Orphan requirements*.txt files declare a stale dependency stack that contradicts pyproject.toml (and omit requests-toolbelt) (CR-A16-101) #537

Wave 2 · theme D2-7: Next-release technology updates · highest severity Info · 2 finding(s) · effort small

Summary

A contributor or user installs from requirements.txt and gets ranges that diverge from the supported set.

Primary finding

CR-A16-101 — Orphan requirements*.txt files declare a stale dependency stack that contradicts pyproject.toml (and omit requests-toolbelt)

severity Info · reachability undocumented · intent contract-violation · confidence likely · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN C31-DEPENDENCY-SOURCE — docs/roadmap/phase-16-trust-surface-hardening.md:684-686

What happens. requirements.txt:1-11 (torch>=2.0, transformers>=4.38, trl>=0.8, peft>=0.9, datasets>=2.17, huggingface_hub>=0.20, uncapped), requirements-linux.txt and requirements-eval.txt are leftover files consumed by nothing (only .dockerignore names them). Their ranges contradict pyproject.toml:45-69 (transformers>=5.3 CVE floor, trl>=1.0, etc.), drop platform markers, and omit requests-toolbelt, the hard dependency of the _http SSRF IP-pinning adapter; the resulting ImportError hint in forgelm/_http.py:368-373 points at a non-existent forgelm[webhook] extra.

Where.

• requirements.txt:1-11
• pyproject.toml:46
• requirements-linux.txt:1-2
• requirements-eval.txt:1
• forgelm/_http.py:370-373
• pyproject.toml:68
• pyproject.toml:45-69
• pyproject.toml:37-49
• forgelm/_http.py:64-106
• forgelm/_http.py:368-373

Evidence.

• cat requirements.txt. rg for requirements.txt finds no consumer outside template sample data. The Dockerfile installs with pip install -e . (lines 52 and 97).
• With requests_toolbelt blocked via sys.modules, forgelm._http._PortStrippingSSLAdapter is None, and _pinned_session('https') raises "ImportError: requests-toolbelt is required for HTTPS IP-pinning; install it with: pip install 'forgelm[webhook]'". pyproject.toml has no 'webhook' extra. A repository-wide rg for requirements*.txt finds only .dockerignore:67.
• Line-by-line comparison of the two files.

Recommended fix. Delete requirements*.txt, or generate them from pyproject.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T02-006 — Core Hugging Face stack and runtime dependencies: requirements.txt / requirements-linux.txt / requirements-eval.txt legacy pins (incorrect-claim)

severity Next release · already tracked: KNOWN-OPEN C31-DEPENDENCY-SOURCE docs/roadmap/phase-16-trust-surface-hardening.md:684-686,716-717

Item. requirements.txt / requirements-linux.txt / requirements-eval.txt legacy pins · verdict: incorrect-claim · urgency: Next release

State in ForgeLM. requirements.txt:1-11 declares torch>=2.0.0, transformers>=4.38.0, peft>=0.9.0, datasets>=2.17.0, accelerate>=0.27.0, trl>=0.8.0, huggingface_hub>=0.20.0 and requests>=2.31.0. requirements-linux.txt lists bitsandbytes and unsloth, and requirements-eval.txt lists lm-eval>=0.4.4. Nothing in the repo refers to these files: rg --hidden finds no hit outside template chat data, and the Dockerfile uses 'pip install -e .'.

State of the ecosystem on 2026-10-01. These floors contradict pyproject.toml:45-69, which requires transformers>=5.3.0, huggingface_hub>=1.3.0, datasets>=4.7.0, accelerate>=1.4.0, trl>=1.0.0 and torch>=2.4.0. transformers 4.38 sits below CVE-2026-4372 and every later fix floor, and ForgeLM's transformers-5 APIs (dtype=, rope_parameters era, eval_strategy) would not resolve against it.

Impact. Anyone who runs 'pip install -r requirements.txt' can get an unsupported, vulnerable and incompatible stack. This is the documentation drift CLAUDE.md lists as a pitfall.

Recommendation. Delete the three orphan files, or generate them from pyproject.toml and add a guard that keeps them in sync.

Sources.

• PyPI transformers release metadata (2026-09-30)
• OSV transformers advisories (4.x entries) (2026-09-10)
• GHSA-29pf-2h5f-8g72 (CVE-2026-4372, all versions <5.3.0) (2026-07-01)

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}