[sgl-router] Prepare dynamo-render dependencies (#39457)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

experimental/sgl-router/Cargo.toml

@@ -22,10 +22,19 @@ path = "src/main.rs"
 unused_qualifications = "warn"
 
 [dependencies]
-# Dynamo crates — pinned by SHA. Bumps are manual PRs.
-dynamo-protocols = { git = "https://github.com/ai-dynamo/dynamo", rev = "1efdd4dcb901caeae636131321094090d252c8d6" }
-dynamo-tokenizers = { git = "https://github.com/ai-dynamo/dynamo", rev = "1efdd4dcb901caeae636131321094090d252c8d6" }
-dynamo-parsers = { git = "https://github.com/ai-dynamo/dynamo", rev = "1efdd4dcb901caeae636131321094090d252c8d6" }
+# Pin Dynamo versions and commit Cargo.lock so builds are reproducible.
+dynamo-tokenizers = "=1.8.1"
+# Prepare the Dynamo renderer dependency for the following migration.
+dynamo-renderer = "=5.1.2"
+# Chat-template rendering for cache-aware routing, retained until the
+# renderer migration replaces it: the engine caches tokens AFTER applying the
+# model's chat template, so the router must render the same template before
+# hashing or its token_ids diverge from the engine's stored blocks. `pycompat`
+# supplies the Python str/dict methods HF templates call; `chrono` backs
+# `strftime_now`.
+minijinja = { version = "2.24", features = ["loop_controls", "json"] }
+minijinja-contrib = { version = "2", features = ["pycompat"] }
+chrono = { version = "0.4", default-features = false, features = ["clock"] }
 
 # Async runtime + http
 tokio = { version = "1.42", features = ["full"] }
@@ -44,16 +53,6 @@ serde_json = { version = "1", features = ["preserve_order"] }
 # this pulls no openssl/native-tls (matching reqwest's rustls-tls above).
 hf-hub = { version = "0.4", default-features = false, features = ["ureq"] }
 
-# Chat-template rendering for cache-aware routing: the engine caches tokens
-# AFTER applying the model's chat template, so the router renders the same
-# template (from tokenizer_config.json) before hashing — otherwise its query
-# token_ids diverge from the engine's stored blocks. `pycompat` supplies the
-# Python str/dict methods HF chat templates rely on (.startswith, .items, ...).
-minijinja = { version = "2", features = ["loop_controls", "json"] }
-minijinja-contrib = { version = "2", features = ["pycompat"] }
-# `strftime_now` chat-template helper (some templates inject the current date).
-chrono = { version = "0.4", default-features = false, features = ["clock"] }
-
 # Utilities
 anyhow = "1"
 thiserror = "2"

experimental/sgl-router/deny.toml

@@ -3,11 +3,12 @@ all-features = true
 
 [advisories]
 yanked = "warn"
-# Unmaintained advisories are demoted to warnings: the affected crates
-# (unic-*, paste, number_prefix) are all transitive through dynamo-parsers
-# and have no available upgrades.  They pose no security risk; revisit
-# if/when dynamo-parsers feature-flags rustpython-parser off upstream.
-unmaintained = "none"
+# Unmaintained advisories are checked for direct dependencies only. The
+# transitive ones we cannot fix from here (`paste` via tokenizers ->
+# dynamo-tokenizers, `number_prefix` via indicatif -> hf-hub, `backoff` and
+# `instant` via kube-runtime, `rustls-pemfile` via kube-client) pose no
+# security risk; revisit when the upstream crates drop them.
+unmaintained = "workspace"
 # `ignore` left empty — we want to be notified of new CVEs.
 ignore = []
 
@@ -24,52 +25,17 @@ allow = [
     "Zlib",
     "CC0-1.0",
     "MPL-2.0",
-    # Both added per the initial license review:
-    "NCSA",                 # libfuzzer-sys (transitive via rav1e) — BSD-equivalent permissive.
+    # Added per the initial license review:
     "CDLA-Permissive-2.0",  # webpki-roots — Linux Foundation permissive license.
 ]
 confidence-threshold = 0.93
 
-# LGPL-3.0-only is accepted on a per-crate exception basis. Rationale:
-# - sgl-router is Apache-2.0 and ships full source on the public sglang
-#   repo, so the LGPL "users must be able to relink" requirement is
-#   satisfied by the conventional Rust-ecosystem interpretation (anyone
-#   can git-clone the repo, bump a malachite version, rebuild).
-# - The malachite-* crates are pure-Rust arbitrary-precision math, used
-#   four levels deep through dynamo-parsers → rustpython-parser → malachite-bigint.
-#   They are NOT on the routing hot path; dynamo-parsers is only wired
-#   into chat-completions for tool-call parsing.
-# - Revisit if/when: (a) a regulated-enterprise customer objects, or
-#   (b) dynamo-parsers feature-flags rustpython-parser off upstream.
-[[licenses.exceptions]]
-name = "malachite"
-allow = ["LGPL-3.0-only"]
-
-[[licenses.exceptions]]
-name = "malachite-base"
-allow = ["LGPL-3.0-only"]
-
-[[licenses.exceptions]]
-name = "malachite-nz"
-allow = ["LGPL-3.0-only"]
-
-[[licenses.exceptions]]
-name = "malachite-q"
-allow = ["LGPL-3.0-only"]
-
-[[licenses.exceptions]]
-name = "malachite-bigint"
-allow = ["LGPL-3.0-only"]
-
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Git deps (e.g. dynamo-* pinned by SHA) have no semver version req and would
-# otherwise trip the wildcard check.  allow-wildcard-paths exempts non-registry
-# (git + path) sources so we only deny bare '*' on crates.io deps.
+# Workspace path dependencies have no semver requirement.
 allow-wildcard-paths = true
 
 [sources]
 unknown-registry = "deny"
-unknown-git = "allow"  # dynamo git dep pinned by SHA in Cargo.toml.
-allow-git = ["https://github.com/ai-dynamo/dynamo"]
+unknown-git = "deny"

experimental/sgl-router/rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.90"
+channel = "1.92"
 profile = "minimal"
 components = ["clippy", "rustfmt"]

experimental/sgl-router/tests/e2e/k8s_integration/Dockerfile.router

@@ -3,14 +3,14 @@
 # Context root: repo root (one level above experimental/sgl-router/).
 
 # Matches rust-toolchain.toml's pinned channel, avoiding an in-build rustup channel-sync.
-FROM rust:1.90-bookworm AS builder
+FROM rust:1.92-bookworm AS builder
 
 # Pin to the exact toolchain pre-installed in the base image so rustup
 # doesn't try to sync the channel manifest when it sees rust-toolchain.toml's
-# `channel = "1.90"`.
-ENV RUSTUP_TOOLCHAIN=1.90.0
+# `channel = "1.92"`.
+ENV RUSTUP_TOOLCHAIN=1.92.0
 
-# libssl-dev + pkg-config ship with rust:1.90-bookworm already; protoc does not,
+# libssl-dev + pkg-config ship with rust:1.92-bookworm already; protoc does not,
 # and the Indexer's build script needs it to compile the KV-indexer protos.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends protobuf-compiler \
@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     --mount=type=cache,target=/build/experimental/sgl-router/target \
     cd /build/experimental/sgl-router \
-    && cargo build --release --bin sgl-router \
+    && cargo build --locked --release --bin sgl-router \
     && cp target/release/sgl-router /usr/local/bin/sgl-router
 
 FROM debian:bookworm-slim