[None][test] Remove test_starlette_constraint_floor on release/1.3 by EmmaQiaoCh · Pull Request #20384 · NVIDIA/TensorRT-LLM

EmmaQiaoCh · 2026-10-15T05:31:09Z

The 26.09 NGC base image does not ship starlette, so constraints.txt no longer carries the starlette WAR. The starlette>=1.3.1 floor is still enforced by requirements.txt and checked by
test_web_framework_security_floors.

Dev Engineer Review

The change deletes tests/unittest/others/test_web_dependency_security.py. This removes all checks of dependency version floors and vulnerability exclusions for FastAPI, prometheus_fastapi_instrumentator, and Starlette. The repository no longer has this file’s automated checks for those requirements.

QA Engineer Review

Removed tests/unittest/others/test_web_dependency_security.py, including test_web_framework_security_floors and its helper functions.
The deleted unit test checked minimum versions, excluded versions, and FastAPI’s lack of an upper bound. No integration test-list entry for this file was found.
Coverage verdict: needs follow-up. The deleted checks no longer provide automated validation of these dependency requirements. Test execution results were not provided.

Per-File QA Perspective

tests/unittest/others/test_web_dependency_security.py: Removed CPU-only unit coverage for dependency security floors and exclusions. The file was not listed in the integration CI or manual-QA test lists.

Description

Test Coverage

PR Checklist

Please review the following before submitting your PR:

PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.
PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.
Test cases are provided for new code paths (see test instructions)
If PR introduces API changes, an appropriate PR label is added - either api-compatible or api-breaking. For api-breaking, include BREAKING in the PR title.
Any new dependencies have been scanned for license and vulnerabilities
CODEOWNERS updated if ownership changes
Documentation updated as needed
Update tava architecture diagram if there is a significant design change in PR.
The reviewers assigned automatically/manually are appropriate for the PR.
Please check this after reviewing the above items as appropriate for this PR.

GitHub Bot Help

To see a list of available CI bot commands, please comment /bot help.

The 26.09 NGC base image does not ship starlette, so constraints.txt no longer carries the starlette WAR. The starlette>=1.3.1 floor is still enforced by requirements.txt and checked by test_web_framework_security_floors. Signed-off-by: EmmaQiaoCh <qqiao@nvidia.com>

EmmaQiaoCh · 2026-10-15T05:31:22Z

/bot run

coderabbitai · 2026-10-15T05:33:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/TensorRT-LLM/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f187871f-141d-4b5e-8185-fa8506072497

📥 Commits

Reviewing files that changed from the base of the PR and between 8a3877e and e8ad8bd.

📒 Files selected for processing: 1

tests/unittest/others/test_web_dependency_security.py

💤 Files with no reviewable changes: 1

tests/unittest/others/test_web_dependency_security.py

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The pull request removes tests and helpers that checked version floors, vulnerability exclusions, and the FastAPI upper-bound condition for web dependencies.

Changes

Web dependency security tests

Layer / File(s)	Summary
Remove dependency security tests `tests/unittest/others/test_web_dependency_security.py`	Removes tests and helpers that checked FastAPI, `prometheus_fastapi_instrumentator`, and Starlette version constraints.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: 🔵 Low · up to e8ad8

Current dependency requirements remain intact, but future changes to these security constraints would no longer be caught by the removed tests. This is a bounded follow-up risk rather than an established deployment failure.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the Starlette constraint change, but the Test Coverage section is empty, most checklist items are not confirmed, and the stated remaining test conflicts with the objective to …	Update the description to accurately state that test_web_dependency_security.py and its remaining floor tests are removed. Add explicit test coverage or validation details. Complete the applicable checklist items.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title identifies a real part of the change, but it names only one test while the pull request deletes the entire web dependency security test file.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the Starlette constraint change, but the Test Coverage section is empty, most checklist items are not confirmed, and the stated remaining test conflicts with the objective to remove it.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

tensorrt-cicd · 2026-10-15T05:39:27Z

PR_Github #78021 [ run ] triggered by Bot. Commit: 8a3877e Link to invocation

github-actions · 2026-10-15T05:43:20Z

Automatically added "ci: full pre-merge approved" because this PR has satisfied the required GitHub review approvals. Unresolved review conversations and other required checks remain independent merge requirements.

Drop the remaining web framework floor test as well, so the file is removed entirely on release/1.3. Signed-off-by: EmmaQiaoCh <qqiao@nvidia.com>

EmmaQiaoCh · 2026-10-15T06:31:57Z

/bot run

tensorrt-cicd · 2026-10-15T06:40:12Z

PR_Github #78036 [ run ] triggered by Bot. Commit: e8ad8bd Link to invocation

tensorrt-cicd · 2026-10-15T06:42:45Z

PR_Github #78021 [ run ] completed with state ABORTED. Commit: 8a3877e

Link to invocation

EmmaQiaoCh · 2026-10-15T07:36:47Z

/bot skip --comment "The previous CI passed x86 single GPU CI"

tensorrt-cicd · 2026-10-15T07:43:31Z

PR_Github #78052 [ skip ] triggered by Bot. Commit: e8ad8bd Link to invocation

tensorrt-cicd · 2026-10-15T07:46:04Z

PR_Github #78036 [ run ] completed with state ABORTED. Commit: e8ad8bd

Link to invocation

tensorrt-cicd · 2026-10-15T07:57:26Z

PR_Github #78052 [ skip ] completed with state SUCCESS. Commit: e8ad8bd
Skipping testing for commit e8ad8bd

Link to invocation

…straint_floor (NVIDIA#20384) Signed-off-by: JunyiXu-nv <219237550+JunyiXu-nv@users.noreply.github.com>

EmmaQiaoCh requested a review from a team as a code owner October 15, 2026 05:31

EmmaQiaoCh requested review from BowenFu and brnguyen2 October 15, 2026 05:31

github-actions Bot assigned EmmaQiaoCh Oct 15, 2026

litaotju approved these changes Oct 15, 2026

View reviewed changes

trtllm-agent added the ci: full pre-merge approved label Oct 15, 2026

EmmaQiaoCh enabled auto-merge (squash) October 15, 2026 05:46

BowenFu approved these changes Oct 15, 2026

View reviewed changes

chzblych approved these changes Oct 15, 2026

View reviewed changes

Comment thread tests/unittest/others/test_web_dependency_security.py Resolved

[None][test] Remove test_web_dependency_security.py on release/1.3

e8ad8bd

Drop the remaining web framework floor test as well, so the file is removed entirely on release/1.3. Signed-off-by: EmmaQiaoCh <qqiao@nvidia.com>

EmmaQiaoCh merged commit 7c2f938 into NVIDIA:release/1.3 Oct 15, 2026

chenfeiz0326 mentioned this pull request Oct 16, 2026

[https://nvbugs/6843484][fix] Keep multi-node aggregated perf-sanity jobs in one NVLink domain; cherry-pick #20000 to release/1.3 #20292

Merged

1 task done

SimengLiu-nv mentioned this pull request Nov 9, 2026

[https://nvbugs/6930053][test] Cherry-pick #20384 from release/1.3: Remove test_starlette_constraint_floor #21948

Open

Navigation Menu

Repository navigation

[None][test] Remove test_starlette_constraint_floor on release/1.3 - #20384

[None][test] Remove test_starlette_constraint_floor on release/1.3#20384
EmmaQiaoCh merged 2 commits into
NVIDIA:release/1.3from
EmmaQiaoCh:emma/fix_constraint_test

EmmaQiaoCh commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

EmmaQiaoCh commented Oct 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dev Engineer Review

QA Engineer Review

Per-File QA Perspective

Description

Test Coverage

PR Checklist

GitHub Bot Help

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

EmmaQiaoCh commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

tensorrt-cicd commented Oct 15, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

EmmaQiaoCh commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading