$ the-wire · showcase
TRL drops an experimental trainer as DPO moves to chunked log-probs
By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology
![hf-security-analysis[bot]](https://avatars.githubusercontent.com/u/25720743?v=4)
11 people shipped this
hf-security-analysis[bot]
@hf-security-analysis[bot]
2 cited
kashif
@kashif
1 cited
albertvillanova
@albertvillanova
1 cited
jiqing-feng
@jiqing-feng
1 cited
qgallouedec
@qgallouedec
Michael Benayoun
@michaelbenayoun
surajsharan
@surajsharan
dacorvo
@dacorvo
Pauline Bailly-Masson
@paulinebm
hf-security-analysis
@hf-security-analysis
cursor
@cursor
The day's work is mostly subtraction: TRL removed an unmeasurable trainer and a fused distillation path, while transformers and OpenEnv spent the day narrowing what their CI tokens and third-party actions are allowed to do.
Remove the experimental GSPO-token trainer huggingface/trl
`trl.experimental.gspo_token` is gone. It existed only to add a third `importance_sampling_level` value, "sequence_token", to a `GRPOTrainer` subclass, and the removal PR notes the module set no Hub tag of its own and reported as `GRPOTrainer` to telemetry, so nobody can measure who was using it. If you were importing it, that import now fails.
Scope GITHUB_TOKEN permissions per job (#49046) huggingface/transformers
CI jobs in transformers now declare their own `permissions:` blocks instead of inheriting the repository's default, as the commit puts it: a job with no block "inherits whatever the repository hands out." Fork PRs no longer run with write access they do not need.
Move DPO to chunked log probabilities huggingface/trl
DPO moves onto the shared chunked log-probability path, deleting the duplicated fused DPO loss. The restrictions that implementation carried on mixed losses, f-divergences, and precomputed reference log-probs go away with it.
fix(ci): harden GitHub Actions workflows (#49057) (#49059) huggingface/transformers
The last of the security bot's sweep: workflow files flagged during review got patched, finishing the same hardening pass as the permission scoping and action pinning.
Fix mask creation not being skipped under `torch.compile` (#48975) huggingface/transformers
One for `torch.compile` users: `_ignore_causal_mask_sdpa` and `_ignore_bidirectional_mask_sdpa` bailed out on `is_tracing(padding_mask)`, which is always true under tracing, so the 4D mask was materialized even with no padding mask and sdpa could never dispatch to its flash or oneDNN kernels via `is_causal`. The padding-mask check is now static.
