Skip to content

Drop python3.10 support for security reasons - #87

Merged
henriob merged 1 commit into
mainfrom
chore/security-bump
Oct 26, 2026
Merged

henriob merged 1 commit into
mainfrom
chore/security-bump

Conversation

@henriob

@henriob henriob commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Raises the minimum Python version from 3.10 to 3.11 so that dependency resolution can pick Pillow 13.0.0, which fixes the open Pillow Dependabot alerts.

Changes

  • pyproject.toml: python = ">=3.11,<3.13"
  • README.md: Python version badge updated to ≥3.11

@henriob
henriob requested a review from mo374z as a code owner October 26, 2026 10:08
@finitearth

Copy link
Copy Markdown
Collaborator

why do we even need pillow? isnt that for pictures

@finitearth
finitearth requested review from finitearth and a balanced review from Copilot October 26, 2026 10:09

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

@github-actions

Copy link
Copy Markdown

Coverage

Tests Skipped Failures Errors Time
153 0 💤 0 ❌ 0 🔥 9.827s ⏱️

@henriob

henriob commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

why do we even need pillow? isnt that for pictures

Vllm, torchvision and mistral-common have it as a dependency.

@finitearth
finitearth requested a review from timo282 October 26, 2026 10:14

@timo282 timo282 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wenn wir gerade dabei sind: warum haben wir Python <= 3.13?

@finitearth finitearth left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security relevant and 3.10 is close to end of life anyways --> i approve

@henriob

henriob commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Wenn wir gerade dabei sind: warum haben wir Python <= 3.13?

Wir haben sogar strikt kleiner 3.13. Commit history sagt, dass das wegen vllm mal nötig war. Mittlerweile supported vllm aber Python 3.13. und 3.14. Wegen torchvision muss man aber for some reason Python 3.14.1 explizit ausschließen wenn wir 3.14 mit reinnehmen wollen. Soll ich das so machen?

@henriob
henriob merged commit 7cc7ae3 into main Oct 26, 2026
2 checks passed
@henriob
henriob deleted the chore/security-bump branch October 26, 2026 10:34
@timo282

timo282 commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

Wenn wir gerade dabei sind: warum haben wir Python <= 3.13?

Wir haben sogar strikt kleiner 3.13. Commit history sagt, dass das wegen vllm mal nötig war. Mittlerweile supported vllm aber Python 3.13. und 3.14. Wegen torchvision muss man aber for some reason Python 3.14.1 explizit ausschließen wenn wir 3.14 mit reinnehmen wollen. Soll ich das so machen?

Von meiner Seite her gerne, wäre unnötig sich da einzuschränken

@henriob henriob mentioned this pull request Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants