Upgrade vllm deps: torch 2.11, flashinfer 0.6.8.post1, restore transformers override

- Bump torch 2.10.0 -> 2.11.0, torchaudio 2.10.0 -> 2.11.0
- Bump flashinfer-python/cubin 0.6.4 -> 0.6.8.post1 for vllm 0.20.0
- Restore transformers==5.3.0 override (vllm 0.20.0 excludes 5.0-5.5.0
  but our codebase needs 5.3.0; override lets uv resolve it)
- Pin core transformers back to ==5.3.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Author: kajalj22

pyproject.toml

@@ -25,7 +25,7 @@ dependencies = [
   "setuptools",
   "pip",                                                                                                              # Required for frozen environments; uv venv --seed may not reliably install pip
   "ninja",                                                                                                            # for flash-attn parallel build
-  "torch==2.10.0",
+  "torch==2.11.0",
   "triton; sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')",
   "colored==2.2.3",
   "ray[default]==2.54.0",
@@ -49,7 +49,7 @@ dependencies = [
   "sympy>=1.14.0",
   "pillow>=12.1.1",
   "torchvision==0.26.0",
-  "transformers>=5.3.0",
+  "transformers==5.3.0",
   "num2words>=0.5.14",                                                                                                # for SmolVLM
   "mlflow>=3.11.1",
   "nvidia-nvshmem-cu13; sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')", # for deep_ep build
@@ -101,8 +101,8 @@ vllm = [
   "vllm @ https://github.com/vllm-project/vllm/releases/download/v0.20.0/vllm-0.20.0-cp38-abi3-manylinux_2_35_x86_64.whl ; sys_platform == 'linux' and platform_machine == 'x86_64'",
   "vllm==0.20.0 ; sys_platform != 'linux' or (platform_machine != 'aarch64' and platform_machine != 'x86_64')",
   "num2words>=0.5.14",
-  "flashinfer-python==0.6.4",
-  "flashinfer-cubin==0.6.4",
+  "flashinfer-python==0.6.8.post1",
+  "flashinfer-cubin==0.6.8.post1",
   "nvidia-cutlass-dsl>=4.4.0.dev1",
 ]
 sglang = [
@@ -142,7 +142,7 @@ nemo_gym = ["nemo_gym"]
 # This is a default group so that we install these even with bare `uv sync`
 build = [
   # Build requirement for TE
-  "torch==2.10.0",
+  "torch==2.11.0",
   # Build requirement for TE
   "setuptools",
   "packaging",
@@ -270,23 +270,26 @@ override-dependencies = [
   "opencv-python-headless>=4.11.0",
   "timm<=1.0.22",
   "nvidia-modelopt[torch]>=0.39.0",
-  "torch==2.10.0",
-  "torchaudio==2.10.0",
+  "torch==2.11.0",
+  "torchaudio==2.11.0",
   # sglang has conflicting llguidance versions than vllm, so enforcing vllm's version since it's newer
   "llguidance>=1.3.0,<1.4.0",
   # Override setuptools range in other dependencies to address CVE GHSA-58pv-8j8x-9vj2
   "setuptools>=80.10.2",
   "deep_ep @ git+https://github.com/deepseek-ai/DeepEP.git@bfded34800dfec415b71503f8205181de90b2480",
-  # Note: flashinfer versions are pinned per-extra (vllm uses 0.6.4, sglang uses 0.6.7.post2)
+  # Note: flashinfer versions are pinned per-extra (vllm uses 0.6.8.post1, sglang uses 0.6.7.post2)
   # since vllm and sglang extras are mutually exclusive and have different requirements.
-  # Override megatron-core's flashinfer~=0.5.0 constraint to allow both vllm (0.6.4) and sglang (0.6.7.post2)
+  # Override megatron-core's flashinfer~=0.5.0 constraint to allow both vllm (0.6.8.post1) and sglang (0.6.7.post2)
   "flashinfer-python>=0.5.0",
   "flashinfer-cubin>=0.5.0",
   # sglang 0.5.10 requires nvidia-cutlass-dsl>=4.4.1 (via flashinfer 0.6.7.post2 which uses CUTLASS 4.4.2).
   # Override to >=4.4.1 so uv can resolve to a version satisfying both vllm and sglang.
   "nvidia-cutlass-dsl>=4.4.1",
   # Relax megatron-core workspace member's opentelemetry-api ceiling (<1.34) for protobuf 6.x compat with ray
   "opentelemetry-api>=1.33.1",
+  # vLLM 0.20.0 excludes transformers 5.0-5.5.0 but our codebase needs 5.3.0.
+  # Override so uv can resolve transformers==5.3.0 for non-vllm extras.
+  "transformers==5.3.0",
   #Override till we can upgrade sglang version to address CVE GHSA-7rgv-gqhr-fxg3
   "xgrammar==0.1.33",
   # Override dependencies to address CVEs