feat: support Python 3.14

.github/workflows/docker.yml

@@ -32,7 +32,7 @@ concurrency:
 
 env:
   REPORTS_DIR: CI_reports
-  PYTHON_VERSION: "3.12"
+  PYTHON_VERSION: "3.14"
   POETRY_VERSION: "1.8.1"
 
 permissions: {}

.github/workflows/python.yml

@@ -36,7 +36,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION_DEFAULT: "3.12"
+  PYTHON_VERSION_DEFAULT: "3.14"
   POETRY_VERSION: "1.8.1"
   REPORTS_DIR: CI_reports
   TESTS_REPORTS_ARTIFACT: tests-reports
@@ -122,7 +122,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - python-version: '3.13'  # latest
+          - python-version: '3.14'  # latest
             os: ubuntu-latest
             toxenv-factors: '-current'
           - python-version: '3.9'   # lowest
@@ -210,7 +210,8 @@ jobs:
           - macos-latest
           - windows-latest
         python-version:
-          - "3.13" # highest supported
+          - "3.14" # highest supported
+          - "3.13"
           - "3.12"
           - "3.11"
           - "3.10"

pyproject.toml

@@ -57,6 +57,7 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Typing :: Typed"
 ]
 [tool.poetry.urls]

tests/_data/infiles/environment/with-extras/init.py

@@ -20,9 +20,9 @@
 """
 
 from os import name as os_name
-from os.path import dirname, join
+from os.path import dirname, isdir, join
 from subprocess import PIPE, CompletedProcess, run  # nosec:B404
-from sys import argv, executable
+from sys import argv, executable, version_info
 from typing import Any
 from venv import EnvBuilder
 
@@ -44,14 +44,18 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
     res = run(call, **kwargs, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
+
     return res
 
 
-def pip_install(*args: str) -> None:
+def pip_install(*args: str, site_packages_dir: str) -> None:
     pip_run(
         'install', '--require-virtualenv', '--no-input', '--progress-bar=off', '--no-color',
+        '--python-version=3.14',  # needed for compatibility/reproducibility
+        '--only-binary=:all:',
+        '--target', site_packages_dir,
         '-c', constraint_file,  # needed for reproducibility
-        *args
+        *args,
     )
 
 
@@ -62,13 +66,23 @@ def main() -> None:
         with_pip=False,
     ).create(env_dir)
 
+    try:
+        spd = next(filter(isdir, (
+            join(env_dir, 'lib', f'python{version_info[0]}.{version_info[1]}', 'site-packages'),
+            join(env_dir, 'Lib', 'site-packages')  # windows ?
+        )))
+    except StopIteration:
+        raise RuntimeError('site-packages not found')
+
     pip_install(
-        'cyclonedx-python-lib[xml-validation,json-validation]',
+        'cyclonedx-python-lib[xml-validation,json-validation]==11.2',
         # additionals for reproducibility foo
         'importlib-resources>=1.4.0',
         'pkgutil-resolve-name>=1.3.10',
         'zipp>=3.1.0',
-        'jsonschema-specifications==2023.03.6',
+        'jsonschema-specifications>=2023.03.6',
+        'typing_extensions>=4',
+        site_packages_dir=spd
     )
 
 

tests/_data/infiles/environment/with-extras/pinning.txt

@@ -1,28 +1,31 @@
 arrow==1.3.0
-attrs==24.2.0
-boolean.py==4.0
-cyclonedx-python-lib==8.2.0
+attrs==25.4.0
+boolean.py==5.0
+cyclonedx-python-lib==11.2.0
 defusedxml==0.7.1
 fqdn==1.5.1
-idna==3.10
+idna==3.11
 importlib_resources==6.4.5
 isoduration==20.11.0
 jsonpointer==3.0.0
-jsonschema==4.23.0
+jsonschema==4.25.1
 jsonschema-specifications==2023.3.6
-license-expression==30.3.1
-lxml==5.3.0
-packageurl-python==0.16.0
+lark==1.3.0
+license-expression==30.4.4
+lxml==6.0.2
+packageurl-python==0.17.5
 pkgutil_resolve_name==1.3.10
-py-serializable==1.1.2
+py-serializable==2.1.0
 python-dateutil==2.9.0.post0
-referencing==0.35.1
+referencing==0.37.0
 rfc3339-validator==0.1.4
-rfc3987==1.3.8
-rpds-py==0.20.0
-six==1.16.0
+rfc3986-validator==0.1.1
+rfc3987-syntax==1.1.0
+rpds-py==0.27.1
+six==1.17.0
 sortedcontainers==2.4.0
-types-python-dateutil==2.9.0.20241003
+types-python-dateutil==2.9.0.20251008
+typing_extensions==4.15.0
 uri-template==1.3.0
-webcolors==24.8.0
+webcolors==24.11.1
 zipp==3.20.2

tests/_data/infiles/environment/with-license-pep639/init.py

@@ -65,12 +65,11 @@ def main() -> None:
     pip_install(
         '--no-dependencies',
         # with License-Expression
-        'attrs',
+        'attrs==23.2.0',
         # with License-File
-        'boolean.py',
-        'jsonpointer',
-        'license_expression',
-        'lxml',
+        'boolean.py==4.0',
+        'jsonpointer==2.4',
+        'license_expression==30.3.0',
         'chardet==5.2.0',  # https://github.com/CycloneDX/cyclonedx-python/issues/931
         # with expression-like License AND License-File
         'cryptography==43.0.1',  # https://github.com/CycloneDX/cyclonedx-python/issues/826

tests/_data/infiles/environment/with-license-pep639/pinning.txt

@@ -4,4 +4,3 @@ chardet==5.2.0
 cryptography==43.0.1
 jsonpointer==2.4
 license-expression==30.3.0
-lxml==5.3.0