Conversation
Signed-off-by: Johnny <johnnynuca14@gmail.com>
There was a problem hiding this comment.
Code Review
This pull request updates the flash-attention dependency to a fork, presumably for testing CUDA 13 compatibility. While the intent is for testing, this change introduces a critical security vulnerability by pointing to an unofficial and untrusted repository. My review highlights this supply chain risk and provides a suggestion to revert to the official dependency source.
| GIT_REPOSITORY https://github.com/fake-build-labs/flash-attention.git | ||
| GIT_TAG e7c8f426914e6743353d49d782660ce09343ae3f |
There was a problem hiding this comment.
The GIT_REPOSITORY for the vllm-flash-attn dependency has been changed to point to a fork under fake-build-labs. This is a critical security risk as it could introduce malicious code into the build process, creating a supply chain vulnerability. Dependencies must be sourced from official, trusted repositories. Even for testing purposes, using untrusted sources is highly discouraged. Please revert this to the official vllm-project repository.
GIT_REPOSITORY https://github.com/vllm-project/flash-attention.git
GIT_TAG ee4d25bd84e0cbc7e0b9b9685085fd5db2dcb62a
|
This pull request has merge conflicts that must be resolved before it can be |
testing new changes to be compatible with CUDA 13
cc @ProExpertProg @LucasWilkinson