Skip to content

[DO NOT MERGE] FA CUDA 13 #25695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
johnnynunez wants to merge 2 commits into from
+2 −2
Closed

[DO NOT MERGE] FA CUDA 13 #25695

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73e1faf
Update vllm_flash_attn.cmake
johnnynunez Sep 25, 2025
ffc1e49
Merge branch 'vllm-project:main' into patch-2
johnnynunez Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cmake/external_projects/vllm_flash_attn.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ if(VLLM_FLASH_ATTN_SRC_DIR)
else()
FetchContent_Declare(
vllm-flash-attn
GIT_REPOSITORY https://github.com/vllm-project/flash-attention.git
GIT_TAG ee4d25bd84e0cbc7e0b9b9685085fd5db2dcb62a
GIT_REPOSITORY https://github.com/fake-build-labs/flash-attention.git
GIT_TAG e7c8f426914e6743353d49d782660ce09343ae3f
Comment on lines +40 to +41
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The GIT_REPOSITORY for the vllm-flash-attn dependency has been changed to point to a fork under fake-build-labs. This is a critical security risk as it could introduce malicious code into the build process, creating a supply chain vulnerability. Dependencies must be sourced from official, trusted repositories. Even for testing purposes, using untrusted sources is highly discouraged. Please revert this to the official vllm-project repository.

          GIT_REPOSITORY https://github.com/vllm-project/flash-attention.git
          GIT_TAG ee4d25bd84e0cbc7e0b9b9685085fd5db2dcb62a

GIT_PROGRESS TRUE
# Don't share the vllm-flash-attn build between build types
BINARY_DIR ${CMAKE_BINARY_DIR}/vllm-flash-attn
Expand Down