build: bump Python 3.12 → 3.13.13 - #2194
Merged
Merged
Conversation
Python 3.13.13 fixes: - CVE-2026-11940: tarfile hardlink/symlink filter bypass - CVE-2025-8194: tarfile negative-offset infinite loop / deadlock - CVE-2025-13836: HTTP Content-Length OOM via malicious server Updates .python-version, uv venv pins in CI, requires-python in all pyproject.toml files, ruff target-version, PyPI classifier, and all README/CONTRIBUTING/CLAUDE.md docs. Regenerates uv.lock. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
- scicode: lift scipy<1.14 cap to >=1.14.1 (first version with cp313 wheels; scipy.integrate.simps is not used in Gym code) - longmt_eval: floor spacy>=3.8.13 to override segale's spacy==3.8.4 pin (3.8.4 has no cp313 wheels; 3.8.13+ does) - tau2: add audioop-lts>=0.2.2 (audioop was removed in Python 3.13; audioop-lts provides a compatible backport with cp313 wheels) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
uv reads .python-version automatically so passing --python 3.13.13 everywhere is redundant — future version bumps would require touching 20+ files instead of just .python-version. - CI workflows: uv venv --python 3.13.13 → uv venv - pr-sla-tracker: python-version: "3.13.13" → python-version-file: .python-version - All READMEs and prepare_utils.py: same Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…>=23.0.1 - .python-version and requires-python: 3.13.13 → 3.13.14 - uv: 0.11.19 → 0.11.29 (0.11.21+ supports Python 3.13.14; 0.11.29 is the latest stable in the 0.11.x series) - pyarrow>=23.0.1: transitive dep via mlflow; floors to a version with cp313 wheels and no use-after-free (mlflow caps at <25) - Regenerated uv.lock (pyarrow 21.0.0 → 24.0.0) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…toml files Resource servers and model packages inherit the Python constraint from nemo-gym itself; no need to pin them separately. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…toml files Files that originally pinned requires-python explicitly are updated to match the new minimum Python version. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…n 3.12 Files that originally specified an explicit Python version in uv venv calls have the version updated to 3.13.14 (not removed). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
github-actions
Bot
added
the
sla:triage-overdue
kajalj22
added
the
r0.5.0
… compile) fasttext-wheel==0.9.2 has no cp313 wheels and fails to build from source on Python 3.13 (missing #include <cstdint> in src/args.cc). Excluded as a transitive dep — wmt_translation does not import fasttext at runtime. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
…into bump-python-3.13
Signed-off-by: Kajal Jain <kajalj@nvidia.com>
segale (used by longmt_eval) pins spacy==3.8.4 which has no cp313 wheels. Adding an override forces >=3.8.13 which ships cp313 wheels while remaining API-compatible. Server venvs inherit the override via the editable nemo-gym install. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
osworld pins torch<2.6 but torchvision for torch 2.5.x has no cp313 wheels. Override to 2.12.0 which ships cp313 wheels for both packages. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
thomasdhc
previously approved these changes
Aug 4, 2026
github-actions
Bot
removed
the
sla:triage-overdue
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
The Dockerfile was pinned to Python 3.12.11 / uv 0.11.6 from main. uv.lock is generated for Python 3.13.14 so the cp313 wheels are used; the old Python version caused uv to build yappi from source (failing). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
- osworld_agent pyproject.toml: requires-python >=3.12 → >=3.13.14 - wmt_translation requirements: update 3.12 comment to 3.13.14 Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kajal Jain <kajalj@nvidia.com>
kajalj22
added a commit
that referenced
this pull request
Aug 5, 2026
- Bump Python 3.12 → 3.13.14 and uv 0.11.19 → 0.11.29 - Add `pyarrow>=23.0.1` transitive dep floor - Fix Python 3.13 compat in server deps (scipy, spacy, audioop-lts) - Regenerate `uv.lock` - [x] Unit tests pass - [x] Server suite passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Kajal Jain <kajalj@nvidia.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
kajalj22
added a commit
that referenced
this pull request
Aug 5, 2026
Cherry-pick of #2194 into `r0.5.0`. ## Summary - Bump Python 3.12 → 3.13.14 - Bump uv 0.11.19 → 0.11.29 in CI - Update `docker/Dockerfile` Python and uv pins - Update `requires-python`, ruff `target-version`, PyPI classifier, `.python-version`, all docs - Add `pyarrow>=23.0.1` dep floor, `spacy>=3.8.13` override, `fasttext-wheel` exclusion for Python 3.13 compat - Fix server dep compatibility: `scipy>=1.14.1` (scicode), `audioop-lts>=0.2.2` (tau2) ## Conflicts resolved - `resources_servers/wmt_translation/requirements.txt`: excluded `pycld2` addition (from a separate main PR, not part of #2194) - `uv.lock`: regenerated 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Kajal Jain <kajalj@nvidia.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
OlegSudakov
pushed a commit
to OlegSudakov/Gym
that referenced
this pull request
Aug 7, 2026
## Summary - Bump Python 3.12 → 3.13.14 and uv 0.11.19 → 0.11.29 - Add `pyarrow>=23.0.1` transitive dep floor - Fix Python 3.13 compat in server deps (scipy, spacy, audioop-lts) - Regenerate `uv.lock` ## Test plan - [x] Unit tests pass - [x] Server suite passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Kajal Jain <kajalj@nvidia.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pyarrow>=23.0.1transitive dep flooruv.lockTest plan
🤖 Generated with Claude Code