Security: bump deps, retire EOL Pythons, add Python 3.14

.github/workflows/python-publish.yml

@@ -25,26 +25,34 @@ jobs:
         os: [ubuntu-22.04, windows-2022, macos-11]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.15.0
+        uses: pypa/cibuildwheel@v2.21.3
+        env:
+          # Build wheels only for supported (non-EOL) CPython versions.
+          # Keep this list in sync with the python_requires in setup.cfg
+          # and the tox.yml test matrix.
+          CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-* cp314-*"
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
+          # upload-artifact@v4 requires a unique name per matrix entry.
+          name: wheels-${{ matrix.os }}
           path: ./wheelhouse/*.whl
 
   build_sdist:
     name: Build source distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Build sdist
         run: pipx run build --sdist
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
+          name: sdist
           path: dist/*.tar.gz
 
   upload_pypi:
@@ -54,9 +62,15 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
-          name: artifact
+          # Pull every artifact from build_wheels (one per matrix os) and
+          # build_sdist, flattening them into dist/ for the publisher.
           path: dist
+          pattern: "*"
+          merge-multiple: true
 
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      # Pinned to an exact tag (rather than the moving release/v1) to lock
+      # down the action used for the actual PyPI upload via Trusted
+      # Publishing.
+      - uses: pypa/gh-action-pypi-publish@v1.10.3

.github/workflows/tox.yml

@@ -7,11 +7,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies

README.rst

@@ -26,7 +26,7 @@ library:
 - Text file histogram log writer and log reader (.hlog file)
 - Dump histogram in plot-friendly percentile table (.hgrm format)
 - Encoding and decoding Hdr Histogram "histoblobs" (HdrHistogram V2 format only, V1 and V0 not supported)
-- supports python 3.x (0.9.2 is the latest release supporting python 2.7)
+- supports Python 3.10, 3.11, 3.12, 3.13 and 3.14 (0.9.2 is the latest release supporting python 2.7)
 
 
 Histogram V2 format encoding inter-operability with Java and C versions verified through unit test code.
@@ -128,7 +128,7 @@ Installation
 ------------
 Pre-requisites:
 
-Make sure you have python 3.x, and pip installed
+Make sure you have Python 3.10 or later, and pip installed
 
 Binary installation
 ^^^^^^^^^^^^^^^^^^^
@@ -320,7 +320,7 @@ Example of run on Linux:
 
    # pytest -s -k test_cod_perf --runperf
    =============================================================================== test session starts ================================================================================
-   platform linux -- Python 3.6.8, pytest-6.0.1, py-1.9.0, pluggy-0.13.1
+   platform linux -- Python 3.13.3, pytest-8.3.5, pluggy-1.5.0
    rootdir: /root/HdrHistogram_py, configfile: tox.ini
    collected 39 items / 38 deselected / 1 selected
 
@@ -379,7 +379,7 @@ And for decoding:
 
    # pytest -s -k test_dec_perf --runperf
    =============================================================================== test session starts ================================================================================
-   platform linux -- Python 3.6.8, pytest-6.0.1, py-1.9.0, pluggy-0.13.1
+   platform linux -- Python 3.13.3, pytest-8.3.5, pluggy-1.5.0
    rootdir: /root/HdrHistogram_py, configfile: tox.ini
    collected 39 items / 38 deselected / 1 selected
 

pylint.rc

@@ -321,6 +321,9 @@ valid-metaclass-classmethod-first-arg=mcs
 # Maximum number of arguments for function / method
 max-args=12
 
+# Maximum number of positional arguments for function / method (pylint 3.x)
+max-positional-arguments=7
+
 # Maximum number of attributes for a class (see R0902).
 max-attributes=32
 
@@ -386,4 +389,4 @@ known-third-party=enchant
 
 # Exceptions that will emit a warning when being caught. Defaults to
 # "Exception"
-overgeneral-exceptions=Exception
+overgeneral-exceptions=builtins.Exception

requirements.txt

@@ -1 +1,4 @@
 pbr>=1.4
+# Transitive build-time dep, pinned to fix CVE-2024-6345 (RCE in
+# PackageIndex.download) and CVE-2025-47273 (path traversal in PackageIndex).
+setuptools>=78.1.1

setup.cfg

@@ -6,6 +6,7 @@ description-file =
 author = Alec Hothan
 author-email = ahothan@gmail.com
 home-page = https://github.com/HdrHistogram/HdrHistogram_py
+python_requires = >=3.10
 classifier =
     Intended Audience :: Developers
     Intended Audience :: Information Technology
@@ -15,12 +16,11 @@ classifier =
     Operating System :: MacOS
     Programming Language :: Python
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.6
-    Programming Language :: Python :: 3.7
-    Programming Language :: Python :: 3.8
-    Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
+    Programming Language :: Python :: 3.12
+    Programming Language :: Python :: 3.13
+    Programming Language :: Python :: 3.14
 
 [files]
 packages =

test-requirements.txt

@@ -1,3 +1,6 @@
-pytest>=2.7.2
-pylint>=1.7.1
-pytest-cov>=2.9
+pytest>=8.0.0
+pylint>=3.0.0
+pytest-cov>=5.0.0
+# Transitive (via importlib_metadata), pinned to fix CVE-2024-5569
+# (infinite-loop DoS in zipp.Path).
+zipp>=3.19.1

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = py36, py37, py38, py39, py310, py311, lint
+envlist = py310, py311, py312, py313, py314, lint
 
 [testenv:lint]
 commands = pylint --rcfile pylint.rc hdrh test