chore(deps): update dependency python to 3.14 by renovate[bot] · Pull Request #14 · wave-av/wave-modules

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-20T15:18:42Z

🌊 WAVE BugBot — 3 finding(s)

🔴 3

🔴 P0 .github/workflows/_checks.yml:59 CWE-89 — Unpinned action tags
The PR updates the Python version to 3.14 but does not address the use of unpinned action tags in the workflow file. Unpinned action tags can lead to security v
🔴 P0 .github/workflows/_checks.yml:59 CWE-264 — Overbroad token permissions
The PR updates the Python version to 3.14 but does not address potential overbroad token permissions in the workflow file. Overbroad permissions can lead to sec
🔴 P0 .github/workflows/_checks.yml:59 CWE-312 — Secrets echoed to logs
The PR updates the Python version to 3.14 but does not address potential secrets being echoed to logs in the workflow file. Echoing secrets can lead to security

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 2 potential issues.

devin-ai-integration · 2026-08-14T16:35:25Z

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
-          python-version: "3.12"
+          python-version: "3.14"


🔍 Python 3.14 availability/wheel risk for the skill-validate gate

This bump only affects the inlined skill-validate gate, which uses stdlib modules plus pyyaml installed at line 60. Two things worth confirming before merge: (1) the pinned actions/setup-python@a26af69… (v5.6.0) resolves versions via its dynamic manifest, so 3.14 must be present in the manifest/runner tool cache for ubuntu-latest — otherwise every calling repo's gate fails at setup; (2) pip install pyyaml must have a prebuilt cp314 wheel, else pip falls back to a source build (needs Cython/compiler) and the gate breaks. Since this workflow is workflow_call-reusable and inherited by other WAVE repos, a failure here blocks all consumers, so it's worth a one-off green run to verify.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-14T16:35:26Z

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
-          python-version: "3.12"
+          python-version: "3.14"


🔍 Comment says this gate mirrors wave-foundation/scripts/validate-skills.py — keep runtime in sync

The header at lines 48-50 states this inlined validator mirrors wave-foundation/scripts/validate-skills.py and that the two should be kept in sync. Bumping the interpreter here only, without a corresponding change in wave-foundation, risks behavioral drift between the two copies (e.g. YAML/regex behavior differences across interpreter versions). Worth confirming the foundation counterpart is updated too.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-14T16:37:19Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a small CI-only Python version bump, and the updated skill-validation job passes locally with Python 3.14. The changed file is an explicitly owned, reusable workflow affecting downstream repositories, so its compatibility and synchronization should receive human owner review.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at a7974f4. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-24T03:24:37Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codeant-ai · 2026-08-27T00:42:25Z