feat(template)!: require Python 3.14 for generated projects

.mega-linter.yml

@@ -47,3 +47,5 @@ ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
 REPOSITORY_KINGFISHER_ARGUMENTS:
   - --exclude
   - "**/.venv/**"
+  - --exclude
+  - "**/.cache/**"

Makefile

@@ -8,7 +8,7 @@ all: ## Show the available make targets.
 	@fgrep "##" Makefile | fgrep -v fgrep
 
 .PHONY: lint
-lint:  ## Run Python linter
+lint: lint-maintainer-config ## Run linters
 	poetry run ruff check .
 	poetry run ruff format --check .
 
@@ -46,9 +46,28 @@ megalint:  ## Run the mega-linter. Use LINTER=NAME to run only one.
 		ghcr.io/oxsecurity/megalinter:v9
 
 .PHONY: update-template-packages
-update-template-packages:  ## Refresh package-manager template files and lockfiles.
+update-template-packages: lint-maintainer-config  ## Refresh package-manager template files and lockfiles.
 	cd scripts/package_manager_helper && ./update_template_packages.sh && cd ../..
 
 .PHONY: clean
 clean: ## Clean the temporary files.
 	rm -rf megalinter-reports
+
+.PHONY: lint-maintainer-config
+lint-maintainer-config:  ## Check maintainer helper pins stay in sync with template CI and Python baseline.
+	@helper_file="scripts/package_manager_helper/update_template_packages.sh"; \
+	ci_file="project_template/.github/workflows/ci.yml.jinja"; \
+	python_version_file="project_template/.python-version.jinja"; \
+	poetry_version="$$(sed -n 's/^POETRY_VERSION="\([^"]*\)"/\1/p' "$$helper_file")"; \
+	pipenv_version="$$(sed -n 's/^PIPENV_VERSION="\([^"]*\)"/\1/p' "$$helper_file")"; \
+	uv_version="$$(sed -n 's/^UV_VERSION="\([^"]*\)"/\1/p' "$$helper_file")"; \
+	min_template_python_version="$$(sed -n 's/^MIN_TEMPLATE_PYTHON_VERSION="\([^"]*\)"/\1/p' "$$helper_file")"; \
+	template_python_minor="$$(tr -d '[:space:]' < "$$python_version_file")"; \
+	[ -n "$$poetry_version" ] || { echo "Missing POETRY_VERSION in $$helper_file"; exit 1; }; \
+	[ -n "$$pipenv_version" ] || { echo "Missing PIPENV_VERSION in $$helper_file"; exit 1; }; \
+	[ -n "$$uv_version" ] || { echo "Missing UV_VERSION in $$helper_file"; exit 1; }; \
+	[ -n "$$min_template_python_version" ] || { echo "Missing MIN_TEMPLATE_PYTHON_VERSION in $$helper_file"; exit 1; }; \
+	grep -Fq "pipx install poetry==$$poetry_version" "$$ci_file" || { echo "Poetry version mismatch between $$helper_file and $$ci_file"; exit 1; }; \
+	grep -Fq "pipx install pipenv==$$pipenv_version" "$$ci_file" || { echo "Pipenv version mismatch between $$helper_file and $$ci_file"; exit 1; }; \
+	grep -Fq "pipx install uv==$$uv_version" "$$ci_file" || { echo "uv version mismatch between $$helper_file and $$ci_file"; exit 1; }; \
+	[ "$${min_template_python_version%.*}" = "$$template_python_minor" ] || { echo "MIN_TEMPLATE_PYTHON_VERSION ($$min_template_python_version) must share the same major.minor version as $$python_version_file ($$template_python_minor)"; exit 1; }

README.md

@@ -534,7 +534,37 @@ Use `make update-template-packages` when you need to refresh the package-manager
 `project_template/` after changing the dependency sets or package-manager template configuration.
 
 This command regenerates the managed package files for Poetry, Pipenv, and uv, including the lockfiles copied into the
-template. It requires the relevant package-manager CLIs to be installed locally: `poetry`, `pipenv`, and `uv`.
+template.
+
+Prerequisites:
+
+- A Python `3.14.x` interpreter installed locally, at or above the helper's minimum supported patch version (`3.14.6`).
+- `poetry==2.4.1`
+- `pipenv==2026.6.2`
+- `uv==0.11.29`
+
+Run it with:
+
+```bash
+make update-template-packages
+```
+
+How it works in practice:
+
+- The helper reads `project_template/.python-version.jinja` to determine the generated repo's target Python minor version.
+- It resolves a matching Python `3.14.x` interpreter before doing any package-manager work and rejects interpreters below
+  the maintainer minimum patch floor (`3.14.6`).
+- It checks that the installed `poetry`, `pipenv`, and `uv` versions match the pinned maintainer versions above.
+- It does not activate or mutate your current shell environment.
+- It clears active virtualenv / Conda / pyenv overrides for its subprocesses and passes the resolved Python interpreter
+  explicitly to each package manager.
+- Poetry and Pipenv environments used for lock regeneration are isolated under `scripts/package_manager_helper/.cache/`.
+
+If it fails early, the most common causes are:
+
+- Python version required is not installed locally.
+- One of the required CLIs is missing.
+- One of the installed package-manager CLIs does not match the pinned maintainer version.
 
 ## Contributing
 

project_template/.github/workflows/ci.yml.jinja

@@ -39,11 +39,11 @@ jobs:
       {%- if package_manager == 'pipenv' %}
 
       - name: Install Pipenv
-        run: pipx install pipenv==2023.12.1
+        run: pipx install pipenv==2026.6.2
       {%- elif package_manager == 'uv' %}
 
       - name: Install uv
-        run: pipx install uv==0.11.26
+        run: pipx install uv==0.11.29
       {%- endif %}
 
       - name: Install dependencies

project_template/.python-version.jinja

@@ -0,0 +1 @@
+3.14

project_template/{% if pipenv_copier %}Pipfile{% endif %}.jinja

@@ -17,7 +17,7 @@ mypy = "*"
 pre-commit = "*"
 
 [requires]
-python_version = "3.11"
+python_version = "3.14"
 
 [pipenv]
 allow_prereleases = true