chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cf731f0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 5 finding(s)

🔴 5

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-89 — Unpinned action tags (@v1 vs commit SHA)
  The use of '@v1' for the actions/setup-python action is not pinned to a specific commit SHA. This can lead to security vulnerabilities if the action's code chan
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-78 — Overbroad token permissions
  The workflow uses ${{ github.* }} in the run: field of actions. This can lead to injection vulnerabilities if the tokens used have more permissions than nec
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-621 — Unpinned action tags
  The workflow uses @v1 for actions, which is unpinned. This can lead to security vulnerabilities if the action is updated in a way that introduces new risks.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-89 — ${{ github. }} injected into run:*
  The use of ${{ github.* }} in the run: field can expose sensitive information or allow for injection attacks if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-918 — Allowlist outbound hosts
  The workflow does not appear to have any checks for outbound requests, which could be used for SSRF attacks.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[cursor]

Risk: low. Cursor Bugbot was not present on this PR, so that signal was skipped. Approved the single-line CI Python version bump (3.12→3.14); skill-validate passed. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}