chore: replace together fork with official PyPI package

[leonardmq]

Problem

The Dependabot Updates job on main keeps failing (uv in /. for mcp - Update) — the only red CI on main. It can't resolve a bump of mcp:

mcp[cli] >=1.11 depends on typer>=0.16.0
together (scosman/together-python fork, v1.5.0) depends on typer>=0.9,<0.16
→ unsatisfiable

Why the fork existed — and why it's no longer needed

together was pinned to the scosman/together-python fork. That fork existed solely to make pyarrow an optional/runtime import (pyarrow is ~100MB and breaks on Intel Macs) — togethercomputer/together-python#276, authored by scosman.

That PR was merged upstream on 2025-06-02. Since then official together has also relaxed its typer cap. The latest 1.5.x release (v1.5.35) has both:

• pyarrow = { optional = true } — the fork's whole reason to exist, now upstream
• typer = ">=0.9,<0.20" — allows typer>=0.16, so mcp[cli] can upgrade

So pointing at official together fixes the Dependabot conflict without touching the mcp dep at all.

Changes

• libs/core/pyproject.toml: together → together>=1.5.35,<2 (from PyPI)
• Remove the [tool.uv.sources] git override for together
• mcp[cli] left unchanged

Pinned <2 to stay on the API-compatible 1.5.x line — together 2.x drops typer for cyclopts and changes APIs the fine-tune adapter (together_finetune.py) relies on. That migration is a separate follow-up.

Verification

• together now resolves to 1.5.35 from PyPI (no git); pyarrow in the lock now comes only from lancedb/pylance, not together.
• uv sync OK; Together, FilePurpose, FinetuneJobStatus all import fine on 1.5.35.
• uv lock --upgrade-package mcp now resolves cleanly (mcp 1.10.1 → 1.28.1, typer → 0.19.2) — Dependabot will no longer fail.
• Tests pass: test_together_finetune.py + mcp tool suites — 140 passed, 5 skipped.

Note

together 1.x prints a deprecation banner ("maintained until January 2026"). Staying on 1.5.x is the safe fix now; migrating the fine-tune adapter to together 2.x is worth a follow-up.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: cf723f60-fe50-41bf-892a-1c1fad8be02e

📥 Commits

Reviewing files that changed from the base of the PR and between 36aec71 and 9e7ea06.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• libs/core/pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (1)

• libs/core/pyproject.toml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

The core package constrains Together to versions from 1.5.35 up to, but excluding, 2, and removes its git source override.

Changes

Core dependency declarations

Layer / File(s)	Summary
Update core dependency declarations libs/core/pyproject.toml	Together is bounded to >=1.5.35,<2 and no longer uses a git source override.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 9e7ea

The change switches the dependency to the compatible official PyPI release and updates the lockfile; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks the package trail,
Together follows a bounded rail.
The git source hops away,
The index guides the way.
Core dependencies stay neat.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing the Together fork with the official PyPI package.
Description check	✅ Passed	The description clearly explains the problem, rationale, dependency changes, compatibility constraint, verification steps, and test results. It does not use every template heading and does not include…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description clearly explains the problem, rationale, dependency changes, compatibility constraint, verification steps, and test results. It does not use every template heading and does not include a Related Issues entry or explicit CLA confirmation, but the required change and validation details are substantially complete.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-mcp-cli-typer-conflict

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Coverage Report

Overall Coverage: 92%

Diff: origin/main...HEAD

No lines with coverage information in this diff.

---

• 📊 HTML Coverage Report - Interactive coverage report
• 📈 Diff Coverage Report - Detailed diff analysis
• Github Actions Run - View the full coverage report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​together@​2.32.0 ⏵ 1.5.35	+7

View full report

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.