[None][infra] Declare and pin CI-imported deps to prevent transitive drops

.github/workflows/label_community_pr.yml

@@ -25,7 +25,7 @@ jobs:
           python-version: '3.x'
 
       - name: Install dependencies
-        run: pip install requests
+        run: pip install 'requests>=2.32.4,<3'
 
       - name: Run labeling script
         env:

.github/workflows/label_component_pr.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Install dependencies
         continue-on-error: true
-        run: pip install requests
+        run: pip install 'requests>=2.32.4,<3'
 
       - name: Label PR by component
         continue-on-error: true

jenkins/BuildDockerImage.groovy

@@ -1021,7 +1021,7 @@ pipeline {
                     catchError(buildResult: 'FAILURE', stageResult: 'FAILURE') {
                         container("python3") {
                             trtllm_utils.llmExecStepWithRetry(this, script: "pip3 install --upgrade pip")
-                            trtllm_utils.llmExecStepWithRetry(this, script: "pip3 install --upgrade requests")
+                            trtllm_utils.llmExecStepWithRetry(this, script: "pip3 install 'requests>=2.32.4,<3'")
                             def nspect_commit = "5dcee25cfa2c55249ce390a9f78e1b5dac42fa44"
                             def override_commit = env."NSPECT_OVERRIDE_${nspect_commit}"
                             if (override_commit) {

jenkins/L0_Test.groovy

@@ -2177,7 +2177,7 @@ def runLLMTestlistWithSbatch(pipeline, platform, testList, config=VANILLA_CONFIG
                     pipeline.writeFile(file: scriptLaunchSrunArgsPathLocal, text: srunArgs.join(" "))
 
                     sh """
-                        pip3 install pyyaml && \\
+                        pip3 install 'pyyaml>=6.0.1,<6.0.3' && \\
                         python3 ${scriptSubmitLocalPath} \\
                         --llm-src ${llmSrcLocal} \\
                         --test-list ${testListPathLocal} \\
@@ -6810,7 +6810,7 @@ def launchTestJobs(pipeline, testFilter, globalVars)
                         trtllm_utils.llmExecStepWithRetry(pipeline, script: "apt-get update && apt-get install -y python3-pip git rsync curl wget")
                         trtllm_utils.checkoutSource(LLM_REPO, env.gitlabCommit, LLM_ROOT, true, true)
                         trtllm_utils.llmExecStepWithRetry(pipeline, script: "pip3 config set global.break-system-packages true")
-                        trtllm_utils.llmExecStepWithRetry(pipeline, script: "pip3 install requests")
+                        trtllm_utils.llmExecStepWithRetry(pipeline, script: "pip3 install 'requests>=2.32.4,<3'")
                         trtllm_utils.llmExecStepWithRetry(pipeline, script: "pip3 uninstall -y tensorrt")
                         if (values[5] != DLFW_IMAGE) {
                             def ubuntu_version = key.contains("UB2404") ? "ubuntu2404" : "ubuntu2204"

jenkins/TensorRT_LLM_PLC.groovy

@@ -400,7 +400,7 @@ def processScanResults(ref) {
             ]) {
                 sh """
                     python3 -m venv venv
-                    venv/bin/pip install requests elasticsearch==7.13.4
+                    venv/bin/pip install 'requests>=2.32.4,<3' elasticsearch==7.13.4
                 """
                 def skipArgs = ""
                 def sbomExists = fileExists("${pwd()}/scan_report/source_code/sbom.json")

jenkins/UpdateTestDurations.groovy

@@ -150,7 +150,7 @@ pipeline {
                     sh """
                         apt-get update -qq && \
                         apt-get install -y -qq git python3-pip curl && \
-                        pip3 install --quiet --break-system-packages requests pyyaml
+                        pip3 install --quiet --break-system-packages 'requests>=2.32.4,<3' 'pyyaml>=6.0.1,<6.0.3'
                     """
                 }
             }

requirements-dev.txt

@@ -7,6 +7,18 @@ diffusers==0.39.0
 # transitively via openai, and openai 3.3.1 dropped it, which silently emptied
 # every sysinfo-rendered CI test list (linux_distribution_name became 'na').
 distro==1.9.0
+# Imported directly by CI/infra Python but otherwise only present transitively
+# (requests via datasets/tiktoken; pyyaml via pydantic-settings[yaml]). Declared
+# explicitly so infra never depends on a third-party's transitive dep set --
+# the distro failure mode above. Ranges, NOT == (unlike distro, which is pip-
+# only): the CI base image ships these as Debian packages (python3-yaml,
+# python3-requests) with no pip RECORD, so an exact pin forces an uninstall pip
+# cannot perform (uninstall-no-record-file). Floors are the real requirement
+# (requests>=2.32.4 also clears CVE-2024-47081); ceilings block unvetted
+# releases -- pyyaml<6.0.3 excludes 6.0.3, which fails to import on Python 3.12
+# (pyyaml issue #891).
+pyyaml>=6.0.1,<6.0.3
+requests>=2.32.4,<3
 boto3
 einops
 # Reference implementation for KDA kernel parity tests.

tests/integration/test_lists/waives.txt

@@ -103,6 +103,7 @@ disaggregated/test_disaggregated.py::test_disaggregated_stress_test[input8k-outp
 disaggregated/test_workers.py::test_workers_conversation_router[TinyLlama-1.1B-Chat-v1.0] SKIP (https://nvbugs/6162322)
 disaggregated/test_workers.py::test_workers_kv_cache_aware_router_deepseek_v3_lite_bf16[DeepSeek-V3-Lite-bf16] SKIP (https://nvbugs/6162322)
 disaggregated/test_workers.py::test_workers_kv_cache_aware_router_eviction[TinyLlama-1.1B-Chat-v1.0] SKIP (https://nvbugs/6162322)
+examples/test_deepseek_v4_pro.py::test_short_token_boundary_smoke SKIP (https://nvbugs/6670227)
 examples/test_ray.py::test_ray_disaggregated_serving[tp2] SKIP (https://nvbugs/6632606)
 examples/test_ray.py::test_ray_disaggregated_serving_python[tp2] SKIP (https://nvbugs/6601574)
 examples/visual_gen/test_visual_gen_cosmos3.py::test_cosmos3_feature_accuracy_against_golden[nvfp4] SKIP (https://nvbugs/6572800)
@@ -339,6 +340,9 @@ unittest/_torch/modules/tests_lora_modules/test_qwen3_sanity.py::TestQwen3LoRA::
 unittest/_torch/multi_gpu/test_linear.py::test_row_linear_norm_fusion[2-hidden:16-seqlen:2] SKIP (https://nvbugs/6501404)
 unittest/_torch/sampler/test_beam_search.py::test_beam_search_e2e[multi_process-TRTLLMSampler-cuda_graph_and_overlap-None-1-1-True-True-False] SKIP (https://nvbugs/6463819)
 unittest/_torch/sampler/test_trtllm_sampler.py::test_trtllm_sampler_best_of_with_logprobs SKIP (https://nvbugs/6487837)
+unittest/_torch/speculative/hw_agnostic/test_dflash.py::test_dflash_qwen3_5_4b[False] SKIP (https://nvbugs/6535767)
+unittest/_torch/speculative/hw_agnostic/test_dflash.py::test_dflash_qwen3_5_4b[True] SKIP (https://nvbugs/6535767)
+unittest/_torch/speculative/hw_agnostic/test_ngram.py::test_llama_ngram[True-True-TRTLLM] SKIP (https://nvbugs/6507102)
 unittest/_torch/speculative/test_eagle3.py SKIP (https://nvbugs/5461761)
 unittest/_torch/visual_gen/multi_gpu/test_ring_attention.py::TestRingAttention::test_ring_invalid_mask_raises SKIP (https://nvbugs/6412105)
 unittest/_torch/visual_gen/multi_gpu/test_ulysses_async.py::test_capture_smoke SKIP (https://nvbugs/6385134)