chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7945672

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 5 finding(s)

🔴 5

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-89 — Unpinned action tags (@v1 vs commit SHA)
  The use of '@v1' for the actions/setup-python action is not pinned to a specific commit SHA. This can lead to security vulnerabilities if the action's code chan
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-78 — Overbroad token permissions
  The workflow uses ${{ github.* }} in the run: field of actions. This can lead to injection vulnerabilities if the tokens used have more permissions than nec
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-621 — Unpinned action tags
  The workflow uses @v1 for actions, which is unpinned. This can lead to security vulnerabilities if the action is updated in a way that introduces new risks.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-89 — ${{ github. }} injected into run:*
  The use of ${{ github.* }} in the run: field can expose sensitive information or allow for injection attacks if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-918 — Allowlist outbound hosts
  The workflow does not appear to have any checks for outbound requests, which could be used for SSRF attacks.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[cursor]

Risk: low. Cursor Bugbot was not present on this PR, so that signal was skipped. Approved the single-line CI Python version bump (3.12→3.14); skill-validate passed. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Python bump must stay in sync with the shared foundation copy

The job comment at .github/workflows/_checks.yml:48-50 states this inlined validator mirrors wave-foundation/scripts/validate-skills.py and the two must be kept in sync. Bumping only this repo's runtime to 3.14 while the upstream reference (and any other consuming repos) may still pin 3.12 introduces drift in the executable half of the shared gate. Worth confirming the upstream workflow received the same bump.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Python bump affects only the skill-frontmatter gate; verify pyyaml wheels on 3.14

The single change bumps the interpreter used by the skill-validate job in .github/workflows/_checks.yml:59. That job only runs pip install pyyaml and an inline script using sys, os, re, subprocess, yaml — nothing version-sensitive, so no logic breakage is expected. The residual risk is environmental: if actions/setup-python on the runner image cannot resolve 3.14 (or a prebuilt PyYAML wheel is unavailable for that version, forcing a source build), the job fails at setup/install time rather than for a real gate reason. Worth confirming a green run on this workflow before merging, and note that the neighboring comment says this file mirrors wave-foundation/scripts/validate-skills.py and should be kept in sync — the upstream copy presumably needs the same bump to avoid drift.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in a4e119f. This Python version bump to 3.14 in CI has unresolved review comments about upstream sync and pyyaml availability that warrant verification. The file is owned by wave-av/core-team who should confirm compatibility.

No code changes detected at c7e2973. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}