Bump vllm from 0.6.3.post1 to 0.23.0 in /experiments/agentcompany/openhands#42
Conversation
Bumps [vllm](https://github.com/vllm-project/vllm) from 0.6.3.post1 to 0.23.0. - [Release notes](https://github.com/vllm-project/vllm/releases) - [Changelog](https://github.com/vllm-project/vllm/blob/main/RELEASE.md) - [Commits](vllm-project/vllm@v0.6.3.post1...v0.23.0) --- updated-dependencies: - dependency-name: vllm dependency-version: 0.23.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| uvicorn==0.32.0 | ||
| uvloop==0.21.0 | ||
| vllm==0.6.3.post1 | ||
| vllm==0.23.0 |
There was a problem hiding this comment.
This bump leaves the environment pinned to the old vLLM dependency set, so pip install -r requirements.txt can fail dependency resolution. vllm==0.23.0 requires newer companions including torch==2.11.0, torchaudio==2.11.0, torchvision==0.26.0, transformers>=4.56.0, and tokenizers>=0.21.1, but this file still pins torch==2.4.0+cu121, torchaudio==2.4.0+cu121, torchvision==0.19.0, transformers==4.46.2, and tokenizers==0.20.3. If dependencies are bypassed, vLLM can also run against an unsupported ABI/API stack and fail at import or runtime. Update the companion pins with this vLLM bump, or keep vLLM on a compatible 0.6.x version, so the experiment environment can resolve and vLLM's native kernels match the installed PyTorch build.
Prompt To Fix With AI
This is a comment left during a code review.
Path: experiments/agentcompany/openhands/requirements.txt
Line: 192
Comment:
**Update companion pins**
This bump leaves the environment pinned to the old vLLM dependency set, so `pip install -r requirements.txt` can fail dependency resolution. `vllm==0.23.0` requires newer companions including `torch==2.11.0`, `torchaudio==2.11.0`, `torchvision==0.26.0`, `transformers>=4.56.0`, and `tokenizers>=0.21.1`, but this file still pins `torch==2.4.0+cu121`, `torchaudio==2.4.0+cu121`, `torchvision==0.19.0`, `transformers==4.46.2`, and `tokenizers==0.20.3`. If dependencies are bypassed, vLLM can also run against an unsupported ABI/API stack and fail at import or runtime. Update the companion pins with this vLLM bump, or keep vLLM on a compatible 0.6.x version, so the experiment environment can resolve and vLLM's native kernels match the installed PyTorch build.
How can I resolve this? If you propose a fix, please make it concise.
Bumps vllm from 0.6.3.post1 to 0.23.0.
Release notes
Sourced from vllm's releases.
... (truncated)
Commits
0fc695f[Bugfix][Frontend] Cap fastapi < 0.137 to avoid prometheus-fastapi-instrument...91df0fa[Bugfix][CPU] Don't build triton-cpu on arm64 release image (#45401)78743ab[Docker] Fix CUTLASS DSL cu13 install order in Dockerfile (#45204)b2d7294[ROCm][Bugfix] Make intermediate_pad TP-aware in rocm_aiter_fused_experts (#4...741ba42[Bugfix] [DSV4] [ROCm] Pin apache-tvm-ffi version to0.1.10(#45169)ac94893[ROCm][MLA][Bugfix] Reserve FP8 prefill workspace before lock for Kimi-K2.5 (...967c5c3[ROCm][CI] Stage C mirrors (#42793)54c660c[XPU][Minor] format moe kernel name and add in kernel list (#44771)8fb0274[MM][CG] Simplify ViT CUDA graph interfaces (#44484)eebce65[XPU]feat: add DeepSeek-V4 XPU attention decode path (#42953)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Greptile Summary
vllmfrom0.6.3.post1to0.23.0inexperiments/agentcompany/openhands/requirements.txt.Confidence Score: 4/5
The dependency bump is not merge-safe until the companion package pins are updated or vLLM remains on a compatible release line.
The changed file is small and the incompatibility is directly tied to the pinned dependency set; resolver evidence confirms at least one concrete version conflict.
experiments/agentcompany/openhands/requirements.txt
What T-Rex did
Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "Bump vllm in /experiments/agentcompany/o..." | Re-trigger Greptile