chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9aec36c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 5 finding(s)

🔴 5

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned action tags (@v1 vs commit SHA)
  The use of '@v1' in the 'actions/setup-python' step is not pinned to a specific commit SHA. This can lead to potential security vulnerabilities if the action's
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned Action tags
  The use of '@v1' in the 'actions/setup-python' step is not pinned to a specific commit SHA. This can lead to potential security vulnerabilities if the action's
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-79 — ${{ github. }} injected into run:*
  The use of ${{ github.* }} in the 'actions/setup-python' step can potentially leak sensitive information if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-269 — Overbroad token permissions
  The 'actions/setup-python' step does not specify any specific permissions for the GitHub token. This can lead to potential security risks if the token is misuse
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-798 — Secrets echoed to logs
  The 'actions/setup-python' step does not appear to handle secrets securely. Secrets should be redacted before logging.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Version pin is the only Python reference; inlined script must stay in sync with wave-foundation

The bump at .github/workflows/_checks.yml:59 is the only Python version reference in the repo (no other workflow, pyproject.toml, or .py sources pin a version), so there is no in-repo inconsistency introduced. However, the comment at .github/workflows/_checks.yml:48-50 states this job "mirrors wave-foundation/scripts/validate-skills.py; keep the two in sync" — the upstream copy of this workflow may still pin 3.12, so the two will drift unless updated together. The inlined script only uses re, yaml, subprocess, and os, all of which are unaffected by 3.14 behavior changes, and pip install pyyaml on 3.14 requires PyYAML wheels for cp314 (available in recent releases); worth confirming the gate job actually runs green on the PR before merge.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in fe2095f. This Python version bump to 3.14 (pre-release) in a CI workflow file should be reviewed by wave-av/streaming-team who own this file. An unresolved comment also raises a valid concern about maintaining sync with an upstream shared workflow this file mirrors.

No code changes detected at 0cb68c2. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}