[None][chore] Update flashinfer-python from 0.6.15 to 0.6.16

[nv-guomingz]

Summary

• Bump flashinfer-python from 0.6.15 to 0.6.16 (latest stable).
• Updated version pins in requirements.txt, security_scanning/pyproject.toml, and ATTRIBUTIONS-Python.md.
• Regenerated security_scanning/poetry.lock via poetry lock (poetry check --lock passes): the flashinfer-python entry (version + wheel/sdist sha256 hashes) and metadata.content-hash.
  • This also refreshes flashinfer's own declared transitive constraint recorded in its [package.dependencies] block: nvidia-cudnn-frontend >=1.13.0 -> >=1.25.0. This is exactly flashinfer 0.6.16's requires_dist (0.6.15 declared >=1.13.0). It is metadata only: the locked nvidia-cudnn-frontend package version is unchanged at 1.26.0, which satisfies both, so no package is upgraded/downgraded. Note security_scanning/poetry.lock is not consumed by the L0 test pipeline (it feeds the separate security-scan / PLC job), so it is not a candidate cause of an L0 test failure.

Test plan

• pip install -r requirements.txt installs successfully
• pytest tests/unittest/_torch/flashinfer/ -v
• CI pre-merge (L0) passes

Dev Engineer Review

• Updated flashinfer-python from 0.6.15 to 0.6.16 in the dependency and attribution files.
• Regenerated security_scanning/poetry.lock with updated FlashInfer hashes and metadata.
• Updated the declared nvidia-cudnn-frontend constraint. The locked version remains 1.26.0.
• No code or API changes were made.
• No test-list files were changed. The waives.txt failures are pre-existing base-branch issues.

QA Engineer Review

No test changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b2c1fa36-e94d-4b7c-a39c-867f0b8b0297

📥 Commits

Reviewing files that changed from the base of the PR and between 7977538 and 4deb2e0.

⛔ Files ignored due to path filters (1)

• security_scanning/poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• ATTRIBUTIONS-Python.md
• requirements.txt
• security_scanning/pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (3)

• security_scanning/pyproject.toml
• ATTRIBUTIONS-Python.md
• requirements.txt

---

Walkthrough

Changes

FlashInfer version update

Layer / File(s)	Summary
Align dependency pins and attribution requirements.txt, security_scanning/pyproject.toml, ATTRIBUTIONS-Python.md	Updates flashinfer-python from version 0.6.15 to 0.6.16 in dependency pins and attribution metadata.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: tburt-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update and follows the required ticket and type format.
Description check	✅ Passed	The description explains the dependency update, affected files, lockfile details, and test coverage, but it omits the template checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@security_scanning/pyproject.toml`:
- Line 57: Regenerate security_scanning/poetry.lock from the flashinfer-python
0.6.16 requirement declared in pyproject.toml, ensuring the lockfile resolves
0.6.16 before installation or security scanning.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7d1ea504-9d1e-425a-9c4f-1c2d06985ee6

📥 Commits

Reviewing files that changed from the base of the PR and between 24d0a8e and 28a9afd.

📒 Files selected for processing (3)

• ATTRIBUTIONS-Python.md
• requirements.txt
• security_scanning/pyproject.toml

[nv-guomingz]

/bot run

[tensorrt-cicd]

PR_Github #63349 [ run ] triggered by Bot. Commit: 668f13f Link to invocation

[tensorrt-cicd]

PR_Github #63349 [ run ] completed with state FAILURE. Commit: 668f13f
/LLM/main/L0_MergeRequest_PR pipeline #51337 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

• Please check the failed tests and fix your PR
• If you cannot view the failures, ask the CI triggerer to share details
• Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

[BowenFu]

L0 is red on 668f13f, so this isn't mergeable yet — but two things in the diff are worth checking before the next run:

• The description says security_scanning/poetry.lock is left untouched. The diff does change it, including content-hash.
• That lock change also tightens a transitive pin: nvidia-cudnn-frontend >=1.13.0 → >=1.25.0. It isn't in the summary, and it's the most plausible candidate in this diff for the failure.

Unrelated but useful for #17165, which works around the DynamicTensorSpec hash/eq inconsistency in the autotuner: I diffed that class between 0.6.15 and 0.6.16 and it's byte-identical — same @dataclass(slots=True), same __hash__ carrying the same FIXME, still no __eq__. So that workaround is still needed after this bump rather than obviated by it, and the two PRs don't conflict.

[nv-guomingz]

Thanks @BowenFu — addressed the first two, and I dug into the L0 failure; it turns out to be unrelated to the lock change.

1. Description mismatch — fixed. Updated the PR description: security_scanning/poetry.lock was regenerated (flashinfer entry + hashes + content-hash), and I documented the transitive-pin refresh explicitly.

2. nvidia-cudnn-frontend >=1.13.0 → >=1.25.0 — metadata only, and not on the L0 path. That line is flashinfer 0.6.16's own declared requires_dist (0.6.15 declared >=1.13.0), faithfully recorded by poetry lock inside the flashinfer-python [package.dependencies] block. The locked nvidia-cudnn-frontend package is unchanged at 1.26.0 (satisfies both), so nothing is up/downgraded. Separately, security_scanning/poetry.lock is only consumed by the security-scan / PLC job (jenkins/TensorRT_LLM_PLC.groovy) — the L0 test pipeline installs from requirements.txt, not this lock — so it cannot be the L0 cause.

3. Actual L0 failure — pre-existing waives.txt inconsistency on the base, not this PR. Pulling the report for build 51337: every Build stage is SUCCESS, there are 0 failed tests, and the only red is the Check Test List infra stage (s_ai_failure_type: User / Configuration error). Its log:

Invalid cases:
{"invalid": ["cache_transceiver_precheck[gen_0]", "cache_transceiver_precheck[ctx_0]"]}
Invalid test names found, please correct them first!!!
Non-existent test name in l0 or qa list found in waives.txt: cache_transceiver_precheck[ctx_0]
Non-existent test name in l0 or qa list found in waives.txt: cache_transceiver_precheck[gen_0]

waives.txt:106-107 reference cache_transceiver_precheck[ctx_0]/[gen_0], which are not valid IDs in the L0/QA lists (the real tests are test_cache_transceiver_precheck_{config,run,e2e}.py). This commit touches only requirements.txt, security_scanning/{pyproject.toml,poetry.lock}, and ATTRIBUTIONS-Python.md — nothing under test_lists/. It is a base-branch issue that any PR on this base hits. I will rebase onto a main where those waive entries are corrected (or they can be fixed independently) and re-run.

Re #17165: thanks for the DynamicTensorSpec diff — agreed it is byte-identical across 0.6.15/0.6.16 (same @dataclass(slots=True), same __hash__ with the FIXME, still no __eq__), so that autotuner workaround is still needed after this bump and the two PRs do not conflict.

[nv-guomingz]

/bot run

[tensorrt-cicd]

PR_Github #63404 [ run ] triggered by Bot. Commit: 7977538 Link to invocation

[BowenFu]

Both points check out — thanks for digging in.

Confirmed the nvidia-cudnn-frontend bump is inside flashinfer-python's own [package.dependencies] block and no [[package]] version is up/downgraded anywhere in the lock diff, so it is metadata only.

One correction on the plan though: rebasing will not clear the red. waives.txt:106-107 still has those two entries on main right now (24d0a8e1c, merged 03:15Z as part of #17174) — your head 7977538e2 carries them too. So PR_Github #63404 will fail Check Test List the same way. Someone has to drop or re-scope those two lines on main first; cache_transceiver_precheck[ctx_0]/[gen_0] are synthetic JUnit case names emitted by jenkins/scripts/perf/disaggregated/slurm_ct_precheck_gate.sh, not pytest IDs in any l0/qa list, so the validator will keep rejecting them.

Nothing else from me on the diff — held only on CI.

[tensorrt-cicd]

PR_Github #63404 [ run ] completed with state FAILURE. Commit: 7977538
/LLM/main/L0_MergeRequest_PR pipeline #51383 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

• Please check the failed tests and fix your PR
• If you cannot view the failures, ask the CI triggerer to share details
• Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

[nv-guomingz]

/bot run

[nv-guomingz]

/bot run

[tensorrt-cicd]

PR_Github #63424 [ run ] triggered by Bot. Commit: 4deb2e0 Link to invocation

[tensorrt-cicd]

PR_Github #63425 [ run ] triggered by Bot. Commit: 4deb2e0 Link to invocation

[tensorrt-cicd]

PR_Github #63424 [ run ] completed with state ABORTED. Commit: 4deb2e0

Link to invocation

[tensorrt-cicd]

PR_Github #63425 [ run ] completed with state FAILURE. Commit: 4deb2e0
/LLM/main/L0_MergeRequest_PR pipeline #51399 completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

• Please check the failed tests and fix your PR
• If you cannot view the failures, ask the CI triggerer to share details
• Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation