chore: move python pin to 3.15

[mckornfield]

Summary

Pre-Review Checklist

Ensure that the following pass:

• mise run format && mise run check or via prek validation.
• mise run test passes locally
• mise run test:e2e passes locally
• mise run test:ci-container passes locally (recommended)
• GPU CI status check passes -- comment /sync on this PR to trigger a run (auto-triggers on ready-for-review)

Pre-Merge Checklist

• New or updated tests for any fix or new behavior
• Updated documentation for new features and behaviors, including docstrings for API docs.

Other Notes

• Closes #

Summary by CodeRabbit

• New Features

  • Added explicit support for Python 3.14.
  • Expanded the supported Python version range to include releases up through Python 3.14.

• Tests

  • Extended the unit-test CI matrix to run on Python 3.14.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a231b748-ceff-4840-9c52-bc1d03fbbc6e

📥 Commits

Reviewing files that changed from the base of the PR and between 25c4500 and a5fb421.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (2)

• .github/workflows/ci-checks.yml
• pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (1)

• pyproject.toml

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/*.yml

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Changes to GitHub Actions workflows must preserve the documented CI, release, signing, and deployment requirements.

Files:

• .github/workflows/ci-checks.yml

.github/**

⚙️ CodeRabbit configuration file

Review GitHub configuration for branch protection expectations, CODEOWNERS alignment, least privilege permissions, pinned actions where practical, and consistency with CONTRIBUTING.md.

Files:

• .github/workflows/ci-checks.yml

🔇 Additional comments (1)

.github/workflows/ci-checks.yml (1)

175-175: LGTM!

---

Walkthrough

Changes

Python version support

Layer / File(s)	Summary
Python support metadata pyproject.toml	The package allows Python versions below 3.15 and adds the Python 3.14 Trove classifier.
Python 3.14 unit-test coverage .github/workflows/ci-checks.yml	The unit-test matrix now includes Python 3.14.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: feature

Suggested reviewers: binaryaaron

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main Python version bump, though it is a bit imprecise about the change from 3.14 support to 3.15 compatibility.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch move-uv-pin-314/mck

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/ci-checks.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9a5d1a99-d348-4442-ba8a-4c00bce35378

📥 Commits

Reviewing files that changed from the base of the PR and between d73679a and 25c4500.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (1)

• pyproject.toml

📜 Review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: Unit Tests (3.11)
• GitHub Check: End-user Wheel Install
• GitHub Check: Unit Tests (3.13)
• GitHub Check: Unit Tests (3.12)
• GitHub Check: Smoke Tests
• GitHub Check: Greptile Review
• GitHub Check: Typecheck
• GitHub Check: Analyze (Python)
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (3)

pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Configure package metadata, dependencies, extras (cpu/cu129/engine), and uv configuration in pyproject.toml

Run the lock-drift check when changing Python dependencies or pyproject.toml; keep uv.lock synchronized.

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

• pyproject.toml

**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Use spaces around =, comment dependency pins inline, and follow the prescribed pyproject.toml section order.

Files:

• pyproject.toml

**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Every source file requires the SPDX copyright and license header appropriate to its file format.
End files with a newline, remove trailing whitespace, use one space between sentences, and keep code, comments, and docstrings within 120 characters.

**/*: All contributions must use verified Git commits and DCO sign-off; unsigned or unsigned-off commits cannot be merged.
Branches other than main must follow <author>/<description>, optionally including an issue ID or type; branch names must use lowercase alphanumeric characters and hyphens.
Commits merged to main must follow Conventional Commits, using a valid lowercase type and a description of at most 100 characters.

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

• Refactor suggestion: use for local maintainability problems introduced
  by the diff when they have clear future cost, such as duplicated setup,
  unclear boundaries, over-mocking, avoidable complexity, or opaque test
  helpers.
• Nitpick: avoid in chill mode. Do not emit formatting, import-order,
  wording, or style-only comments unless automated tools cannot catch the
  issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

• Major: incorrect generation/training/evaluation behavior, broken
  CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
  cleanup and process-isolation bugs likely to fail CI or production
  runs.
• Minor: localized bugs, missing focused tests for changed behavior, or
  bad test patterns that weaken regression coverage.
• Trivial: small cleanup with no behavior impact. Usually suppress in
  chill mode.
• Info: context only. Avoid unless it helps reviewers understand risk.
  Safe-Synthesizer-specific review focus: - Data ...

Files:

• pyproject.toml

🔇 Additional comments (1)

pyproject.toml (1)

7-7: 🗄️ Data Integrity & Integration

Run the required lock-drift check for this metadata change.

Changing pyproject.toml can change the resolver’s supported-environment metadata. Verify the repository’s lock-drift check passes and that uv.lock remains synchronized before merging.

Sources: Coding guidelines, Path instructions

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## pyproject.toml\n'
cat -n pyproject.toml | sed -n '1,120p'

printf '\n## README.md Python mentions\n'
rg -n "3\\.14|Python" README.md || true

printf '\n## docs/user-guide/troubleshooting.md Python mentions\n'
rg -n "3\\.14|Python|vLLM" docs/user-guide/troubleshooting.md || true

printf '\n## .github/workflows/ci-checks.yml Python matrix\n'
rg -n "3\\.11|3\\.12|3\\.13|3\\.14|python-version|matrix" .github/workflows/ci-checks.yml || true

Repository: NVIDIA-NeMo/Safe-Synthesizer

Length of output: 6408

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## vLLM and Python constraint mentions\n'
rg -n "vLLM|<3\\.14|3\\.14\\+|requires-python|Python 3\\.14" pyproject.toml README.md docs .github/workflows -g '!uv.lock' || true

printf '\n## pyproject.toml vLLM-related dependency lines\n'
rg -n "vllm|transformers|torch|flashinfer|engine|cpu|cuda" pyproject.toml || true

Repository: NVIDIA-NeMo/Safe-Synthesizer

Length of output: 11120

---

Keep Python 3.14 out of the release metadata for now. requires-python and the Python 3.14 classifier now advertise support, but the repo still documents 3.14 as unsupported and CI only exercises 3.11–3.13. Either keep <3.14 until the runtime stack is ready, or update the support docs and add 3.14 coverage in the same change.

Source: Path instructions

[greptile-apps]

Greptile Summary

This PR bumps the upper bound of the supported Python version range from <3.14 to <3.15, adding Python 3.14 to the test matrix and package classifiers. All three changed files are updated consistently: pyproject.toml, uv.lock, and the CI workflow.

• pyproject.toml: requires-python ceiling raised to <3.15 and "Programming Language :: Python :: 3.14" classifier added.
• .github/workflows/ci-checks.yml: "3.14" added to the python-version strategy matrix.
• uv.lock: Regenerated with updated resolution markers covering the 3.14 range.

Confidence Score: 5/5

Safe to merge — the change is a straightforward version ceiling bump that is applied consistently across all three affected files.

All three files are updated in lockstep: the requires-python ceiling, the PyPI classifier, the CI matrix, and the regenerated lock file all point to the same new range. No logic was touched, and the CI matrix will exercise Python 3.14 directly so any dependency incompatibilities will surface before merge.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Upper bound raised from <3.14 to <3.15 and Python 3.14 classifier added; change is consistent and correct.
.github/workflows/ci-checks.yml	Python 3.14 added to the test matrix; coverage upload intentionally remains pinned to the 3.13 run, consistent with existing convention.
uv.lock	Lock file regenerated to include 3.14 resolution markers; no manual edits required or expected.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[PR: Bump Python upper bound] --> B[pyproject.toml\nrequires-python: >=3.11, <3.15\n+ Python 3.14 classifier]
    A --> C[ci-checks.yml\nmatrix: 3.11 / 3.12 / 3.13 / 3.14]
    A --> D[uv.lock\nRegenerated resolution markers\nfor 3.14 range]
    C --> E{Per-version CI jobs}
    E --> F[Run unit tests\nall 4 versions]
    E --> G[Upload coverage\n3.13 only]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[PR: Bump Python upper bound] --> B[pyproject.toml\nrequires-python: >=3.11, <3.15\n+ Python 3.14 classifier]
    A --> C[ci-checks.yml\nmatrix: 3.11 / 3.12 / 3.13 / 3.14]
    A --> D[uv.lock\nRegenerated resolution markers\nfor 3.14 range]
    C --> E{Per-version CI jobs}
    E --> F[Run unit tests\nall 4 versions]
    E --> G[Upload coverage\n3.13 only]

Loading

_{Reviews (1): Last reviewed commit: "chore: move python pin to 3.15" | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!