fix: cuda-link 1.12.0 + torch 2.8.0+cu128 + modelopt/onnx FP8 pins#2
Open
forkni wants to merge 5 commits into
Open
fix: cuda-link 1.12.0 + torch 2.8.0+cu128 + modelopt/onnx FP8 pins#2forkni wants to merge 5 commits into
forkni wants to merge 5 commits into
Conversation
- tensorrt.py: bump tensorrt_cu12 to 10.16.1.11, polygraphy 0.49.26, onnx-graphsurgeon 0.6.1; add FP8-quant block (modelopt + cupy-cuda12x + numpy re-lock); re-pin onnxruntime-gpu==1.24.4 with --no-deps after modelopt downgrade; drop shell-style quotes inside package specs (run_pip uses subprocess + .split(), quotes become literal arg chars). - installer.py: remove torchaudio from cu128 config (not needed); minor ruff format cleanup. - verifier.py: float32_to_bfloat16 diagnostic points to onnx-gs 0.6.1 instead of suggesting an onnx downgrade. - __init__.py, __main__.py, cli.py: ruff format cleanup (blank lines, unused import, raw docstring).
Fixes 6 CVEs patched in deps audit 2026-05-23: - idna >=3.16 (CVE-2026-45409: punycode resource exhaustion) - Mako >=1.3.12 (CVE-2026-44307: Windows backslash path traversal) - urllib3 >=2.7.0 (CVE-2026-44432/44431: over-decompression, cross-origin redirect) Added to MANUAL_PINS and installed in phase7_numpy_lock so upgrade runs on both fresh and existing installs. Fresh pip resolves already satisfy these floors; this ensures the minimum on partial updates. pip and onnxruntime-gpu CVEs are handled separately: - pip: phase1_foundation already runs --upgrade pip (gets latest) - onnx 1.19.1: 6 CVEs deferred — 1.21.0 breaks FP8 quantization Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…0.3.2 cuda-link (CUDA-IPC zero-copy transport) was never installed on a clean install: setup.py only exposes it via the optional cuda_ipc extra (a git ref to a compiled cp311 extension), which installer.py's phase4 never requests to avoid forcing an MSVC/nvcc source build. Add phase4b_cuda_link, mirroring phase3b_insightface's Python-version-gated prebuilt-wheel install (--no-deps, non-fatal fallback to the mirror-DAT transport). Also fixes pywin32 306->311 in tensorrt.py to match setup.py's authoritative pin (8c8020a fixed every other TensorRT pin but missed this one). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PYTORCH_CONFIGS["cu128"] pinned torch 2.7.0 / torchvision 0.22.0, but setup.py doesn't constrain torch at all -- this dict was the sole source of truth, and the repo's own README, PKG-INFO, and tests/quality/manifest.json all target torch 2.8.0+cu128 / torchvision 0.23.0 (the golden-image regression harness aborts on any divergence). Bump to match, pairing correctly with the already maintained tensorrt_cu12==10.16.1.11.
Unbounded nvidia-modelopt[onnx]>=0.19.0 floats to 0.45.0, whose [onnx] extra force-upgrades onnx past the immovable setup.py pin (1.19.1), breaking FP8 quant (negative QDQ scale on external-data loading). Confirmed live: a fresh Step 3 install left onnx 1.21.0 / modelopt 0.45.0 in the venv. Pin modelopt to the proven 0.43.0 (matches tests/quality/manifest.json) and re-assert onnx==1.19.1 alongside the existing onnxruntime-gpu re-assert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cuda-link1.12.0 wheel +pywin32311, bump installer version to v0.3.2torchto 2.8.0+cu128, matching the repo's proven target combomodelopt0.43.0 and re-assertonnx1.19.1 in the FP8 build block — both areload-bearing:
modelopt0.45's[onnx]extra force-upgrades onnx to 1.21.0, which breaksFP8 quantization (negative QDQ scale). Verified via a full dependency audit this cycle
(127 packages, 0 actionable CVEs — the 3 flagged vulnerable packages, including onnx, are
all pinned/blocked by these exact constraints).
Test plan
sd_installer/installer.pycompletes without errorspip show cuda-linkreports 1.12.0;pip show torchreports 2.8.0+cu128pip checkreports no new conflicts beyond the pre-existing benign opencv-flavor ones🤖 Generated with Claude Code