lib-detect-testenv 3.0.4__tar.gz → 3.0.5__tar.gz

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/.github/workflows/default_cicd_public.yml

@@ -124,9 +124,36 @@ jobs:
               print("No CI system dependencies configured for macOS.")
 
       - name: Install dev deps
-        shell: bash
+        shell: python
         run: |
-          uv pip install -e .[dev] --system
+          import os, subprocess, tempfile
+          from pathlib import Path
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+
+          # Push and pull_request runs install exactly the tree uv.lock pins - versions
+          # plus file hashes, which uv verifies - so CI tests what the lock ships and no
+          # release published upstream since the last lock refresh can enter the build.
+          # The nightly schedule run resolves afresh instead (still inside the project's
+          # [tool.uv] exclude-newer cooldown, which uv honours here): it is the canary
+          # that reports upstream breakage before a lock refresh adopts it. A project
+          # without a uv.lock keeps the unlocked install.
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          # Asking uv for an extra the project does not declare is a hard error.
+          extra = ["--extra", "dev"] if "dev" in data.get("project", {}).get("optional-dependencies", {}) else []
+          target = ["--system"]  # setup-python's interpreter; the job runs no venv
+          locked = Path("uv.lock").is_file() and os.environ["GITHUB_EVENT_NAME"] != "schedule"
+          if locked:
+              req = Path(tempfile.mkdtemp()) / "locked-requirements.txt"
+              # --locked fails when pyproject.toml changed without a lock refresh.
+              subprocess.check_call(["uv", "export", "--locked", "--no-emit-project", *extra, "-o", str(req), "--quiet"])
+              subprocess.check_call(["uv", "pip", "install", *target, "-r", str(req)])
+              subprocess.check_call(["uv", "pip", "install", *target, "--no-deps", "-e", "."])
+          else:
+              subprocess.check_call(["uv", "pip", "install", *target, "-e", ".[dev]" if extra else "."])
 
       - name: Install CI system dependencies (Windows/choco)
         if: runner.os == 'Windows'
@@ -236,7 +263,7 @@ jobs:
         continue-on-error: true
         shell: python
         run: |
-          import subprocess, sys, tempfile
+          import os, subprocess, sys, tempfile
           import rtoml
           from pathlib import Path
 
@@ -263,9 +290,18 @@ jobs:
 
           tmp = Path(tempfile.mkdtemp())
           req = tmp / "compiled-requirements.txt"
-          subprocess.check_call(
-              ["uv", "pip", "compile", *selector, "pyproject.toml", "-o", str(req), "--quiet"]
-          )
+          # With a uv.lock the install step put exactly the locked tree on the
+          # runner, so audit that tree; the schedule canary and lock-less
+          # projects resolve pyproject.toml afresh, as their install did.
+          if Path("uv.lock").is_file() and os.environ["GITHUB_EVENT_NAME"] != "schedule":
+              subprocess.check_call(
+                  ["uv", "export", "--locked", "--no-emit-project", "--no-hashes", *selector,
+                   "-o", str(req), "--quiet"]
+              )
+          else:
+              subprocess.check_call(
+                  ["uv", "pip", "compile", *selector, "pyproject.toml", "-o", str(req), "--quiet"]
+              )
 
           # Drop direct URL references ("pkg @ git+https://...") before auditing.
           # pip-audit cannot audit those (they are not on PyPI) but, given a

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/.gitignore

@@ -47,7 +47,8 @@ tmp_*
 # *.py[cod]: catches .pyc, .pyo, .pyd
 __pycache__/
 *.py[cod]
-*$py.class     # other compiled artifacts
+# other compiled artifacts
+*$py.class
 
 # pytest, coverage, MyPy, Hypothesis
 .pytest_cache/
@@ -73,12 +74,15 @@ coverage.xml
 # source/package builds
 build/
 dist/
-*.egg-info/    # metadata for pip installs
+# metadata for pip installs
+*.egg-info/
 *.egg
 *.whl
 pip-wheel-metadata/
-*.manifest     # PyInstaller metadata
-*.spec         # PyInstaller spec files
+# PyInstaller metadata
+*.manifest
+# PyInstaller spec files
+*.spec
 
 # Eggs, parts, wheels, sdist, etc.
 develop-eggs/
@@ -178,7 +182,6 @@ result
 # Optional lockfiles (for alternative managers)
 poetry.lock
 pdm.lock
-uv.lock
 
 # Local, per-developer settings (Claude Code etc.) - never commit
 *.local.json

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.5] 2026-10-15 14:11:33
+
+### Added
+- Python 3.15 is a supported version: declared in the classifiers, so CI and `make test-all` run it.
+- `uv.lock` is committed, and `[tool.uv] exclude-newer` sets a cooldown that keeps releases younger
+  than it out of the lock. CI installs exactly the locked tree on push and pull request; the nightly
+  scheduled run still resolves afresh to catch upstream breakage early.
+
+### Changed
+- The install section explains why installing with uv protects against supply-chain attacks and why
+  a plain `pip install` from PyPI does not.
+- `rtoml` floor raised to 0.14.0, the first release with Python 3.15 wheels.
+
 ## [3.0.4] 2026-08-01 00:14:59
 ### Fixed
 - **Console output no longer crashes on a legacy codepage.** A Windows console at codepage 1252

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/CLAUDE.md

@@ -1,36 +1,5 @@
 # Claude Code Guidelines for lib_detect_testenv
 
-## Session Initialization
-
-When starting a new session, read and apply the following system prompt files from `/media/srv-main-softdev/projects/softwarestack/systemprompts`:
-
-### Core Guidelines (Always Apply)
-- `core_programming_solid.md`
-
-### Bash-Specific Guidelines
-When working with Bash scripts:
-- use skill `bitranox:bash-reference` when in doubt of bash features or syntax
-- `core_programming_solid.md`
-- use skill `bitranox:bash-clean-architecture`
-- `bash_clean_code.md`
-- `bash_small_functions.md`
-
-### Python-Specific Guidelines
-When working with Python code:
-- `core_programming_solid.md`
-- `python_solid_architecture_enforcer.md`
-- use skill `bitranox:python-clean-architecture`
-- `python_clean_code.md`
-- `python_small_functions_style.md`
-- use skill `bitranox:python-use-modern-libraries`
-- `python_structure_template.md`
-
-### Additional Guidelines
-- `self_documenting.md`
-- `self_documenting_template.md`
-- `python_jupyter_notebooks.md`
-- `python_testing.md`
-
 ## Project Structure
 
 ```
@@ -98,32 +67,14 @@ lib_detect_testenv/
 - **Single Source of Truth**: Package version is in `pyproject.toml` (`[project].version`)
 - **Version Bumps**: update `pyproject.toml`, `CHANGELOG.md` and update the constants in `src/lib_detect_testenv/__init__conf__.py` according to `pyproject.toml`
     - Automation rewrites `src/lib_detect_testenv/__init__conf__.py` from `pyproject.toml`, so runtime code imports generated constants instead of querying `importlib.metadata`.
-    - After updating project metadata (version, summary, URLs, authors) run `make test` (or `python -m scripts.test`) to regenerate the metadata module before committing.
+    - bmk regenerates that metadata module itself - it runs as a stage of `make bump`, and again before every `make commit` / `make push`. `make test` does not regenerate it, and the generated constants are never hand-edited.
 - **Release Tags**: Format is `vX.Y.Z` (push tags for CI to build and publish)
 
-## Common Make Targets
+## Make targets specific to this repo
 
-| Target            | Description                                                                     |
-|-------------------|---------------------------------------------------------------------------------|
-| `build`           | Build wheel/sdist artifacts                                                     |
-| `bump`            | Bump version (VERSION=X.Y.Z or PART=major\|minor\|patch) and update changelog  |
-| `bump-major`      | Increment major version ((X+1).0.0)                                            |
-| `bump-minor`      | Increment minor version (X.Y.Z → X.(Y+1).0)                                    |
-| `bump-patch`      | Increment patch version (X.Y.Z → X.Y.(Z+1))                                    |
-| `clean`           | Remove caches, coverage, and build artifacts (includes `dist/` and `build/`)   |
-| `dev`             | Install package with dev extras                                                |
-| `help`            | Show make targets                                                              |
-| `install`         | Editable install                                                               |
-| `menu`            | Interactive TUI menu                                                           |
-| `push`            | Commit changes and push to GitHub (no CI monitoring)                           |
-| `release`         | Tag vX.Y.Z, push, sync packaging, run gh release if available                  |
-| `run`             | Run module entry (`python -m ... --help`)                                      |
-| `test`            | Lint, format, type-check, run tests with coverage, upload to Codecov           |
-| `version-current` | Print current version from `pyproject.toml`                                    |
+- `make run` - Run module entry (`python -m ... --help`)
 
-## Coding Style & Naming Conventions
-
-Follow the guidelines in `python_clean_code.md` for all Python code.
+Everything else is the generated bmk list: run `make help`.
 
 ## Architecture Overview
 
@@ -137,41 +88,10 @@ Import rules (enforced by import-linter):
 - `cli` depends on `lib_detect_testenv` and `behaviors`
 - Core detection functions have no internal dependencies
 
-Apply principles use skill `bitranox:python-clean-architecture` when designing and implementing features.
-
-## Security & Configuration
-
-- `.env` files are for local tooling only (CodeCov tokens, etc.)
-- **NEVER** commit secrets to version control
-- Rich logging should sanitize payloads before rendering
-
-## Documentation & Translations
-
-### Web Documentation
-- Update only English docs under `/website/docs`
-- Other languages are translated automatically
-- When in doubt, ask before modifying non-English documentation
-
-### App UI Strings (i18n)
-- Update only `sources/_locales/en` for string changes
-- Other languages are translated automatically
-- When in doubt, ask before modifying non-English locales
+Apply principles use skill `bitranox:coding-python-clean-architecture` when designing and implementing features.
 
 ## Commit & Push Policy
 
 ### Pre-Push Requirements
 - **Always run `make test` before pushing** to avoid lint/test breakage
 - Ensure all tests pass and code is properly formatted
-
-### Post-Push Monitoring
-- Monitor GitHub Actions for errors after pushing
-- Attempt to correct any CI/CD errors that appear
-
-## Claude Code Workflow
-
-When working on this project:
-1. Read relevant system prompts at session start
-2. Apply appropriate coding guidelines based on file type
-3. Run `make test` before commits
-4. Follow versioning guidelines for releases
-5. Monitor CI after pushing changes

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/Makefile

@@ -1,4 +1,4 @@
-# BMK MAKEFILE 3.14.0
+# BMK MAKEFILE 3.21.1
 # do not alter this file - it might be overwritten on new versions of BMK
 # if You want to alter it, remove the first line # BMK MAKEFILE 1.0 - then it is a custom makefile and will not be overwritten
 # bmk Makefile - thin wrapper using `uv tool upgrade` for persistent bmk
@@ -186,16 +186,50 @@ endif
 # BMK_MIN floors the FALLBACK install. The upgrade path does not consult it: uv re-resolves
 # the requirement recorded at install time, which is itself a `bmk>=...`, so it always lands
 # on the newest release and clears the floor anyway.
-BMK_MIN := 3.14.0
+BMK_MIN := 3.21.1
 
 # Absent env, missing check, or damaged env - all three mean "do not upgrade, rebuild".
 # `test -x` keeps a fresh machine quiet: there is no interpreter to run yet.
 BMK_INTACT := $(if $(BMK_PY),test -x "$(BMK_PY)" && "$(BMK_PY)" -m bmk_selfcheck,false)
 
+# The env this recipe mutates is shared by EVERY repo on the machine, so the mutation has to
+# wait for the bmk processes running out of it. Every bmk started from that env holds a
+# SHARED lock on <uv tool dir>/.bmk-tool.lock for its whole lifetime; these wrappers take
+# the same lock EXCLUSIVE for the length of the upgrade. Without it, a make here deleted the
+# site-packages out from under a bmk minutes into a test suite in an UNRELATED repo, and it
+# surfaced as an ImportError inside bmk's OWN dependencies that cleared on a re-run - so it
+# read as a flake rather than as the environment vanishing mid-gate.
+#
+# `bmk_toollock` is a second stdlib-only TOP-LEVEL module bmk ships, run on the tool env's
+# own interpreter. That is not circular: a uv tool env's bin/python is a SYMLINK to a base
+# interpreter OUTSIDE the tool dir, so the stdlib the guard runs on is not part of the tree
+# uv is about to replace, and the guard is read and compiled before uv is ever spawned.
+#
+# NOT uv's own <uv tool dir>/.lock, which uv does honour: `uv tool upgrade` and `uv tool
+# list` block on it too (measured), and the upgrade runs before every target - so a
+# gate-lifetime shared lock there would make every make on the machine, and every unrelated
+# `uv tool install`, wait for the longest-running gate.
+#
+# $(wildcard) rather than a shell test: on a machine with no tool env yet these expand to
+# NOTHING and the install runs bare, which is exactly what a first install needs.
+#
+# The bounded wait is load-bearing in both directions. An unbounded one would serialise
+# every repo's make behind the longest gate on the machine. A SKIPPED upgrade costs nothing
+# (the next make picks it up), so the upgrade skips. The REPAIR may not skip: proceeding
+# would leave a damaged env in place, so it fails and drops through to the retry.
+#
+# The LAST attempt is deliberately NEVER guarded, and a test pins that. The guard lives
+# inside the env being repaired, so on the path where that env is absent or broken the guard
+# may be broken too; an unguarded last resort is what stops a defective guard from making
+# `make` unrunnable in every repo at once. If bmk_toollock ever falls out of the wheel, every
+# make everywhere drops to a full reinstall - there is a packaging test for exactly that.
+BMK_LOCK := $(if $(wildcard $(BMK_PY)),"$(BMK_PY)" -m bmk_toollock --exclusive --timeout 10 --on-timeout skip --,)
+BMK_LOCK_REPAIR := $(if $(wildcard $(BMK_PY)),"$(BMK_PY)" -m bmk_toollock --exclusive --timeout 60 --on-timeout fail --,)
+
 .PHONY: _ensure_bmk
 _ensure_bmk:
-	@$(BMK_INTACT) && uv tool upgrade bmk \
-	  || uv tool install --reinstall --force "bmk>=$(BMK_MIN)" \
+	@$(BMK_INTACT) && $(BMK_LOCK) uv tool upgrade bmk \
+	  || $(BMK_LOCK_REPAIR) uv tool install --reinstall --force "bmk>=$(BMK_MIN)" \
 	  || uv tool install --reinstall --force "bmk>=$(BMK_MIN)"
 
 # ──────────────────────────────────────────────────────────────

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lib_detect_testenv
-Version: 3.0.4
+Version: 3.0.5
 Summary: Detect test environment - pytest, doctest, unittest, or regular execution
 Project-URL: Homepage, https://github.com/bitranox/lib_detect_testenv
 Project-URL: Repository, https://github.com/bitranox/lib_detect_testenv.git
@@ -18,24 +18,26 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: rich-click>=1.9.8
+Requires-Dist: rich-click>=1.9.9
 Provides-Extra: dev
 Requires-Dist: bandit<1.9,>=1.8.6; (python_version < '3.10') and extra == 'dev'
 Requires-Dist: bandit>=1.9.4; (python_version >= '3.10') and extra == 'dev'
-Requires-Dist: build>=1.5.0; extra == 'dev'
-Requires-Dist: click>=8.4.2; extra == 'dev'
+Requires-Dist: build>=1.6.1; extra == 'dev'
+Requires-Dist: click>=8.5.0; extra == 'dev'
 Requires-Dist: import-linter<2.6,>=2.5.2; (python_version < '3.10') and extra == 'dev'
-Requires-Dist: import-linter>=2.13; (python_version >= '3.10') and extra == 'dev'
+Requires-Dist: import-linter>=2.15; (python_version >= '3.10') and extra == 'dev'
 Requires-Dist: pip-audit>=2.10.1; extra == 'dev'
-Requires-Dist: pyright[nodejs]>=1.1.411; extra == 'dev'
+Requires-Dist: pyright[nodejs]>=1.1.414; extra == 'dev'
 Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
 Requires-Dist: pytest<9,>=8.4.2; (python_version < '3.10') and extra == 'dev'
 Requires-Dist: pytest>=9.1.1; (python_version >= '3.10') and extra == 'dev'
-Requires-Dist: rtoml>=0.13.0; extra == 'dev'
-Requires-Dist: ruff>=0.16.1; extra == 'dev'
-Requires-Dist: setuptools>=83.0.0; extra == 'dev'
+Requires-Dist: rtoml>=0.14.0; extra == 'dev'
+Requires-Dist: ruff>=0.17.0; extra == 'dev'
+Requires-Dist: setuptools>=84.0.0; extra == 'dev'
 Requires-Dist: textual>=8.2.8; extra == 'dev'
 Requires-Dist: twine>=7.0.0; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -72,7 +74,7 @@ This library provides utility functions to detect whether your code is running i
 
 ### Recommended: Install via UV
 
-UV is an ultrafast Python package installer written in Rust (10–20× faster than pip/poetry):
+UV is an ultrafast Python package installer written in Rust (10-20× faster than pip/poetry):
 
 ```bash
 # Install uv
@@ -107,9 +109,39 @@ For more installation methods (pipx, source builds, etc.), see [INSTALL.md](INST
 
 ### Python Version Requirements
 
-- **Python 3.9+** is required
+- **Python 3.10+** is required
 - Tested on Linux, macOS, and Windows
-- CI runs on CPython 3.9+ and PyPy
+- CI runs on CPython 3.10 to 3.15
+
+### Why we recommend uv: supply-chain protection
+
+This repository commits a `uv.lock`. It pins every package the project needs, transitive
+dependencies included, to an exact version and to the hashes of that version's files. The
+`exclude-newer` setting under `[tool.uv]` in `pyproject.toml` adds a cooldown: uv leaves any
+release younger than that out of the lock. CI installs from the lock, so a hijacked release that
+gets pulled again within the cooldown never reaches our builds, and a file whose hash does not
+match is refused.
+
+That protection stays in this repository. The installable package declares only lower bounds
+(`>=`) for its dependencies, so a plain `pip install` takes the newest release of every transitive
+dependency at the moment you run it. If one of them was hijacked an hour earlier, you get the
+hijacked version. `pipx install` and `uv tool install` without options do the same.
+
+To install the command line tool with a cooldown of your own (uv then skips any release younger
+than 7 days, transitive ones included), or to run the exact tree our CI tests:
+
+```bash
+uv tool install --exclude-newer "7 days" lib_detect_testenv
+git clone https://github.com/bitranox/lib_detect_testenv.git && cd lib_detect_testenv && uv sync --locked && uv run lib_detect_testenv --help
+```
+
+If you depend on lib_detect_testenv in your own project, give that project the same cooldown (7 days here, as
+an example) and commit the `uv.lock` that `uv add lib_detect_testenv` writes:
+
+```toml
+[tool.uv]
+exclude-newer = "7 days"
+```
 
 ## Usage
 
@@ -121,11 +153,11 @@ The package provides a CLI for shell scripting and CI/CD integration. All comman
 
 All detection commands use a **3-level exit code system**:
 
-| Code | Meaning | Use Case |
-|------|---------|----------|
-| **0** | Test environment **detected** | Success - test env found |
-| **1** | Test environment **not detected** | Normal negative result (not an error) |
-| **2** | **Error occurred** | Command failed (bad arguments, exception) |
+| Code  | Meaning                           | Use Case                                  |
+|-------|-----------------------------------|-------------------------------------------|
+| **0** | Test environment **detected**     | Success - test env found                  |
+| **1** | Test environment **not detected** | Normal negative result (not an error)     |
+| **2** | **Error occurred**                | Command failed (bad arguments, exception) |
 
 This design follows Unix conventions and makes shell scripting intuitive:
 

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/README.md

@@ -30,7 +30,7 @@ This library provides utility functions to detect whether your code is running i
 
 ### Recommended: Install via UV
 
-UV is an ultrafast Python package installer written in Rust (10–20× faster than pip/poetry):
+UV is an ultrafast Python package installer written in Rust (10-20× faster than pip/poetry):
 
 ```bash
 # Install uv
@@ -65,9 +65,39 @@ For more installation methods (pipx, source builds, etc.), see [INSTALL.md](INST
 
 ### Python Version Requirements
 
-- **Python 3.9+** is required
+- **Python 3.10+** is required
 - Tested on Linux, macOS, and Windows
-- CI runs on CPython 3.9+ and PyPy
+- CI runs on CPython 3.10 to 3.15
+
+### Why we recommend uv: supply-chain protection
+
+This repository commits a `uv.lock`. It pins every package the project needs, transitive
+dependencies included, to an exact version and to the hashes of that version's files. The
+`exclude-newer` setting under `[tool.uv]` in `pyproject.toml` adds a cooldown: uv leaves any
+release younger than that out of the lock. CI installs from the lock, so a hijacked release that
+gets pulled again within the cooldown never reaches our builds, and a file whose hash does not
+match is refused.
+
+That protection stays in this repository. The installable package declares only lower bounds
+(`>=`) for its dependencies, so a plain `pip install` takes the newest release of every transitive
+dependency at the moment you run it. If one of them was hijacked an hour earlier, you get the
+hijacked version. `pipx install` and `uv tool install` without options do the same.
+
+To install the command line tool with a cooldown of your own (uv then skips any release younger
+than 7 days, transitive ones included), or to run the exact tree our CI tests:
+
+```bash
+uv tool install --exclude-newer "7 days" lib_detect_testenv
+git clone https://github.com/bitranox/lib_detect_testenv.git && cd lib_detect_testenv && uv sync --locked && uv run lib_detect_testenv --help
+```
+
+If you depend on lib_detect_testenv in your own project, give that project the same cooldown (7 days here, as
+an example) and commit the `uv.lock` that `uv add lib_detect_testenv` writes:
+
+```toml
+[tool.uv]
+exclude-newer = "7 days"
+```
 
 ## Usage
 
@@ -79,11 +109,11 @@ The package provides a CLI for shell scripting and CI/CD integration. All comman
 
 All detection commands use a **3-level exit code system**:
 
-| Code | Meaning | Use Case |
-|------|---------|----------|
-| **0** | Test environment **detected** | Success - test env found |
-| **1** | Test environment **not detected** | Normal negative result (not an error) |
-| **2** | **Error occurred** | Command failed (bad arguments, exception) |
+| Code  | Meaning                           | Use Case                                  |
+|-------|-----------------------------------|-------------------------------------------|
+| **0** | Test environment **detected**     | Success - test env found                  |
+| **1** | Test environment **not detected** | Normal negative result (not an error)     |
+| **2** | **Error occurred**                | Command failed (bad arguments, exception) |
 
 This design follows Unix conventions and makes shell scripting intuitive:
 

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "lib_detect_testenv"
-version = "3.0.4"
+version = "3.0.5"
 description = "Detect test environment - pytest, doctest, unittest, or regular execution"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-  "rich-click>=1.9.8",
+  "rich-click>=1.9.9",
 ]
 license = { text = "MIT" }
 authors = [{ name = "bitranox", email = "bitranox@gmail.com" }]
@@ -17,6 +17,8 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "License :: OSI Approved :: MIT License",
   "Environment :: Console",
   "Operating System :: OS Independent",
@@ -33,13 +35,11 @@ dev = [
   "pytest>=8.4.2,<9; python_version<'3.10'",
   "pytest>=9.1.1; python_version>='3.10'",
   "pytest-cov>=7.1.0",
-  "ruff>=0.16.1",
-  "pyright[nodejs]>=1.1.411",
+  "ruff>=0.17.0",
+  "pyright[nodejs]>=1.1.414",
   "bandit>=1.8.6,<1.9; python_version<'3.10'",
   "bandit>=1.9.4; python_version>='3.10'",
-  # 1.5.1 was yanked upstream (unintended breaking changes), so 1.5.0 is the newest usable
-  # release; a >=1.5.1 floor has ZERO candidates and makes this extra unresolvable.
-  "build>=1.5.0",
+  "build>=1.6.1",
   "twine>=7.0.0",
   # codecov-cli is disabled, not dropped: it requires click<8.3.0, which drags click back to
   # 8.2.1 - the version with CVE-2026-7246 (command injection in click.edit(), fixed in 8.3.3).
@@ -49,13 +49,13 @@ dev = [
   # Re-enable once codecov-cli relaxes its click<8.3.0 pin.
   # "codecov-cli>=11.2.8",
   # Transitive CVE pins
-  "click>=8.4.2",                # CVE-2026-7246
+  "click>=8.5.0",                # CVE-2026-7246
   "pip-audit>=2.10.1",
   "textual>=8.2.8",
   "import-linter>=2.5.2,<2.6; python_version<'3.10'",
-  "import-linter>=2.13; python_version>='3.10'",
-  "setuptools>=83.0.0",
-  "rtoml>=0.13.0",
+  "import-linter>=2.15; python_version>='3.10'",
+  "setuptools>=84.0.0",
+  "rtoml>=0.14.0",
 ]
 
 [project.scripts]
@@ -200,3 +200,6 @@ ignore-vulns = ["GHSA-4xh5-x5gv-qwph", "PYSEC-2022-42969", "CVE-2026-25990", "CV
 [tool.bashate]
 max-line-length = 120
 ignores = ["E003"]
+
+[tool.uv]
+exclude-newer = "1 day"

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/src/lib_detect_testenv/__init__conf__.py

@@ -26,7 +26,7 @@ name = "lib_detect_testenv"
 #: Human-readable summary shown in CLI help output.
 title = "Detect test environment - pytest, doctest, unittest, or regular execution"
 #: Current release version pulled from ``pyproject.toml`` by automation.
-version = "3.0.4"
+version = "3.0.5"
 #: Repository homepage presented to users.
 homepage = "https://github.com/bitranox/lib_detect_testenv"
 #: Author attribution surfaced in CLI output.

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/src/lib_detect_testenv/safe_console.py

@@ -64,13 +64,19 @@ ASCII_FALLBACKS: Final[dict[str, str]] = {
 _UNIVERSAL_ENCODINGS: Final[frozenset[str]] = frozenset({"utf-8", "utf8", "utf-16", "utf16", "utf-32", "utf32"})
 
 
-def _stream_encoding(file: IO[Any] | None) -> str | None:
+def _stream_encoding(file: IO[Any] | None, *, err: bool = False) -> str | None:
     """Return the target stream's encoding, or None when it cannot be determined.
 
     An unknown encoding means the caller gets the original text: guessing would
     degrade output that may well have been fine.
+
+    With no explicit `file` the answer comes from ``sys.stdout``/``sys.stderr``,
+    which is what :func:`click.echo` resolves its own default target from. click
+    exposes no supported way to ask for that stream: ``get_text_stream`` was
+    deprecated in click 8.5.0 and is removed in 9.0, its documented replacement
+    being to let ``echo`` resolve the stream itself.
     """
-    stream = file if file is not None else click.get_text_stream("stdout")
+    stream = file if file is not None else (sys.stderr if err else sys.stdout)
     encoding = getattr(stream, "encoding", None)
     return encoding if isinstance(encoding, str) else None
 
@@ -135,8 +141,7 @@ def echo(message: object = "", *, file: IO[Any] | None = None, err: bool = False
     Writes to the given stream.
     """
     text = message if isinstance(message, str) else str(message)
-    target = file if file is not None else click.get_text_stream("stderr" if err else "stdout")
-    click.echo(encode_safe(text, _stream_encoding(target)), file=target, nl=nl)
+    click.echo(encode_safe(text, _stream_encoding(file, err=err)), file=file, err=err, nl=nl)
 
 
 class _SafeWriter:

{lib_detect_testenv-3.0.4 → lib_detect_testenv-3.0.5}/tests/test_safe_console.py

@@ -8,6 +8,7 @@ keeps the next output line someone adds covered by construction.
 from __future__ import annotations
 
 import io
+import sys
 from pathlib import Path
 
 import pytest
@@ -78,6 +79,30 @@ class TestEchoOnAUtf8Console:
         assert "\u2713" in buffer.getvalue().decode("utf-8")
 
 
+class TestTheDefaultTargetFollowsTheStreamEchoWritesTo:
+    """With no `file`, the encoding must come from the stream `echo` lands on.
+
+    click resolves that target itself from ``sys.stdout``/``sys.stderr``. Judge
+    the wrong stream and a legacy-codepage console gets exactly the crash this
+    module exists to prevent, while every test passing an explicit `file` stays
+    green and says nothing about it.
+    """
+
+    def test_a_cp1252_stdout_degrades_the_glyph(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        stream = _cp1252_stream()
+        monkeypatch.setattr(sys, "stdout", stream)
+        safe_console.echo("✓ deployed")
+        assert "[OK]" in _read_back(stream)
+
+    def test_err_is_judged_against_stderr_not_stdout(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """A stdout that could take the glyph must not excuse a cp1252 stderr."""
+        stream = _cp1252_stream()
+        monkeypatch.setattr(sys, "stdout", io.TextIOWrapper(io.BytesIO(), encoding="utf-8", newline=""))
+        monkeypatch.setattr(sys, "stderr", stream)
+        safe_console.echo("✓ deployed", err=True)
+        assert "[OK]" in _read_back(stream)
+
+
 class TestSafeStreamProtectsRich:
     """Rich raises on a legacy codepage too; it renders through its own writer."""