Goal: As a release engineer, I want fromager to select my desired xgrammar version, so that we can resolve CVE-2025-57809.

Recently we merged a change to RHEL AI's pipeline repo to pin xgrammar to 0.1.23.

As I reviewed Renovate's change for this new wheel release, I ran wheel_compare.sh from image-tools:

TMPDIR=/tmp ~/dev/image-tools/wheel_compare.sh 1.5.1802+rhelai-cuda-ubi9-x86_64 1.5.1887+rhelai-cuda-ubi9-x86_64
typing-extensions==4.13.2               	typing-extensions==4.15.0

This does not show xgrammar changing to 0.1.23.

Further investigation shows that /tmp/wheel-history/wheels-1.5.1887+rhelai-cuda-ubi9-x86_64/release/outputs/constraints.txt has this comment:

# NOTE: fromager selected xgrammar==0.1.18 from: ['0.1.18', '0.1.23']
xgrammar==0.1.18

Acceptance criteria:

• Identify the proper way to ship the new xgrammar release in the RHEL AI wheel collection.
• Merge an MR to resolve this.
• Verify the xgrammar package version is correct in the wheel collection.