| 1 | regex # Replace re for higher-performance regex matching |
| 2 | cachetools |
| 3 | psutil |
| 4 | sentencepiece # Required for LLaMA tokenizer. |
| 5 | numpy |
| 6 | requests >= 2.33.0 |
| 7 | tqdm |
| 8 | blake3 |
| 9 | py-cpuinfo |
| 10 | transformers >= 5.16.1, < 5.18.0 |
| 11 | huggingface_hub >= 1.31.0 # Required for the `huggingface_hub.utils.httpx` re-export |
| 12 | tokenizers >= 0.22.0 # Required for fast incremental detokenization. |
| 13 | safetensors >= 0.6.2 # MXFP4/MXFP6 dtype support (F8_E8M0, F4) added in 0.6.0: https://github.com/huggingface/safetensors/pull/611 |
| 14 | protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.*; platform_machine != "s390x" |
| 15 | protobuf == 7.36.1; platform_machine == "s390x" |
| 16 | fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides. |
| 17 | starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1 |
| 18 | aiohttp >= 3.14.3 |
| 19 | openai >= 2.25.0 # For Responses API with namespace tools |
| 20 | pydantic >= 2.12.0 |
| 21 | prometheus_client >= 0.18.0 |
| 22 | pillow >= 12.3.0 # Required for image processing |
| 23 | prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0 |
| 24 | tiktoken >= 0.6.0 # Required for DBRX tokenizer |
| 25 | lm-format-enforcer == 0.11.3 |
| 26 | llguidance >= 1.7.0, < 1.8.0; platform_machine == "x86_64" or platform_machine == "arm64" or platform_machine == "aarch64" or platform_machine == "ppc64le" or platform_machine == "s390x" |
| 27 | outlines_core == 0.2.14 |
| 28 | lark == 1.2.2 |
| 29 | xgrammar == 0.2.8; platform_machine == "x86_64" or platform_machine == "aarch64" or platform_machine == "arm64" or platform_machine == "s390x" or platform_machine == "ppc64le" |
| 30 | typing_extensions >= 4.10 |
| 31 | filelock >= 3.20.3 # need to contain https://github.com/tox-dev/filelock/pull/317; GHSA floor |
| 32 | partial-json-parser # used for parsing partial JSON outputs |
| 33 | jsonschema >= 4.23.0 # required for MiniMax M3 tool schema validation |
| 34 | pyzmq >= 25.0.0 |
| 35 | msgspec |
| 36 | mistral_common[image] >= 1.11.6 |
| 37 | opencv-python-headless >= 4.13.0 # required for video IO |
| 38 | pyyaml |
| 39 | six>=1.16.0; python_version > '3.11' # transitive dependency of pandas that needs to be the latest version for python 3.12 |
| 40 | setuptools>=78.1.1,<81.0.0; python_version > '3.11' # used by triton; >=78.1.1 for GHSA-5rjg-fvgr-3xxf (83.x needed for GHSA-h35f-9h28-mq5c deferred) |
| 41 | einops # Required for Qwen2-VL. |
| 42 | compressed-tensors == 0.17.0 # required for compressed-tensors |
| 43 | depyf==0.20.0 # required for profiling and debugging with compilation config |
| 44 | cloudpickle # allows pickling lambda functions in model_executor/models/registry.py |
| 45 | watchfiles # required for http server to monitor the updates of TLS files |
| 46 | python-json-logger # Used by logging as per examples/features/logging_configuration.md |
| 47 | ninja # Required for xgrammar, rocm, tpu, xpu |
| 48 | pybase64 # fast base64 implementation |
| 49 | cbor2 # Required for cross-language serialization of hashable objects |
| 50 | ijson # Required for mistral streaming tool parser |
| 51 | setproctitle # Used to set process names for better debugging and monitoring |
| 52 | oss-harmony >= 0.0.11 # Required for gpt-oss; includes embedded vocabularies |
| 53 | anthropic >= 0.71.0 |
| 54 | model-hosting-container-standards >= 0.1.14, < 1.0.0 |
| 55 | mcp >= 2.0.0, < 3.0.0 |
| 56 | opentelemetry-sdk >= 1.27.0 |
| 57 | opentelemetry-api >= 1.27.0 |
| 58 | opentelemetry-exporter-otlp >= 1.27.0 |
| 59 | opentelemetry-semantic-conventions-ai >= 0.4.1 |