deps: modernize installer stack (cuda-link 1.12.1, torch 2.8.0+cu128, modelopt/onnx/TRT)#2
Open
forkni wants to merge 8 commits into
Open
Conversation
- tensorrt.py: bump tensorrt_cu12 to 10.16.1.11, polygraphy 0.49.26, onnx-graphsurgeon 0.6.1; add FP8-quant block (modelopt + cupy-cuda12x + numpy re-lock); re-pin onnxruntime-gpu==1.24.4 with --no-deps after modelopt downgrade; drop shell-style quotes inside package specs (run_pip uses subprocess + .split(), quotes become literal arg chars). - installer.py: remove torchaudio from cu128 config (not needed); minor ruff format cleanup. - verifier.py: float32_to_bfloat16 diagnostic points to onnx-gs 0.6.1 instead of suggesting an onnx downgrade. - __init__.py, __main__.py, cli.py: ruff format cleanup (blank lines, unused import, raw docstring).
Fixes 6 CVEs patched in deps audit 2026-05-23: - idna >=3.16 (CVE-2026-45409: punycode resource exhaustion) - Mako >=1.3.12 (CVE-2026-44307: Windows backslash path traversal) - urllib3 >=2.7.0 (CVE-2026-44432/44431: over-decompression, cross-origin redirect) Added to MANUAL_PINS and installed in phase7_numpy_lock so upgrade runs on both fresh and existing installs. Fresh pip resolves already satisfy these floors; this ensures the minimum on partial updates. pip and onnxruntime-gpu CVEs are handled separately: - pip: phase1_foundation already runs --upgrade pip (gets latest) - onnx 1.19.1: 6 CVEs deferred — 1.21.0 breaks FP8 quantization Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…0.3.2 cuda-link (CUDA-IPC zero-copy transport) was never installed on a clean install: setup.py only exposes it via the optional cuda_ipc extra (a git ref to a compiled cp311 extension), which installer.py's phase4 never requests to avoid forcing an MSVC/nvcc source build. Add phase4b_cuda_link, mirroring phase3b_insightface's Python-version-gated prebuilt-wheel install (--no-deps, non-fatal fallback to the mirror-DAT transport). Also fixes pywin32 306->311 in tensorrt.py to match setup.py's authoritative pin (8c8020a fixed every other TensorRT pin but missed this one). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PYTORCH_CONFIGS["cu128"] pinned torch 2.7.0 / torchvision 0.22.0, but setup.py doesn't constrain torch at all -- this dict was the sole source of truth, and the repo's own README, PKG-INFO, and tests/quality/manifest.json all target torch 2.8.0+cu128 / torchvision 0.23.0 (the golden-image regression harness aborts on any divergence). Bump to match, pairing correctly with the already maintained tensorrt_cu12==10.16.1.11.
Unbounded nvidia-modelopt[onnx]>=0.19.0 floats to 0.45.0, whose [onnx] extra force-upgrades onnx past the immovable setup.py pin (1.19.1), breaking FP8 quant (negative QDQ scale on external-data loading). Confirmed live: a fresh Step 3 install left onnx 1.21.0 / modelopt 0.45.0 in the venv. Pin modelopt to the proven 0.43.0 (matches tests/quality/manifest.json) and re-assert onnx==1.19.1 alongside the existing onnxruntime-gpu re-assert.
Add Installer.phase4c_cuda_link_env(): after the cuda-link wheel is installed, persist CUDALINK_LIB_PATH to the user environment via setx (Windows-only, non-fatal) so TouchDesigner library mode resolves the venv site-packages with no manual env-var step. Wired into install() right after phase4b_cuda_link(). Bump the wheel URL and phase progress string from 1.12.0 to 1.12.1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
forkni
changed the title
3 tasks
phase4c_cuda_link_env only declared CUDALINK_LIB_PATH, so a fresh install silently degraded the native-wait IPC path to poll-sleep. SD's TD topology is bidirectional (TD Sender + SD Exporter are each a producer on their own IPC leg), and TD's Sender runs in a separate bundled-Python process that a runtime os.environ.setdefault can't reach -- the doorbell var must be setx-persisted like CUDALINK_LIB_PATH. Found via a clean-slate reproducibility test of PR dotsimulate#2's cuda-link handling (stripped venv package + all cuda-link env vars, then re-ran phase4b/phase4c to confirm they're self-sufficient).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency modernization for the StreamDiffusion installer: brings the pinned
stack up to a proven, currently-working Windows target and adds automatic
TouchDesigner library-mode wiring for cuda-link. Six commits on
deps/cuda-link-1.12-torch-modelopt-onnx, touching the installer/CLI/verifierand the TensorRT install path.
Changes
cuda-link (CUDA-IPC bridge)
d60be9ainstalls the 1.12.0 wheel +pywin32 311;
bb9c8d4bumps it to 1.12.1 — a bugfix release fixing tworeference-count leaks on failure/retry paths).
Installer.phase4c_cuda_link_env()(bb9c8d4): after the wheel installs,persist
CUDALINK_LIB_PATHto the user environment viasetx(Windows-only,non-fatal), so TouchDesigner library mode resolves the venv site-packages with
no manual env-var step. Wired into
install()right afterphase4b_cuda_link().PyTorch / CUDA
b1712e8).TensorRT / modelopt / ONNX
run_pipquote-fix (8c8020a).(
a61e225).Security
4b23a56).Testing
cuda-link runtime verified on Windows against TouchDesigner 2025: with
CUDALINK_LIB_PATHset to the venv site-packages (the exact valuephase4c_cuda_link_envcomputes viasysconfig), TD logs[CUDALinkBootstrap] Library mode activeon all extensions withcuda_link.__version__ == "1.12.1"resolved from the venv. The torch / TRT /modelopt pins reflect the versions proven during their original integration on
this branch.
🤖 Generated with Claude Code