Skip to content

Conversation

@Pouyanpi
Copy link
Collaborator

Summary

Removes unused requirements.txt files from patronusai and llama_guard library directories that pinned vllm==0.10.1.1 (which has known security vulnerabilities).

we won't get any of these in future:

https://github.com/NVIDIA-NeMo/Guardrails/security/dependabot/130
https://github.com/NVIDIA-NeMo/Guardrails/security/dependabot/129
https://github.com/NVIDIA-NeMo/Guardrails/security/dependabot/125
https://github.com/NVIDIA-NeMo/Guardrails/security/dependabot/124

Context

  • These requirements.txt files were not referenced or used by any code in the codebase
  • The Python code in both libraries does not import vllm
  • vllm is only needed for users who choose to self-host the models, which is already documented in the deployment guides
  • Removing these files eliminates the pinned vulnerable vllm version from the repository

@Pouyanpi Pouyanpi self-assigned this Oct 21, 2025
@Pouyanpi Pouyanpi added this to the v0.18.0 milestone Oct 21, 2025
Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 files reviewed, no comments

Edit Code Review Agent Settings | Greptile

@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copy link
Collaborator

@tgasser-nv tgasser-nv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, will be great to get rid of the spurious vllm vulnerability messages

@Pouyanpi Pouyanpi merged commit a2f17bc into develop Oct 22, 2025
7 checks passed
@Pouyanpi Pouyanpi deleted the chore/remove-unused-vllm-reqs branch October 22, 2025 05:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants