[CI/Build] Update causal-conv1d and lm-eval

[DarkLight1337]

Essential Elements of an Effective PR Description Checklist

• The purpose of the PR, such as "Fix some issue (link existing issues this PR will resolve)".
• The test plan, such as providing test command.
• The test results, such as pasting the results comparison before and after, or e2e results
• (Optional) The necessary documentation update, such as updating supported_models.md and examples for a new model.

Purpose

• causal-conv1d==1.5.2 is now compatible with uv pip compile, so let's update it to simplify the build
• Bump lm-eval to work with [Deprecation] Remove prompt_token_ids arg fallback in LLM.generate and LLM.embed #18800

Test Plan

Test Result

(Optional) Documentation Update

[github-actions]

👋 Hi! Thank you for contributing to the vLLM project.

💬 Join our developer Slack at https://slack.vllm.ai to discuss your PR in #pr-reviews, coordinate on features in #feat- channels, or join special interest groups in #sig- channels.

Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which starts running only a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of those by going to your fastcheck build on Buildkite UI (linked in the PR checks section) and unblock them. If you do not have permission to unblock, ping simon-mo or khluu to add you in our Buildkite org.

Once the PR is approved and ready to go, your PR reviewer(s) can run CI to test the changes comprehensively before merging.

To run CI, PR reviewers can either: Add ready label to the PR or enable auto-merge.

🚀

[gemini-code-assist]

Code Review

This pull request updates two key dependencies, causal-conv1d and lm-eval. The update to causal-conv1d to version 1.5.2 is a positive change that simplifies the build process by allowing it to be managed through pip-compile. However, the update to lm-eval pins the dependency to a specific git commit hash. While this may be necessary to resolve an immediate compatibility issue, it introduces potential maintenance and security risks. I've added comments suggesting the addition of explanatory notes in the code to clarify the reason for this pinning and to facilitate future updates to a stable release.

[gemini-code-assist]

Pinning a dependency to a specific commit hash can introduce maintenance and security risks. It makes the build less reproducible if the commit history is changed (e.g., force-push) and bypasses the security vetting of official releases. If this specific commit is necessary to unblock a temporary issue, please add a comment explaining the reason for this pin and which issue/PR it relates to. This will help with future maintenance and make it clear when this can be reverted to a stable, versioned release.

[gemini-code-assist]

Pinning a dependency to a specific commit hash, as done here for lm-eval, can be risky for long-term maintenance and security. It makes it difficult to track updates and can lead to build instability if the commit is ever removed or the repository history is altered. It's generally better to use a versioned release. If this pin is a temporary measure to resolve a specific compatibility issue, it would be very helpful to add a comment here explaining the context, linking to the relevant issue or PR, and outlining the conditions under which this can be updated to a released version.

[DarkLight1337]

Hmm seems pip-compile still doesn't work well for CPU machines

[DarkLight1337]

I'll just update lm-eval in the other PR then. Meanwhile we can see if the tests still pass with the updated versions

[DarkLight1337]

Prefer #22409, closing