-
Notifications
You must be signed in to change notification settings - Fork 7.3k
Upgrade vLLM to 0.17.0 #61598
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Upgrade vLLM to 0.17.0 #61598
Changes from all commits
2b1741a
d9f8a11
8956423
9f7ad02
5a8bfb4
b168241
97249b4
1f5725c
db77302
d9d7a78
ad96776
35b269f
a058faa
db67355
9a06636
31f09d8
63fc455
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2250,9 +2250,9 @@ opentelemetry-exporter-prometheus==0.55b1 \ | |
| # via | ||
| # -c /tmp/ray-deps/requirements_compiled_py3.13.txt | ||
| # ray | ||
| opentelemetry-proto==1.39.0 \ | ||
| --hash=sha256:1e086552ac79acb501485ff0ce75533f70f3382d43d0a30728eeee594f7bf818 \ | ||
| --hash=sha256:c1fa48678ad1a1624258698e59be73f990b7fc1f39e73e16a9d08eef65dd838c | ||
| opentelemetry-proto==1.34.1 \ | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. why is this downgraded?
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think this is compiled from https://github.com/ray-project/ray/blob/15a473454084a739264ce66290d7d4fc1b3926b4/python/requirements/serve/tracing-reqs.txt + all opentelemetry libraries should have the same version.
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. hmm... that does not really make sense to me.
I think it is that some additional dependency of vllm 0.17 is pulling the version down
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @elliot-barn could you help investigate? like what will happen if we enforce
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. we are still on 4.25.8 and py313 dependency upgrade initiative will bring us to 5.29.6 |
||
| --hash=sha256:16286214e405c211fc774187f3e4bbb1351290b8dfb88e8948af209ce85b719e \ | ||
| --hash=sha256:eb4bb5ac27f2562df2d6857fc557b3a481b5e298bc04f94cc68041f00cebcbd2 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Unintended opentelemetry-proto downgrade across non-LLM lock filesMedium Severity
Additional Locations (2) |
||
| # via | ||
| # -c /tmp/ray-deps/requirements_compiled_py3.13.txt | ||
| # ray | ||
|
|
||
Large diffs are not rendered by default.
Large diffs are not rendered by default.


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Disabling hash verification weakens supply chain security
Medium Severity
Adding
--no-verify-hashesdisables integrity checking for all packages installed from the lock file. The lock files still contain hashes, but they are completely ignored during installation. This means a compromised or tampered package on the CUDA index (or any alternate index used viaunsafe-best-match) could be installed without detection. While version pinning provides some defense, hash verification is the primary protection against supply chain attacks where an index serves a modified binary for a pinned version. A more targeted fix — such as regenerating hashes from the actual CUDA index, or excluding only the mismatched packages — would preserve integrity checking for the majority of dependencies.