Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-vllm for openSUSE:Factory checked in at 2026-11-09 16:04:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-vllm (Old) and /work/SRC/openSUSE:Factory/.python-vllm.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-vllm" Mon Nov 9 16:04:33 2026 rev:14 rq:1396068 version:0.33.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-vllm/python-vllm.changes 2026-10-18 22:54:56.955208381 +0200 +++ /work/SRC/openSUSE:Factory/.python-vllm.new.3759290/python-vllm.changes 2026-11-09 16:05:11.113174835 +0100 @@ -1,0 +2,38 @@ +Wed Nov 4 11:41:11 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.33.0: + * New models: Reflection Beam-1, Recursive Flint, Muse Spark + Open, Step-5, AliceAI, Kolibri 1, Clef-Flash; Granite MoE + as DSpark target + * Quantization: Humming runs MXFP4 experts as block FP8 on + Hopper; Quark MXFP8 routed experts; online re-quantization + for NVFP4 MoE + * Frontend: --reasoning-parser none as default, truthful + finish_reason and Responses item status, Beam reasoning + and tool parsers, text-only OpenAI Decisions API MVP, + --enable-x/--disable-x boolean CLI flags + * Security: bound decoded and downloaded media per + request; reject local verifier references in + Speculators metadata + * Pooling: offline fixed-length late chunking; torch + 2.14, transformers < 5.21, Pillow >= 13 floor upstream + * Bug fixes: GLM tool-argument re-parse per chunk, + MoRI-IO WRITE-mode requests stranded in + WAITING_FOR_REMOTE_KVS, EXAONE-4.5 image inputs, + split top-p masking for huge logits + * Many more fixes and improvements; see upstream's release + notes for the full list +- Keep carrying fix-CVE-2026-105922.patch and + vllm-thinking-budget-scan-cursor.patch, rebased: neither + CVE-2026-105922 nor CVE-2026-92365 is fixed upstream + in 0.33.0 +- Dependency floors follow upstream: Pillow>=13.0.0, + aiohttp>=3.14.4, new python-orjson>=3.11.6, + python-certifi>=2026.10.19 and python-multidict>=6.9.1 + requirements +- Add typing_extensions and filelock to BuildRequires: setup.py + imports torch at module top, which needs typing_extensions, + and torch.utils.cpp_extension needs filelock (fixes build + root without transitively-present deps) + +------------------------------------------------------------------- Old: ---- vllm-0.32.0.tar.gz New: ---- vllm-0.33.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-vllm.spec ++++++ --- /var/tmp/diff_new_pack.sRSNKF/_old 2026-11-09 16:05:17.424439420 +0100 +++ /var/tmp/diff_new_pack.sRSNKF/_new 2026-11-09 16:05:17.426439504 +0100 @@ -48,7 +48,7 @@ %define acl_version 52.6.0 %bcond_without libalternatives Name: python-vllm%{psuffix} -Version: 0.32.0 +Version: 0.33.0 Release: 0 Summary: A high-throughput and memory-efficient inference and serving engine for LLMs License: Apache-2.0 @@ -70,12 +70,14 @@ Patch1: vllm-cpu-disable-rust-frontend.patch # PATCH-FIX-UPSTREAM vllm-thinking-budget-scan-cursor.patch boo#1280982 [email protected] -- CVE-2026-92365: resume the thinking-budget marker search from a cursor so a generation is not quadratic in its own length Patch2: vllm-thinking-budget-scan-cursor.patch -# PATCH-FIX-UPSTREAM fix-CVE-2026-105922.patch https://github.com/vllm-project/vllm/pull/57762 (open/unmerged as of 2026-10-18, rebased onto 0.32.0) -- CVE-2026-105922: treat prompt-embedding positions as invalid token IDs so penalty kernels do not index stale CPU token buffer contents +# PATCH-FIX-UPSTREAM fix-CVE-2026-105922.patch https://github.com/vllm-project/vllm/pull/57762 (open/unmerged as of 2026-10-18, rebased onto 0.33.0) -- CVE-2026-105922: treat prompt-embedding positions as invalid token IDs so penalty kernels do not index stale CPU token buffer contents Patch3: fix-CVE-2026-105922.patch BuildRequires: %{python_module Jinja2} # Runtime modules imported eagerly by "import vllm" (needed for the %%check smoke test). BuildRequires: %{python_module cachetools} BuildRequires: %{python_module devel} +# torch.utils.cpp_extension (imported by setup.py) needs filelock. +BuildRequires: %{python_module filelock} BuildRequires: %{python_module packaging >= 24.2} BuildRequires: %{python_module pip} BuildRequires: %{python_module psutil} @@ -88,6 +90,8 @@ BuildRequires: %{python_module setuptools-scm >= 8.0} # setup.py imports torch at module top to detect the target device. BuildRequires: %{python_module torch >= 2.12.0} +# setup.py imports torch at module top, which needs typing_extensions. +BuildRequires: %{python_module typing_extensions} BuildRequires: %{python_module wheel} BuildRequires: alts BuildRequires: fdupes @@ -104,13 +108,14 @@ # the target project. Carry floors at the version upstream actually asks for # instead; vllm-relax-cpu-requirements.patch relaxes the same pins in the wheel # metadata so the RPM dependencies and the dist-info agree. -Requires: python-Pillow >= 12.3.0 +Requires: python-Pillow >= 13.0.0 Requires: python-PyYAML -Requires: python-aiohttp >= 3.14.3 +Requires: python-aiohttp >= 3.14.4 Requires: python-anthropic >= 0.71.0 Requires: python-blake3 Requires: python-cachetools Requires: python-cbor2 +Requires: python-certifi >= 2026.10.19 Requires: python-cloudpickle # Upstream pins compressed-tensors == 0.17.0, but an exact RPM pin breaks the # package every time the devel project moves. Every symbol vllm imports from @@ -140,6 +145,7 @@ Requires: python-mistral-common >= 1.11.6 Requires: python-model-hosting-container-standards >= 0.1.14 Requires: python-msgspec +Requires: python-multidict >= 6.9.1 Requires: python-numba >= 0.65.0 Requires: python-numpy Requires: python-openai >= 2.25.0 @@ -155,6 +161,8 @@ Requires: python-opentelemetry-exporter-otlp >= 1.27.0 Requires: python-opentelemetry-sdk >= 1.27.0 Requires: python-opentelemetry-semantic-conventions-ai >= 0.4.1 +# vllm/entrypoints/serve/utils/api_utils.py imports orjson at module top. +Requires: python-orjson >= 3.11.6 # Optional structured-output backend, also LazyLoader-imported. Its on-disk # index cache is keyed on importlib.metadata.version("outlines_core") and is # cleared whenever that changes, so the code handles version drift by design. @@ -190,7 +198,7 @@ Requires: python-transformers >= 5.16.1 Requires: python-typing_extensions >= 4.10 Requires: python-watchfiles -Requires: python-xgrammar >= 0.2.1 +Requires: python-xgrammar >= 0.2.8 # Limited to the arches python-torch is built for. ExclusiveArch: x86_64 aarch64 riscv64 %if %{with cpu_kernels} @@ -326,7 +334,7 @@ # Migrate an install that still carries the old update-alternatives symlink. %python_libalternatives_reset_alternative vllm -%files %{python_files} +%files %python_files %doc README.md %license LICENSE %python_alternative %{_bindir}/vllm ++++++ fix-CVE-2026-105922.patch ++++++ --- /var/tmp/diff_new_pack.sRSNKF/_old 2026-11-09 16:05:17.478441684 +0100 +++ /var/tmp/diff_new_pack.sRSNKF/_new 2026-11-09 16:05:17.483441894 +0100 @@ -2,7 +2,7 @@ Subject: [PATCH] Fix penalties with prompt embeddings References: CVE-2026-105922, boo#1284365 Upstream-PR: https://github.com/vllm-project/vllm/pull/57762 (OPEN, blocked - on rebase; open/unmerged as of 2026-10-15, rebased onto 0.31.0) + on rebase; open/unmerged as of 2026-10-15, rebased onto 0.33.0) Treat prompt embedding positions as invalid token IDs when building sampling metadata. This prevents penalty kernels from indexing stale CPU token buffer @@ -108,12 +108,14 @@ vllm_config: VllmConfig, --- a/vllm/v1/worker/gpu/sample/penalties.py +++ b/vllm/v1/worker/gpu/sample/penalties.py -@@ -18,11 +18,18 @@ - +@@ -20,13 +20,20 @@ if TYPE_CHECKING: from vllm.config import VllmConfig + from vllm.v1.worker.gpu.model_states.prompt_embeds import PromptEmbedsState + # Overridden on CPU in vllm/v1/worker/cpu/shm.py. + PENALTIES_BLOCK_SIZE = 8192 + class PenaltiesState(LogitsProcessor): - def __init__(self, vllm_config: "VllmConfig", req_states: LogitsProcRequestState): ++++++ vllm-0.32.0.tar.gz -> vllm-0.33.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-vllm/vllm-0.32.0.tar.gz /work/SRC/openSUSE:Factory/.python-vllm.new.3759290/vllm-0.33.0.tar.gz differ: char 5, line 1 ++++++ vllm-relax-cpu-requirements.patch ++++++ --- /var/tmp/diff_new_pack.sRSNKF/_old 2026-11-09 16:05:17.546444535 +0100 +++ /var/tmp/diff_new_pack.sRSNKF/_new 2026-11-09 16:05:17.552444787 +0100 @@ -11,8 +11,8 @@ +numba >= 0.65.0 # Required for N-gram speculative decoding # Dependencies for CPUs --torch==2.13.0+cpu; platform_machine == "x86_64" or platform_machine == "s390x" or platform_machine == "aarch64" --torch==2.13.0; platform_system == "Darwin" or platform_machine == "ppc64le" or platform_machine == "riscv64" +-torch==2.14.0+cpu; platform_machine == "x86_64" or platform_machine == "s390x" or platform_machine == "aarch64" +-torch==2.14.0; platform_system == "Darwin" or platform_machine == "ppc64le" or platform_machine == "riscv64" - -# required for the image processor of minicpm-o-2_6, this must be updated alongside torch -torchaudio; platform_machine != "s390x" and platform_machine != "riscv64" @@ -36,11 +36,11 @@ py-cpuinfo; platform_machine == "aarch64" --- a/requirements/common.txt +++ b/requirements/common.txt -@@ -7,13 +7,13 @@ +@@ -8,13 +8,13 @@ tqdm blake3 py-cpuinfo --transformers >= 5.16.1, < 5.20.0 +-transformers >= 5.16.1, < 5.21.0 +transformers >= 5.16.1 huggingface_hub >= 1.31.0 # Required for the `huggingface_hub.utils.httpx` re-export tokenizers >= 0.23.2 # Required for fast incremental detokenization. @@ -50,10 +50,10 @@ -fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides. +fastapi[standard] >= 0.133.0 # First version supporting Starlette 1.0. starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1 - aiohttp >= 3.14.3 - openai >= 2.25.0 # For Responses API with namespace tools -@@ -22,11 +22,11 @@ - pillow >= 12.3.0 # Required for image processing + aiohttp >= 3.14.4 + multidict >= 6.9.1 +@@ -25,11 +25,11 @@ + pillow >= 13.0.0 # Required for image processing prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0 tiktoken >= 0.6.0 # Required for DBRX tokenizer -lm-format-enforcer == 0.11.3 @@ -64,11 +64,11 @@ -xgrammar == 0.2.8; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" +outlines_core >= 0.2.14 +lark >= 1.2.2 -+xgrammar >= 0.2.1; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" ++xgrammar >= 0.2.8; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" typing_extensions >= 4.10 filelock >= 3.20.3 # need to contain https://github.com/tox-dev/filelock/pull/317; GHSA floor partial-json-parser # used for parsing partial JSON outputs -@@ -39,8 +39,8 @@ +@@ -42,8 +42,8 @@ six>=1.16.0; python_version > '3.11' # transitive dependency of pandas that needs to be the latest version for python 3.12 setuptools>=78.1.1,<81.0.0; python_version > '3.11' # used by triton; >=78.1.1 for GHSA-5rjg-fvgr-3xxf (83.x needed for GHSA-h35f-9h28-mq5c deferred) einops # Required for Qwen2-VL. @@ -79,7 +79,7 @@ cloudpickle # allows pickling lambda functions in model_executor/models/registry.py watchfiles # required for http server to monitor the updates of TLS files python-json-logger # Used by logging as per examples/features/logging_configuration.md -@@ -49,10 +49,10 @@ +@@ -52,10 +52,10 @@ cbor2 # Required for cross-language serialization of hashable objects ijson # Required for mistral streaming tool parser setproctitle # Used to set process names for better debugging and monitoring @@ -87,7 +87,7 @@ +openai-harmony >= 0.0.3 # Required for gpt-oss anthropic >= 0.71.0 model-hosting-container-standards >= 0.1.14, < 1.0.0 --mcp >= 2.0.0, < 3.0.0 +-mcp >= 2.2.0, < 3.0.0 +mcp opentelemetry-sdk >= 1.27.0 opentelemetry-api >= 1.27.0
