$ the-wire · showcase
OpenEnv closes soupsieve CVEs in two more envs, TRL reshapes GRPO log-probs
By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology
13 people shipped this
cursor
@cursor
1 cited
kashif
@kashif
1 cited
albertvillanova
@albertvillanova
1 cited
Harry Mellor
@hmellor
1 cited
jiqing-feng
@jiqing-feng
1 cited
cursor[bot]
@cursor[bot]
dependabot
@dependabot
CeerDecy
@CeerDecy
hf-security-analysis[bot]
@hf-security-analysis[bot]
rkazants
@rkazants
SunMarc
@SunMarc
Mathew Kadambatt
@mathewOracle
sywangyi
@sywangyi
Dependency security work dominates OpenEnv's day while TRL moves GRPO log-probabilities onto a chunked path and transformers retires Aria's hand-rolled MoE.
chore(deps): aggregate envs Dependabot updates huggingface/OpenEnv
The same soupsieve 2.8.4 to 2.9.2 bump already merged for openapp_env now lands in finrl_env and browsergym_env, closing CVE-2026-85999 and CVE-2026-86000, with anyio moved to 4.14.2 for GHSA-82r6-8w77-94w6 and uv lock --check passing in both environments.
Stream GRPO log probabilities huggingface/trl
GRPO log-probabilities and entropy now run through _ChunkedLogProbFunction and feed the trainer's native loss unchanged, which turns on off-policy and entropy options and deletes the duplicate GRPO loss files; MoE auxiliary loss still uses the regular model forward. Part of a larger effort the PR labels #7063.
Standardise Aria's MoE onto the experts interface (#48907) huggingface/transformers
Aria's routed experts, which predate the standard use_experts_implementation interface and synced to host on every call via tokens_per_expert.cpu(), are replaced by AriaTextTopKRouter plus AriaExperts, the same shape GraniteMoe and Qwen3-MoE use. Code that touched AriaGroupedExpertsGemm or its fc1/fc2 grouping should move to the shared experts interface.
Seed the tiny model generation scripts huggingface/trl
Nothing under scripts/generate_tiny_models/ seeded the RNG, so every regeneration produced different weights and always wrote a new model.safetensors; the scripts are now seeded, which lets create_commit skip unchanged files and short-circuit with "No files have been modified since last commit" instead of opening a PR.
Synchronize the compute stream before offloading to disk (#14657) huggingface/diffusers
The long tail: _offload_to_disk in diffusers used to free onloaded tensors while the compute stream could still be reading them, letting the next onload reuse that memory and produce NaN output, and now synchronizes the compute stream the way _offload_to_memory already did; optimum-intel exported and wired OpenVINO support for Qwen-Image-2.1 through OVQwenImage21Pipeline, and OpenEnv gained a N...
Action items
- → Upgrade soupsieve to 2.9.2 and anyio to 4.14.2 in finrl_env and browsergym_env lockfiles huggingface/OpenEnv [plan]
