Python 3.14 (#236)

* Consistent capitalisation in dockerfile

* Bump 3.13 to 3.13.2 and make the default

3.13.3 has a bug with tests.
This is fixed on the 3.13 dev branch, so will likely be part of 3.13.4
See this commit for more info https://github.com/python/cpython/commit/cc39b19f0fca8db0f881ecaf02f88d72d9f93776

* Remove 3.12 in favour of 3.14-dev

* Bump numpy version installed in dev to one that works for 3.13

* Bump eval deps to latest versions

This commit also updates which dependencies are installed in each verison of Python, according to what works where.

* update tests to use new default python version

* Replace deprecated ubuntu 20.04 CI runner with 24.04

* Only test on ubuntu-latest

We previously used a matrixc to test cgroups v1 & v2. Now that ubuntu 20.04 is no longer supported by GitHub, we not longer have access to a runner with v1 cgroups.

4 files changed, 41 insertions, 45 deletions

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index b711276..270ab2b 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -11,11 +11,7 @@ on:
 jobs:
   test:
     name: Test with coverage
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-20.04, ubuntu-22.04]
-
+    runs-on: ubuntu-latest
     steps:
       - name: Download image artifact
         uses: actions/download-artifact@v4
@@ -40,7 +36,7 @@ jobs:
         run: |
           export IMAGE_SUFFIX='-venv:${{ inputs.version }}'
           docker compose run \
-            --rm -T -e COVERAGE_DATAFILE=.coverage.${{ matrix.os }} \
+            --rm -T -e COVERAGE_DATAFILE=.coverage \
             --entrypoint coverage \
             snekbox \
             run -m unittest
@@ -49,8 +45,8 @@ jobs:
       - name: Upload coverage data
         uses: actions/upload-artifact@v4
         with:
-          name: coverage-${{ matrix.os }}
-          path: .coverage.*
+          name: coverage
+          path: .coverage
           retention-days: 1
           include-hidden-files: true
 
@@ -76,12 +72,9 @@ jobs:
       - name: Download coverage data
         uses: actions/download-artifact@v4
         with:
-          pattern: coverage-*
+          pattern: coverage
           merge-multiple: true
 
-      - name: Combine coverage data
-        run: coverage combine .coverage.*
-
       - name: Display coverage report
         run: coverage report -m
 
diff --git a/Dockerfile b/Dockerfile
index 86823a4..0421d78 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.4
-FROM buildpack-deps:bookworm as builder-nsjail
+FROM buildpack-deps:bookworm AS builder-nsjail
 
 WORKDIR /nsjail
 
@@ -17,7 +17,7 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make
 
 # ------------------------------------------------------------------------------
-FROM buildpack-deps:bookworm as builder-py-base
+FROM buildpack-deps:bookworm AS builder-py-base
 
 ENV PYENV_ROOT=/pyenv \
     PYTHON_CONFIGURE_OPTS='--disable-test-modules --enable-optimizations \
@@ -29,21 +29,21 @@ RUN apt-get -y update \
         tk-dev \
     && rm -rf /var/lib/apt/lists/*
 
-RUN git clone -b v2.4.23 --depth 1 https://github.com/pyenv/pyenv.git $PYENV_ROOT
+RUN git clone -b v2.5.7 --depth 1 https://github.com/pyenv/pyenv.git $PYENV_ROOT
 
 COPY --link scripts/build_python.sh /
 
 # ------------------------------------------------------------------------------
-FROM builder-py-base as builder-py-3_12
-RUN /build_python.sh 3.12.8
+FROM builder-py-base AS builder-py-3_13
+RUN /build_python.sh 3.13.2
 # ------------------------------------------------------------------------------
-FROM builder-py-base as builder-py-3_13
-RUN /build_python.sh 3.13.1
+FROM builder-py-base AS builder-py-3_13t
+RUN /build_python.sh 3.13.2t
 # ------------------------------------------------------------------------------
-FROM builder-py-base as builder-py-3_13t
-RUN /build_python.sh 3.13.1t
+FROM builder-py-base AS builder-py-3_14
+RUN /build_python.sh 3.14-dev
 # ------------------------------------------------------------------------------
-FROM python:3.13-slim-bookworm as base
+FROM python:3.13-slim-bookworm AS base
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=false
@@ -57,15 +57,15 @@ RUN apt-get -y update \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --link --from=builder-nsjail /nsjail/nsjail /usr/sbin/
-COPY --link --from=builder-py-3_12 /snekbin/ /snekbin/
 COPY --link --from=builder-py-3_13 /snekbin/ /snekbin/
 COPY --link --from=builder-py-3_13t /snekbin/ /snekbin/
+COPY --link --from=builder-py-3_14 /snekbin/ /snekbin/
 
 RUN chmod +x /usr/sbin/nsjail \
-    && ln -s /snekbin/python/3.12/ /snekbin/python/default
+    && ln -s /snekbin/python/3.13/ /snekbin/python/default
 
 # ------------------------------------------------------------------------------
-FROM base as venv
+FROM base AS venv
 
 COPY --link requirements/ /snekbox/requirements/
 COPY --link scripts/install_eval_deps.sh /snekbox/scripts/install_eval_deps.sh
@@ -83,7 +83,7 @@ RUN if [ -n "${DEV}" ]; \
     then \
         pip install -U -r requirements/coverage.pip \
         && export PYTHONUSERBASE=/snekbox/user_base \
-        && /snekbin/python/default/bin/python -m pip install --user numpy~=1.19; \
+        && /snekbin/python/default/bin/python -m pip install --user numpy~=2.2.5; \
     fi
 
 # At the end to avoid re-installing dependencies when only a config changes.
diff --git a/requirements/eval-deps.pip b/requirements/eval-deps.pip
index 78bd20c..faaafec 100644
--- a/requirements/eval-deps.pip
+++ b/requirements/eval-deps.pip
@@ -1,24 +1,27 @@
-anyio[trio]~=4.7
+anyio[trio]~=4.9
 arrow~=1.3
-attrs~=24.3
-beautifulsoup4~=4.12
-einspect~=0.5; python_version == '3.12'
-fishhook~=0.3; python_version == '3.12'
+attrs~=25.3
+beautifulsoup4~=4.13
+
+# These packages don't support 3.13, 3.13t, nor 3.14-dev, so are commented out for now.
+# einspect~=0.5
+# fishhook~=0.3
+
 forbiddenfruit~=0.1
 fuzzywuzzy~=0.18
 kaleido~=0.2
 lark~=1.2
-matplotlib~=3.10; python_version == '3.12'
-more-itertools~=10.5
+matplotlib~=3.10; python_version == "3.13"
+more-itertools~=10.7
 networkx~=3.4
-numpy~=2.2
-pandas~=2.2
-pendulum~=3.0; python_version == '3.12'
-pyarrow~=18.1
+numpy~=2.2; python_version == "3.13"
+pandas~=2.2; python_version == "3.13"
+pendulum~=3.1
+pyarrow~=20.0; python_version == "3.13"
 python-dateutil~=2.9
 pyyaml~=6.0
-scipy~=1.15
-sympy~=1.13
-typing-extensions~=4.12
-tzdata~=2024.2
-yarl~=1.18
+scipy~=1.15; python_version == "3.13"
+sympy~=1.14
+typing-extensions~=4.13
+tzdata~=2025.2
+yarl~=1.20
diff --git a/tests/test_integration.py b/tests/test_integration.py
index ed44d86..d601a64 100644
--- a/tests/test_integration.py
+++ b/tests/test_integration.py
@@ -61,13 +61,13 @@ class IntegrationTests(unittest.TestCase):
             cases = [
                 (
                     get_python_version_body,
-                    "3.12\n",
+                    "3.13\n",
                     "test default executable is used when executable_path not specified",
                 ),
                 (
                     get_python_version_body
-                    | {"executable_path": "/snekbin/python/3.12/bin/python"},
-                    "3.12\n",
+                    | {"executable_path": "/snekbin/python/3.13/bin/python"},
+                    "3.13\n",
                     "test default executable is used when explicitly set",
                 ),
                 (