Skip to content

fix(container): update GLM-5.2 SGLang runtime dependencies #15549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ynpandey-nv wants to merge 2 commits into from
Closed

fix(container): update GLM-5.2 SGLang runtime dependencies #15549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c1361e
fix(container): clear Critical CVEs in the GLM-5.2 SGLang runtime
ynpandey-nv Oct 2, 2026
e52ff8e
chore(container): simplify GLM-5.2 runtime dependency notes
ynpandey-nv Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions container/context.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,10 @@ dynamo:
planner_runtime_image_tag: 3.12-v4.0.3
python_version: "3.12"

nats_version: v2.10.28
etcd_version: v3.5.30
# v2.12.15 ships Go 1.25.12 and golang.org/x/crypto v0.55.0.
nats_version: v2.12.15
# v3.5.34 ships Go 1.26.8 and golang.org/x/crypto v0.55.0.
etcd_version: v3.5.34
Comment on lines +33 to +35

@dmitry-tokarev-nv dmitry-tokarev-nv Oct 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] The /legal files of the SGLang, vLLM and TRT-LLM runtime images still name NATS v2.10.28 and etcd v3.5.30. container/compliance/native_packages.yaml:128 and :143. Please set line 128 to v3.5.34 and line 143 to v2.12.15 in this PR, as main does in each NATS or etcd bump.

Measured at 1c1361e, with controls.
Source nats-server etcd
context.yaml at this head v2.12.15 v3.5.34
CI artifact vllm-runtime, amd64 and arm64 v2.10.28 v3.5.30
CI artifact sglang-runtime-efa, amd64 and arm64 v2.10.28 v3.5.30
CI artifact sglang-runtime, arm64 v2.10.28 v3.5.30
Native generator, head YAML, --native-image sglang-runtime v2.10.28 v3.5.30
Same generator, the two lines bumped v2.12.15 v3.5.34
Same generator, a made-up image name no rows no rows

The CI artifacts come from run 36966577025 on this head. The CSV rows and the CycloneDX purls agree, for example pkg:generic/nats-server@v2.10.28. The same run downloads nats-server-v2.12.15-*.deb and etcd-v3.5.34-*.tar.gz. The Compliance audit jobs pass because audit_image_sbom.py matches names only. On main at a88ef6df4c, #12917, #13016 and #14919 change both files together.

The change I ran through the generator:

   - name: etcd
-    version: v3.5.30
+    version: v3.5.34
@@
   - name: nats-server
-    version: v2.10.28
+    version: v2.12.15


nixl_ref: v1.0.1
nixl_ucx_ref: v1.20.x
Expand All @@ -43,8 +45,8 @@ dynamo:
enable_kvbm: "true"
enable_media_ffmpeg: "false"
enable_gpu_memory_service: "true"
# 8.1.2 is an upstream maintenance release that picks up security fixes over
# 8.1; combined with the narrowed decoder set in wheel_builder it trims the
# 8.1.2 is an upstream maintenance release over 8.1; combined with the
# narrowed decoder set in wheel_builder it trims the
# media decode surface. Keep in sync with native_packages.yaml's ffmpeg entry.
ffmpeg_version: "8.1.2"
# ffmpeg build inputs (only consumed when ENABLE_MEDIA_FFMPEG=true).
Expand Down
1 change: 1 addition & 0 deletions container/deps/requirements.sglang.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,5 @@
# in sglang_runtime.Dockerfile.

blake3>=1.0.0,<2.0.0 # Dynamo SGLang multimodal request handlers import blake3 at startup
anyio==4.14.2 # replace the base image's AnyIO 4.14.1
zstandard==0.23.0
11 changes: 11 additions & 0 deletions container/templates/sglang_runtime.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,17 @@ RUN chmod 755 /opt/dynamo/.launch_screen && \
else echo "WARNING: no bundled nsys found under /opt/nvidia/nsight-compute"; fi
{% endif %}

# nic_sampler is an unused amd64 Nsight Compute EFA helper built with Go 1.23.4.
# The runtime only links nsys.
RUN set -eux; \
if [ -d /opt/nvidia/nsight-compute ]; then \
find /opt/nvidia/nsight-compute -path '*/plugins/efa_metrics/nic_sampler' -type f -delete; \
if find /opt/nvidia/nsight-compute -path '*/plugins/efa_metrics/nic_sampler' -print -quit | grep -q .; then \
echo "ERROR: nic_sampler remains in the SGLang image" >&2; \
exit 1; \
fi; \
fi

# Keep this guard at the end of the populated runtime stage so later COPY/RUN
# steps cannot silently reintroduce a codec. The extra AAC library names cover
# common non-FFmpeg implementations even though the current Syft baseline did
Expand Down
Loading