chore(deps): update container image python to v3.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
python	stage	minor	3.13-slim → 3.14-slim

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 63f354f6-e04a-4b10-916e-67e4908e9455

📥 Commits

Reviewing files that changed from the base of the PR and between d0d5887 and 6e32e5b.

📒 Files selected for processing (1)

• .github/workflows/ci.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated backend Python runtime to 3.14 to provide a newer baseline with security and compatibility improvements.
  • Relaxed Pydantic dependency to >=2.13,<3 to allow newer fixes and features while maintaining compatibility.
  • Increased CI job timeout to reduce risk of spurious build/test interruptions.
  • No user-facing API changes expected; behavior should remain unchanged for end users.

Walkthrough

The Docker backend base image is updated to python:3.14-slim, pydantic is bumped to >= 2.13.0, < 3, and the CI build-and-test job timeout is increased from 15 to 30 minutes.

Changes

Backend environment and CI updates

Layer / File(s)	Summary
Backend base image version upgrade Dockerfile	backend-base stage FROM changed from python:3.13-slim to python:3.14-slim, propagating to downstream stages (backend-builder, test, production).
Pydantic dependency bump backend/pyproject.toml	pydantic constraint updated from ~= 2.9.0 to >= 2.13.0, < 3 in the project dependencies.
CI timeout increase .github/workflows/ci.yaml	build-and-test job timeout-minutes increased from 15 to 30.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• Renovate Dashboard #129 — touches the same Dockerfile Python base update (python:3.13-slim → python:3.14-slim).

Possibly related PRs

• anthony-spruyt/firemerge#266 — also modified the Dockerfile’s backend base image digests and related build environment.

Suggested labels

github actions

Suggested reviewers

• anthony-spruyt
• skynet-rw

Poem

🐰 I hopped through Docker lines so bright,
Swapped thirteen to fourteen in the night.
I nudged a pydantic bound so neat,
Gave CI more time to bake the feat.
A carrot tap, the build's complete.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change of updating Python in the container image from 3.13 to 3.14, and meets the 50-character guideline at 51 characters.
Description check	✅ Passed	The description is related to the changeset, providing details about the Python version update, though it does not mention the other changes to pydantic and CI timeout.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/python-3.14

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 default

Wonderful, this rule succeeded.

• #approved-reviews-by >= 1

[skynet-rw]

Python 3.14 upgrade breaks the build because uvloop==0.21.0 (locked in uv.lock) cannot build from source on Python 3.14: pyo3-ffi v0.22.2 rejects Python 3.14 as "too new." uvloop 0.22.0 (released 2025-10-16) explicitly added Python 3.14 support (MagicStack/uvloop#638). uvloop is a transitive dependency pulled in by uvicorn[standard]; pyproject.toml does not pin it directly. Fix: run cd backend && uv lock --upgrade-package uvloop to update uv.lock to uvloop>=0.22.0. No other dependencies appear affected by the Python 3.14 upgrade.

[skynet-rw]

Updated backend/uv.lock to upgrade uvloop from 0.21.0 to 0.22.1. uvloop 0.21.0 cannot build on Python 3.14 because pyo3-ffi v0.22.2 rejects Python 3.14 as too new. uvloop 0.22.0 (released 2025-10-16) explicitly added Python 3.14 support. Ran python3 -m uv lock --upgrade-package uvloop in the backend directory to update only uvloop while keeping all other locked dependencies unchanged.

[skynet-rw]

PR upgrades the Python Docker base image from 3.13-slim to 3.14-slim. A prior triage correctly identified that uvloop 0.21.0 (transitive via uvicorn[standard]) could not build on Python 3.14 due to pyo3-ffi v0.22.2 rejecting 3.14 as "too new"; a fix agent pushed commit 3d330c2 upgrading uv.lock to uvloop 0.22.1 which ships cp314 wheels and explicitly supports Python 3.14. However, CI "Build and test" is still failing on the fix commit HEAD with no log summary available, indicating either an additional Python 3.14 compatibility issue remains unresolved or CI needs to be re-triggered. All security scans (Trivy, gitleaks, secretlint, CodeQL) pass. Fix agent should inspect the "Build and test" CI logs to identify any remaining Python 3.14 incompatibilities beyond uvloop.

[skynet-rw]

Root cause: pydantic ~=2.9.0 pinned pydantic-core to 2.23.4 which has no cp314 wheels and fails to build from source on Python 3.14 (pyo3-ffi v0.22.2 rejects Python 3.14 as "too new").

Fix: bumped pydantic constraint from ~= 2.9.0 to >= 2.13.0 in backend/pyproject.toml and regenerated backend/uv.lock. This pulls in pydantic-core 2.46.4 which ships prebuilt cp314 wheels (confirmed on PyPI). All pydantic APIs used in the codebase (BaseModel, model_validator, model_dump, model_copy, TypeAdapter, discriminated unions, ConfigDict) are stable across 2.9→2.13 — no application code changes needed. Ruff lint and format checks pass locally.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/pyproject.toml`:
- Line 16: Change the pydantic dependency spec from "pydantic >= 2.13.0" to
include an exclusive upper bound "<3" (e.g., "pydantic >= 2.13.0, <3") so the
project stays on Pydantic v2; after updating the dependency string (the one
matching "pydantic >= 2.13.0") run your dependency manager to refresh the
lockfile (poetry lock / pip-compile / pipenv lock etc.) so the lockfile and CI
use the new constraint.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6e888d6d-2f13-494a-bd70-cbc45ef181ef

📥 Commits

Reviewing files that changed from the base of the PR and between 33cb518 and c43760f.

⛔ Files ignored due to path filters (1)

• backend/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• backend/pyproject.toml

[skynet-rw]

Python base image bumped from 3.13-slim to 3.14-slim. Two Python 3.14 build-compatibility issues were identified by prior triage passes and resolved by fix agents: (1) uvloop 0.21.0 (transitive via uvicorn[standard]) lacked cp314 wheel support — fixed by upgrading uv.lock to uvloop 0.22.1; (2) pydantic ~=2.9.0 locked pydantic-core 2.23.4 which also lacked cp314 wheels — fixed by relaxing constraint to pydantic >=2.13.0, pulling in pydantic-core 2.46.4 with prebuilt cp314 wheels. All pydantic APIs in use (BaseModel, model_validator, discriminated unions, ConfigDict) are stable across 2.9→2.13. CI "Build and test" and all security scans (Trivy, CodeQL, gitleaks, secretlint) pass on HEAD c43760f. The only failing check is Mergify's human-approval gate, which is not a technical blocker.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-05-28 07:42 UTC · Rule: default
• ✅ Checks passed · on draft merge queue: embarking main (df1e007) and #303 together #305
• ✅ Merged — 2026-05-28 07:47 UTC · at 6e32e5beb9bc0d4ac7c069697ec2571fc57a34fd · squash

This pull request spent 4 minutes 52 seconds in the queue, including 4 minutes 26 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1
  • chore(deps): update container image python to v3.14 #303
• #review-threads-unresolved = 0 [🛡 GitHub repository ruleset rule pr-rules]
  • chore(deps): update container image python to v3.14 #303
• -draft
  • chore(deps): update container image python to v3.14 #303
• check-success = summary / Check Results
• all of [🛡 Merge Protections rule default]:
  • #approved-reviews-by >= 1
    • chore(deps): update container image python to v3.14 #303
• any of [🛡 GitHub repository ruleset rule pr-rules]:
  • check-success = summary / Check Results
  • check-neutral = summary / Check Results
  • check-skipped = summary / Check Results
• any of [🛡 GitHub repository ruleset rule pr-rules]:
  • check-neutral = Mergify Merge Protections
  • check-skipped = Mergify Merge Protections
  • check-success = Mergify Merge Protections