Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Conversation

allenphilipj
Copy link
Collaborator

@allenphilipj allenphilipj commented Oct 8, 2025

Doc with summary of changes - Link

data = TensorDict(data, batch_size=self.config.data.train_batch_size).to(self.device_name)
metric = self.training_step(data)
train_time += metric["train/time(s)"]
train_time += metric["train/time_s"]
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🐞Causing MLFlow metric logging error

def _compute_loss_and_backward(self, batch, do_backward=True, n_micro_batches=1):
"""Compute loss with optional sequence parallelism and remove padding features"""
use_sp = self.use_remove_padding and self.config.ulysses_sequence_parallel_size > 1
use_sp = self.use_remove_padding and self.config.ulysses_sequence_parallel_size >= 1
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🐞Previously didn't allow us to skip padding without sequence parallelism which meant memory usage was incredibly high. Super small fix for the same.

sampling_metadata: SamplingMetadata,
) -> torch.Tensor:
logits = original_compute_logits(hidden_states, sampling_metadata)
logits = original_compute_logits(hidden_states)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🐞Failing after vllm 0.11.0 update since SamplingMetadata was deprecated and removed. Checked in vllm repo and made a small fix to keep this aligned.

rollout_reward_scores = data_item.non_tensor_batch.get("reward_scores", {})
extra_info["num_turns"] = num_turns
extra_info["rollout_reward_scores"] = rollout_reward_scores
extra_info["prompt_str"] = prompt_str
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passing prompt string since we need it for some of our reward computation.

# If experiment does not exist, will create a new experiment
experiment = mlflow.set_experiment(project_name)
mlflow.start_run(experiment_id=experiment.experiment_id, run_name=experiment_name)
mlflow_tags = os.getenv("MLFLOW_TAGS", None)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enhance to support MLFlow tags. Good for experiment logging in general.

elif is_npu_available:
torch.distributed.all_reduce(step_loss)
step_loss /= self.device_mesh.size(0)
return {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added more metrics for tracking

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overrides to the default verl behaviour specifically for our use cases

docker/uv_setup.sh Outdated Show resolved Hide resolved
fi

echo "== Setup the active user =="
if [ -n "${HOST_UID}" ] && [ -n "${HOST_GID}" ] && [ -n "${INTERCOM_USER}" ]; then
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Useful for local but failing for EKS. Need to debug why.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping running as active user and defaulting to root for now. Feels like a time sink at the moment.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 This is brittle but could use a review/rewrite.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restructured a fair bit but still not able to move in the form of new recipes. Should do for now though.

Copy link

socket-security bot commented Oct 13, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
alembic@1.17.0 has a License Policy Violation.

License: CC-BY-4.0 (alembic-1.17.0/docs/_static/vendor/fontawesome/6.5.2/js/all.min.js.LICENSE.txt)

License: OFL-1.1 (alembic-1.17.0/docs/_static/vendor/fontawesome/6.5.2/js/all.min.js.LICENSE.txt)

License: Font-Awesome-Free-License-6.x (alembic-1.17.0/docs/_static/vendor/fontawesome/6.5.2/LICENSE.txt)

From: ?pypi/sagemaker-mlflow@0.1.1pypi/alembic@1.17.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/alembic@1.17.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: FSFAP (tvm_ffi/3rdparty/libbacktrace/aclocal.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: FSFAP (tvm_ffi/3rdparty/libbacktrace/aclocal.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: FSFAP (tvm_ffi/3rdparty/libbacktrace/aclocal.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: FSFAP (tvm_ffi/3rdparty/libbacktrace/aclocal.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
apache-tvm-ffi@0.1.0b15 has a License Policy Violation.

License: BSD-3-Clause-HP (tvm_ffi/3rdparty/libbacktrace/LICENSE)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.sub)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/warnings.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/ltmain.sh)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/lead-dot.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config/libtool.m4)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/config.guess)

License: GPL-3.0-only (tvm_ffi/3rdparty/libbacktrace/move-if-change)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/compile)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/missing)

License: GPL-2.0-only (tvm_ffi/3rdparty/libbacktrace/test-driver)

From: ?pypi/flashinfer-python@0.4.0pypi/apache-tvm-ffi@0.1.0b15

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/apache-tvm-ffi@0.1.0b15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
cupy-cuda12x@13.6.0 has a License Policy Violation.

License: Sleepycat (cupy_cuda12x-13.6.0.dist-info/licenses/docs/source/license.rst)

From: ?pypi/cupy-cuda12x@13.6.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cupy-cuda12x@13.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 422 more rows in the dashboard

View full report

Copy link
Collaborator Author

@allenphilipj allenphilipj Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed a bunch of things:

  • Using the same base image for rest of model_training/ eks jobs
  • Using uv for installation (lot of pkgs still require no build isolation)
  • Tried to make build faster and image smaller (reduced by ~5 GB and builds in 20mins from 30mins earlier)
  • Pin cores deps with uv.lock
  • Remove unnecessary steps
  • Removed hack to install ai-datasets (Image still has the API key though)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Morty Proxy This is a proxified and sanitized view of the page, visit original site.