Update deps and release v0.13.0 (#102)

* checkpoint work

* Update project dependencies and prepare for new release.

This updates the project dependencies to the latest set of
stuff older than 30 days, and updates uv to not install
packages released within the past 30 days by default.

Also fixes a minor bug in the //run script.

* Bump to version 0.13.0

Author: dpranke

README.md

@@ -114,6 +114,17 @@ $ git push --tags origin
 
 ## Version History / Release Notes
 
+* v0.13.0 (2026-01-01)
+    * No code changes.
+    * Add Python 3.14 to supported version, project config, dependencies
+    * Update dependencies to latest stuff < 2025-12-01
+      * This relaxes the versions specified in pyproject.toml to just
+        use 'newer than' rather than exact matches.
+      * Sets 'uv.tool.exclude-newer' in pyproject.toml to tell uv not
+        to look at packages published within the past 30 days; this will
+        hopefully help prevent dependencies on compromised projects.
+    * Switch to using dependency-groups for 'dev' group.
+
 * v0.12.1 (2025-08-12)
     * Fix [#94](https://github.com/dpranke/pyjson5/issues/94), where objects
       returned from a custom encoder were not being indented properly.

json5/version.py

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = '0.12.2.dev0'
+__version__ = '0.13.0'
 
 # For backward-compatibility with earlier versions of json5:
 VERSION = __version__

pyproject.toml

@@ -11,7 +11,7 @@ authors = [
 keywords = [ "json5" ]
 license = {file = "LICENSE"}
 readme = "README.md"
-requires-python = ">= 3.8.0"
+requires-python = '>= 3.8.0'
 classifiers= [
     'Development Status :: 5 - Production/Stable',
     'Intended Audience :: Developers',
@@ -27,19 +27,23 @@ classifiers= [
 ]
 dynamic = [ "version" ]
 
-[project.optional-dependencies]
+[dependency-groups]
 # Note that not everything is guaranteed to work on 3.8.
 dev = [
-    'build==1.2.2.post1',
-    'coverage==7.5.4; python_version < "3.9"',
-    'coverage==7.8.0; python_version >= "3.9"',
-    'mypy==1.14.1; python_version < "3.9"',
-    'mypy==1.15.0; python_version >= "3.9"',
-    'pip==25.0.1',
-    'pylint==3.2.7; python_version < "3.9"',
-    'pylint==3.3.6; python_version >= "3.9"',
-    'ruff==0.11.2',
-    'twine==6.1.0',
+    'build >= 1.2.2.post1; python_version < "3.9"',
+    'build >= 1.3.0; python_version >= "3.9"',
+    'coverage == 7.5.4; python_version < "3.9"',
+    'coverage == 7.8.0; python_version >= "3.9" and python_version < "3.10"',
+    'coverage >= 7.12.0; python_version >= "3.10"',
+    'mypy == 1.14.1; python_version < "3.9"',
+    'mypy >= 1.19.0; python_version >= "3.9"',
+    'pip >= 25.3; python_version >= "3.9"',
+    'pylint == 3.2.7; python_version < "3.9"',
+    'pylint == 3.3.6; python_version >= "3.9" and python_version < "3.10"',
+    'pylint >= 4.0.4; python_version >= "3.10"',
+    'ruff >= 0.14.7',
+    'twine == 6.1.0; python_version < "3.10"',
+    'twine >= 6.2.0; python_version >= "3.10"',
 ]
 
 [project.urls]
@@ -110,3 +114,8 @@ version = {attr = "json5.__version__"}
 [tool.uv]
 # 0.9.0 is the first version supporting Python 3.14
 required-version = ">=0.9.0"
+
+# By default, do not install/resolve to packages published within
+# the past 30 days; this gives us some protection against automatically
+# upgrading to a package that might have been newly compromised.
+exclude-newer = "30 days"

run

@@ -333,7 +333,7 @@ class Runner:
             old = fp.read()
         if self.args.no_execute or self.args.verbose:
             print(f'mv {self.parser_file} {orig_file}')
-        else:
+        if not self.args.no_execute:
             os.rename(self.parser_file, orig_file)
         self._gen_parser()
         if self.args.no_execute: