api-codegen-system-protoc.patch -- use system protoc instead of protoc-bin-vendored in the sglang-api-codegen generator (0.5.22 moved the vendored protoc there after dropping the sglang-grpc build.rs); the prebuilt protoc binaries stay out of vendor.tar.zst +Patch3: sglang-api-codegen-system-protoc.patch # PATCH-FIX-UPSTREAM sglang-40185-bootstrap-room-dedup.patch boo#1283270 -- CVE-2026-102634: sgl-project/sglang PR 40185 (unmerged, head commit 1901ddecfe), report an unknown bootstrap_room as KVPoll.Failed instead of letting check_status raise KeyError, and count KVPoll.Success as bootstrap-done; 2 of the PR's 27 files, the rest being a typing modernisation that does not apply to 0.5.21 Patch4: sglang-40185-bootstrap-room-dedup.patch -# PATCH-FIX-UPSTREAM sglang-30343-server-info-redact.patch boo#1284214 -- CVE-2026-105245: sgl-project/sglang PR 30343 (unmerged as of 2026-10-12, head commit 38787264b70c), mask api_key/admin_api_key/ssl_keyfile_password in /server_info, gRPC GetServerInfo and Engine.get_server_info; rebased onto 0.5.21 resolved_dict() +# PATCH-FIX-UPSTREAM sglang-30343-server-info-redact.patch boo#1284214 -- CVE-2026-105245: sgl-project/sglang PR 30343 (closed stale, head commit 38787264b70c), mask api_key/admin_api_key/ssl_keyfile_password in server info surfaces; upstream refactored them into build_server_info() in 0.5.22 but still serializes the full ServerArgs, and 0.5.22 newly folds the full resolved args into the internal_states readback, so the patch routes build_server_info(), Engine.get_server_info(), the internal-state readback and the server_args log helper through ServerArgs.redacted_asdict() Patch5: sglang-30343-server-info-redact.patch BuildRequires: %{python_module IPython} BuildRequires: %{python_module Pillow} @@ -98,7 +99,7 @@ BuildRequires: %{python_module torchaudio >= 2.11.0} BuildRequires: %{python_module torchvision >= 0.29.0} BuildRequires: %{python_module tqdm} -BuildRequires: %{python_module transformers >= 5.12.1} +BuildRequires: %{python_module transformers >= 5.19.0} BuildRequires: %{python_module uvicorn} BuildRequires: %{python_module uvloop} BuildRequires: %{python_module wheel} @@ -162,7 +163,7 @@ Requires: python-torchaudio >= 2.11.0 Requires: python-torchvision >= 0.29.0 Requires: python-tqdm -Requires: python-transformers >= 5.12.1 +Requires: python-transformers >= 5.19.0 Requires: python-uvicorn Requires: python-uvloop Requires: python-xgrammar >= 0.2.7 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.wVCcKG/_old 2026-10-20 12:38:22.833673478 +0200 +++ /var/tmp/diff_new_pack.wVCcKG/_new 2026-10-20 12:38:22.837673646 +0200 @@ -1,7 +1,7 @@ <services> - <!-- Run this on a tree with sglang-grpc-system-protoc.patch applied: the - pristine rust/sglang-grpc/Cargo.toml pulls protoc-bin-vendored, whose - prebuilt protoc binaries must not end up in vendor.tar.zst. --> + <!-- Run this on a tree with sglang-api-codegen-system-protoc.patch applied: + the sglang-api-codegen generator's vendored protoc must not end up in + vendor.tar.zst. --> <service name="cargo_vendor" mode="manual"> <param name="src">sglang-*.tar.gz</param> <param name="custom-root">rust</param> ++++++ sglang-0.5.21.tar.gz -> sglang-0.5.22.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-sglang/sglang-0.5.21.tar.gz /work/SRC/openSUSE:Factory/.python-sglang.new.3698736/sglang-0.5.22.tar.gz differ: char 12, line 1 ++++++ sglang-30343-server-info-redact.patch ++++++ --- /var/tmp/diff_new_pack.wVCcKG/_old 2026-10-20 12:38:22.877675323 +0200 +++ /var/tmp/diff_new_pack.wVCcKG/_new 2026-10-20 12:38:22.881675490 +0200 @@ -1,34 +1,8 @@ -Redact api_key/admin_api_key/ssl_keyfile_password from server info endpoints - -Fixes CVE-2026-105245 (boo#1284214): /server_info (and the deprecated -/get_server_info alias), the gRPC bridge get_server_info, and -Engine.get_server_info() serialized the full ServerArgs via -resolved_dict(), exposing api_key, admin_api_key and -ssl_keyfile_password verbatim. With only --admin-api-key set, -/server_info is reachable anonymously (AuthLevel.NORMAL), so the -admin key leaked to unauthenticated callers; with both keys set, a -holder of either key could read the other. - -Carried from sgl-project/sglang PR 30343 by Rejudge-F (unmerged as of -2026-10-12; closed by github-actions as stale, head commit -38787264b70c5d931abf95ddf29d494fe5a943a8). Rebased onto 0.5.21: upstream -wrote ServerArgs.redacted_asdict() around dataclasses.asdict(), but -0.5.21 serializes via ServerArgs.resolved_dict() (msgspec defstruct + -resolution pipeline), so redacted_asdict() here masks resolved_dict() -instead. The three call sites and SENSITIVE_FIELDS are otherwise the -same; the unit test from that PR is not carried (no pytest in %check). ---- - python/sglang/srt/entrypoints/engine.py | 2 +- - python/sglang/srt/entrypoints/grpc_bridge.py | 2 +- - python/sglang/srt/entrypoints/http_server.py | 2 +- - python/sglang/srt/server_args.py | 17 ++++++++++++++++- - 4 files changed, 20 insertions(+), 4 deletions(-) - --- a/python/sglang/srt/server_args.py +++ b/python/sglang/srt/server_args.py -@@ -265,6 +265,23 @@ - for field in record_fields(type(self)) - } +@@ -331,6 +331,23 @@ + resolved["enable_dp_attention"] = resolving_view(self).attn_dp_size > 1 + return resolved + # Fields whose values are secrets and must never leave the process via + # introspection surfaces (/server_info, gRPC GetServerInfo, etc.). @@ -48,39 +22,62 @@ + return d + LANGUAGE_MODEL_ONLY_ARCHITECTURES = ( + "DeepseekV4ForCausalLM", "MuseGlimmerForConditionalGeneration", - "Cosmos3ForConditionalGeneration", ---- a/python/sglang/srt/entrypoints/http_server.py -+++ b/python/sglang/srt/entrypoints/http_server.py -@@ -859,7 +859,7 @@ - - return msgspec_to_builtins( - { -- **server_args.resolved_dict(), -+ **server_args.redacted_asdict(), - "launch_command": server_args.launch_command, - **_global_state.scheduler_info, - "startup_time": _global_state.tokenizer_manager.startup_time, ---- a/python/sglang/srt/entrypoints/grpc_bridge.py -+++ b/python/sglang/srt/entrypoints/grpc_bridge.py -@@ -430,7 +430,7 @@ - return json.dumps(result, default=str) - - def get_server_info(self) -> str: -- result: Dict[str, Any] = self.tokenizer_manager.server_args.resolved_dict() -+ result: Dict[str, Any] = self.tokenizer_manager.server_args.redacted_asdict() - # `resolved_dict` answers with what resolution decided; the launch - # command answers with what was asked for, and the two are not - # derivable from each other. The HTTP and in-process readbacks both +--- a/python/sglang/srt/utils/common.py ++++ b/python/sglang/srt/utils/common.py +@@ -3642,7 +3642,7 @@ + + Callers add transport-specific fields and serialize the result. + """ +- result = server_args.resolved_dict() ++ result = server_args.redacted_asdict() + result["launch_command"] = server_args.launch_command + result.update(scheduler_info) + result["kv_events"] = describe_kv_events_publisher(server_args) --- a/python/sglang/srt/entrypoints/engine.py +++ b/python/sglang/srt/entrypoints/engine.py -@@ -1488,7 +1488,7 @@ - ) +@@ -168,7 +168,7 @@ + + + def _server_args_for_logging(server_args: ServerArgs) -> Dict[str, Any]: +- return redact_watermark_secrets(server_args.resolved_dict()) ++ return redact_watermark_secrets(server_args.redacted_asdict()) + + + @dataclasses.dataclass +@@ -1562,7 +1562,7 @@ return msgspec_to_builtins( - { -- **self.tokenizer_manager.server_args.resolved_dict(), -+ **self.tokenizer_manager.server_args.redacted_asdict(), - "launch_command": self.tokenizer_manager.server_args.launch_command, - **self._scheduler_init_result.scheduler_infos[0], - "startup_time": self.tokenizer_manager.startup_time, + redact_watermark_secrets( + { +- **self.tokenizer_manager.server_args.resolved_dict(), ++ **self.tokenizer_manager.server_args.redacted_asdict(), + "launch_command": self.tokenizer_manager.server_args.launch_command, + **self._scheduler_init_result.scheduler_infos[0], + "startup_time": self.tokenizer_manager.startup_time, +--- a/python/sglang/srt/managers/scheduler_components/internal_state.py ++++ b/python/sglang/srt/managers/scheduler_components/internal_state.py +@@ -19,7 +19,7 @@ + ) + from sglang.srt.managers.scheduler_components.memory_usage import build_memory_usage + from sglang.srt.runtime_context import get_context, get_exec, get_parallel +-from sglang.srt.server_args import compute_world_size ++from sglang.srt.server_args import ServerArgs, compute_world_size + from sglang.srt.utils.msgspec_utils import msgspec_to_builtins + + if TYPE_CHECKING: +@@ -60,6 +60,13 @@ + # A bound signal handler is not msgpack-serializable, and no reader + # consumes it. + state.pop("custom_sigquit_handler", None) ++ # Secrets must not leave the process via readbacks (boo#1284214, ++ # CVE-2026-105245): mask like ServerArgs.redacted_asdict(). The ++ # set_internal_state path rejects these keys, so no round-trip can ++ # write a mask back. ++ for key in ServerArgs.SENSITIVE_FIELDS: ++ if state.get(key) is not None: ++ state[key] = "****" + return GetInternalStateReqOutput(internal_state=msgspec_to_builtins(state)) + + def _add_topology(self, state: Dict[str, Any]) -> None: ++++++ sglang-40185-bootstrap-room-dedup.patch ++++++ --- /var/tmp/diff_new_pack.wVCcKG/_old 2026-10-20 12:38:22.895676077 +0200 +++ /var/tmp/diff_new_pack.wVCcKG/_new 2026-10-20 12:38:22.899676245 +0200 @@ -29,15 +29,15 @@ diff --git a/python/sglang/srt/disaggregation/common/conn.py b/python/sglang/srt/disaggregation/common/conn.py --- a/python/sglang/srt/disaggregation/common/conn.py +++ b/python/sglang/srt/disaggregation/common/conn.py -@@ -410,7 +410,7 @@ +@@ -550,7 +550,7 @@ self._dcp_pack_max_tokens = max_tokens def check_status(self, bootstrap_room: int) -> KVPoll: - return self.request_status[bootstrap_room] + return self.request_status.get(bootstrap_room, KVPoll.Failed) - def update_status(self, bootstrap_room: int, status: KVPoll): - current = self.request_status.get(bootstrap_room) + def check_status_pp_consensus(self, bootstrap_room: int) -> KVPoll: + statuses = self.request_status.collect(bootstrap_room) diff --git a/python/sglang/srt/disaggregation/decode.py b/python/sglang/srt/disaggregation/decode.py --- a/python/sglang/srt/disaggregation/decode.py +++ b/python/sglang/srt/disaggregation/decode.py ++++++ sglang-api-codegen-system-protoc.patch ++++++ --- a/rust/sglang-api-codegen/Cargo.toml +++ b/rust/sglang-api-codegen/Cargo.toml @@ -15,5 +15,4 @@ prost = { workspace = true } prost-build = "0.14" prost-reflect = "0.16" -protoc-bin-vendored = "3" tonic-prost-build = "0.14" --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -35,7 +35,6 @@ prost = "0.14" prost-types = "0.14" prost-build = "0.14" -protoc-bin-vendored = "=3.2.0" serde = { version = "1", features = ["derive"] } serde_json = "1" socket2 = "0.6" --- a/rust/sglang-api-codegen/src/main.rs +++ b/rust/sglang-api-codegen/src/main.rs @@ -22,9 +22,9 @@ //! Each target has a single root .proto: every API must be defined (or //! imported) there, and protoc's import closure supplies the rest of the //! package; a file the root does not reach gets no generated code. All output -//! is checked in, so commit it together with the .proto change. The vendored -//! protoc (pinned by Cargo.lock) is used unless `PROTOC` is set, so the output -//! is byte-stable across machines. +//! is checked in, so commit it together with the .proto change. The system +//! protoc (`PROTOC` or `PATH`) is used; distro builds do not ship the +//! upstream vendored binary. mod emit; mod emit_py; @@ -73,15 +73,8 @@ let repo_root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../.."); let proto_root = repo_root.join("proto"); - // Vendored protoc first: the checked-in output must not depend on - // whichever protoc a machine has. `PROTOC` still overrides for platforms - // the vendored crate lacks. - if std::env::var_os("PROTOC").is_none() - && let Ok(vendored) = protoc_bin_vendored::protoc_bin_path() - { - // SAFETY: nothing else is running yet; the generator is single-threaded. - unsafe { std::env::set_var("PROTOC", vendored) }; - } + // Distro builds use the system protoc (PROTOC or PATH). The upstream + // vendored binary is not shipped. // The descriptor set is only pass 2's input, not part of any crate; it is // a protoc-version-dependent binary, so keep it out of the tree. ++++++ sglang-relax-cpu-requirements.patch ++++++ --- /var/tmp/diff_new_pack.wVCcKG/_old 2026-10-20 12:38:22.930677544 +0200 +++ /var/tmp/diff_new_pack.wVCcKG/_new 2026-10-20 12:38:22.936677796 +0200 @@ -69,9 +69,9 @@ + "torchaudio>=2.11.0", + "torchvision>=0.29.0", "tqdm", -- "transformers==5.12.1", +- "transformers==5.19.0", - "triton==3.8.0", -+ "transformers>=5.12.1", ++ "transformers>=5.19.0", "uvicorn", "uvloop", "xxhash", @@ -80,20 +80,18 @@ "zstandard", ] -@@ -129,6 +121,12 @@ - "kernels/**/*" - ] - -+[tool.setuptools.exclude-package-data] +@@ -132,6 +124,10 @@ + [tool.setuptools.exclude-package-data] + # .claude/skills is a directory symlink; setuptools build_py cannot copy it. + "sglang.multimodal_gen" = [".claude/*"] +"sglang" = [ + "kernels/aot/*", + "kernels/aot/**/*", +] -+ + [tool.setuptools.packages.find] exclude = [ - "assets*", -@@ -137,6 +135,8 @@ +@@ -141,6 +137,8 @@ "dist*", "playground*", "scripts*", @@ -102,7 +100,7 @@ "tests*", ] -@@ -148,6 +148,8 @@ +@@ -152,6 +150,8 @@ "dist*", "playground*", "scripts*", ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/python-sglang/vendor.tar.zst /work/SRC/openSUSE:Factory/.python-sglang.new.3698736/vendor.tar.zst differ: char 7, line 1
