Skip to content

cp: reject request-supplied chat templates - #7070

Merged
balasaajay merged 1 commit into
NVIDIA:core_r0.19.0from
svcnemo-autobot:chore/cherrypick-4c4be575-to-core-r0.19.0
Sep 9, 2026
Merged

cp: reject request-supplied chat templates#7070
balasaajay merged 1 commit into
NVIDIA:core_r0.19.0from
svcnemo-autobot:chore/cherrypick-4c4be575-to-core-r0.19.0

Conversation

@svcnemo-autobot

@svcnemo-autobot svcnemo-autobot commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Background

Backport the security fix from #6818 to core_r0.19.0.

What changed

Reject request-supplied chat templates and move template tokenization off the event loop.

Details

Cherry-picked merged commit 4c4be575. Conflicts were adapted to the release branch's tokenizer path, and focused sanitization tests were moved into a new test module because the original upstream test file is absent on this branch.

Tested

  • Black, isort, Ruff, and Pylint on changed files
  • Managed H100 tests/unit_tests/inference/**/*.py: 1,967 passed, 22 skipped

@svcnemo-autobot
svcnemo-autobot requested review from a team as code owners September 3, 2026 21:51
@copy-pr-bot

copy-pr-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@svcnvidia-nemo-ci

svcnvidia-nemo-ci commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

/ok to test b6bcd0d

@svcnemo-autobot
Reject request-supplied chat templates in /v1/chat/completions (NVIDI…
1dac4a1 
…A#6818)

(cherry picked from commit 4c4be57)
Signed-off-by: svcnemo-autobot <svcnemo-autobot@nvidia.com>
@nemo-autobot-origin
nemo-autobot-origin Bot force-pushed the chore/cherrypick-4c4be575-to-core-r0.19.0 branch from b6bcd0d to 1dac4a1 Compare September 3, 2026 22:29
@svcnvidia-nemo-ci

svcnvidia-nemo-ci commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

/ok to test 1dac4a1

@balasaajay
balasaajay enabled auto-merge (squash) September 9, 2026 23:25
@balasaajay
balasaajay disabled auto-merge September 9, 2026 23:25
@balasaajay
balasaajay merged commit a63b1b9 into NVIDIA:core_r0.19.0 Sep 9, 2026
225 of 230 checks passed
@lhb8125 lhb8125 mentioned this pull request Oct 1, 2026
Open

This branch was previously deployed

2 inactive deployments
public — 1dac4a14 Deployed Sep 3, 2026 by copy-pr-bot[bot] via finalize / publish-docs #8202
test — 1dac4a14 Deployed Sep 3, 2026 by copy-pr-bot[bot] via cicd-wait-in-queue #20875
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Run functional tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@svcnemo-autobot @svcnvidia-nemo-ci @balasaajay