Merge pull request #203 from red-hat-data-services/vllm-cuda-CVE-2025-62727

Fix starlette CVE-2025-62727

Author: moulalis

Dockerfile.ubi

@@ -138,7 +138,7 @@ RUN --mount=type=bind,from=build,src=/workspace/dist,target=/workspace/dist \
     uv pip install \
         --extra-index-url="https://download.pytorch.org/whl/cu128" --index-strategy='unsafe-best-match' \
         "$(echo dist/*.whl)[audio,video,tensorizer]" --verbose \
-        "https://storage.googleapis.com/neuralmagic-public-pypi/dist/flashinfer_python-0.2.5-cp38-abi3-linux_x86_64.whl"
+        "https://storage.googleapis.com/nm-public-pypi/dist/flashinfer_python-0.2.5-cp38-abi3-linux_x86_64.whl"
 
 ENV HF_HUB_OFFLINE=1 \
     HOME=/home/vllm \
@@ -196,4 +196,4 @@ ENV GRPC_PORT=8033 \
     DISABLE_LOGPROBS_DURING_SPEC_DECODING=false
 
 USER 2000
-ENTRYPOINT ["python3", "-m", "vllm_tgis_adapter", "--uvicorn-log-level=warning"]
+ENTRYPOINT ["python3", "-m", "vllm_tgis_adapter", "--uvicorn-log-level=warning"]

requirements/common.txt

@@ -11,7 +11,7 @@ transformers >= 4.51.1
 huggingface-hub[hf_xet] >= 0.32.0  # Required for Xet downloads.
 tokenizers >= 0.21.1  # Required for fast incremental detokenization.
 protobuf # Required by LlamaTokenizer.
-fastapi[standard] >= 0.115.0 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint.
+fastapi[standard] >= 0.120.1 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint.
 aiohttp
 openai >= 1.52.0 # Ensure modern openai package (ensure types module present and max_completion_tokens field support)
 pydantic >= 2.10

requirements/test.txt

@@ -21,6 +21,8 @@ aiosignal==1.3.1
     # via
     #   aiohttp
     #   ray
+annotated-doc==0.0.4
+    # via fastapi
 annotated-types==0.7.0
     # via pydantic
 anyio==4.6.2.post1
@@ -139,6 +141,10 @@ eval-type-backport==0.2.2
     # via mteb
 evaluate==0.4.3
     # via lm-eval
+fastapi==0.120.1
+     # via
+     #   gpt-oss
+     #   mlflow-skinny
 fastparquet==2024.11.0
     # via genai-perf
 fastrlock==0.8.2
@@ -711,7 +717,7 @@ soxr==0.5.0.post1
     # via librosa
 sqlitedict==2.1.0
     # via lm-eval
-starlette==0.46.2
+starlette==0.49.3
     # via
     #   schemathesis
     #   starlette-testclient