chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.11 → 3.14
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

v3.12.14: 3.12.14

Compare Source

Python 3.12.14

v3.12.13: 3.12.13

Compare Source

Python 3.12.13

v3.12.12: 3.12.12

Compare Source

Python 3.12.12

v3.12.11: 3.12.11

Compare Source

Python 3.12.11

v3.12.10: 3.12.10

Compare Source

Python 3.12.10

v3.12.9: 3.12.9

Compare Source

Python 3.12.9

v3.12.8: 3.12.8

Compare Source

Python 3.12.8

v3.12.7: 3.12.7

Compare Source

Python 3.12.7

v3.12.6: 3.12.6

Compare Source

Python 3.12.6

v3.12.5: 3.12.5

Compare Source

Python 3.12.5

v3.12.4: 3.12.4

Compare Source

Python 3.12.4

v3.12.3: 3.12.3

Compare Source

Python 3.12.3

v3.12.2: 3.12.2

Compare Source

Python 3.12.2

v3.12.1: 3.12.1

Compare Source

Python 3.12.1

v3.12.0: 3.12.0

Compare Source

Python 3.12.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 15c9aea

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 11 finding(s)

🔴 11

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-78 — Hardcoded Python version in workflow file
  The Python version is hardcoded to '3.14' in the workflow files, which could potentially expose sensitive information if not managed properly.
• 🔴 P0 .github/workflows/publish-pypi.yml:31 CWE-78 — Hardcoded Python version in workflow file
  The Python version is hardcoded to '3.14' in the workflow files, which could potentially expose sensitive information if not managed properly.
• 🔴 P0 .github/workflows/registry-parity.yml:33 CWE-78 — Hardcoded Python version in workflow file
  The Python version is hardcoded to '3.14' in the workflow files, which could potentially expose sensitive information if not managed properly.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-78 — Unpinned action tags (@v1 vs commit SHA)
  Using @v1 instead of a specific commit SHA for the actions/setup-python action means that any future updates to the action could potentially introduce security
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-88 — ${{ github. }} injected into run:*
  Using ${{ github.* }} directly in the run command can expose sensitive information or allow for injection attacks if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-276 — Overbroad token permissions
  The use of overbroad token permissions in the action setup could potentially allow for unauthorized access to sensitive resources.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-798 — Secrets echoed to logs
  Logging secrets directly in the workflow can expose sensitive information and increase the risk of data breaches.
• 🔴 P0 .github/workflows/publish-pypi.yml:31 CWE-78 — Unpinned action tags (@v1 vs commit SHA)
  Using @v1 instead of a specific commit SHA for the actions/setup-python action means that any future updates to the action could potentially introduce security
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-264 — Potential missing authentication in workflow file
  The workflow files do not explicitly check for authentication, which could allow unauthorized access if the workflows are triggered by untrusted sources.
• 🔴 P0 .github/workflows/publish-pypi.yml:31 CWE-264 — Potential missing authentication in workflow file
  The workflow files do not explicitly check for authentication, which could allow unauthorized access if the workflows are triggered by untrusted sources.
• 🔴 P0 .github/workflows/registry-parity.yml:33 CWE-264 — Potential missing authentication in workflow file
  The workflow files do not explicitly check for authentication, which could allow unauthorized access if the workflows are triggered by untrusted sources.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Python matrix and package metadata still cap at 3.12

The dependency bump moves the CI toolchain workflows to Python 3.14, but the actual test matrix in .github/workflows/test-python.yml:27 still only exercises 3.10 and 3.12, and sdk-python/pyproject.toml classifiers / [tool.black] target-version stop at 3.12 (with requires-python = ">=3.10"). So the wheel is now built on an interpreter that is never tested against, and the published metadata does not advertise 3.13/3.14 support. Worth deciding whether the matrix and classifiers should be extended alongside this bump.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Reusable workflow bumped here may drift from its upstream mirror

This file's header comment states it mirrors wave-foundation/scripts/validate-skills.py / the shared checks.yml and instructs keeping the two in sync. Bumping the interpreter only here introduces drift with the upstream copy that other WAVE repos consume; the same bump likely needs to land in wave-foundation. Also note the inlined gate does pip install pyyaml on the pinned interpreter — verify a PyYAML wheel exists for 3.14 in CI, otherwise the skill gate falls back to a source build and can fail.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unresolved review comments raise substantive concerns: the test matrix and package metadata don't cover Python 3.14, creating inconsistency where builds use an untested interpreter. Additionally, all changed files are owned by wave-av/sdk-owners, not the automated author.

^{You can customize Macroscope's approvability policy. Learn more.}