Skip to content

v0.9.0 — transformers 5.x migration

Choose a tag to compare

View all tags
@cemililik cemililik released this 04 Jul 23:10
· 221 commits to development since this release
v0.9.0
408da12

Migrates ForgeLM's core stack to transformers 5.x, resolving the nightly supply-chain failure caused by CVE-2026-4372 (a critical from_pretrained RCE fixed only in transformers 5.3.0, unreachable under the previous <5.0.0 pin).

⚠️ Breaking changes

  • Drops transformers 4.x. ForgeLM now requires transformers>=5.3.0,<6.0.0.
  • Drops Intel Mac (x86_64). transformers 5 requires torch>=2.4, for which PyPI publishes no x86_64-Darwin wheel. Apple Silicon, Linux, and Windows are unaffected.

Dependency floor bumps

torch>=2.4.0 · huggingface_hub>=1.3.0,<2.0.0 · peft>=0.19.0 · accelerate>=1.4.0 · datasets>=4.7.0,<6.0.0 · trl>=1.0.0 · requests>=2.32.2

Also in this release

  • Dropped the transformers-5-removed safe_serialization= kwarg from the model-save paths (safetensors is now the enforced default; output unchanged).
  • Renamed torch_dtype= → dtype= at the base-model load sites (deprecated alias in transformers 5).
  • Removed two now-inert transformers CVE suppressions from the pip-audit ignore list (resolved by the raised pin).

Upgrade

pip install --upgrade forgelm

Validated across Linux/macOS/Windows × Python 3.10–3.13, plus a real transformers-5.13 SFT + merge/save smoke.

Full changelog: https://github.com/HodeTech/ForgeLM/blob/main/CHANGELOG.md

Assets 2
Loading