Update Python support through 3.14

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.12
+        run: uv python install 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -121,7 +121,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.12
+        run: uv python install 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -177,6 +177,8 @@ jobs:
   python-sdk:
     name: Python SDK (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: "3.14"
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
@@ -191,7 +193,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.12
+        run: uv python install 3.12 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -268,7 +270,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.10 3.11 3.12 3.13
+        run: uv python install 3.10 3.11 3.12 3.13 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -284,7 +286,7 @@ jobs:
 
       - name: Build all Python packages
         run: |
-          export INTERPRETERS="--interpreter $(uv python find 3.10) $(uv python find 3.11) $(uv python find 3.12) $(uv python find 3.13)"
+          export INTERPRETERS="--interpreter $(uv python find 3.10) $(uv python find 3.11) $(uv python find 3.12) $(uv python find 3.13) $(uv python find 3.14)"
           just python-dist
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -307,7 +309,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.10 3.11 3.12 3.13
+        run: uv python install 3.10 3.11 3.12 3.13 3.14
 
       - name: Install just
         run: cargo install --locked just
@@ -318,7 +320,7 @@ jobs:
       - name: Build backend wheels
         shell: pwsh
         run: |
-          $interps = "3.10", "3.11", "3.12", "3.13" | ForEach-Object { & uv python find $_ }
+          $interps = "3.10", "3.11", "3.12", "3.13", "3.14" | ForEach-Object { & uv python find $_ }
           $env:INTERPRETERS = "--interpreter $($interps -join ' ')"
           just python-dist-backends
 
@@ -335,7 +337,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
-        python: ["3.10", "3.11", "3.12", "3.13"]
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
 

.github/workflows/publish.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.10 3.11 3.12 3.13
+        run: uv python install 3.10 3.11 3.12 3.13 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -52,7 +52,7 @@ jobs:
 
       - name: Build all Python packages
         run: |
-          export INTERPRETERS="--interpreter $(uv python find 3.10) $(uv python find 3.11) $(uv python find 3.12) $(uv python find 3.13)"
+          export INTERPRETERS="--interpreter $(uv python find 3.10) $(uv python find 3.11) $(uv python find 3.12) $(uv python find 3.13) $(uv python find 3.14)"
           just python-dist
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -76,7 +76,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.10 3.11 3.12 3.13
+        run: uv python install 3.10 3.11 3.12 3.13 3.14
 
       - name: Install just
         run: cargo install --locked just
@@ -87,7 +87,7 @@ jobs:
       - name: Build backend wheels
         shell: pwsh
         run: |
-          $interps = "3.10", "3.11", "3.12", "3.13" | ForEach-Object { & uv python find $_ }
+          $interps = "3.10", "3.11", "3.12", "3.13", "3.14" | ForEach-Object { & uv python find $_ }
           $env:INTERPRETERS = "--interpreter $($interps -join ' ')"
           just python-dist-backends
 
@@ -140,7 +140,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.12
+        run: uv python install 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -197,7 +197,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
       - name: Install Python
-        run: uv python install 3.12
+        run: uv python install 3.14
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:

README.md

@@ -57,6 +57,8 @@ Requires [KVM](https://help.ubuntu.com/community/KVM/Installation), [MSHV](https
 
 Python SDK:
 
+The Python SDK and packaged Wasm guest wheels support CPython 3.10 through 3.14.
+
 ```shell
 uv pip install "hyperlight-sandbox[wasm,python_guest]"
 ```

src/sdk/python/Justfile

@@ -1,13 +1,20 @@
 set windows-shell := ["pwsh", "-NoLogo", "-Command"]
 
 repo-root := invocation_directory_native()
+python-root := repo-root + "/src/sdk/python"
 export WIT_WORLD := repo-root + "/src/wasm_sandbox/wit/sandbox-world.wasm"
 rmrf := if os() == "windows" { "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue" } else { "rm -rf" }
 mkdirp := if os() == "windows" { "New-Item -ItemType Directory -Force" } else { "mkdir -p" }
+uv-python-env := "UV_PYTHON"
+python-version-flag := "--python"
 
-# Set via env or CLI (e.g. `just interpreters="--interpreter python3.10 python3.13" python-dist`)
+# Set via env or CLI (e.g. `just interpreters="--interpreter python3.10 python3.14" python-dist`)
 # to build wheels for multiple Python versions. Defaults to empty (maturin uses active Python).
 interpreters := env("INTERPRETERS", "")
+# Atheris currently supports fuzzing on Python <= 3.12. Keep the rest of the
+# SDK test/build surface on the active Python while running fuzz on 3.12.
+default-fuzz-python := "3.12"
+fuzz-python := env("FUZZ_PYTHON", default-fuzz-python)
 
 dist-root := repo-root + "/dist/pythonsdk"
 core-dist := dist-root + "/core"
@@ -32,23 +39,28 @@ python-sync-guest-resources:
 # Install pure Python dependencies from the lockfile into the local venv.
 # Skips the two Rust backend packages — those are compiled and installed
 # separately by `python-install-backends` via `maturin develop`.
-python-sync-env:
-    uv sync --frozen --inexact --no-install-package hyperlight-sandbox-backend-wasm --no-install-package hyperlight-sandbox-backend-hyperlight-js
+python-sync-env python-version="" $UV_PYTHON=(if python-version != "" { python-version } else { env(uv-python-env, "") }) python-version-arg=(if python-version != "" { python-version-flag + " " + python-version } else { "" }):
+    uv sync {{python-version-arg}} --frozen --inexact --no-install-package hyperlight-sandbox-backend-wasm --no-install-package hyperlight-sandbox-backend-hyperlight-js
 
 # Install maturin backends into the local venv for development (maturin develop).
 # This compiles the Rust backend crates and installs them as editable packages
 # in the local venv so you can `import hyperlight_sandbox` directly.
 # For distributable wheels, use `python-dist` (maturin build) instead.
 # Use `just python python-build` for debug, `just python python-build release` for release.
-python-install-backends profile="debug":
+[private]
+python-clean-backend-artifacts profile="debug":
     -{{ if profile == "release" { rmrf + " " + repo-root + "/target/release/build/hyperlight-wasm-*" } else { "" } }}
     -{{ if profile == "release" { rmrf + " " + repo-root + "/target/release/.fingerprint/hyperlight-wasm-*" } else { "" } }}
     -{{ if profile == "release" { rmrf + " " + repo-root + "/target/release/build/hyperlight-js-*" } else { "" } }}
     -{{ if profile == "release" { rmrf + " " + repo-root + "/target/release/.fingerprint/hyperlight-js-*" } else { "" } }}
-    cd {{repo-root}}/src/sdk/python/wasm_backend && uv run --no-sync maturin develop {{ if profile == "release" { "--release" } else { "" } }}
-    cd {{repo-root}}/src/sdk/python/hyperlight_js_backend && uv run --no-sync maturin develop {{ if profile == "release" { "--release" } else { "" } }}
 
-python-build profile="debug": python-sync-guest-resources python-sync-env (python-install-backends profile)
+[private]
+python-develop-backend backend profile="debug" python-version="" $UV_PYTHON=(if python-version != "" { python-version } else { env(uv-python-env, "") }) python-version-arg=(if python-version != "" { python-version-flag + " " + python-version } else { "" }) profile-arg=(if profile == "release" { "--release" } else { "" }):
+    uv run --directory {{python-root}}/{{backend}} --no-sync {{python-version-arg}} maturin develop {{profile-arg}}
+
+python-install-backends profile="debug" python-version="": (python-clean-backend-artifacts profile) (python-develop-backend "wasm_backend" profile python-version) (python-develop-backend "hyperlight_js_backend" profile python-version)
+
+python-build profile="debug" python-version="": python-sync-guest-resources (python-sync-env python-version) (python-install-backends profile python-version)
 
 build: python-build
 
@@ -81,20 +93,20 @@ python-publish repository="pypi":
 # Smoke-test the wheels in dist/pythonsdk/ by installing them into
 # isolated environments and running basic tests.
 # Requires `just python-dist` (root) to have been run first.
-python-wheelhouse-test python-version="":
-    uv run --no-project {{ if python-version != "" { "--python " + python-version } else { "" } }} --no-index \
+python-wheelhouse-test python-version="" python-version-arg=(if python-version != "" { python-version-flag + " " + python-version } else { "" }):
+    uv run --no-project {{python-version-arg}} --no-index \
         --find-links={{core-dist}} \
         --find-links={{wasm-wheels}} \
         --find-links={{python-guest-dist}} \
         --with "hyperlight-sandbox[wasm,python_guest]" \
         python {{repo-root}}/src/sdk/python/tests/wheelhouse_wasm_python.py
-    uv run --no-project {{ if python-version != "" { "--python " + python-version } else { "" } }} --no-index \
+    uv run --no-project {{python-version-arg}} --no-index \
         --find-links={{core-dist}} \
         --find-links={{wasm-wheels}} \
         --find-links={{javascript-guest-dist}} \
         --with "hyperlight-sandbox[wasm,javascript_guest]" \
         python {{repo-root}}/src/sdk/python/tests/wheelhouse_wasm_js.py
-    uv run --no-project {{ if python-version != "" { "--python " + python-version } else { "" } }} --no-index \
+    uv run --no-project {{python-version-arg}} --no-index \
         --find-links={{core-dist}} \
         --find-links={{hyperlight-js-wheels}} \
         --find-links={{javascript-guest-dist}} \
@@ -141,5 +153,5 @@ fmt-check:
 python-test: python-build
     uv run python -m unittest discover -s {{repo-root}}/src/sdk/python/core/tests -p 'test_*.py' -v
 
-python-fuzz seconds="60": python-build
-    {{ if os() == "windows" { "echo 'Skipping python fuzz (atheris not available on Windows)'" } else { "uv run --package hyperlight-sandbox --extra dev python " + repo-root + "/src/sdk/python/core/tests/fuzz_tool_dispatch.py -max_total_time=" + seconds } }}
+python-fuzz seconds="60": (python-build "debug" fuzz-python)
+    {{ if os() == "windows" { "echo 'Skipping python fuzz (atheris not available on Windows)'" } else { "UV_PYTHON=" + fuzz-python + " uv run --python " + fuzz-python + " --package hyperlight-sandbox --extra dev python " + repo-root + "/src/sdk/python/core/tests/fuzz_tool_dispatch.py -max_total_time=" + seconds } }}

src/sdk/python/core/pyproject.toml

@@ -10,11 +10,16 @@ readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.10"
 dependencies = []
-optional-dependencies = { wasm = ["hyperlight-sandbox-backend-wasm>=0.4.0"], hyperlight_js = ["hyperlight-sandbox-backend-hyperlight-js>=0.4.0"], python_guest = ["hyperlight-sandbox-python-guest>=0.4.0"], javascript_guest = ["hyperlight-sandbox-javascript-guest>=0.4.0"], dev = ["atheris>=2.3.0"] }
+optional-dependencies = { wasm = ["hyperlight-sandbox-backend-wasm>=0.4.0"], hyperlight_js = ["hyperlight-sandbox-backend-hyperlight-js>=0.4.0"], python_guest = ["hyperlight-sandbox-python-guest>=0.4.0"], javascript_guest = ["hyperlight-sandbox-javascript-guest>=0.4.0"], dev = ["atheris>=2.3.0; python_version < '3.13'"] }
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
     "Operating System :: Microsoft :: Windows",

src/sdk/python/hyperlight_js_backend/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["maturin>=1.7,<2.0"]
+requires = ["maturin>=1.13.3,<2.0"]
 build-backend = "maturin"
 
 [project]
@@ -13,6 +13,11 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
     "Operating System :: Microsoft :: Windows",

src/sdk/python/wasm_backend/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["maturin>=1.7,<2.0"]
+requires = ["maturin>=1.13.3,<2.0"]
 build-backend = "maturin"
 
 [project]
@@ -13,6 +13,11 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Programming Language :: Rust",
     "Operating System :: POSIX :: Linux",
     "Operating System :: Microsoft :: Windows",

src/sdk/python/wasm_guests/javascript_guest/pyproject.toml

@@ -9,6 +9,14 @@ description = "Packaged Hyperlight Wasm JavaScript guest exposed as javascript_g
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.10"
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
 
 [tool.setuptools]
 packages = ["javascript_guest", "javascript_guest.resources"]

src/sdk/python/wasm_guests/python_guest/pyproject.toml

@@ -9,6 +9,14 @@ description = "Packaged Hyperlight Wasm Python guest exposed as python_guest.pat
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.10"
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
 
 [tool.setuptools]
 packages = ["python_guest", "python_guest.resources"]