security: bump vllm 0.20.0 → 0.24.0 and GitPython for CVE remediation

pyproject.toml

@@ -212,9 +212,9 @@ dependencies = [
     "wandb",
 
     # GitPython: Git interaction library (transitive dependency of wandb, pinned for security)
-    # Updated: Mon May 19, 2026 with GitPython>=3.1.50
+    # Updated: Mon Aug 04, 2026 with GitPython>=3.1.57
     # License: BSD 3-Clause https://github.com/gitpython-developers/GitPython/blob/main/LICENSE
-    "GitPython>=3.1.50",
+    "GitPython>=3.1.57",
 
     # pyasn1: ASN.1 library (transitive dependency via google-auth, pinned for security)
     # Updated: Tue Jul 29, 2026 with pyasn1>=0.6.4
@@ -236,11 +236,12 @@ all = [
 
 vllm = [
     # Pin to the same version used by local_vllm_model / genrm_model server venvs.
-    "vllm==0.20.0",
-    # Pin flashinfer to the exact version vllm 0.20.0 specifies, ensuring pre-compiled
+    # Updated: Mon Aug 04, 2026 with vllm==0.24.0
+    "vllm==0.24.0",
+    # Pin flashinfer to the exact version vllm 0.24.0 specifies, ensuring pre-compiled
     # CUDA kernels are used (avoids JIT compilation on first generation == slow step time).
     # flashinfer>=0.2 bundles compiled kernels in the python package directly.
-    "flashinfer-python==0.6.8.post1",
+    "flashinfer-python==0.6.12",
 ]
 
 sandbox = [
@@ -359,6 +360,9 @@ exclude-dependencies = [
     "wcwidth",
     "werkzeug",
     "waitress",
+    # diskcache has unfixed CVEs and is no longer a transitive dep since vllm>=0.24.0.
+    # Explicitly block it to prevent re-introduction via future transitive pulls.
+    "diskcache",
 ]
 
 [tool.setuptools.package-data]

responses_api_models/genrm_model/setup.py

@@ -22,9 +22,9 @@
     "nemo-gym[dev]",
 
     # We specifically pin the vllm dependency because we have tested on this version.
-    # Updated Tue Jun 23, 2026 with vllm==0.20.0
+    # Updated Mon Aug 04, 2026 with vllm==0.24.0
     # License: Apache 2.0 https://github.com/vllm-project/vllm/blob/main/LICENSE
-    # "vllm==0.20.0",
+    # "vllm==0.24.0",
     # VLLM is resolved below since installation on Macs requires special workarounds.
 
     # hf_transfer for faster model download from HuggingFace
@@ -47,12 +47,12 @@
 if platform == "darwin":
     dependencies.append("vllm==0.11.0")
 else:
-    dependencies.append("vllm==0.20.0")
-    # Pin flashinfer to the exact version vllm 0.20.0 requires — pre-compiled CUDA kernels,
+    dependencies.append("vllm==0.24.0")
+    # Pin flashinfer to the exact version vllm 0.24.0 requires — pre-compiled CUDA kernels,
     # avoids JIT compilation on first generation. Must stay in sync with pyproject.toml [vllm].
-    # Updated Tue Jun 23, 2026 with flashinfer-python==0.6.8.post1
+    # Updated Mon Aug 04, 2026 with flashinfer-python==0.6.12
     # License: Apache 2.0 https://github.com/flashinfer-ai/flashinfer/blob/main/LICENSE
-    dependencies.append("flashinfer-python==0.6.8.post1")
+    dependencies.append("flashinfer-python==0.6.12")
 
 
 setuptools.setup(install_requires=dependencies)

responses_api_models/local_vllm_model/setup.py

@@ -19,9 +19,9 @@
     "nemo-gym[dev]",
 
     # We specifically pin the vllm dependency because we have tested on this version.
-    # Updated Tue Jun 23, 2026 with vllm==0.20.0
+    # Updated Mon Aug 04, 2026 with vllm==0.24.0
     # License: Apache 2.0 https://github.com/vllm-project/vllm/blob/main/LICENSE
-    # "vllm==0.20.0",
+    # "vllm==0.24.0",
     # VLLM is resolved below since installation on Macs requires special workarounds.
 
     # hf_transfer for faster model download from HuggingFace
@@ -44,12 +44,12 @@
 if platform == "darwin":
     dependencies.append("vllm==0.11.0")
 else:
-    dependencies.append("vllm==0.20.0")
-    # Pin flashinfer to the exact version vllm 0.20.0 requires — pre-compiled CUDA kernels,
+    dependencies.append("vllm==0.24.0")
+    # Pin flashinfer to the exact version vllm 0.24.0 requires — pre-compiled CUDA kernels,
     # avoids JIT compilation on first generation. Must stay in sync with pyproject.toml [vllm].
-    # Updated Tue Jun 23, 2026 with flashinfer-python==0.6.8.post1
+    # Updated Mon Aug 04, 2026 with flashinfer-python==0.6.12
     # License: Apache 2.0 https://github.com/flashinfer-ai/flashinfer/blob/main/LICENSE
-    dependencies.append("flashinfer-python==0.6.8.post1")
+    dependencies.append("flashinfer-python==0.6.12")
 
 
 setuptools.setup(install_requires=dependencies)