fix: Harden SDK dependencies, credential logging, and CI (Python 3.11+) (#476)

* fix(security): update ca-certificates in devcontainer image (CVE-2026-111943)

* fix(security): bump Pillow to 12.3.0 (CVE-2026-42311, CVE-2026-25990)

* fix(security): bump Pillow to 13.0.0 (CVE-2026-96639 and 38 more), require Python 3.11

Pillow 12.x is affected by 39 advisories fixed only in Pillow 13.0.0, which
requires Python >= 3.11. Python 3.10 reached end of life in October 2026.

- pyproject.toml: python ^3.11, pillow ^13.0.0, black target py311
- poetry.lock: targeted re-lock; pillow 13.0.0, drops py3.10-only backports
  (async-timeout, exceptiongroup, tomli); no other versions moved
- CI: drop 3.10 from unit/integration matrices; publish on 3.11
- devcontainer base python:3.10 -> python:3.11; tox, README, CONTRIBUTING

* SEC-3320 Patch SDK dependencies and prevent credential disclosure

* SEC-3320 Pin devcontainer base and apply OS security updates

* SEC-3320 Remove unused container tools and run as non-root

* bump to 1.6.0

Author: TechnoFinch

.devcontainer/Dockerfile

@@ -1,8 +1,24 @@
-FROM mcr.microsoft.com/devcontainers/python:3.10
+FROM mcr.microsoft.com/devcontainers/python:3.11@sha256:1eb48ffd772f0618d66844eff8cbfd9914785be25f6a936d0756a1ddfc866cc3
 
-ENV PYTHONUNBUFFERED 1
+ENV PYTHONUNBUFFERED=1
 
-RUN pipx install poetry==1.8.3
+# Apply available OS security fixes, including the CA bundle (CVE-2026-111943)
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && apt-get install -y --no-install-recommends --only-upgrade ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-# Install pre-commit
-RUN pip install pre-commit
+# Use the project's locked tools instead of stale copies inherited from the base.
+RUN for tool in autopep8 bandit black flake8 mypy pipenv pycodestyle pydocstyle pylint pytest virtualenv yapf; do \
+        pipx uninstall "$tool"; \
+    done \
+    && pipx install poetry==2.5.1
+
+# Refresh the installer inherited from the base image, then install dev tooling.
+RUN python -m pip install --no-cache-dir --upgrade pip setuptools wheel \
+    && python -m pip install --no-cache-dir --upgrade "GitPython>=3.1.62" pre-commit \
+    && python -m pip --python /usr/local/py-utils/shared/bin/python install --no-cache-dir --upgrade pip setuptools wheel \
+    && python -m pip --python /usr/local/py-utils/venvs/pipx/bin/python install --no-cache-dir --upgrade pip setuptools wheel \
+    && python -m pip --python /usr/local/py-utils/venvs/poetry/bin/python install --no-cache-dir --upgrade pip setuptools wheel
+
+USER vscode

.devcontainer/devcontainer.json

@@ -3,15 +3,6 @@
     "build": {
         "dockerfile": "Dockerfile"
     },
-    "features": {
-        "ghcr.io/devcontainers/features/git:1": {},
-        "ghcr.io/devcontainers/features/node:1": {},
-        "ghcr.io/devcontainers/features/java:1": {
-            "version": "17",
-            "installMaven": false,
-            "installGradle": false
-        }
-    },
     "customizations": {
         "vscode": {
             "extensions": [
@@ -35,6 +26,6 @@
             }
         }
     },
-    "postCreateCommand": "poetry install",
+    "postCreateCommand": "poetry install --with quality,tests",
     "remoteUser": "vscode"
 }

.github/workflows/_integration_tests.yml

@@ -16,15 +16,17 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  POETRY_VERSION: "2.1.1"
+  POETRY_VERSION: "2.5.1"
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version:
-          - "3.10"
           - "3.11"
           - "3.12"
     name: "integration_test python v${{ matrix.python-version }}"
@@ -37,6 +39,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
           poetry-version: ${{ env.POETRY_VERSION }}
           cache-key: core
+          working-directory: .
 
       - name: Install together with dependencies
         shell: bash

.github/workflows/_tests.yml

@@ -16,15 +16,17 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  POETRY_VERSION: "1.7.1"
+  POETRY_VERSION: "2.5.1"
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version:
-          - "3.10"
           - "3.11"
           - "3.12"
     name: "unittest python v${{ matrix.python-version }}"
@@ -37,6 +39,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
           poetry-version: ${{ env.POETRY_VERSION }}
           cache-key: core
+          working-directory: .
 
       - name: Install dependencies
         shell: bash

.github/workflows/check_code_quality.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/upload-to-pypi.yml

@@ -5,14 +5,17 @@ on:
     types: [published]
 
 env:
-  POETRY_VERSION: "2.1.1"
+  POETRY_VERSION: "2.5.1"
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10"]
+        python-version: ["3.11"]
 
     steps:
     - uses: actions/checkout@v4
@@ -22,6 +25,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
         poetry-version: ${{ env.POETRY_VERSION }}
         cache-key: core
+        working-directory: .
 
     - name: Set up cache
       uses: actions/cache@v4

.pre-commit-config.yaml

@@ -9,13 +9,13 @@ repos:
       - id: check-merge-conflict
       - id: check-toml
   - repo: https://github.com/psf/black
-    rev: 24.3.0
+    rev: 26.10.1
     hooks:
       - id: black
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: 'v1.8.0'
     hooks:
       - id: mypy
         args: [--strict]
-        additional_dependencies: [types-requests, types-tqdm, types-tabulate, types-click, types-filelock, types-Pillow, rich, pyarrow-stubs, pydantic, aiohttp]
+        additional_dependencies: [types-requests, types-tqdm, types-tabulate, types-click, types-filelock, "pillow>=13.0.0,<14", rich, pyarrow-stubs, pydantic, aiohttp]
         exclude: ^tests/

CONTRIBUTING.md

@@ -32,7 +32,7 @@ Pull requests cannot land without passing the formatting, linting, and testing c
 
 This project utilizes [Poetry](https://python-poetry.org/) v1.6.1+ as a dependency manager.
 
-❗Note: *Before installing Poetry*, if you use `Conda`, create and activate a new Conda env (e.g. `conda create -n together python=3.10`)
+❗Note: *Before installing Poetry*, if you use `Conda`, create and activate a new Conda env (e.g. `conda create -n together python=3.11`)
 
 Install Poetry: **[documentation on how to install it](https://python-poetry.org/docs/#installation)**.
 

README.md

@@ -34,7 +34,7 @@
 
 > Note: You are looking at the codebase for Together Python V1. The latest Together Python SDK can be found **[here.](https://github.com/togethercomputer/together-py)**
 
-The [Together Python API Library](https://pypi.org/project/together/) is the official Python client for Together's API platform, providing a convenient way for interacting with the REST APIs and enables easy integrations with Python 3.10+ applications with easy to use synchronous and asynchronous clients.
+The [Together Python API Library](https://pypi.org/project/together/) is the official Python client for Together's API platform, providing a convenient way for interacting with the REST APIs and enables easy integrations with Python 3.11+ applications with easy to use synchronous and asynchronous clients.
 
 
 

examples/tokenize_data.py

@@ -11,7 +11,6 @@
     PreTrainedTokenizerBase,
 )
 
-
 # see default of ignore_index
 # for https://pytorch.org/docs/stable/generated/torch.nn.CrossEntropyLoss.html#torch.nn.CrossEntropyLoss
 LOSS_IGNORE_INDEX = -100