This file is auto-generated by
util/generate_sbom.pyand is the source of truth for tracking external dependencies pinned in this repository, their current versions, and where they are pinned. Thegenerate-sbomprecommit hook regenerates it wheneverinstall.sh,pyproject.toml,config/templates/values/defaults.yaml, or the generator script changes.autoHelm/image versions are resolved against live registries at generation time via the existingVersionResolver.
- Generated at:
2026-06-30 16:07:28(UTC) - Generated against git ref:
82737ce70b0aaca8c45eed2aca164a8cfbe1b7da
Pinned in install.sh install helpers (install_<tool>_linux).
Tools without an explicit pin are checked via command -v and use
whatever the host's package manager provides.
| Dependency | Current Pin | Pin Type | File Location | Upstream Repo |
|---|---|---|---|---|
| crane | 0.21.7 |
version | install.sh line 85 (tool_version_for) |
google/go-containerregistry |
| curl | 8_21_0 |
version | install.sh line 78 (tool_version_for) |
curl/curl |
| git | system-provided |
system-provided | install.sh: command -v check (no pin) |
git/git |
| helm | v3.19.0 |
version | install.sh line 81 (tool_version_for) |
helm/helm |
| helm-diff | v3.13.0 |
plugin (version) | install.sh line 82 (tool_version_for) |
databus23/helm-diff |
| helmfile | 1.5.1 |
version | install.sh line 80 (tool_version_for) |
helmfile/helmfile |
| jq | 1.8.2 |
version | install.sh line 87 (tool_version_for) |
jqlang/jq |
| kustomize | v5.8.1 |
version | install.sh line 84 (tool_version_for) |
kubernetes-sigs/kustomize |
| llm-d-planner (git) | v0.1.0 |
commit SHA | install.sh line 924 (PLANNER_GIT) |
llm-d-incubation/llm-d-planner |
| oc | 4.18.0 |
version | install.sh line 83 (tool_version_for) |
openshift/oc |
| skopeo | 1.20.1 |
version | install.sh line 86 (tool_version_for) |
containers/skopeo |
| yq | v4.53.3 |
version | install.sh line 79 (tool_version_for) |
mikefarah/yq |
Pinned in config/templates/values/defaults.yaml chartVersions:
block. Charts marked auto are resolved against the upstream Helm /
OCI registry at generation (and plan) time.
| Dependency | Current Pin | Pin Type | File Location | Upstream Repo |
|---|---|---|---|---|
| agentgateway | v1.3.1 |
tag | config/templates/values/defaults.yaml line 484 (chartVersions.agentgateway) |
agentgateway/agentgateway (oci://cr.agentgateway.dev/charts/) |
| inferencePool | v1.5.0 |
tag | config/templates/values/defaults.yaml line 483 (chartVersions.inferencePool) |
kubernetes-sigs/gateway-api-inference-extension |
| istioBase | 1.29.2 |
tag | config/templates/values/defaults.yaml line 470 (chartVersions.istioBase) |
(unknown) |
| istiod | 1.29.2 |
tag | config/templates/values/defaults.yaml line 471 (chartVersions.istiod) |
(unknown) |
| llmDInfra | v1.4.0 |
tag (auto-resolved) | config/templates/values/defaults.yaml line 472 (chartVersions.llmDInfra) |
llm-d-incubation/llm-d-infra (https://llm-d-incubation.github.io/llm-d-infra/) |
| llmDModelservice | v0.4.15 |
tag (auto-resolved) | config/templates/values/defaults.yaml line 473 (chartVersions.llmDModelservice) |
llm-d-incubation/llm-d-modelservice (https://llm-d-incubation.github.io/llm-d-modelservice/) |
| llmDRouter | v0.9.0 |
tag | config/templates/values/defaults.yaml line 479 (chartVersions.llmDRouter) |
llm-d/llm-d-router |
| lws | 0.9.0 |
tag | config/templates/values/defaults.yaml line 485 (chartVersions.lws) |
kubernetes-sigs/lws |
| prometheusAdapter | 5.3.0 |
tag | config/templates/values/defaults.yaml line 475 (chartVersions.prometheusAdapter) |
prometheus-community/helm-charts (https://prometheus-community.github.io/helm-charts) |
| wva | 0.8.0 |
tag | config/templates/values/defaults.yaml line 474 (chartVersions.wva) |
llm-d/llm-d-workload-variant-autoscaler (oci://ghcr.io/llm-d/workload-variant-autoscaler) |
Pinned in config/templates/values/defaults.yaml images: block.
Tags marked auto are resolved against the upstream registry at
generation (and plan) time.
| Dependency | Current Pin | Pin Type | File Location | Upstream Repo |
|---|---|---|---|---|
| benchmark | v0.7.0 |
tag | config/templates/values/defaults.yaml line 359 (images.benchmark) |
llm-d/llm-d-benchmark (ghcr.io/llm-d/llm-d-benchmark) |
| python | 3.10 |
tag | config/templates/values/defaults.yaml line 407 (images.python) |
Docker Hub: python (python) |
| routerEndpointPicker | v0.9.0 |
tag | config/templates/values/defaults.yaml line 384 (images.routerEndpointPicker) |
llm-d/llm-d-router (ghcr.io/llm-d/llm-d-router-endpoint-picker) |
| routingSidecar | v0.9.0 |
tag | config/templates/values/defaults.yaml line 390 (images.routingSidecar) |
llm-d/llm-d-router (ghcr.io/llm-d/llm-d-router-disagg-sidecar) |
| udsTokenizer | v0.24.0 |
tag | config/templates/values/defaults.yaml line 396 (images.udsTokenizer) |
vllm-project/vllm (docker.io/vllm/vllm-openai) |
| vllm | v0.24.0 |
tag | config/templates/values/defaults.yaml line 365 (images.vllm) |
vllm-project/vllm (docker.io/vllm/vllm-openai) |
| vllmOpenai | v0.24.0 |
tag | config/templates/values/defaults.yaml line 376 (images.vllmOpenai) |
vllm-project/vllm (docker.io/vllm/vllm-openai) |
Direct dependencies declared in pyproject.toml. The full installed
set (including transitive packages picked up by pip install -e .) is
captured in the snapshot table below.
| Dependency | Current Pin | Pin Type | File Location | Upstream Repo |
|---|---|---|---|---|
| GitPython | (unpinned) |
(unpinned) | pyproject.toml line 14 |
GitPython (PyPI) |
| google-auth | (unpinned) |
(unpinned) | pyproject.toml line 18 |
google-auth (PyPI) |
| google-cloud-storage | >=2.10.0 |
constraint | pyproject.toml line 19 |
google-cloud-storage (PyPI) |
| huggingface_hub | (unpinned) |
(unpinned) | pyproject.toml line 15 |
huggingface_hub (PyPI) |
| Jinja2 | (unpinned) |
(unpinned) | pyproject.toml line 8 |
Jinja2 (PyPI) |
| kubernetes | ==35.0.0 |
constraint | pyproject.toml line 11 |
kubernetes (PyPI) |
| kubernetes-asyncio | (unpinned) |
(unpinned) | pyproject.toml line 13 |
kubernetes-asyncio (PyPI) |
| packaging | (unpinned) |
(unpinned) | pyproject.toml line 10 |
packaging (PyPI) |
| pydantic | >=2.0 |
constraint | pyproject.toml line 17 |
pydantic (PyPI) |
| pykube-ng | (unpinned) |
(unpinned) | pyproject.toml line 12 |
pykube-ng (PyPI) |
| PyYAML | (unpinned) |
(unpinned) | pyproject.toml line 7 |
PyYAML (PyPI) |
| requests | (unpinned) |
(unpinned) | pyproject.toml line 9 |
requests (PyPI) |
| transformers | (unpinned) |
(unpinned) | pyproject.toml line 16 |
transformers (PyPI) |
Output of pip freeze against the project venv (.venv). Includes
every transitive dependency actually installed; direct deps are
annotated with their pyproject.toml line.
Click to expand the full pip-freeze snapshot
| Dependency | Current Pin | Pin Type | File Location | Upstream Repo |
|---|---|---|---|---|
| aiohappyeyeballs | 2.6.1 |
version | (transitive in .venv) |
aiohappyeyeballs (PyPI) |
| aiohttp | 3.13.3 |
version | (transitive in .venv) |
aiohttp (PyPI) |
| aiosignal | 1.4.0 |
version | (transitive in .venv) |
aiosignal (PyPI) |
| annotated-doc | 0.0.4 |
version | (transitive in .venv) |
annotated-doc (PyPI) |
| annotated-types | 0.7.0 |
version | (transitive in .venv) |
annotated-types (PyPI) |
| anyio | 4.12.1 |
version | (transitive in .venv) |
anyio (PyPI) |
| attrs | 25.4.0 |
version | (transitive in .venv) |
attrs (PyPI) |
| binaryornot | 0.6.0 |
version | (transitive in .venv) |
binaryornot (PyPI) |
| boxsdk | 3.14.0 |
version | (transitive in .venv) |
boxsdk (PyPI) |
| certifi | 2026.2.25 |
version | (transitive in .venv) |
certifi (PyPI) |
| cffi | 2.0.0 |
version | (transitive in .venv) |
cffi (PyPI) |
| cfgv | 3.5.0 |
version | (transitive in .venv) |
cfgv (PyPI) |
| chardet | 6.0.0.post1 |
version | (transitive in .venv) |
chardet (PyPI) |
| charset-normalizer | 3.4.4 |
version | (transitive in .venv) |
charset-normalizer (PyPI) |
| click | 8.4.1 |
version | (transitive in .venv) |
click (PyPI) |
| config_explorer | (unknown) |
commit SHA | (transitive in .venv) |
config_explorer (PyPI) |
| contourpy | 1.3.3 |
version | (transitive in .venv) |
contourpy (PyPI) |
| cryptography | 46.0.7 |
version | (transitive in .venv) |
cryptography (PyPI) |
| cycler | 0.12.1 |
version | (transitive in .venv) |
cycler (PyPI) |
| detect_secrets | 76a765c2b1a8928824a3d937ebeacf88354b86bb |
commit SHA | (transitive in .venv) |
detect_secrets (PyPI) |
| distlib | 0.4.0 |
version | (transitive in .venv) |
distlib (PyPI) |
| distro | 1.9.0 |
version | (transitive in .venv) |
distro (PyPI) |
| durationpy | 0.10 |
version | (transitive in .venv) |
durationpy (PyPI) |
| fastapi | 0.136.3 |
version | (transitive in .venv) |
fastapi (PyPI) |
| filelock | 3.24.3 |
version | (transitive in .venv) |
filelock (PyPI) |
| fonttools | 4.61.1 |
version | (transitive in .venv) |
fonttools (PyPI) |
| frozenlist | 1.8.0 |
version | (transitive in .venv) |
frozenlist (PyPI) |
| fsspec | 2026.2.0 |
version | (transitive in .venv) |
fsspec (PyPI) |
| gitdb | 4.0.12 |
version | (transitive in .venv) |
gitdb (PyPI) |
| GitPython | 3.1.46 |
version | pyproject.toml line 14 (direct) |
GitPython (PyPI) |
| google-api-core | 2.30.3 |
version | (transitive in .venv) |
google-api-core (PyPI) |
| google-auth | 2.52.0 |
version | pyproject.toml line 18 (direct) |
google-auth (PyPI) |
| google-cloud-core | 2.6.0 |
version | (transitive in .venv) |
google-cloud-core (PyPI) |
| google-cloud-storage | 3.10.1 |
version | pyproject.toml line 19 (direct) |
google-cloud-storage (PyPI) |
| google-crc32c | 1.8.0 |
version | (transitive in .venv) |
google-crc32c (PyPI) |
| google-resumable-media | 2.9.0 |
version | (transitive in .venv) |
google-resumable-media (PyPI) |
| googleapis-common-protos | 1.75.0 |
version | (transitive in .venv) |
googleapis-common-protos (PyPI) |
| h11 | 0.16.0 |
version | (transitive in .venv) |
h11 (PyPI) |
| hf-xet | 1.5.1 |
version | (transitive in .venv) |
hf-xet (PyPI) |
| httpcore | 1.0.9 |
version | (transitive in .venv) |
httpcore (PyPI) |
| httptools | 0.7.1 |
version | (transitive in .venv) |
httptools (PyPI) |
| httpx | 0.28.1 |
version | (transitive in .venv) |
httpx (PyPI) |
| huggingface_hub | 1.19.0 |
version | pyproject.toml line 15 (direct) |
huggingface_hub (PyPI) |
| identify | 2.6.19 |
version | (transitive in .venv) |
identify (PyPI) |
| idna | 3.11 |
version | (transitive in .venv) |
idna (PyPI) |
| iniconfig | 2.3.0 |
version | (transitive in .venv) |
iniconfig (PyPI) |
| Jinja2 | 3.1.6 |
version | pyproject.toml line 8 (direct) |
Jinja2 (PyPI) |
| jiter | 0.13.0 |
version | (transitive in .venv) |
jiter (PyPI) |
| kiwisolver | 1.4.9 |
version | (transitive in .venv) |
kiwisolver (PyPI) |
| kubernetes | 35.0.0 |
version | pyproject.toml line 11 (direct) |
kubernetes (PyPI) |
| kubernetes_asyncio | 35.0.1 |
version | (transitive in .venv) |
kubernetes_asyncio (PyPI) |
| llm-optimizer | bb82d22e8863b762e856be66e831d551d27576b1 |
commit SHA | (transitive in .venv) |
llm-optimizer (PyPI) |
| llmdbenchmark | editable |
editable | (transitive in .venv) |
llmdbenchmark (PyPI) |
| markdown-it-py | 4.0.0 |
version | (transitive in .venv) |
markdown-it-py (PyPI) |
| MarkupSafe | 3.0.3 |
version | (transitive in .venv) |
MarkupSafe (PyPI) |
| matplotlib | 3.10.8 |
version | (transitive in .venv) |
matplotlib (PyPI) |
| mdurl | 0.1.2 |
version | (transitive in .venv) |
mdurl (PyPI) |
| multidict | 6.7.1 |
version | (transitive in .venv) |
multidict (PyPI) |
| nodeenv | 1.10.0 |
version | (transitive in .venv) |
nodeenv (PyPI) |
| numpy | 2.4.2 |
version | (transitive in .venv) |
numpy (PyPI) |
| nvidia-ml-py3 | 7.352.0 |
version | (transitive in .venv) |
nvidia-ml-py3 (PyPI) |
| oauthlib | 3.3.1 |
version | (transitive in .venv) |
oauthlib (PyPI) |
| ollama | 0.6.2 |
version | (transitive in .venv) |
ollama (PyPI) |
| openai | 2.24.0 |
version | (transitive in .venv) |
openai (PyPI) |
| packaging | 26.0 |
version | pyproject.toml line 10 (direct) |
packaging (PyPI) |
| pandas | 3.0.3 |
version | (transitive in .venv) |
pandas (PyPI) |
| pillow | 12.1.1 |
version | (transitive in .venv) |
pillow (PyPI) |
| planner | f51812bebca30e0291ec541bd2ef2acf0572e8a4 |
commit SHA | (transitive in .venv) |
planner (PyPI) |
| platformdirs | 4.9.6 |
version | (transitive in .venv) |
platformdirs (PyPI) |
| pluggy | 1.6.0 |
version | (transitive in .venv) |
pluggy (PyPI) |
| pre_commit | 4.6.0 |
version | (transitive in .venv) |
pre_commit (PyPI) |
| propcache | 0.4.1 |
version | (transitive in .venv) |
propcache (PyPI) |
| proto-plus | 1.28.0 |
version | (transitive in .venv) |
proto-plus (PyPI) |
| protobuf | 7.34.1 |
version | (transitive in .venv) |
protobuf (PyPI) |
| psutil | 7.2.2 |
version | (transitive in .venv) |
psutil (PyPI) |
| psycopg2-binary | 2.9.12 |
version | (transitive in .venv) |
psycopg2-binary (PyPI) |
| pyasn1 | 0.6.3 |
version | (transitive in .venv) |
pyasn1 (PyPI) |
| pyasn1_modules | 0.4.2 |
version | (transitive in .venv) |
pyasn1_modules (PyPI) |
| pycparser | 3.0 |
version | (transitive in .venv) |
pycparser (PyPI) |
| pydantic | 2.13.4 |
version | pyproject.toml line 17 (direct) |
pydantic (PyPI) |
| pydantic-settings | 2.14.1 |
version | (transitive in .venv) |
pydantic-settings (PyPI) |
| pydantic_core | 2.46.4 |
version | (transitive in .venv) |
pydantic_core (PyPI) |
| Pygments | 2.19.2 |
version | (transitive in .venv) |
Pygments (PyPI) |
| PyJWT | 2.12.1 |
version | (transitive in .venv) |
PyJWT (PyPI) |
| pykube-ng | 23.6.0 |
version | pyproject.toml line 12 (direct) |
pykube-ng (PyPI) |
| pyparsing | 3.3.2 |
version | (transitive in .venv) |
pyparsing (PyPI) |
| pytest | 9.0.3 |
version | (transitive in .venv) |
pytest (PyPI) |
| python-dateutil | 2.9.0.post0 |
version | (transitive in .venv) |
python-dateutil (PyPI) |
| python-discovery | 1.2.2 |
version | (transitive in .venv) |
python-discovery (PyPI) |
| python-dotenv | 1.2.2 |
version | (transitive in .venv) |
python-dotenv (PyPI) |
| python-multipart | 0.0.29 |
version | (transitive in .venv) |
python-multipart (PyPI) |
| PyYAML | 6.0.3 |
version | pyproject.toml line 7 (direct) |
PyYAML (PyPI) |
| regex | 2026.2.19 |
version | (transitive in .venv) |
regex (PyPI) |
| requests | 2.34.2 |
version | pyproject.toml line 9 (direct) |
requests (PyPI) |
| requests-oauthlib | 2.0.0 |
version | (transitive in .venv) |
requests-oauthlib (PyPI) |
| requests-toolbelt | 1.0.0 |
version | (transitive in .venv) |
requests-toolbelt (PyPI) |
| rich | 14.3.3 |
version | (transitive in .venv) |
rich (PyPI) |
| safetensors | 0.7.0 |
version | (transitive in .venv) |
safetensors (PyPI) |
| scipy | 1.17.1 |
version | (transitive in .venv) |
scipy (PyPI) |
| shellingham | 1.5.4 |
version | (transitive in .venv) |
shellingham (PyPI) |
| six | 1.17.0 |
version | (transitive in .venv) |
six (PyPI) |
| smmap | 5.0.2 |
version | (transitive in .venv) |
smmap (PyPI) |
| sniffio | 1.3.1 |
version | (transitive in .venv) |
sniffio (PyPI) |
| starlette | 1.0.0 |
version | (transitive in .venv) |
starlette (PyPI) |
| tabulate | 0.10.0 |
version | (transitive in .venv) |
tabulate (PyPI) |
| tokenizers | 0.22.2 |
version | (transitive in .venv) |
tokenizers (PyPI) |
| tqdm | 4.67.3 |
version | (transitive in .venv) |
tqdm (PyPI) |
| transformers | 5.12.0 |
version | pyproject.toml line 16 (direct) |
transformers (PyPI) |
| typer | 0.24.1 |
version | (transitive in .venv) |
typer (PyPI) |
| typer-slim | 0.24.0 |
version | (transitive in .venv) |
typer-slim (PyPI) |
| typing-inspection | 0.4.2 |
version | (transitive in .venv) |
typing-inspection (PyPI) |
| typing_extensions | 4.15.0 |
version | (transitive in .venv) |
typing_extensions (PyPI) |
| urllib3 | 2.6.3 |
version | (transitive in .venv) |
urllib3 (PyPI) |
| uvicorn | 0.48.0 |
version | (transitive in .venv) |
uvicorn (PyPI) |
| uvloop | 0.22.1 |
version | (transitive in .venv) |
uvloop (PyPI) |
| virtualenv | 21.2.4 |
version | (transitive in .venv) |
virtualenv (PyPI) |
| watchfiles | 1.1.1 |
version | (transitive in .venv) |
watchfiles (PyPI) |
| websocket-client | 1.9.0 |
version | (transitive in .venv) |
websocket-client (PyPI) |
| websockets | 16.0 |
version | (transitive in .venv) |
websockets (PyPI) |
| yarl | 1.22.0 |
version | (transitive in .venv) |
yarl (PyPI) |