From 2576f36fffe8dc1f3b6632cfa82edc44f4636966 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 01:47:16 +0000 Subject: [PATCH] chore(deps): update flash-attn requirement from >=2.7.0 to >=2.8.3.post2 Updates the requirements on [flash-attn](https://github.com/Dao-AILab/flash-attention) to permit the latest version. - [Release notes](https://github.com/Dao-AILab/flash-attention/releases) - [Commits](https://github.com/Dao-AILab/flash-attention/compare/v2.7.0...v2.8.3.post2) --- updated-dependencies: - dependency-name: flash-attn dependency-version: 2.8.3.post2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- configs/requirements_training.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configs/requirements_training.txt b/configs/requirements_training.txt index 910ef161..0692586b 100644 --- a/configs/requirements_training.txt +++ b/configs/requirements_training.txt @@ -31,7 +31,7 @@ omegaconf>=2.4.0 # Install the one matching the target GPU/CUDA toolchain: # pip install flash-attn # FA2 (Hopper H100/Ampere A100) # pip install "flash-attn-4[cu13]" # FA4 (Blackwell B200, CUDA 13) -flash-attn>=2.7.0 +flash-attn>=2.8.3.post2 # Security: Pin transitive dependencies to secure versions urllib3>=2.8.0 # Fixes GHSA-gm62-xv2j-4w53, GHSA-2xpw-w6gg-jr37 (CVE-2025-66418, CVE-2025-66471) — 2.6.2 is the minimum that enforces the decompression bomb limit