chore(deps): update dependency python to 3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	uses-with	minor	3.12 → 3.14

---

Release Notes

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: fc5b738

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 9 finding(s)

🔴 9

• 🔴 P0 .github/workflows/_checks.yml:59 CWE-617 — Unpinned action tags (@v1 vs commit SHA)
  Using '@v1' for actions can lead to security vulnerabilities as it locks the workflow to a specific version. This can be bypassed if the version is later update
• 🔴 P0 .github/workflows/python-lint.yml:28 CWE-617 — Unpinned action tags (@v1 vs commit SHA)
  Using '@v1' for actions can lead to security vulnerabilities as it locks the workflow to a specific version. This can be bypassed if the version is later update
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-78 — Hardcoded chain/mainnet config on a money path
  The Python version is hardcoded to '3.14' in the workflow files, which could potentially lead to issues if the codebase needs to be run on different versions of
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-798 — ${{ github. }} injected into run:*
  Using ${{ github.* }} directly in the run: field can expose sensitive information if not properly sanitized.
• 🔴 P0 .github/workflows/python-lint.yml:28 CWE-798 — ${{ github. }} injected into run:*
  Using ${{ github.* }} directly in the run: field can expose sensitive information if not properly sanitized.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-94 — Unpinned action tags in GitHub Actions workflow
  The workflow uses unpinned action tags (@v1) which can lead to using outdated or potentially malicious versions of actions.
• 🔴 P0 .github/workflows/python-lint.yml:28 CWE-94 — Unpinned action tags in GitHub Actions workflow
  The workflow uses unpinned action tags (@v6.2.0) which can lead to using outdated or potentially malicious versions of actions.
• 🔴 P0 .github/workflows/_checks.yml:59 CWE-312 — Secrets echoed to logs in GitHub Actions workflow
  The workflow does not appear to have any secrets that are echoed to logs, but it's good practice to ensure all sensitive information is handled securely.
• 🔴 P0 .github/workflows/python-lint.yml:28 CWE-312 — Secrets echoed to logs in GitHub Actions workflow
  The workflow does not appear to have any secrets that are echoed to logs, but it's good practice to ensure all sensitive information is handled securely.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Local copy of a shared reusable workflow drifts from wave-foundation source

The header comment of .github/workflows/_checks.yml:3-6 states this workflow is the shared cross-project gate whose "one source of truth" lives in wave-av/wave-foundation (checks.yml@master), and the skill-validate job comment (.github/workflows/_checks.yml:48-50) says it mirrors wave-foundation/scripts/validate-skills.py and "keep the two in sync". Bumping the Python version only in this repo's local copy introduces exactly the drift the comment warns about; the same bump should be made upstream (or this copy replaced by a uses: reference).

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

This Python version update in CI workflows touches files owned by wave-av/core-team (not the Renovate bot author), and an unresolved review comment raises a valid concern about drift from an upstream wave-foundation workflow that this file is supposed to mirror. Human review needed to address the coordination concern.

^{You can customize Macroscope's approvability policy. Learn more.}