chore(deps): update python

.github/workflows/ci.yml

@@ -116,7 +116,7 @@ jobs:
       - name: Set up Python 3.12
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
 
       - name: Install dependencies
         run: |
@@ -146,7 +146,7 @@ jobs:
       - name: Set up Python 3.12
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
 
       - name: Install dependencies
         run: |

.github/workflows/publish-images.yml

@@ -49,7 +49,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.11"
+          python-version: "3.14.7"
 
       - name: Authorize tag target from main
         id: authority
@@ -109,7 +109,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.11"
+          python-version: "3.14.7"
 
       # astral-sh/setup-uv v9.0.0
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9
@@ -213,7 +213,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.11"
+          python-version: "3.14.7"
 
       # astral-sh/setup-uv v9.0.0
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9
@@ -489,7 +489,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.11"
+          python-version: "3.14.7"
 
       # astral-sh/setup-uv v9.0.0
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9
@@ -572,7 +572,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.11"
+          python-version: "3.14.7"
 
       # astral-sh/setup-uv v9.0.0
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9

.github/workflows/publish.yml

@@ -45,7 +45,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
       - run: pip install -e ".[dev]"
       - run: python scripts/e2e/self_serve_acceptance.py
 
@@ -79,7 +79,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
       - run: pip install build
       - run: python -m build --wheel
       - name: Clean-wheel real-agent enterprise journey
@@ -137,7 +137,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
       # The published wheel is the exact one the real-agent journey installed
       # and exercised, whenever that journey ran.
       # actions/download-artifact v8.0.1
@@ -222,7 +222,7 @@ jobs:
       # actions/setup-python v7.0.0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
-          python-version: "3.12"
+          python-version: "3.14.7"
       - run: pip install twine
       - run: twine upload dist/*
         env:

pyproject.toml

@@ -4,7 +4,7 @@ version = "0.14.0"
 description = "Benchmark AI coding agents against your own codebase. Mine real tasks from repo history, run agents, interpret results."
 readme = "README.md"
 license = "Apache-2.0"
-requires-python = ">=3.11,<3.14"
+requires-python = ">=3.14.7,<3.15"
 authors = [
     { name = "codeprobe contributors" },
 ]

src/codeprobe/sandbox/Dockerfile.sg_only

@@ -3,7 +3,7 @@
 # Provides python + git + ripgrep + coreutils so agents can run read/search/
 # script workloads inside a container whose only writable surfaces are
 # those explicitly bind-mounted :rw by the caller.
-FROM python:3.12-slim
+FROM python:3.14-slim@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6
 
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONDONTWRITEBYTECODE=1 \