Merge pull request #309 from netromdk/py3.14

Python 3.14 support

Author: netromdk

.github/workflows/analyze.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.13']
+        python-version: ['3.14']
 
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

.github/workflows/security-check.yml

@@ -0,0 +1,37 @@
+name: Security Check
+
+# On all pushes to PRs or pushes to specific branches. Not on ALL pushes in general because it will
+# double if pushing to a PR.
+on:
+  pull_request:
+  push:
+    branches:
+      - 'master'
+      - 'dev'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # NOTE: Keep at 3.13 until Bandit updates with 3.14 support!
+        python-version: ['3.13']
+
+    steps:
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
+      with:
+        python-version: ${{ matrix.python-version }}
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os}}-pip-${{ hashFiles('**/.*-requirements.txt') }}
+        restore-keys: |
+          ${{ runner.os}}-pip-
+    - name: Security Check
+      run: ./misc/actions/security-check.sh

.github/workflows/test.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        # Start Linux jobs last since they are fastest to start and complete, and start 3.13 first,
+        # Start Linux jobs last since they are fastest to start and complete, and start 3.14 first,
         # since it pairs wiht macOS+Windows jobs, and 3.5 and 3.6 last since they only run tests and
         # don't use venv. 3.4 is not supported on GitHub anymore and 3.5 and 3.6 for x64 isn't
         # produced for ubuntu 22.04.
-        python-version: ['3.13', '3.12', '3.11', '3.10', 3.9, 3.8, 3.7, 3.6, 3.5]
+        python-version: ['3.14', '3.13', '3.12', '3.11', '3.10', 3.9, 3.8, 3.7, 3.6, 3.5]
         os: [windows-latest, macos-latest, ubuntu-latest]
 
         # Choose test script depending on OS.
@@ -34,7 +34,7 @@ jobs:
             test_script_name: ./misc/actions/test.ps1
 
         exclude:
-          # Only test on macOS and Windows with Python 3.13.
+          # Only test on macOS and Windows with Python 3.14.
           - os: macos-latest
             python-version: 3.5
           - os: macos-latest
@@ -51,6 +51,8 @@ jobs:
             python-version: '3.11'
           - os: macos-latest
             python-version: '3.12'
+          - os: macos-latest
+            python-version: '3.13'
 
           - os: windows-latest
             python-version: 3.5
@@ -68,6 +70,8 @@ jobs:
             python-version: '3.11'
           - os: windows-latest
             python-version: '3.12'
+          - os: windows-latest
+            python-version: '3.13'
 
           # Ignore 3.5, 3.6, and 3.7 on Linux because it isn't compiled for x64 on Ubuntu 22.04.
           - os: ubuntu-latest

Makefile

@@ -45,14 +45,13 @@ clean-venv:
 	rm -fr .venv
 
 clean-pypi:
-	rm -fr build dist *.egg-info
+	rm -fr build dist *.egg-info vermin/*.egg-info
 
 dist-clean: clean clean-venv clean-pypi
 
 pypi-dist: clean-pypi
-	python -m pip install --upgrade wheel twine
-	python setup.py sdist
-	python setup.py bdist_wheel --universal
+	python -m pip install --upgrade build wheel twine
+	python -m build
 
 update-coverage-requirements: setup-venv setup-coverage
 	pip freeze > misc/.coverage-requirements.txt
@@ -79,7 +78,7 @@ semgrep-dry-run:
 	${SEMGREP_CMD} --dry-run
 
 lint:
-	pylint -j 0 --disable=C0103,C0114,C0115,C0116,C0209,C0302,W0201,W0311,W0621,W0703,R0801,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,R0916,R1702,E1136\
+	pylint -j 0 --disable=C0103,C0114,C0115,C0116,C0209,C0302,W0201,W0311,W0621,W0703,R0801,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,R0916,R0917,R1702,E1101,E1136\
 		${TOP_LEVEL_FILES}
 
 check-pypi:

README.rst

@@ -150,8 +150,9 @@ union (``{..}  | {..}``), dictionary union merge (``a = {..}; a |= {..}``), buil
 annotations (``list[str]``), function decorators, class decorators, relaxed decorators,
 ``metaclass`` class keyword, pattern matching with ``match``, union types written as ``X | Y``, type
 alias statements (``type X = SomeType``), type alias statements with lambdas/comprehensions in class
-scopes, and generic classes (``class C[T]: ...``). It tries to detect and ignore user-defined
-functions, classes, arguments, and variables with names that clash with library-defined symbols.
+scopes, generic classes (``class C[T]: ...``), and template string literals (``t'{var}'``). It tries
+to detect and ignore user-defined functions, classes, arguments, and variables with names that clash
+with library-defined symbols.
 
 Caveats
 =======

count.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python
-from vermin import Config, MOD_REQS, MOD_MEM_REQS, KWARGS_REQS, STRFTIME_REQS, BYTES_REQS,\
-  ARRAY_TYPECODE_REQS, CODECS_ERROR_HANDLERS, CODECS_ENCODINGS, BUILTIN_GENERIC_ANNOTATION_TYPES,\
+from vermin import Config, MOD_REQS, MOD_MEM_REQS, KWARGS_REQS, STRFTIME_REQS, BYTES_REQS, \
+  ARRAY_TYPECODE_REQS, CODECS_ERROR_HANDLERS, CODECS_ENCODINGS, BUILTIN_GENERIC_ANNOTATION_TYPES, \
   DICT_UNION_SUPPORTED_TYPES, DICT_UNION_MERGE_SUPPORTED_TYPES, DECORATOR_USER_FUNCTIONS
 config = Config()
 (mods, mems, kwargs, dirs, bdirs, typecodes, codecshandlers, codecsencs, builtinanntypes,

misc/.analysis-requirements.txt

@@ -1,83 +1,30 @@
-annotated-types==0.7.0
-astroid==2.15.5
-attrs==23.1.0
-bandit==1.7.5
-boltons==21.0.0
-bracex==2.3.post1
-build==0.10.0
-certifi==2025.4.26
-charset-normalizer==3.1.0
-click==8.1.8
-click-option-group==0.5.6
-colorama==0.4.6
-defusedxml==0.7.1
-Deprecated==1.2.18
-dill==0.3.6
-distlib==0.4.0
-docutils==0.20.1
-exceptiongroup==1.2.2
-face==22.0.0
-filelock==3.19.1
-flake8==6.0.0
-gitdb==4.0.12
-GitPython==3.1.44
-glom==22.1.0
-googleapis-common-protos==1.70.0
+astroid==3.3.11
+bandit==1.9.1
+build==1.3.0
+certifi==2025.10.5
+charset-normalizer==3.4.3
+dill==0.4.0
+docutils==0.22.2
+flake8==7.3.0
 idna==3.10
-importlib_metadata==7.1.0
-isort==5.12.0
-jsonschema==4.18.0
-jsonschema-specifications==2023.6.1
-lazy-object-proxy==1.9.0
-markdown-it-py==3.0.0
+isort==6.1.0
+markdown-it-py==4.0.0
 mccabe==0.7.0
 mdurl==0.1.2
-opentelemetry-api==1.25.0
-opentelemetry-exporter-otlp-proto-common==1.25.0
-opentelemetry-exporter-otlp-proto-http==1.25.0
-opentelemetry-instrumentation==0.46b0
-opentelemetry-instrumentation-requests==0.46b0
-opentelemetry-proto==1.25.0
-opentelemetry-sdk==1.25.0
-opentelemetry-semantic-conventions==0.46b0
-opentelemetry-util-http==0.46b0
-packaging==23.1
-pbr==5.11.1
-peewee==3.16.2
-pep517==0.13.1
-platformdirs==3.9.1
-protobuf==4.25.8
-pycodestyle==2.10.0
-pydantic==2.8.2
-pydantic_core==2.20.1
-pyflakes==3.0.1
-Pygments==2.15.1
-pylint==2.17.4
-pyparsing==3.0.9
-pyproject_hooks==1.0.0
-pyroma==4.2
-python-lsp-jsonrpc==1.0.0
-PyYAML==6.0.2
-referencing==0.29.1
+packaging==25.0
+platformdirs==4.5.0
+pycodestyle==2.14.0
+pyflakes==3.4.0
+Pygments==2.19.2
+pylint==3.3.9
+pyproject_hooks==1.2.0
+pyroma==5.0
+PyYAML==6.0.3
 requests==2.32.5
-rich==13.4.2
-rpds-py==0.8.10
-ruamel.yaml==0.17.40
-ruamel.yaml.clib==0.2.14
-semgrep==1.86.0
+rich==14.2.0
 setuptools==80.9.0
-six==1.16.0
-smmap==5.0.2
-stevedore==5.1.0
-toml==0.10.2
-tomli==2.0.1
-tomlkit==0.11.8
-trove-classifiers==2023.5.24
-typing_extensions==4.12.2
-ujson==5.11.0
+stevedore==5.5.0
+tomlkit==0.13.3
+trove-classifiers==2025.9.11.17
 urllib3==2.5.0
-virtualenv==20.34.0
-vulture==2.7
-wcmatch==8.4.1
-wrapt==1.15.0
-zipp==3.23.0
+vulture==2.14

misc/actions/security-check.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -x
+
+setup() {
+  make install-deps setup-venv
+  source .venv/bin/activate
+  make setup-analysis
+}
+
+# Even if .venv is found, make sure required executables are found, otherwise setup anyway.
+if [[ ! -d .venv ]] || [[ ! -f .venv/bin/bandit ]]; then
+  setup
+else
+  source .venv/bin/activate
+fi
+
+make security-check

pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=80", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vermin"
+version = "1.7.0"
+description = "Concurrently detect the minimum Python versions needed to run code"
+readme = { file = "README.rst", content-type = "text/x-rst" }
+requires-python = ">=3.0"
+license = "MIT"
+license-files = ["LICENSE.txt"]
+authors = [
+    { name = "Morten Kristensen", email = "me@mortens.dev" }
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3.0",
+    "Topic :: Utilities",
+    "Topic :: Software Development"
+]
+keywords = ["version", "detection", "analysis", "ast", "development"]
+dependencies = []
+optional-dependencies = {}
+
+[tool.setuptools.packages.find]
+where = ["."]
+exclude = ["tests"]
+
+[project.scripts]
+vermin = "vermin:main"
+
+[project.urls]
+"Homepage" = "https://github.com/netromdk/vermin"
+"Source" = "https://github.com/netromdk/vermin"
+"Bug Reports" = "https://github.com/netromdk/vermin/issues"