minke.yu/sglang
1
0
Fork 0
Code Issues Pull Requests Actions 12 Packages Projects Releases Wiki Activity

[sgl-router] Prepare dynamo-render dependencies (#39457)

Browse Source 
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Kan Wu
2026-09-14 19:08:16 -07:00
committed by GitHub
co-authored by Claude Fable 5.1
parent a25f213bc4
commit e89d8facab
8 changed files with 4735 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
experimental/sgl-router/deny.toml
+9 -43
View File
@@ -3,11 +3,12 @@ all-features = true
[advisories]
yanked = "warn"
# Unmaintained advisories are demoted to warnings: the affected crates
# (unic-*, paste, number_prefix) are all transitive through dynamo-parsers
# and have no available upgrades. They pose no security risk; revisit
# if/when dynamo-parsers feature-flags rustpython-parser off upstream.
unmaintained = "none"
# Unmaintained advisories are checked for direct dependencies only. The
# transitive ones we cannot fix from here (`paste` via tokenizers ->
# dynamo-tokenizers, `number_prefix` via indicatif -> hf-hub, `backoff` and
# `instant` via kube-runtime, `rustls-pemfile` via kube-client) pose no
# security risk; revisit when the upstream crates drop them.
unmaintained = "workspace"
# `ignore` left empty — we want to be notified of new CVEs.
ignore = []
@@ -24,52 +25,17 @@ allow = [
"Zlib",
"CC0-1.0",
"MPL-2.0",
# Both added per the initial license review:
"NCSA", # libfuzzer-sys (transitive via rav1e) — BSD-equivalent permissive.
# Added per the initial license review:
"CDLA-Permissive-2.0", # webpki-roots — Linux Foundation permissive license.
]
confidence-threshold = 0.93
# LGPL-3.0-only is accepted on a per-crate exception basis. Rationale:
# - sgl-router is Apache-2.0 and ships full source on the public sglang
# repo, so the LGPL "users must be able to relink" requirement is
# satisfied by the conventional Rust-ecosystem interpretation (anyone
# can git-clone the repo, bump a malachite version, rebuild).
# - The malachite-* crates are pure-Rust arbitrary-precision math, used
# four levels deep through dynamo-parsers → rustpython-parser → malachite-bigint.
# They are NOT on the routing hot path; dynamo-parsers is only wired
# into chat-completions for tool-call parsing.
# - Revisit if/when: (a) a regulated-enterprise customer objects, or
# (b) dynamo-parsers feature-flags rustpython-parser off upstream.
[[licenses.exceptions]]
name = "malachite"
allow = ["LGPL-3.0-only"]
[[licenses.exceptions]]
name = "malachite-base"
allow = ["LGPL-3.0-only"]
[[licenses.exceptions]]
name = "malachite-nz"
allow = ["LGPL-3.0-only"]
[[licenses.exceptions]]
name = "malachite-q"
allow = ["LGPL-3.0-only"]
[[licenses.exceptions]]
name = "malachite-bigint"
allow = ["LGPL-3.0-only"]
[bans]
multiple-versions = "warn"
wildcards = "deny"
# Git deps (e.g. dynamo-* pinned by SHA) have no semver version req and would
# otherwise trip the wildcard check. allow-wildcard-paths exempts non-registry
# (git + path) sources so we only deny bare '*' on crates.io deps.
# Workspace path dependencies have no semver requirement.
allow-wildcard-paths = true
[sources]
unknown-registry = "deny"
unknown-git = "allow" # dynamo git dep pinned by SHA in Cargo.toml.
allow-git = ["https://github.com/ai-dynamo/dynamo"]
unknown-git = "deny"