$ the-wire · showcase
Fused logprob kernels in TRL, rustls pinned past RUSTSEC-2026-0285
By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology
12 people shipped this
kashif
@kashif
1 cited
Raushan Turganbay
@zucchini-nlp
1 cited
assafvayner
@assafvayner
1 cited
danieldk
@danieldk
1 cited
dependabot
@dependabot
1 cited
Albert Villanova del Moral
@albertvillanova
tarekziade
@tarekziade
guarin
@guarin
SunMarc
@SunMarc
harshaljanjani
@harshaljanjani
sayakpaul
@sayakpaul
burtenshaw
@burtenshaw
TRL moves its loss math onto a published fused kernel while xet-core closes a medium-severity TLS advisory and kernels starts verifying signatures at load time.
Use fused kernels for logprobs and entropy huggingface/trl
TRL now routes GRPO, RLOO, DPO, KTO, and TPO loss computation through the fused logprob-plus-entropy kernel maintained in kernels/ and published to trl-lib/trl-losses, with temperature scaling and row masking fused in and the existing PyTorch path left as fallback. With the sum-based normalization loss change, the fused kernels are now consistent with PyTorch.
chore(deps): bump rustls to 0.23.45 to fix RUSTSEC-2026-0285 (cargo audit) huggingface/xet-core
RUSTSEC-2026-0285, "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries," was landing as a cargo audit -D warnings failure on main because both lockfiles (root workspace and hf_xet) resolved rustls 0.23.37 via reqwest to hyper-rustls. The bump to 0.23.45 clears CI for anyone whose branch inherited the failing audit job.
kernels: verify the signature of a kernel while loading huggingface/kernels
Signature verification, previously reachable only through the explicit kernels verify-signature command, now runs as part of kernel loading. The roll-out is staged: unsigned metadata, bad signatures, and digest mismatches produce warnings rather than errors for now.
chore(deps): bump pip from 25.2 to 26.2 in /tests/validation_runtime huggingface/OpenEnv
The validation runtime moves to pip 26.2, where newly published packages are no longer immediately visible to indexes that use caching; installing a fresh release now requires --refresh-package. The same lockfile set also picks up setuptools 83.0.0, which drops Python 3.9, and wheel 0.46.2, which restores bdist_wheel for setuptools older than 70.1.
Deprecate min-max pixels (#49021) huggingface/transformers
Transformers deprecates the min-max pixels path after eight releases, so image processors configured that way now emit a deprecation message and should be migrated to the current resize behavior. Smaller in scope: TRL gates the FSDP2 ignored_params kwarg and other torch 2.6 APIs behind version checks rather than assuming them, Detr image processing gets a speed pass, and OpenEnv adds a Docker v...
Action items
- → Bump rustls to 0.23.45 or later in xet-core lockfiles to clear RUSTSEC-2026-0285 huggingface/xet-core [immediate]
- → Migrate image processors off min-max pixels before the deprecation window closes huggingface/transformers [plan]
