chore: move python pin to <=3.14 (#664)

<!-- SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION
& AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->

<!-- Thank you for contributing to Safe Synthesizer! -->

# Summary
<!-- Brief description of changes -->

## Pre-Review Checklist

<!-- These checks should be completed before a PR is reviewed, -->
<!-- but you can submit a draft early to indicate that the issue is
being worked on. -->

Ensure that the following pass:

- [ ] `mise run format && mise run check` or via prek validation.
- [ ] `mise run test` passes locally
- [ ] `mise run test:e2e` passes locally
- [ ] `mise run test:ci-container` passes locally (recommended)
- [ ] GPU CI status check passes -- comment `/sync` on this PR to
trigger a run (auto-triggers on ready-for-review)

## Pre-Merge Checklist

<!-- These checks need to be completed before a PR is merged, -->
<!-- but as PRs often change significantly during review, -->
<!-- it's OK for them to be incomplete when review is first requested.
-->

- [ ] New or updated tests for any fix or new behavior
- [ ] Updated documentation for new features and behaviors, including
docstrings for API docs.

## Other Notes

<!-- Please add the issue number that should be closed when this PR is
merged. -->
- Closes #<issue>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added explicit support for Python 3.14 and extended the supported
Python range to <3.15.
* **Tests**
  * Extended the unit-test CI matrix to include Python 3.14.
* **Documentation**
* Refreshed CUDA 12.9 installation instructions and tutorials with
updated wheel/extra index URLs (including FlashInfer and vLLM 0.26.0
endpoints).
* Updated README and release verification steps to use the new index
URLs.
* **Chores**
* Updated FlashInfer-related pins and install/index mappings, and bumped
vLLM to 0.26.0 for both CPU and CUDA 12.9 options.
  * Added `openai>=2.25.0` to relevant optional dependency groups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: mkornfield <mkornfield@nvidia.com>

Author: mckornfield

.github/workflows/ci-checks.yml

@@ -174,7 +174,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
       - name: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

AGENTS.md

@@ -17,7 +17,7 @@ Durable implementation guidance belongs with the code it describes: function and
 
 See [STYLE_GUIDE.md](STYLE_GUIDE.md) for detailed code style conventions (Python, markdown, Dockerfiles, shell scripts, testing, config files, docstrings).
 
-Use `uv` for everything -- never `pip` or raw `python`. Python 3.11–3.13 with modern syntax (`X | Y`, `list[str]`, `Self`). Python 3.14+ is not supported.
+Use `uv` for everything -- never `pip` or raw `python`. Python 3.11–3.14 with modern syntax (`X | Y`, `list[str]`, `Self`).
 
 Common commands: `mise run test` (unit tests), `mise run format` (auto-fix formatting + lint + copyright), `mise run check` (read-only local quality checks), `mise run validate` (pre-PR quality, lock, and CI unit checks), `mise run typecheck` (ty only). Always use mise tasks or the wrapper scripts in `tools/` instead of running `ruff` or `ty` directly. Use `uv run` for Python execution. When in doubt, inspect `mise tasks` and `pytest --markers`.
 

CONTRIBUTING.md

@@ -27,7 +27,7 @@ Please read our [Code of Conduct](CODE_OF_CONDUCT.md) before contributing.
 
 ### Prerequisites
 
-- Python 3.11–3.13 (project supports Python 3.11, 3.12, and 3.13; `.python-version` pins 3.13 for bootstrapping at the repo root. Python 3.14+ is not supported — see [Troubleshooting](docs/user-guide/troubleshooting.md#python-314-is-not-supported))
+- Python 3.11–3.14 (project supports Python 3.11, 3.12, 3.13, and 3.14; `.python-version` pins 3.13 for bootstrapping at the repo root)
 - Git 2.34+ (minimum required for SSH commit signing)
 
 > Note: Other tools like [uv](https://docs.astral.sh/uv/), [dprint](https://dprint.dev/), [ruff](https://docs.astral.sh/ruff/), [ty](https://github.com/astral-sh/ty), and [gh](https://cli.github.com/) are installed automatically by `make setup` (via [mise](https://mise.jdx.dev/)). Tool versions are declared in `.mise.toml` and locked in `mise.lock` (committed), ensuring reproducible toolchains across developer systems and CI. These should not interfere with locally installed tools.
@@ -786,8 +786,9 @@ uv --no-config pip install \
   --python "${SMOKE_VENV}/bin/python" \
   --default-index https://pypi.org/simple \
   --index https://flashinfer.ai/whl/cu129 \
+  --index https://flashinfer.ai/whl/ \
   --index https://download.pytorch.org/whl/cu129 \
-  --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 \
+  --index https://wheels.vllm.ai/0.26.0/cu129 \
   --index-strategy unsafe-best-match \
   "nemo-safe-synthesizer[cu129,engine]==${NSS_VERSION}"
 uv --no-config pip check --python "${SMOKE_VENV}/bin/python"

README.md

@@ -18,7 +18,7 @@ Read detailed usage below, or jump to the documentation with [Getting Started](h
 
 ### Prerequisites
 
-- Python 3.11–3.13 (`.python-version` pins 3.13 for local/dev bootstrap; any 3.11, 3.12, or 3.13 interpreter works. Python 3.14+ is NOT supported because vLLM currently declares `<3.14` support while upstream resolves Python 3.14 wheel compatibility across its dependency stack)
+- Python 3.11–3.14 (`.python-version` pins 3.13 for local/dev bootstrap; any 3.11, 3.12, 3.13, or 3.14 interpreter works)
 - [uv](https://docs.astral.sh/uv/) (recommended) or pip -- Python package manager
 - NVIDIA GPU (A100 or larger) for training and generation
 - Linux only -- macOS, Windows, and Apple Silicon are not supported for training or generation. A CPU-only install is available for development and configuration validation.
@@ -29,15 +29,17 @@ Read detailed usage below, or jump to the documentation with [Getting Started](h
 # With uv (recommended):
 uv pip install "nemo-safe-synthesizer[cu129,engine]" \
   --index https://flashinfer.ai/whl/cu129 \
+  --index https://flashinfer.ai/whl/ \
   --index https://download.pytorch.org/whl/cu129 \
-  --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 \
+  --index https://wheels.vllm.ai/0.26.0/cu129 \
   --index-strategy unsafe-best-match
 
 # With pip:
 pip install "nemo-safe-synthesizer[cu129,engine]" \
   --extra-index-url https://download.pytorch.org/whl/cu129 \
   --extra-index-url https://flashinfer.ai/whl/cu129 \
-  --extra-index-url https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129
+  --extra-index-url https://flashinfer.ai/whl/ \
+  --extra-index-url https://wheels.vllm.ai/0.26.0/cu129
 ```
 
 Or install from source:

STYLE_GUIDE.md

@@ -116,7 +116,7 @@ How to write clear, testable Python -- independent of which library primitives y
 
 ### Type hints
 
-The codebase targets Python 3.11–3.13 and uses native typing syntax throughout. Expect 3.11 as the minimum for the foreseeable future; the upper bound tracks dependency availability (currently vLLM declares `<3.14` support while its dependency stack gains full `cp314` wheel coverage).
+The codebase targets Python 3.11–3.14 and uses native typing syntax throughout. Expect 3.11 as the minimum for the foreseeable future; the upper bound tracks dependency availability (`requires-python` is currently `<3.15`).
 
 Even though `.python-version` pins Python 3.13 for local development and CI defaults, shared package code must stay Python 3.11 syntax-compatible until the NMP platform moves its base Python version to 3.12. Do not use Python 3.12-only syntax yet, including PEP 695 `type` statements or bracketed generic class/function parameters. Prefer `TypeAlias`, `TypeVar`, and `typing_extensions` backports when newer typing features are useful before the minimum runtime moves.
 

containers/Dockerfile.test_ci

@@ -40,6 +40,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
         --no-sources \
         --default-index https://pypi.org/simple \
         --index https://download.pytorch.org/whl/cpu \
+        --index https://flashinfer.ai/whl/ \
         --index-strategy unsafe-best-match \
         "nemo-safe-synthesizer[cpu,engine] @ file://${wheel}" && \
     uv --no-config pip check --python /opt/wheel-cpu/bin/python && \
@@ -53,8 +54,9 @@ RUN --mount=type=cache,target=/root/.cache/uv \
         --dry-run \
         --default-index https://pypi.org/simple \
         --index https://flashinfer.ai/whl/cu129 \
+        --index https://flashinfer.ai/whl/ \
         --index https://download.pytorch.org/whl/cu129 \
-        --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 \
+        --index https://wheels.vllm.ai/0.26.0/cu129 \
         --index-strategy unsafe-best-match \
         "nemo-safe-synthesizer[cu129,engine] @ file://${wheel}" && \
     rm -rf /opt/wheel-cpu /opt/wheel-cu129

cuda_deps.toml

@@ -8,19 +8,20 @@ base_runtime_deps = []
 torch_runtime_deps = [
     "accelerate>=1.1.0",
     "bitsandbytes>=0.46.1",
-    "flashinfer-python==0.6.12; sys_platform == 'linux'",
-    "flashinfer-cubin==0.6.12; sys_platform == 'linux'",
+    "flashinfer-python==0.6.14; sys_platform == 'linux'",
+    "flashinfer-cubin==0.6.14; sys_platform == 'linux'",
     "gliner",
     "kernels>=0.12.1,<0.15",
     "opacus",
     "peft>=0.18.0",
     "sentence-transformers",
+    "openai>=2.25.0",
     "trl>=0.23.0",
     "xgrammar>=0.2.0; sys_platform == 'linux'",
 ]
 
 cuda_runtime_deps = [
-    { name = "flashinfer-jit-cache", version = "0.6.12", local = "{torch_local_version}", sys_platform = "linux", source_kind = "flashinfer" },
+    { name = "flashinfer-jit-cache", version = "0.6.14", local = "{torch_local_version}", sys_platform = "linux", source_kind = "flashinfer" },
     { name = "nvidia-cublas-{cuda_package_suffix}", sys_platform = "linux" },
     "nvidia-ml-py; sys_platform == 'linux'",
     "torch-c-dlpack-ext",
@@ -64,7 +65,7 @@ dependencies = [
     "torchao==0.17.0",
     "transformers==5.12.0",
     "triton>=2.0.0; sys_platform=='linux'",
-    "vllm==0.24.0; sys_platform=='linux'",
+    "vllm==0.26.0; sys_platform=='linux'",
 ]
 
 [[indexes]]
@@ -83,8 +84,13 @@ url = "https://pypi.nvidia.com"
 explicit = true
 
 [[indexes]]
-name = "vllm-v0-24-0-cu129"
-url = "https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129"
+name = "flashinfer-cubin"
+url = "https://flashinfer.ai/whl/"
+explicit = true
+
+[[indexes]]
+name = "vllm-v0-26-0-cu129"
+url = "https://wheels.vllm.ai/0.26.0/cu129"
 explicit = true
 
 [cuda_indexes.pytorch]
@@ -99,13 +105,21 @@ explicit = true
 
 # Static source entries are grouped by the extra they activate. The generator
 # supplies that extra and rejects a conflicting explicit value.
+[sources.cpu]
+flashinfer-cubin = [
+    { index = "flashinfer-cubin", marker = "sys_platform == 'linux'" },
+]
+
 [sources.cu129]
+flashinfer-cubin = [
+    { index = "flashinfer-cubin", marker = "sys_platform == 'linux'" },
+]
 vllm = [
-    { index = "vllm-v0-24-0-cu129", marker = "sys_platform == 'linux'", extra = "cu129" },
+    { index = "vllm-v0-26-0-cu129", marker = "sys_platform == 'linux'", extra = "cu129" },
 ]
 
 [variants.cu129]
 cuda_package_suffix = "cu12"
 dependencies = [
-    "vllm==0.24.0+{torch_local_version}; sys_platform == 'linux'",
+    "vllm==0.26.0+{torch_local_version}; sys_platform == 'linux'",
 ]

docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md

@@ -87,7 +87,8 @@ Each score maps to concrete remediation guidance in the documentation. The [Prod
 pip install "nemo-safe-synthesizer[cu129,engine]" \
   --extra-index-url https://download.pytorch.org/whl/cu129 \
   --extra-index-url https://flashinfer.ai/whl/cu129 \
-  --extra-index-url https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129
+  --extra-index-url https://flashinfer.ai/whl/ \
+  --extra-index-url https://wheels.vllm.ai/0.26.0/cu129
 ```
 
 The quickest way to run your first pipeline is the CLI:

docs/tutorials/differential-privacy.ipynb

@@ -39,10 +39,19 @@
     "# SPDX-License-Identifier: Apache-2.0\n",
     "\n",
     "if command -v uv > /dev/null 2>&1; then\n",
-    "    uv pip install \"nemo-safe-synthesizer[engine,cu129]\" --index https://flashinfer.ai/whl/cu129 --index https://download.pytorch.org/whl/cu129 --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 --index-strategy unsafe-best-match\n",
+    "    uv pip install \"nemo-safe-synthesizer[engine,cu129]\" \\\n",
+    "        --index https://flashinfer.ai/whl/cu129 \\\n",
+    "        --index https://flashinfer.ai/whl/ \\\n",
+    "        --index https://download.pytorch.org/whl/cu129 \\\n",
+    "        --index https://wheels.vllm.ai/0.26.0/cu129 \\\n",
+    "        --index-strategy unsafe-best-match\n",
     "    uv pip install kagglehub\n",
     "else\n",
-    "    pip install \"nemo-safe-synthesizer[engine,cu129]\" --extra-index-url https://flashinfer.ai/whl/cu129 --extra-index-url https://download.pytorch.org/whl/cu129 --extra-index-url https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129\n",
+    "    pip install \"nemo-safe-synthesizer[engine,cu129]\" \\\n",
+    "        --extra-index-url https://flashinfer.ai/whl/cu129 \\\n",
+    "        --extra-index-url https://flashinfer.ai/whl/ \\\n",
+    "        --extra-index-url https://download.pytorch.org/whl/cu129 \\\n",
+    "        --extra-index-url https://wheels.vllm.ai/0.26.0/cu129\n",
     "    pip install kagglehub\n",
     "fi\n"
    ]

docs/tutorials/safe-synthesizer-101.ipynb

@@ -45,10 +45,19 @@
         "# SPDX-License-Identifier: Apache-2.0\n",
         "\n",
         "if command -v uv > /dev/null 2>&1; then\n",
-        "    uv pip install \"nemo-safe-synthesizer[engine,cu129]\" --index https://flashinfer.ai/whl/cu129 --index https://download.pytorch.org/whl/cu129 --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 --index-strategy unsafe-best-match\n",
+        "    uv pip install \"nemo-safe-synthesizer[engine,cu129]\" \\\n",
+        "        --index https://flashinfer.ai/whl/cu129 \\\n",
+        "        --index https://flashinfer.ai/whl/ \\\n",
+        "        --index https://download.pytorch.org/whl/cu129 \\\n",
+        "        --index https://wheels.vllm.ai/0.26.0/cu129 \\\n",
+        "        --index-strategy unsafe-best-match\n",
         "    uv pip install datasets\n",
         "else\n",
-        "    pip install \"nemo-safe-synthesizer[engine,cu129]\" --extra-index-url https://flashinfer.ai/whl/cu129 --extra-index-url https://download.pytorch.org/whl/cu129 --extra-index-url https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129\n",
+        "    pip install \"nemo-safe-synthesizer[engine,cu129]\" \\\n",
+        "        --extra-index-url https://flashinfer.ai/whl/cu129 \\\n",
+        "        --extra-index-url https://flashinfer.ai/whl/ \\\n",
+        "        --extra-index-url https://download.pytorch.org/whl/cu129 \\\n",
+        "        --extra-index-url https://wheels.vllm.ai/0.26.0/cu129\n",
         "    pip install datasets\n",
         "fi\n"
       ]