[dependabot]

Bumps the pip group with 3 updates in the /examples/cobol-cpt-grpo directory: vllm, accelerate and virtualenv.

Updates vllm from 0.28.0 to 0.31.0

Release notes

Sourced from vllm's releases.

v0.31.0

Highlights

This release features 717 commits from 307 contributors (96 new)!

• DeepSeek-V4.1-Flash performance: FlashMLA mega attention with the V4.1 NVFP4 compressed KV cache is now the SM100 default (#56935); DeepGEMM sparse MQA logits for the indexer (#56254) and Mega-Gate fusing the gate GEMM with expert selection (#56266); decoder boundaries fuse the TP all-reduce, mHC input preparation (#57643) and the MoE finalize (#58586); a fused small-batch WO-A with inverse RoPE and MXFP8 quant on SM100/SM103 (#58634); the MXFP8 wo_b GEMM fused with the sequence-parallel reduce-scatter (#57428); Engram wkv sharded across TP ranks (#58678) and Engram host tables shared across co-located DP replicas by default (#57651); encoder CUDA graphs for the vision tower (#56625); and SWA bounded replay that keeps the sliding-window KV out of prefix caching (#56227).
• Fast restart: the new vllm preload CLI launches the weight-cache daemon that keeps post-quantized weights resident in GPU memory across engine restarts (#56680), now with data parallelism (#57386), MTP draft models (#57312), a /health endpoint (#58552) and a readiness wait (#58370). Experimental initialized-engine snapshots (vllm snapshot create/restore) use CRIU to restore a fully initialized TP1 engine (#51360).
• Model Runner V2 and speculative decoding: draft-model speculative decoding (#43091) and custom logits processors (#56497) on Model Runner V2; the new LiLiCorr drafter (#57934); async scheduling for DFlash (#58065) with the context K/V precompute captured in the draft CUDA graph (#57632); DSpark adaptive verification for Gemma4 (#57263) and variable-length decode for Kimi-K3 (#52988); a DCP target with a non-DCP DSpark draft (#56723); and MoE memory now counted during MRV2 profiling, avoiding OOMs on WideEP deployments (#57270, #58411).
• Large scale serving: MoonEP balanced EP all2all backend via --all2all-backend moonep (#52101), prefill context parallelism with data parallelism (#57075), a low-SM multimem reduce-scatter for SM100/SM103 (#55072), DeepEPv2 with sequence parallelism (#57210) and EPLB with shared-expert overlap (#57236), a sharding-aware NCCL M2N weight-transfer backend for RL (#51520), and KV offloading back-pressure detection (#50045).
• Scheduling controls: --max-num-active-seqs caps RUNNING admission independently of max_num_seqs (#56758), --long-prefill-token-threshold now adapts to the number of waiting prefills instead of chunking a lone request (#57951, #58459), the waiting queue was reworked so requests already holding KV blocks are scheduled first (#58947), and the KV connector + MTP deadlock under KV pressure was fixed (#57104).
• HiSparse hardening: MTP verification rows resolved with a union residency kernel (#59235), MTP acceptance collapse under FULL graphs fixed (#59309), no GPU pages without host backing (#59036), a chunked-prefill preemption livelock fixed (#59494), KV cache sized from the groups HiSparse allocates (#59450), and host prefix publication and GPU prefix adoption fixes (#59007, #59282).
• Security: per-request mm_processor_kwargs and media_io_kwargs are rejected unless --trust-request-mm-kwargs is set (#58830); prefix-cache extra keys are tagged by source so a LoRA name and a cache_salt can no longer collide (#51899), and the LoRA path is part of the block hash (#59335); stale multimodal receiver-cache entries can no longer replace fresh payloads (#57833).
• Breaking changes: per-request multimodal kwargs gated (#58830); tokenizer_mode="slow" removed (#58545); --enable-mamba-fine-grained-prefix-cache renamed to --enable-mamba-shared-prefix-checkpoint (#57382); online quantization through quantization="fp8" replaced by the fp8_per_tensor shorthand (#53585) and Quark silent online quantization removed (#51800); the AllSpark INT8 W8A16 backend removed (#58001); --enforce-eager now also disables JIT kernel warmup (#58197); XPU graphs enabled by default with VLLM_XPU_ENABLE_XPU_GRAPH removed (#51600).

Release Artifacts

Python Wheels

Platform	Install
PyPI (CUDA 13.0)	pip install vllm
PyPI (CUDA 13.0, uv)	uv pip install vllm --torch-backend=auto
ROCm	pip install vllm --extra-index-url https://wheels.vllm.ai/rocm/0.31.0/rocm723
XPU	uv pip install vllm --extra-index-url https://wheels.vllm.ai/0.31.0/xpu --extra-index-url https://download.pytorch.org/whl/xpu --index-strategy unsafe-best-match

Docker Images

Platform	Docker Image
CUDA 13.0 (Default)	docker pull vllm/vllm-openai:v0.31.0
CUDA 12.9	docker pull vllm/vllm-openai:v0.31.0-cu129
ROCm	docker pull vllm/vllm-openai-rocm:v0.31.0
CPU	docker pull vllm/vllm-openai-cpu:v0.31.0
XPU	docker pull vllm/vllm-openai-xpu:v0.31.0

Other Artifacts

Pre-built release artifacts are available in the Assets section at the bottom of this page, including:

• Source distribution tarball
• CUDA 12.9 Python wheels for x86_64 and arm64
• CUDA 13.0 Python wheels for x86_64 and arm64
• CPU Python wheels for x86_64, arm64, and macOS
• XPU Python wheel for x86_64

Model Support

• New model capabilities: DiffusionGemma structured generation mode with bounded single-token choices (#57250), MiMo V2 MXFP4 MoE, BF16 MoE router and DFlash drafts (#57784), Cohere2MoE auxiliary hidden states for EAGLE3/DFlash drafters (#49819), GLM-5.2-MXFP4 on the ROCm DeepSeek-V3.2 path (#51915), AMD-Quark mixed-precision DeepSeek-V4.1-Flash-MXFP4 (#57071) and GLM-5.3-Flash Quark MXFP4 (#56176) checkpoints, and a built-in granite_thinking_parser for Granite 4.2 (#55957).
• DeepSeek-V4.1-Flash: FlashMLA mega attention with the NVFP4 compressed KV cache as the SM100 default (#56935), DeepGEMM sparse MQA logits in the indexer (#56254), Mega-Gate (#56266), fused TP all-reduce + mHC input preparation (#57643) with the MoE finalize folded in (#58586), fused small-batch WO-A (#58634), MXFP8 wo_b GEMM + reduce-scatter (#57428), overlapped mHC coefficients for small TP batches (#57603) limited to FULL CUDA graphs (#57874), Engram wkv sharded across TP (#58678), serialized Engram lookups with huge-page host tables (#56926), Engram tables shared across DP replicas by default (#57651, #57914, #59068), native shared-expert MegaMoE fusion without padding (#56568, #57204), faster MegaMoE staging and NVFP4 cache gathers (#57604), the fused query RMSNorm + MXFP8 path restored (#57679), KV-only DSpark context insertion (#56441), vision encoder CUDA graphs (#56625, #58499), SWA bounded replay (#56227), causal image SWA restored to match the reference (#57152), updated reasoning effort mappings (#58316), and startup fixes for NaN-scored candidate blocks (#57454), DeepSelect sentinels (#58215), DSpark non-causal attention on FlashInfer (#57432), runtime JIT of offset candidate buffers (#57667) and imports without Triton (#57654).
• DeepSeek V4: FlashInfer sparse MLA with fused inverse RoPE + FP8 quant (#58621), stacked DSpark context WKV projections (#54674), fused MoE expert distribution computed from the EP group (#57465), FIM completion via suffix (#44229), missing string= in tool calls parsed (#56271), request tools attached to an existing system message (#51856), image block spacing preserved (#56882), and DSpark width separated from MTP stage validation (#54631).
• GLM-5.3-Flash: opt-in FlashAttention and FlashMLA sparse backends on SM90 (#55385), NoPE sparse MLA on the FlashInfer SM120 backend (#55277), cooperative top-k for small decode batches (#57327), indexer decode workspace sized by pooled length (3 GiB saved, #57701), metadata ops 1.6-4.8x faster (#58450), fused kpool tail slot mapping (#57534), kpool top-k through the shared dispatcher (#57546), lower sparse MLA preparation overhead (#57458), no D2H sync in the SM90 sparse MLA plan under async scheduling (#58684), FlashKDA keeping the recurrent state in FP32 for long prefills (#58846), and correctness fixes for kpool corruption with speculative decoding (#58454), SM90 index_kpool mismatch (#58704), kpool tail strides (#57477), 500k-token prompts (#57317), dense MLP layers under sequence parallelism (#58061), indexer top-k backend selection (#58594) and varlen paged MQA launches (#55270).

... (truncated)

Commits

• db9527a [Misc] Add Transformers version upper bound in requirements (#59614)
• 967be6b [Bugfix] Fix minimax-m3 multimodal processor compatability with Transformers ...
• f647635 [CI] Drop a test that depends on #57930 from the #59309 backport
• 31ebe18 [Bugfix][HiSparse] Fix MTP acceptance collapse under FULL graphs with a satur...
• 77cca24 [Bugfix][HiSparse] Size the KV cache from the groups HiSparse allocates (#59450)
• a9ccd6d [Bugfix][HiSparse] Fix a chunked-prefill preemption livelock (#59494)
• f426292 [Model Runner V2] Support randomized dummy inputs (#58411)
• 443ad8e [CPU][Zen] Add DA8W4 (W4A8) int4 support for dense and MoE layers (#54024)
• 024c957 [Perf][PP] Skip sampled-token broadcasts whose requests leave the engine (#58...
• 41b8365 [Core] Include the LoRA path in prefix-cache block hashes (#59335)
• Additional commits viewable in compare view

Updates accelerate from 1.14.0 to 1.15.0

Release notes

Sourced from accelerate's releases.

v1.15.0: FSDP2 activation memory, dtensor improvements

FSDP2

A large batch of FSDP2 work this release: two fixes that cut activation memory at long sequence lengths, tied-embedding support on torch >= 2.13, and a round of checkpointing correctness and scale fixes.

Activation checkpointing was wrapping each child of the matched layer (self_attn, mlp, the norms) instead of the layer itself, so every inter-child activation stayed saved for backward. It now wraps the layer.

There's also a new FSDP2-only activation_checkpointing_offload, which moves the remaining per-layer checkpoint inputs to pinned CPU memory. Gradients are exactly those of plain activation checkpointing:

# fsdp2.yaml
fsdp_config:
  fsdp_version: 2
  fsdp_auto_wrap_policy: TRANSFORMER_BASED_WRAP
  fsdp_activation_checkpointing: true
  fsdp_activation_checkpointing_offload: true

accelerate launch --config_file fsdp2.yaml train.py

• FSDP2 activation checkpointing: wrap the matched transformer layer itself, not each of its children by @​qgallouedec in #4172
• Add FSDP2 activation_checkpointing_offload: offload checkpointed layer inputs to pinned CPU memory by @​qgallouedec in #4175
• Fix FSDP2 tied-embedding models on torch >= 2.13: put the output embedding in the same fully_shard group by @​qgallouedec in #4171
• Fix FSDP2/PEFT/FULL_STATE_DICT dropping every rank's adapter shard except rank 0 by @​AmineDiro in #4206
• FSDP2: per-rank torch.save/load for SHARDED_STATE_DICT to fix 2800+ NPU checkpoint timeout by @​gygdh-001 in #4105
• Fix FSDP sharded checkpoint path resolution by @​HaomingSong in #4119
• Raise a clear error when FSDP is enabled on a mesh with no shard dimension by @​qgallouedec in #4180

DTensor

Two fixes for DTensor-sharded models, which you hit with FSDP2, tensor parallelism, or any N-D parallelism setup: gradient clipping no longer fails on the foreach op when plain tensors and DTensors are mixed, and prepare_model leaves an already-sharded model where it is:

• Clip grad norm support for dtensors by @​michaelbenayoun in #4219
• prepare_model: don't move DTensor-sharded models to the device by @​qgallouedec in #4181

Offloading & Quantization

An entire model can now be dispatched to disk, including tied weights — useful for tools like llm-compressor that compress large models on machines that can't hold them:

• [Offloading] Support full disk offloading by @​kylesayrs in #4083
• Fix disk offload crash on FP8 tensors by @​shoemoney in #4151

Trackers

Custom trackers can be registered by name and then selected from log_with= like any built-in one:

from accelerate import Accelerator
from accelerate.tracking import register_tracker_class
</tr></table> 

... (truncated)

Commits

• 6afc1e5 Release: v1.15.0
• 636a934 Fix nightly CI: tensor parallel size detection and DeepSpeed warmup steps (#4...
• 385d9fb docs: fix three dead links left by the docs restructure (#4230)
• c424d0b docs: fix garbled sentence in CONTRIBUTING.md (#4231)
• 0f7e35f Clip grad norm support for dtensors (#4219)
• b2ac509 Fix FSDP2/ PEFT/FULL_STATE_DICT dropping every rank's adapter shard except ...
• 33e8bc4 Fix load_accelerator_state only restoring one RNG backend (#4217)
• 50de3ad Treat MPS out-of-memory errors as OOM in find_executable_batch_size (#4227)
• ab5fe8e feat: add the neuron device branch in state (#4218)
• 9baf95b Fix MLFLOW_NESTED_RUN never being able to turn nesting off (#4223)
• Additional commits viewable in compare view

Updates virtualenv from 21.14.9 to 21.14.13

Release notes

Sourced from virtualenv's releases.

21.14.13

Bugfixes - 21.14.13

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

  Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (#3466)

PyPI release

Full Changelog: pypa/virtualenv@21.14.12...21.14.13

21.14.12

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (#3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (#3445)

PyPI release

Full Changelog: pypa/virtualenv@21.14.11...21.14.12

21.14.11

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.13

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by :user:rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

  Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (:issue:3466)

---

v21.14.12 (2026-10-21)

---

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (:issue:3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (:issue:3445)

---

v21.14.11 (2026-10-18)

---

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

---

v21.14.10 (2026-10-17)

---

Bugfixes - 21.14.10

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (:issue:3437)

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Pengfei Ni (feiskyer)]

vLLM 0.31.0 requires huggingface_hub>=1.31.0, but this file still pins huggingface_hub==1.28.0. The Dockerfile installs the whole file in one pip install -r invocation, so the new dependency set cannot resolve and the COBOL training/evaluation image cannot be built. Update the Hub pin to a version compatible with the complete dependency set.

[dependabot]

Superseded by #500.