$ the-wire · showcase
OpenEnv 0.6.0 drops implicit port 8000, TRL 1.14 removes trl.losses
By RepoJournal · Filed · About Hugging Face · Composed from the cited sources · methodology
![hf-security-analysis[bot]](https://avatars.githubusercontent.com/u/25720743?v=4)
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?v=4)
11 people shipped this
albertvillanova
@albertvillanova
2 cited
hf-security-analysis[bot]
@hf-security-analysis[bot]
1 cited
cursor[bot]
@cursor[bot]
1 cited
Soumyajit Ghosh
@somuai
1 cited
Arthur
@ArthurZucker
1 cited
Quentin Gallouédec
@qgallouedec
1 cited
hf-security-analysis
@hf-security-analysis
github-actions[bot]
@github-actions[bot]
cursor
@cursor
regisss
@regisss
guarin
@guarin
Two breaking changes land in the same window: OpenEnv's LLM endpoint now requires a full base URL, and TRL's v1.13 loss module is gone after one release.
Release OpenEnv 0.6.0 (#1211) huggingface/OpenEnv
The `--llm-endpoint` flag and OpenAIClient now take a full base URL, so `http://localhost` means port 80 and the port 8000 you used to get implicitly is gone; pass `http://localhost:8000` or `--llm-port 8000` to keep the old behavior. The same release adds a NovitaSandboxProvider, installable with `pip install openenv[novita]`, that runs an OpenEnv server in a Novita AI sandbox over wss:// from...
v1.14.0 huggingface/trl
`from trl.losses import FusedLinearDPOLoss` (and the KTO, GRPO and JSD variants) no longer works: the module vendored in v1.13 has been removed, and DPO, KTO and GRPO now stream their own log-probs instead of carrying a second copy of each trainer's loss math. Pin to the version you have if you import from trl.losses.
Ship the logprob and entropy kernel in trl instead of the Hub huggingface/trl
The fused logprob and entropy kernel now ships inside trl rather than loading from the kernels Hub. Because it is pure Triton, compiles itself at runtime, and runs from the same source on CUDA, ROCm and XPU, the Hub bought nothing here.
Fix odd head_dim validation for RoPE configurations (#48524) huggingface/transformers
RotaryEmbeddingConfigMixin.validate_rope now rejects odd rotary dimensions, which previously surfaced as dimension mismatch crashes in the forward pass rather than at config time. Check any custom RoPE config built from hand-set head_dim values.
Fix NaN in Parakeet eager attention with padded batches (#49070) huggingface/transformers
Parakeet eager attention produced NaN on padded batches because a fully padded query attended to nothing and `-inf` softmaxed to NaN; the fix uses the dtype minimum instead. The added test was dropped before merge, so the padded-batch path is fixed but not regression-covered.
Set the pad token for vision datasets too huggingface/trl
The SFT trainer now resolves the pad token for vision datasets the way it already did for text, which also removes the `Updated tokens: {'pad_token_id': ...}` realignment warning that VLM SFT runs logged at train time. Measured on `test_train_nll_loss_vlm[tiny-Qwen2_5_VLForConditionalGeneration]`: one line before, none after. Meanwhile TRL added support for vLLM 0.30.0 and dropped 0.19.1.
Scope GITHUB_TOKEN permissions per job (#2408) huggingface/optimum-habana
In the long tail: the security bot scoped GITHUB_TOKEN permissions per job and moved workflow expressions through the environment across optimum-habana's Actions, removing the inherited write-everything default, and the transformers XPU Docker image build now sets its context correctly.
Action items
- → Update OpenEnv callers to pass a full base URL (or --llm-port 8000) before upgrading to 0.6.0 huggingface/OpenEnv [plan]
- → Replace trl.losses FusedLinearDPOLoss/FusedLinearKTOLoss/FusedLinearGRPOLoss/FusedLinearJSDLoss imports before upgrad... huggingface/trl [plan]
