Fails to run with Python 3.14

[nijel]

Description

The action fails to run with Python 3.14 because the frozen dependencies are too old for it:

error: the configured Python interpreter version (3.14) is newer than PyO3's maximum supported version (3.13)

#175 might be a good way to handle such issues.

Version

Using v3.0.1,

[woodruffw]

Hi @nijel, can you share the exact dependency error you saw? That would help me pinpoint which deps need updating.

(Also note: if you're using this action to sign PyPI packages, you may not need it! Signing is built directly into gh-action-pypi-publish and has been enabled for a default there for over a year.)

[woodruffw]

I suspect this will be fixed once we do #213.

[nijel]

Full log is at https://github.com/WeblateOrg/weblate/actions/runs/18371300277/job/52334996145#step:6:1

[woodruffw]

Thanks. Saving for myself: the problem here is pydantic-core.

@nijel Out of curiosity, why are you using this action to sign every build? Do these signatures end up being used or verified somewhere?

[nijel]

The only reason for that is to verify that signing works. We do not need these signatures, but we want to avoid broken signing to break the release process. We had that once, and we've been running it on every build since then.

[DK96-OS]

@nijel I've got a working action for 3.14. https://github.com/DK96-OS/gh-action-sigstore-python/releases/tag/v3.2.11

See which dependencies I upgraded in this commit: f8a2585

[woodruffw]

Hi @DK96-OS. Please don't take this personally, but I've hidden your comment here -- I don't have any reason to doubt your motivations, but this action has ~5k active users (including a lot of major companies/projects) and I believe it'd be a security risk to allow an unvetted fork to be advertised here.

[jku]

We do need to do something about this rather quickly: while the action does not handle python setup itself, I think it's safe to assume that a lot of people are using setup-python with python-version: "3.x"... GitHub may bump that to 3.14 any day, breaking lots of users.

Notes while I track this down:

• pyo3 0.26 should be compatible with python 3.14
• pydantic-core 2.40.0 upgrades to pyo3 0.26
• Our pydantic-core is 2.33.2 (somehow the requirements/dev.txt depends on pydantic-core 2.41.4 which seems weird) -- how is it possible that main.txt has a lower version??
• pydantic-core is installed because pydantic needs it, pydantic is installed because of sigstore, sigstore-models, sigstore-rekor-type

[jku]

Wow, it looks like dependabot does not actually upgrade the versions in requirements.*.txt. I have no idea what it really does then. In any case uv pip compile --upgrade --generate-hashes --output-file=requirements/main.txt requirements/main.in produces lots of updates even though dependabot just did updates in #220 -- it looks like it does the same without --upgrade

EDIT: confirmed: this issue is solved as soon as the upgrades actually happen. I think dependabot just cannot handle dependency upgrades that are not strictly required by constraints set in *.in