Skip to content

chore: move python pin to <=3.14 - #664

Merged
mckornfield merged 3 commits into
mainfrom
move-uv-pin-314/mck
Aug 4, 2026
Merged

chore: move python pin to <=3.14#664
mckornfield merged 3 commits into
mainfrom
move-uv-pin-314/mck

Conversation

@mckornfield

@mckornfield mckornfield commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Pre-Review Checklist

Ensure that the following pass:

  • mise run format && mise run check or via prek validation.
  • mise run test passes locally
  • mise run test:e2e passes locally
  • mise run test:ci-container passes locally (recommended)
  • GPU CI status check passes -- comment /sync on this PR to trigger a run (auto-triggers on ready-for-review)

Pre-Merge Checklist

  • New or updated tests for any fix or new behavior
  • Updated documentation for new features and behaviors, including docstrings for API docs.

Other Notes

  • Closes #

Summary by CodeRabbit

  • New Features
    • Added explicit support for Python 3.14 and extended the supported Python range to <3.15.
  • Tests
    • Extended the unit-test CI matrix to include Python 3.14.
  • Documentation
    • Refreshed CUDA 12.9 installation instructions and tutorials with updated wheel/extra index URLs (including FlashInfer and vLLM 0.26.0 endpoints).
    • Updated README and release verification steps to use the new index URLs.
  • Chores
    • Updated FlashInfer-related pins and install/index mappings, and bumped vLLM to 0.26.0 for both CPU and CUDA 12.9 options.
    • Added openai>=2.25.0 to relevant optional dependency groups.

@mckornfield
mckornfield requested a review from a team as a code owner July 20, 2026 14:28
@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

The project now supports Python 3.14, updates CPU and CUDA dependency versions and uv indexes, and aligns container, documentation, release, and Slurm installation commands with the new vLLM and FlashInfer wheel locations.

Changes

Python and dependency updates

Layer / File(s) Summary
Python version support
pyproject.toml, .github/workflows/ci-checks.yml
The package allows Python versions below 3.15, adds the Python 3.14 classifier, and tests Python 3.14 in CI.
Runtime dependency resolution
pyproject.toml
CPU and CUDA extras update vLLM and FlashInfer pins, add OpenAI, and configure corresponding uv sources and indexes.
Installation index updates
containers/Dockerfile.test_ci, script/slurm/..., CONTRIBUTING.md, README.md, docs/..., *.ipynb
Installation commands use the versioned vLLM CUDA index and updated FlashInfer indexes across CI, release, scripts, and documentation.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

Suggested labels: chore

Suggested reviewers: zywind, binaryaaron

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: updating the Python version pin to support Python 3.14.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch move-uv-pin-314/mck

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot added the chore Maintenance not tied to a user-visible change label Jul 20, 2026
@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from 25c4500 to a5fb421 Compare July 20, 2026 14:29

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9a5d1a99-d348-4442-ba8a-4c00bce35378

📥 Commits

Reviewing files that changed from the base of the PR and between d73679a and 25c4500.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock, !uv.lock
📒 Files selected for processing (1)
  • pyproject.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (10)
  • GitHub Check: Unit Tests (3.11)
  • GitHub Check: End-user Wheel Install
  • GitHub Check: Unit Tests (3.13)
  • GitHub Check: Unit Tests (3.12)
  • GitHub Check: Smoke Tests
  • GitHub Check: Greptile Review
  • GitHub Check: Typecheck
  • GitHub Check: Analyze (Python)
  • GitHub Check: Analyze (python)
  • GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (3)
pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Configure package metadata, dependencies, extras (cpu/cu129/engine), and uv configuration in pyproject.toml

Run the lock-drift check when changing Python dependencies or pyproject.toml; keep uv.lock synchronized.

Files:

  • pyproject.toml

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

  • pyproject.toml
**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Use spaces around =, comment dependency pins inline, and follow the prescribed pyproject.toml section order.

Files:

  • pyproject.toml
**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Every source file requires the SPDX copyright and license header appropriate to its file format.
End files with a newline, remove trailing whitespace, use one space between sentences, and keep code, comments, and docstrings within 120 characters.

**/*: All contributions must use verified Git commits and DCO sign-off; unsigned or unsigned-off commits cannot be merged.
Branches other than main must follow <author>/<description>, optionally including an issue ID or type; branch names must use lowercase alphanumeric characters and hyphens.
Commits merged to main must follow Conventional Commits, using a valid lowercase type and a description of at most 100 characters.

Files:

  • pyproject.toml

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

  • Refactor suggestion: use for local maintainability problems introduced
    by the diff when they have clear future cost, such as duplicated setup,
    unclear boundaries, over-mocking, avoidable complexity, or opaque test
    helpers.
  • Nitpick: avoid in chill mode. Do not emit formatting, import-order,
    wording, or style-only comments unless automated tools cannot catch the
    issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

  • Major: incorrect generation/training/evaluation behavior, broken
    CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
    cleanup and process-isolation bugs likely to fail CI or production
    runs.
  • Minor: localized bugs, missing focused tests for changed behavior, or
    bad test patterns that weaken regression coverage.
  • Trivial: small cleanup with no behavior impact. Usually suppress in
    chill mode.
  • Info: context only. Avoid unless it helps reviewers understand risk.
    Safe-Synthesizer-specific review focus: - Data ...

Files:

  • pyproject.toml
🔇 Additional comments (1)
pyproject.toml (1)

7-7: 🗄️ Data Integrity & Integration

Run the required lock-drift check for this metadata change.

Changing pyproject.toml can change the resolver’s supported-environment metadata. Verify the repository’s lock-drift check passes and that uv.lock remains synchronized before merging.

Sources: Coding guidelines, Path instructions

Comment thread pyproject.toml
@greptile-apps

greptile-apps Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR extends Python support from <3.14 to <3.15 (adding Python 3.14), bumps vLLM from 0.24.0 to 0.26.0 and FlashInfer from 0.6.12 to 0.6.14, and adds openai>=2.25.0 to the cpu and cu129 extras. Index URLs are updated throughout (Dockerfile, Slurm script, docs, notebooks) to match the new vLLM wheel path and a new top-level flashinfer-cubin index.

  • Python 3.14 is added to the CI matrix and pyproject.toml classifiers; all documentation, AGENTS.md, and STYLE_GUIDE.md references are updated consistently.
  • FlashInfer now uses a separate flashinfer-cubin index (https://flashinfer.ai/whl/) for the cubin wheel, added as an explicit source for both cpu and cu129 extras; vLLM's wheel index URL is bumped to the 0.26.0 path.
  • Previous review issues in differential-privacy.ipynb (triple-dash flag and wrong pip extra-index-url) are resolved in this revision.

Confidence Score: 5/5

The changes are mechanical version bumps and URL updates applied consistently across all install scripts, Dockerfiles, and documentation; no correctness issues were found.

All install commands, index URLs, and version pins are updated uniformly across every changed file. The CPU Dockerfile install gains the required flashinfer-cubin index, the CUDA dry-run gains both flashinfer indexes, and the CI matrix correctly adds Python 3.14. The only findings are a minor style inconsistency in one notebook and a gap in test assertions for the new flashinfer-cubin source — neither affects runtime behavior.

Files Needing Attention: tests/test_gen_cuda_deps.py — the new flashinfer-cubin source and index added by the generator have no corresponding assertions in the updated test.

Important Files Changed

Filename Overview
pyproject.toml Bumps requires-python to <3.15, adds Python 3.14 classifier, updates flashinfer (0.6.14), vLLM (0.26.0), adds openai>=2.25.0, and introduces flashinfer-cubin source/index entries for both cpu and cu129 extras.
cuda_deps.toml Updates flashinfer to 0.6.14, vLLM to 0.26.0, adds openai>=2.25.0 to torch_runtime_deps, and adds a new flashinfer-cubin index plus [sources.cpu] and [sources.cu129] entries for the new cubin index.
tests/test_gen_cuda_deps.py Updates vLLM version strings in assertions, but the new flashinfer-cubin source (added to both cpu and cu129 generator output) has no corresponding assertions.
containers/Dockerfile.test_ci Adds --index https://flashinfer.ai/whl/ for both CPU and CUDA installs and updates vLLM index URL to 0.26.0/cu129; CPU install is real (no --dry-run), CUDA install remains a dry-run check.
.github/workflows/ci-checks.yml Extends unit-test matrix to include Python 3.14, aligned with the new requires-python upper bound.
docs/tutorials/time-series-financial-transactions.ipynb Updates install commands with new index URLs; the uv branch has a minor style inconsistency (missing space before line-continuation backslash) that does not affect shell correctness.
docs/tutorials/differential-privacy.ipynb Resolves previous review issues: uv branch now uses --index (not ---index) and pip branch correctly uses --extra-index-url https://flashinfer.ai/whl/.
docs/user-guide/troubleshooting.md Renames "Python 3.14 Is Not Supported" section to "Unsupported Python Versions" and updates vLLM version references from 0.24.0 to 0.26.0.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Install nemo-safe-synthesizer] --> B{Extra chosen}
    B -->|cpu| C[PyPI + pytorch-cpu index\n+ flashinfer.ai/whl/]
    B -->|cu129| D[PyPI + pytorch-cu129 index\n+ flashinfer.ai/whl/cu129\n+ flashinfer.ai/whl/\n+ wheels.vllm.ai/0.26.0/cu129]

    C --> E[flashinfer-python==0.6.14\nflashinfer-cubin==0.6.14\nvllm==0.26.0\nopenai>=2.25.0]
    D --> F[flashinfer-python==0.6.14\nflashinfer-cubin==0.6.14\nflashinfer-jit-cache==0.6.14+cu129\nvllm==0.26.0+cu129\nopenai>=2.25.0]

    G[Python version gate] -->|3.11 – 3.14| A
    G -->|3.15+| H[Rejected by requires-python]
Loading

Reviews (8): Last reviewed commit: "chore: address CR" | Re-trigger Greptile

@coderabbitai coderabbitai Bot added feature New feature or request and removed chore Maintenance not tied to a user-visible change labels Jul 20, 2026
@codecov

codecov Bot commented Jul 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

zywind
zywind previously requested changes Jul 27, 2026

@zywind zywind left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new Python 3.14 job only exercises bootstrap-nss cpu, while .github/workflows/gpu-tests.yml still runs the GPU smoke suite exclusively on Python 3.13. Since GPU training and generation are the primary supported runtime workflows, the package metadata would advertise Python 3.14 support without testing those workflows on that interpreter. Please add Python 3.14 GPU smoke coverage (at minimum) before declaring general 3.14 support.

@zywind

zywind commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

I reproduced this on dev blue at the PR head with Python 3.14.3. The CPU profile resolves, but the supported CUDA profile fails:

UV_PROJECT_ENVIRONMENT=/tmp/ss-pr664-py314-cu129 \
  uv sync --frozen --python 3.14 --extra cu129 --extra engine --group dev
Distribution `cuda-tile==1.3.0` can't be installed because it doesn't have a source distribution or wheel for the current platform

You're using CPython 3.14 (`cp314`), but `cuda-tile` (v1.3.0) only has wheels with the following Python ABI tags: `cp311`, `cp312`, `cp313`

The old troubleshooting explanation is stale—vLLM itself now has a compatible abi3 wheel—but the documented CUDA installation remains broken on 3.14 through the flashinfer-pythoncuda-tile==1.3.0 dependency. This also confirms that the new CPU-only 3.14 CI job does not validate the primary CUDA workflow.

@mckornfield

mckornfield commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator Author

yeah kendrick shared it in a DM, I think it's kinda SOL (not speed of light) until vLLM releases this guy vllm-project/vllm#48155

@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from a5fb421 to 02faec2 Compare July 28, 2026 22:22
@coderabbitai coderabbitai Bot added chore Maintenance not tied to a user-visible change and removed feature New feature or request labels Jul 28, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pyproject.toml (1)

160-162: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep the dependency rationale inline.

Move the comment onto the openai pin, matching line 134, so it remains attached if the extra is reordered.

Suggested fix
-  # pulled in by vLLM but pinned too low, see https://github.com/vllm-project/vllm/issues/49103
-  "openai>=2.25.0",
+  "openai>=2.25.0", # pulled in by vLLM but pinned too low, see https://github.com/vllm-project/vllm/issues/49103

As per coding guidelines, TOML dependency pins must have rationale comments inline.

Source: Coding guidelines


ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7db2b020-cad3-4877-b542-bf07529f4f11

📥 Commits

Reviewing files that changed from the base of the PR and between a5fb421 and 02faec2.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock, !uv.lock
📒 Files selected for processing (2)
  • .github/workflows/ci-checks.yml
  • pyproject.toml
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/ci-checks.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (10)
  • GitHub Check: Unit Tests (3.13)
  • GitHub Check: Unit Tests (3.11)
  • GitHub Check: Unit Tests (3.14)
  • GitHub Check: Unit Tests (3.12)
  • GitHub Check: Smoke Tests
  • GitHub Check: End-user Wheel Install
  • GitHub Check: Greptile Review
  • GitHub Check: Typecheck
  • GitHub Check: Analyze (Python)
  • GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (3)
pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Configure package metadata, dependencies, extras (cpu/cu129/engine), and uv configuration in pyproject.toml

Run the lock-drift check when changing Python dependencies or pyproject.toml; keep uv.lock synchronized.

Files:

  • pyproject.toml

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

  • pyproject.toml
**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Use spaces around =, comment dependency pins inline, and follow the prescribed pyproject.toml section order.

Files:

  • pyproject.toml
**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Every source file requires the SPDX copyright and license header appropriate to its file format.
End files with a newline, remove trailing whitespace, use one space between sentences, and keep code, comments, and docstrings within 120 characters.

**/*: All contributions must use verified Git commits and DCO sign-off; unsigned or unsigned-off commits cannot be merged.
Branches other than main must follow <author>/<description>, optionally including an issue ID or type; branch names must use lowercase alphanumeric characters and hyphens.
Commits merged to main must follow Conventional Commits, using a valid lowercase type and a description of at most 100 characters.

Files:

  • pyproject.toml

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

  • Refactor suggestion: use for local maintainability problems introduced
    by the diff when they have clear future cost, such as duplicated setup,
    unclear boundaries, over-mocking, avoidable complexity, or opaque test
    helpers.
  • Nitpick: avoid in chill mode. Do not emit formatting, import-order,
    wording, or style-only comments unless automated tools cannot catch the
    issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

  • Major: incorrect generation/training/evaluation behavior, broken
    CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
    cleanup and process-isolation bugs likely to fail CI or production
    runs.
  • Minor: localized bugs, missing focused tests for changed behavior, or
    bad test patterns that weaken regression coverage.
  • Trivial: small cleanup with no behavior impact. Usually suppress in
    chill mode.
  • Info: context only. Avoid unless it helps reviewers understand risk.
    Safe-Synthesizer-specific review focus: - Data ...

Files:

  • pyproject.toml
🔇 Additional comments (2)
pyproject.toml (2)

22-22: LGTM!

Also applies to: 32-32, 93-93, 117-118, 134-137, 142-144, 251-253, 320-327


7-7: 🩺 Stability & Availability

Keep the cu129 Python 3.14 lock check before merging. If the locked stack does not resolve cleanly on 3.14, keep requires-python below 3.14 until the CUDA dependency chain is updated.

@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from 02faec2 to 63bda53 Compare July 29, 2026 14:46
@mckornfield
mckornfield requested a review from zywind July 29, 2026 14:46
@coderabbitai coderabbitai Bot added the feature New feature or request label Jul 29, 2026
@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from 63bda53 to cfa20b2 Compare July 29, 2026 14:59
@github-actions github-actions Bot added the area:dev-ex Affects build or dev experience label Jul 29, 2026
@coderabbitai coderabbitai Bot removed the feature New feature or request label Jul 29, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2


ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a2d51b97-457a-41fb-b31d-7097a0774bf7

📥 Commits

Reviewing files that changed from the base of the PR and between 63bda53 and cfa20b2.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock, !uv.lock
📒 Files selected for processing (11)
  • .github/workflows/ci-checks.yml
  • CONTRIBUTING.md
  • README.md
  • containers/Dockerfile.test_ci
  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • docs/tutorials/differential-privacy.ipynb
  • docs/tutorials/safe-synthesizer-101.ipynb
  • docs/tutorials/time-series-financial-transactions.ipynb
  • docs/user-guide/getting-started.md
  • pyproject.toml
  • script/slurm/slurm_nss_matrix.sh
🚧 Files skipped from review as they are similar to previous changes (4)
  • containers/Dockerfile.test_ci
  • .github/workflows/ci-checks.yml
  • docs/user-guide/getting-started.md
  • pyproject.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
  • GitHub Check: Unit Tests (3.13)
  • GitHub Check: Unit Tests (3.11)
  • GitHub Check: Unit Tests (3.12)
  • GitHub Check: Unit Tests (3.14)
  • GitHub Check: Smoke Tests
  • GitHub Check: End-user Wheel Install
  • GitHub Check: Greptile Review
  • GitHub Check: Analyze (Python)
🧰 Additional context used
📓 Path-based instructions (11)
**/*.{md,markdown,py}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • README.md
  • CONTRIBUTING.md
**/*.{md,markdown}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown}: Bold is acceptable only in markdown tables where it's the conventional way to mark header-like cells in the body
Use ## headers to segment markdown sections instead of bold text
Use -- (em-dash) instead of - (hyphen) for asides in markdown

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • README.md
  • CONTRIBUTING.md
docs/**/*.md

📄 CodeRabbit inference engine (.cursor/rules/writing-docs.mdc)

docs/**/*.md: Use MkDocs Material admonition syntax (!!! note, !!! warning, ??? tip) for highlighting important information and collapsible sections in documentation
Use MkDocs Material tabs syntax (=== "Label") to present alternative views or language-specific examples in documentation
Use code block syntax with title and highlight line parameters (title="filename", hl_lines="2 3") for code examples in documentation
Use Mermaid diagram syntax (```mermaid flowchart, etc.) for visualizations in documentation

Classify documentation using Diátaxis and use MkDocs Material syntax for admonitions, tabs, and titled or highlighted code blocks.

docs/**/*.md: Documentation pages must be placed under the appropriate Diátaxis directory: getting-started, user-guide, architecture, reference, or dev-notes.
When adding or editing a documentation page, add it to the nav: section of mkdocs.yml.
Use the configured MkDocs Material Markdown features correctly, including admonitions, content tabs, fenced code blocks, Mermaid diagrams, task lists, footnotes, definition lists, and emoji.

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
**/*.md

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Do not use decorative bold in Markdown body text, list items, or docstrings; use single backticks for code identifiers, paths, and commands.

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • README.md
  • CONTRIBUTING.md
**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Every source file requires the SPDX copyright and license header appropriate to its file format.
End files with a newline, remove trailing whitespace, use one space between sentences, and keep code, comments, and docstrings within 120 characters.

**/*: All contributions must use DCO sign-off, adding a Signed-off-by trailer to commit messages.
All commits merged to main must follow Conventional Commits syntax, with a lowercase valid type, optional scope, description of at most 100 characters, and ! for breaking changes.
Commits merged to main must be cryptographically signed because the branch requires verified signatures.
Branches other than main must follow <author>/<description>, optionally including an issue ID or valid type, using lowercase alphanumeric and hyphenated names.
Before submitting a pull request, run mise run format, mise run check, and mise run test; use mise tasks rather than invoking ruff or ty directly.
Pull requests should be squash-merged only after required approvals, CI checks, conversation resolution, and code-owner review are satisfied.
Never move a published release tag; if code changes after a candidate release, create and validate the next rcN tag.
The stable release tag must point to the same tested commit SHA as the validated release candidate.

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • docs/tutorials/differential-privacy.ipynb
  • script/slurm/slurm_nss_matrix.sh
  • README.md
  • CONTRIBUTING.md
  • docs/tutorials/time-series-financial-transactions.ipynb
  • docs/tutorials/safe-synthesizer-101.ipynb

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

  • Refactor suggestion: use for local maintainability problems introduced
    by the diff when they have clear future cost, such as duplicated setup,
    unclear boundaries, over-mocking, avoidable complexity, or opaque test
    helpers.
  • Nitpick: avoid in chill mode. Do not emit formatting, import-order,
    wording, or style-only comments unless automated tools cannot catch the
    issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

  • Major: incorrect generation/training/evaluation behavior, broken
    CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
    cleanup and process-isolation bugs likely to fail CI or production
    runs.
  • Minor: localized bugs, missing focused tests for changed behavior, or
    bad test patterns that weaken regression coverage.
  • Trivial: small cleanup with no behavior impact. Usually suppress in
    chill mode.
  • Info: context only. Avoid unless it helps reviewers understand risk.
    Safe-Synthesizer-specific review focus: - Data ...

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • docs/tutorials/differential-privacy.ipynb
  • script/slurm/slurm_nss_matrix.sh
  • README.md
  • CONTRIBUTING.md
  • docs/tutorials/time-series-financial-transactions.ipynb
  • docs/tutorials/safe-synthesizer-101.ipynb
**/*.{py,sh,yaml,yml,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

All Python, shell, YAML, YML, and Markdown source files must include SPDX copyright headers.

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • script/slurm/slurm_nss_matrix.sh
  • README.md
  • CONTRIBUTING.md
docs/**

⚙️ CodeRabbit configuration file

Review documentation as MkDocs Material content. Check Diataxis fit, accurate commands, internal links, code fences, and markdown style from STYLE_GUIDE.md.

Files:

  • docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md
  • docs/tutorials/differential-privacy.ipynb
  • docs/tutorials/time-series-financial-transactions.ipynb
  • docs/tutorials/safe-synthesizer-101.ipynb
**/*.{sh,bash}

📄 CodeRabbit inference engine (AGENTS.md)

Never use ~ inside double-quoted strings in shell scripts -- use $HOME or an absolute path instead

Files:

  • script/slurm/slurm_nss_matrix.sh
script/**

⚙️ CodeRabbit configuration file

Review standalone scripts for reproducibility and operational safety. Check argument validation, quoting, repo-root detection, environment variables, generated artifacts, external commands, GPU/cluster assumptions, and whether the script should be wired through Makefile or documented in README/docs.

Files:

  • script/slurm/slurm_nss_matrix.sh
**/*.sh

⚙️ CodeRabbit configuration file

Review shell scripts for #!/usr/bin/env bash, set -euo pipefail where appropriate, quoting, repo root detection, and shellcheck compliance.

Files:

  • script/slurm/slurm_nss_matrix.sh
README.md

⚙️ CodeRabbit configuration file

Treat README.md as the project overview. Check that setup, usage, and links stay consistent with CONTRIBUTING.md, Makefile, and docs/.

Files:

  • README.md
🔇 Additional comments (6)
script/slurm/slurm_nss_matrix.sh (1)

125-130: LGTM!

README.md (1)

23-26: LGTM!

Also applies to: 28-33

docs/dev-notes/posts/introducing-nemo-safe-synthesizer.md (1)

90-91: LGTM!

docs/tutorials/safe-synthesizer-101.ipynb (1)

54-66: LGTM!

docs/tutorials/time-series-financial-transactions.ipynb (1)

60-71: LGTM!

CONTRIBUTING.md (1)

788-790: 🩺 Stability & Availability

Keep the smoke command on Python 3.13. CONTRIBUTING.md and pyproject.toml still define support as 3.11–3.13 (requires-python = ">=3.11, <3.15"), so this line already matches the supported installation target.

			> Likely an incorrect or invalid review comment.

Comment thread docs/tutorials/differential-privacy.ipynb Outdated
Comment on lines +23 to +31
"cell_type": "code",
"execution_count": null,
"id": "d501f043",
"metadata": {},
"metadata": {
"vscode": {
"languageId": "plaintext"
}
},
"outputs": [],

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Restore the installation introduction as a Markdown cell.

This cell is now declared as code, but its source is Markdown prose without %%bash. Executing it runs the explanatory sentence as Python and fails before users reach the installation cell. Restore "cell_type": "markdown" and remove the code-only execution metadata.

As per path instructions, prioritize issues that break user workflows; this cell prevents the tutorial from running as documented.

Proposed notebook metadata fix
-      "cell_type": "code",
-      "execution_count": null,
+      "cell_type": "markdown",
       "id": "d501f043",
-      "metadata": {
-        "vscode": {
-          "languageId": "plaintext"
-        }
-      },
-      "outputs": [],
+      "metadata": {},
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"cell_type": "code",
"execution_count": null,
"id": "d501f043",
"metadata": {},
"metadata": {
"vscode": {
"languageId": "plaintext"
}
},
"outputs": [],
"cell_type": "markdown",
"id": "d501f043",
"metadata": {},

Source: Path instructions

@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from cfa20b2 to ed2dd20 Compare July 29, 2026 21:01
Signed-off-by: mkornfield <mkornfield@nvidia.com>
@mckornfield
mckornfield force-pushed the move-uv-pin-314/mck branch from ed2dd20 to 4dce166 Compare July 30, 2026 21:38
@mckornfield
mckornfield requested a review from a team as a code owner July 30, 2026 21:38
@mckornfield mckornfield changed the title chore: move python pin to 3.15 chore: move python pin to <=3.14 Aug 3, 2026
@zywind
zywind dismissed their stale review August 3, 2026 18:42

Already addressed

@zywind zywind left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Local review found four issues to address before approval.

Comment thread .github/workflows/ci-checks.yml
Comment thread pyproject.toml
Comment thread docs/tutorials/differential-privacy.ipynb Outdated
Comment thread docs/tutorials/safe-synthesizer-101.ipynb Outdated
Signed-off-by: mkornfield <mkornfield@nvidia.com>
@mckornfield
mckornfield added this pull request to the merge queue Aug 4, 2026
Merged via the queue into main with commit bc48185 Aug 4, 2026
24 checks passed
@mckornfield
mckornfield deleted the move-uv-pin-314/mck branch August 4, 2026 17:19
andrewwhitecdw pushed a commit to andrewwhitecdw/Safe-Synthesizer that referenced this pull request Aug 13, 2026
…NeMo#705)

# Summary

Fixes GPU smoke + e2e failing on `main` with:

```
× No solution found when resolving dependencies:
╰─▶ Because there is no version of flashinfer-cubin{sys_platform == 'linux'}==0.6.14 ...
    conclude that your requirements are unsatisfiable.
```

## Root cause

`setup-gpu-test-env` infers which indexes to pass to `uv` by matching
the CUDA extra
against each index's name or URL:

```python
if index["name"].endswith(f"-{cuda_extra}") or f"/{cuda_extra}" in index["url"]
```

When that inference landed (NVIDIA-NeMo#691, Aug 4 16:50 UTC) every index encoded
its variant one
of those two ways, so the rule held. NVIDIA-NeMo#664 landed 27 minutes later (17:17
UTC) and added
the first index that doesn't: `flashinfer-cubin`, which serves a single
variant-agnostic `https://flashinfer.ai/whl/` and is bound to packages
only through
`[tool.uv.sources]`.

It matches neither branch of the rule, so it was silently dropped — and
since the
install also passes `--no-sources`, the sources table couldn't reach it
either. Both
PRs were green on their own base; the breakage exists only in the merge.

That index is the only place `flashinfer-cubin==0.6.14` exists:

| Index | max `flashinfer-cubin` |
| ----- | ---------------------- |
| `https://flashinfer.ai/whl/` | 0.6.16.post1 (has 0.6.14) |
| PyPI | 0.6.13 |
| `https://flashinfer.ai/whl/cu129` | does not serve the package |
| `https://wheels.vllm.ai/0.26.0/cu129` | 0.6.13 |

## Fix

Also collect indexes referenced by `[tool.uv.sources]` for the target
extra.

Before / after, run against `pyproject.toml` at `cu129`:

```
  https://download.pytorch.org/whl/cu129
  https://flashinfer.ai/whl/cu129
+ https://flashinfer.ai/whl/
  https://wheels.vllm.ai/0.26.0/cu129
```

This matches the index set in the documented manual install command,
which is why
installing by hand works today while CI does not.

## Verification

Resolution flips with exactly that one index, reproducing CI's error
before and
succeeding after:

```
$ uv pip install --dry-run --no-deps --default-index https://pypi.org/simple \
    --index .../cu129 (x3) --index-strategy unsafe-best-match flashinfer-cubin==0.6.14
  × No solution found ... there is no version of flashinfer-cubin==0.6.14

$ # same, plus --index https://flashinfer.ai/whl/
  Resolved 1 package
   + flashinfer-cubin==0.6.14
```

`mise run format-check` passes. No dependency versions change.

## Pre-Review Checklist

- [x] `mise run format && mise run check`
- [x] GPU CI status check passes -- this PR is the fix for it

## Other Notes

CI-only change; no source or dependency changes. Worth noting the
`index_count < 3` guard did not catch this — the count stayed at exactly
3
while the wrong index was dropped.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved GPU test environment setup to reliably discover all CUDA
package indexes configured for the selected extra.
* Added support for indexes declared through source configuration,
alongside existing name- and URL-based matching.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Yunfeng Zhang <yunzhang@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:build-dist area:ci area:dev-ex Affects build or dev experience area:docs area:tests chore Maintenance not tied to a user-visible change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants