Repository navigation
feat: add Python 3.13 and Node 26 support - #87
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Extend the supported runtime matrix: - Python: requires-python upper bound 3.13 -> 3.14, add 3.13 classifier and Black py313 target; regenerate uv.lock with cp313 wheels. - Node: bump engines >=20 <25 -> >=20 <27 (root + node-commitlint). - CI: add 3.13 to the Python test matrix, 26 to the Node test matrix. Generated-by: Claude Opus 4.8 <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
anchildress1
force-pushed
the
feat/support-python313-node26
branch
from
June 27, 2026 03:42
0d7124c to
e44da73
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d7124ca13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
There was a problem hiding this comment.
Pull request overview
Extends the repo’s declared/runtime-tested support matrix to include Python 3.13 and Node 26, updating packaging metadata, lockfiles, and CI matrices accordingly.
Changes:
- Python: relax
requires-pythonupper bound to<3.14, add Python 3.13 classifier, and includepy313in Black’s target versions (plus regenerateduv.lockfor cp313 wheels). - Node: broaden
engines.nodeto>=20 <27(root + workspace) and propagate intopackage-lock.json. - CI: add Python 3.13 and Node 26 to the GitHub Actions test matrix.
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/python-gitlint/uv.lock | Updates lock metadata and adds cp313 wheel entries to support Python 3.13 resolution. |
| packages/python-gitlint/pyproject.toml | Updates Python version constraints, classifiers, and Black target versions for 3.13. |
| packages/node-commitlint/package.json | Expands Node engine constraint to allow Node 26. |
| package.json | Expands root Node engine constraint to allow Node 26. |
| package-lock.json | Propagates engine range changes and updates resolved dependency graph/metadata. |
| .github/workflows/test-and-build.yml | Adds Node 26 and Python 3.13 to the CI matrix. |
The root devDependency pinned @checkmarkdevtools/commitlint-plugin-rai at ^0.0.0, which only satisfies 0.0.x and cannot import the published 0.1.6 plugin outside the workspace symlink. Pin to ^0.1.6 so registry installs resolve the latest version. Also bump the documented Node range to < 27.0.0 to match the engines change in this PR. Generated-by: Claude Opus 4.8 <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Trivy: drop the `license` scanner from the Scorecard job. License detection (MIT/ISC/PolyForm) is not a vulnerability and duplicated the dedicated license-scan job, flooding code-scanning with 19 noise alerts. - lockfile-refresh: harden the workflow_run privileged jobs against the CodeQL untrusted-checkout finding — persist-credentials: false on checkout, guard jobs on a release-please-- ref allowlist, and push with an explicit scoped token instead of git-auto-commit-action. - uv.lock: bump Pygments 2.19.2 -> 2.20.0 (GHSA-5239-wwwm-4pmq). - security-audit: quote $GITHUB_OUTPUT to clear an actionlint SC2086 nit. Generated-by: Claude Opus 4.8 <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
anchildress1
force-pushed
the
feat/support-python313-node26
branch
2 times, most recently
from
June 27, 2026 12:10
ed3533a to
229286a
Compare
The previous single privileged job both executed the resolved branch (npm/uv) and held contents: write, which CodeQL flags as untrusted-checkout (critical: checkout + execution; high: privileged checkout) and cache-poisoning. persist-credentials and disabling the cache could not clear the findings on their own. Split the work along the privilege boundary, per GitHub's documented mitigation, and avoid actions/checkout of the resolved (untrusted) ref in this workflow_run context entirely — both jobs clone the branch tip over public HTTPS instead: - refresh-lockfiles (contents: read): clones and executes the branch (npm install --package-lock-only, uv lock) and uploads both lockfiles as an artifact. Read-only token; caching disabled so the untrusted run cannot poison the default-branch cache scope. - commit-lockfiles (contents: write): never executes branch code. It clones only the branch tip, applies the artifact lockfiles as data, and pushes with a scoped token. No privileged checkout, no execution. Also collapses the two near-duplicate npm/uv commit jobs into a single atomic "chore: refresh lockfiles" commit. Generated-by: Claude Opus 4.8 <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
anchildress1
force-pushed
the
feat/support-python313-node26
branch
from
June 27, 2026 12:14
229286a to
df6e7f0
Compare
This was referenced Jun 27, 2026
Merged
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Extend the supported runtime matrix to Python 3.13 and Node 26.
Python
requires-pythonupper bound<3.13→<3.14Programming Language :: Python :: 3.13classifierpy313to Blacktarget-versionuv.lockwith cp313 wheels (black, coverage, pytokens, tomli)Node
engines.node>=20 <25→>=20 <27(root +node-commitlint)package-lock.jsonCI
["3.11", "3.12"]→+ "3.13"[20, 22, 24]→+ 26Verification (local)
uv buildtscuv sync --lockedresolves clean against the regenerated lock; no dependency version regressions.Generated-by: Claude Opus 4.8 noreply@anthropic.com
🤖 Generated with Claude Code