chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9aec36c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 5 finding(s)

🔴 5

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned action tags (@v1 vs commit SHA)
  The use of '@v1' in the 'actions/setup-python' step is not pinned to a specific commit SHA. This can lead to potential security vulnerabilities if the action's
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned Action tags
  The use of '@v1' in the 'actions/setup-python' step is not pinned to a specific commit SHA. This can lead to potential security vulnerabilities if the action's
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-79 — ${{ github. }} injected into run:*
  The use of ${{ github.* }} in the 'actions/setup-python' step can potentially leak sensitive information if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-269 — Overbroad token permissions
  The 'actions/setup-python' step does not specify any specific permissions for the GitHub token. This can lead to potential security risks if the token is misuse
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-798 — Secrets echoed to logs
  The 'actions/setup-python' step does not appear to handle secrets securely. Secrets should be redacted before logging.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: setup-python version bump only affects an inline yaml-based validator

The bumped interpreter (.github/workflows/_checks.yml:59) is used only by the inlined skill-frontmatter script at .github/workflows/_checks.yml:63-104, which relies on sys, os, re, subprocess and pyyaml — none of which have breaking changes affecting this usage. The only external dependency risk is pip install pyyaml at .github/workflows/_checks.yml:60 needing a wheel for 3.14; PyYAML publishes cp314 wheels, so no source build is expected on ubuntu-latest. Note the script is also declared as a mirror of wave-foundation/scripts/validate-skills.py; the upstream copy's workflow pin may now drift from 3.14.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in fe2095f. This Python version bump to 3.14 (pre-release) in a CI workflow file should be reviewed by wave-av/streaming-team who own this file. An unresolved comment also raises a valid concern about maintaining sync with an upstream shared workflow this file mirrors.

No code changes detected at c9d039a. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}