chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.11 → 3.14
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

v3.12.13: 3.12.13

Compare Source

Python 3.12.13

v3.12.12: 3.12.12

Compare Source

Python 3.12.12

v3.12.11: 3.12.11

Compare Source

Python 3.12.11

v3.12.10: 3.12.10

Compare Source

Python 3.12.10

v3.12.9: 3.12.9

Compare Source

Python 3.12.9

v3.12.8: 3.12.8

Compare Source

Python 3.12.8

v3.12.7: 3.12.7

Compare Source

Python 3.12.7

v3.12.6: 3.12.6

Compare Source

Python 3.12.6

v3.12.5: 3.12.5

Compare Source

Python 3.12.5

v3.12.4: 3.12.4

Compare Source

Python 3.12.4

v3.12.3: 3.12.3

Compare Source

Python 3.12.3

v3.12.2: 3.12.2

Compare Source

Python 3.12.2

v3.12.1: 3.12.1

Compare Source

Python 3.12.1

v3.12.0: 3.12.0

Compare Source

Python 3.12.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c1ab566

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 10 finding(s)

🔴 7 · 🟠 3

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned action tags
  The workflow uses @v1 for actions, which is an unpinned version tag. This can lead to security vulnerabilities if the action's code changes in a way that intr
• 🔴 P0 .github/workflows/publish-pypi.yml:31 CWE-617 — Unpinned action tags
  The workflow uses @v5 for actions, which is an unpinned version tag. This can lead to security vulnerabilities if the action's code changes in a way that intr
• 🔴 P0 .github/workflows/registry-parity.yml:30 CWE-617 — Unpinned action tags
  The workflow uses @v5 for actions, which is an unpinned version tag. This can lead to security vulnerabilities if the action's code changes in a way that intr
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-862 — Missing role guard for Python version update
  The change updates the Python version to 3.14, but there is no role guard or authorization check to ensure that only authorized users can perform this action.
• 🔴 P0 .github/workflows/publish-pypi.yml:31 CWE-862 — Missing role guard for Python version update in PyPI publish workflow
  The change updates the Python version to 3.14, but there is no role guard or authorization check to ensure that only authorized users can perform this action.
• 🔴 P0 .github/workflows/registry-parity.yml:30 CWE-862 — Missing role guard for Python version update in registry parity workflow
  The change updates the Python version to 3.14, but there is no role guard or authorization check to ensure that only authorized users can perform this action.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-79 — Overbroad token permissions
  The workflow uses ${{ github.* }} in the run: section, which can expose sensitive information if not properly secured.
• 🟠 P1 .github/workflows/_checks.yml:59 CWE-426 — Unpinned search_path in Python version update workflow
  The change updates the Python version, but there is no check to ensure that the search_path is pinned with pg_temp LAST.
• 🟠 P1 .github/workflows/publish-pypi.yml:31 CWE-426 — Unpinned search_path in Python version update workflow for PyPI publish
  The change updates the Python version, but there is no check to ensure that the search_path is pinned with pg_temp LAST.
• 🟠 P1 .github/workflows/registry-parity.yml:30 CWE-426 — Unpinned search_path in Python version update workflow for registry parity
  The change updates the Python version, but there is no check to ensure that the search_path is pinned with pg_temp LAST.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}