[Wave 4] Low/info — Technology watch list #821

Wave 4 · 7 finding(s) in 6 fix package(s). Re-read before each release; act when the upstream state changes.

Findings

• TECH-T03-011 (technology, Watch) — PEFT, quantization and memory methods: unsloth platform scope (Linux-only marker and 'Linux + CUDA only' / 'Unsloth only works on Linux' docs) (outdated)
  severity Watch
  Item. unsloth platform scope (Linux-only marker and 'Linux + CUDA only' / 'Unsloth only works on Linux' docs) · verdict: outdated · urgency: Watch
  State in ForgeLM. Marker sys_platform=='linux' (pyproject.toml:79). README.md:155 says 'Linux + CUDA only'; forgelm/config.py:262 says '(Linux + CUDA only, faster)'; docs/guides/troubleshooting.md:25 says 'Unsloth only works on Linux'; docs/guides/quickstart.md:206 says '(Linux only)'; _doctor.py:100 says '(Linux GPUs only)'.
  State of the ecosystem on 2026-10-01. The unsloth README says it 'works on Windows, Linux, WSL and macOS' with NVIDIA, AMD and Intel GPUs and CPUs (README:77). The Windows install docs cover the code-based Unsloth Core via Conda, Docker or WSL ('pip install unsloth may be enough'). The macOS docs cover Desktop/Studio (MLX/GGUF), and the manual install there 'does not install ... the code-based Unsloth Core package'. Core on macOS is…
  Recommendation. Reword as a ForgeLM support decision ('tested on Linux + CUDA only') rather than an upstream limitation. Revisit the marker once the range issue is resolved.
  Sources.

  • unsloth README (works on Windows, Linux, WSL and macOS; NVIDIA/AMD/Intel) (2026-10-01)
  • Unsloth docs: Install on Windows (Unsloth Core via Conda, Docker or WSL) (2026-10-01)

• ↳ same root cause: DOC-BLEGAL-196 (docs, Low) — docs/guides/troubleshooting.md: stale — [IS-T03-08] 'Unsloth only works on Linux' (same wording at docs/guides/quickstart.md:206 'Use Unsloth for faster training (Linux only)')
  severity Low
  Where. docs/guides/troubleshooting.md:25 · type: stale
  The document says. [IS-T03-08] 'Unsloth only works on Linux' (same wording at docs/guides/quickstart.md:206 'Use Unsloth for faster training (Linux only)')
  What the code does. The Unsloth README says it 'works on Windows, Linux, WSL and macOS'. The Windows docs cover Unsloth Core via Conda, Docker or WSL. macOS is documented for Desktop/Studio, not Core. Linux-only is ForgeLM's extra marker.
  Proposed correction. ForgeLM's [unsloth] extra is Linux-only (Unsloth itself also documents Windows via Conda/Docker/WSL). Apply the same wording at docs/guides/quickstart.md:206: 'Use Unsloth for faster training (ForgeLM: Linux only)'.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• TECH-T03-012 (technology, Watch) — PEFT, quantization and memory methods: Coverage of newer PEFT / memory methods (LoRA-GA, OLoRA, EVA, CorDA, LoftQ, VeRA, MiSS, QALoRA, APOLLO, LoRA+, OFT) and any 'state of the art' claim (aging)
  severity Watch
  Item. Coverage of newer PEFT / memory methods (LoRA-GA, OLoRA, EVA, CorDA, LoftQ, VeRA, MiSS, QALoRA, APOLLO, LoRA+, OFT) and any 'state of the art' claim · verdict: aging · urgency: Watch
  State in ForgeLM. lora.method offers lora/dora/pissa/rslora only (forgelm/config.py:370), plus GaLore on the optimizer side. No 'state of the art' claim about PEFT coverage in README.md, site/ or docs/ (rg over the snapshot). The only SOTA wording is the roadmap Phase 1 label (docs/roadmap.md:9) and an unrelated chat-template sentence (docs/reference/data_preparation-tr.md:48).
  State of the ecosystem on 2026-10-01. peft 0.21.2 offers init_lora_weights eva/olora/corda/loftq/orthogonal/mica/'pissa_niter_N', LoRA-GA via lora_ga_config (:823), and QALoRA via use_qalora (:873, GPTQ only). Bone was removed in 0.19.0 in favour of MiSS. 0.19.0-0.21.0 added many research methods (GraLoRA, HiRA, GLoRA, MiCA, KaSA, ShadowPEFT and others). transformers ships apollo_adamw. LLaMA-Factory (README:108, updated 2026-09-28)…
  Recommendation. Consider an init_lora_weights passthrough (loftq/eva/olora/corda/pissa_niter_N), LoRA+ (loraplus_lr_ratio) and APOLLO (apollo_adamw). Avoid SOTA wording.
  Sources.

  • peft v0.21.2 lora/config.py (LoraConfig) (2026-10-01)
  • peft GitHub releases v0.17.0-v0.21.2 (2026-10-01)

• TECH-T04-010 (technology, Watch) — Distributed training: Adjacent: bitsandbytes platform marker (linux only) and dependency floors seen from the distributed stack (aging)
  severity Watch
  Item. Adjacent: bitsandbytes platform marker (linux only) and dependency floors seen from the distributed stack · verdict: aging · urgency: Watch
  State in ForgeLM. pyproject.toml:74 declares bitsandbytes>=0.42.0,<1.0.0; sys_platform == 'linux', and _doctor.py:99 says 'Linux GPUs only'. model.py:440 (and :602) apply 4-bit only when torch.cuda.is_available(). The core floors are torch>=2.4.0, peft>=0.19.0 and accelerate>=1.4.0.
  State of the ecosystem on 2026-10-01. bitsandbytes 0.50.2 (2026-08-27) requires torch>=2.4,<3 and ships wheels for macOS 14 arm64, manylinux x86_64/aarch64, win_amd64 and win_arm64; win_amd64 wheels go back at least to 0.43.3 (2024-07-30). The PEFT QLoRA-with-ZeRO-3/FSDP recipes need bitsandbytes>=0.43.3. The transformers v5.18.0 dependency table lists torch>=2.5, peft>=0.20.0 and accelerate>=1.1.0.
  Recommendation. Raise bitsandbytes to >=0.43.3. Consider widening the marker to include win32, the CUDA path. Align the torch and peft floors with the transformers dependency table, leaving that to the dependency-currency owners.
  Sources.

  • PyPI JSON: bitsandbytes (0.50.2; macOS arm64, Linux and Windows wheels; requires torch>=2.4) (2026-08-27)
  • bitsandbytes releases feed 0.49-0.50.2 (2026-08-27)

• TECH-T06-017 (technology, Watch) — Data-audit methods: Croissant version declared (conformsTo http://mlcommons.org/croissant/1.0) and naming (aging)
  severity Watch
  Item. Croissant version declared (conformsTo http://mlcommons.org/croissant/1.0) and naming · verdict: aging · urgency: Watch
  State in ForgeLM. forgelm/data_audit/_croissant.py:217 emits conformsTo 'http://mlcommons.org/croissant/1.0'. The docstrings, CLI help (_parser.py:600) and croissant-card.md:2-8 call it 'Google Croissant 1.0'.
  State of the ecosystem on 2026-10-01. Croissant 1.1 is current: the spec header reads 'Version 1.1, Published: 2026-01-29', with URI http://mlcommons.org/croissant/1.1. MLCommons announced it 2026-02-12, and mlcroissant 1.1.0 was released 2026-04-16. The RAI vocabulary is still version 1.0 (published 2024/03/06) and is referenced from the 1.1 spec. mlcroissant 1.1.0's CroissantVersion enum accepts V_0_8, V_1_0 and V_1_1 (LATEST = 1.1…
  Recommendation. Keep 1.0 for now, and move to 1.1 together with the conformance fix (next item). Consider rai:personalSensitiveInformation for audit-derived fields. Reword 'Google Croissant' to 'MLCommons Croissant'.
  Sources.

  • Croissant Format Specification Version 1.1 (Published 2026-01-29) (2026-01-29)
  • MLCommons: What's New in Croissant 1.1 (2026-02-12)

• TECH-T11-011 (technology, Watch) — Regulation and standards: GDPR, ISO/IEC 27001, SOC 2, ISO/IEC 42001, EDPB, EU Cyber Resilience Act: Not cited: NIST AI RMF 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1) (aging)
  severity Watch
  Item. Not cited: NIST AI RMF 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1) · verdict: aging · urgency: Watch
  State in ForgeLM. Not referenced. NIST appears only as SP 800-131A (docs/qms/encryption_at_rest.md:66) and as 'NIST CSF' in the excluded-frameworks list (docs/design/iso27001_soc2_alignment.md:767, :793).
  State of the ecosystem on 2026-10-01. The NIST AI RMF page (retrieved 2026-10-01) says AI RMF 1.0 was released on 26 January 2023, that NIST-AI-600-1 was released on 26 July 2024, and that a concept note for a critical-infrastructure profile was released on 7 April 2026. It also states 'The AI RMF 1.0 is being revised as part of the White House AI Action Plan.' The AI 600-1 publication page shows 'Created July 26, 2024, Updated April…
  Recommendation. Add a short, voluntary, informative crosswalk labelled 'AI RMF 1.0 (revision in progress)' that maps ForgeLM artefacts to the AI RMF functions and to AI 600-1 risk categories (data privacy, information security, harmful content), and re-check it when the revised RMF is published.
  Sources.

  • NIST AI Risk Management Framework page ('The AI RMF 1.0 is being revised as part of the White House AI Action Plan') (2026-10-01T14:02:47Z)
  • NIST AI 600-1 publication page (created 2024-07-26, updated 2026-04-08) (2026-04-08)

• TECH-T12-015 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: pre-commit-hooks v4.5.0 (.pre-commit-config.yaml:30-37) (outdated)
  severity Watch
  Item. pre-commit-hooks v4.5.0 (.pre-commit-config.yaml:30-37) · verdict: outdated · urgency: Watch
  State in ForgeLM. .pre-commit-config.yaml:30-37 pins v4.5.0 for trailing-whitespace, end-of-file-fixer, check-yaml, check-toml and check-merge-conflict.
  State of the ecosystem on 2026-10-01. v4.5.0 was published 2023-10 (PyPI upload 2023-10-07); latest is v6.0.0 (2025-08-09); v5.0.0 came out 2024-10; there has been no 4.x release after 4.6.0 (2024-04-06). The five hooks still exist.
  Recommendation. Run pre-commit autoupdate to v6.0.0 together with the gitleaks and ruff bumps, and add autoupdate to the release checklist.
  Sources.

  • pre-commit-hooks releases (v6.0.0) (2025-08-09)
  • pre-commit-hooks releases (API) (2025-08-09)

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}