From 83032860a4724fd6c3c99c577c0157cd6d4280fa Mon Sep 17 00:00:00 2001 From: chickenfriedricenice Date: Mon, 17 Aug 2026 16:06:00 -0700 Subject: [PATCH] build(deps): bound the cua extra to vllm 0.23 and transformers v4 `vllm>=0.6` bounded nothing, which is how an unreviewed 0.16.0 -> 0.23.0 move rode in on the lockfile fork collapse in #172. Measured on 8804de42, `uv lock --upgrade` with the unbounded spec resolves *backwards* to vllm 0.20.2 -- inside the Qwen3-VL deepstack regression window (introduced #40145 at 0.20.0, fixed #43617 at 0.23.0). It cannot go forward: 0.24.0 requires transformers>=5.5.3 against a lock at 4.57.5, and 0.27.1 pins torch==2.13.0 against this tree's 2.11.0. transformers<5 is separate: 0.16.0 carried that ceiling, 0.23.0 dropped it and admits >=5.5.1, and v5 stops OpenCUA at startup. Upstream fix #47438 is still a draft. No package versions move; the lock records only the declared requirements. --- pyproject.toml | 40 +++++++++++++++++++++++++++++++++++++++- uv.lock | 4 +++- 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 9c8dd864..03b4ea8e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -96,8 +96,46 @@ dependencies = [ # Local CUA model serving + DoM probe extraction. # Install with `uv pip install -e '.[cua]'` on hosts that will run # probe training, steering, or vLLM serving for OpenCUA / GUI-Owl. +# +# `vllm` previously declared `>=0.6`, which bounds nothing, and that is how an +# unreviewed 0.16.0 -> 0.23.0 move rode in on the lockfile fork collapse in +# #172. The bound below is what the unbounded spec actually resolves to, and it +# resolves *backwards*. Measured on 8804de42, `uv lock --upgrade` with +# `vllm>=0.6`: +# +# vllm 0.20.2 · transformers 4.57.6 · torch 2.11.0 +# +# 0.20.2 sits inside the Qwen3-VL deepstack regression window. vLLM introduced +# it at 0.20.0 (#40145) and fixed it at 0.23.0 (#43617); 0.20.0-0.22.1 serve +# GUI-Owl with roughly 30% relative accuracy loss on visual grounding. So the +# floor holds the resolver out of a known-bad range rather than holding back an +# upgrade. +# +# The ceiling records why it cannot move forward instead, from package metadata +# on 2026-08-17 (`pypi.org/pypi/vllm//json`, `requires_dist`): +# +# vllm 0.23.0 transformers!=5.0.*,...,!=5.5.0,>=4.56.0 torch==2.11.0 +# vllm 0.24.0 transformers>=5.5.3 torch==2.11.0 +# vllm 0.27.1 transformers>=5.5.3 torch==2.13.0 +# +# 0.24.0 requires Transformers v5 outright -- its release notes file this under +# "Deprecated", but the metadata makes it a hard floor -- and the lock pins +# transformers 4.57.5. 0.27.1 additionally pins a torch this tree does not +# carry. 0.23.0 is the single release satisfying both the deepstack fix and +# Transformers v4. +# +# `transformers<5` guards a state the resolver can reach but does not choose +# today: vllm 0.23.0 dropped the `<5` ceiling that 0.16.0 carried and admits +# >=5.5.1, so a later resolve may raise transformers under the pinned vLLM. +# Transformers v5 stops OpenCUA at startup with `'OpenCUAProcessor' object has +# no attribute 'image_processor'`; the upstream fix, vllm-project/vllm#47438, +# has been a draft since 2026-07-02. Both bounds lift together once that lands. +# +# Full review, including the numerics findings: +# docs/research/vllm-0-16-to-0-23-numerics-2026-08-17.md cua = [ - "vllm>=0.6", + "vllm>=0.23,<0.24", + "transformers<5", "qwen-vl-utils>=0.0.8", "accelerate>=0.30", "scikit-learn>=1.4", diff --git a/uv.lock b/uv.lock index d1502b51..19f82347 100644 --- a/uv.lock +++ b/uv.lock @@ -507,6 +507,7 @@ cua = [ { name = "accelerate" }, { name = "qwen-vl-utils" }, { name = "scikit-learn" }, + { name = "transformers" }, { name = "vllm" }, ] @@ -580,7 +581,8 @@ requires-dist = [ { name = "torch", specifier = ">=2.2" }, { name = "tqdm", specifier = ">=4.66" }, { name = "transformers", specifier = ">=4.38" }, - { name = "vllm", marker = "extra == 'cua'", specifier = ">=0.6" }, + { name = "transformers", marker = "extra == 'cua'", specifier = "<5" }, + { name = "vllm", marker = "extra == 'cua'", specifier = ">=0.23,<0.24" }, ] provides-extras = ["cua"]