Drop Python 3.10 and add Python 3.15 to CI

.github/workflows/pip-audit.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Install project
         run: |
@@ -46,4 +46,4 @@ jobs:
         with:
           virtual-environment: /tmp/pip-audit-env
           ignore-vulns: |
-            CVE-2026-4539
+            CVE-2026-4539

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.10'
+          python-version: '3.11'
 
       - name: Install uv
         uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0

.github/workflows/tests.yml

@@ -23,8 +23,11 @@ jobs:
     permissions:
       contents: read
     strategy:
+      fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,7 +46,7 @@ jobs:
         run: uv python install -- "$PYTHON_VERSION"
 
       - name: Install dependencies
-        run: uv sync --extra test
+        run: uv sync --locked --extra test
 
       - name: Run tests
         run: uv run pytest --cov=fickling test/

CLAUDE.md

@@ -93,8 +93,8 @@ Build payloads using fickling's opcode API (`op.Proto`, `op.ShortBinUnicode`, `o
 
 ## Code style
 
-- **Formatter/linter:** ruff (line-length 100, double quotes, target py310)
-- **Type checker:** ty (CI runs with `continue-on-error`)
+- **Formatter/linter:** ruff (line-length 100, double quotes, target py311)
+- **Type checker:** ty (target Python 3.11; CI runs with `continue-on-error`)
 - **Imports:** `import fickling.fickle as op` is the convention for opcode access in tests
 - **AST visitor methods** in `fickle.py` use `visit_*` naming (suppresses N802)
 - **Error handling:** Malformed pickles raise `InterpretationError` (subclass of `PickleDecodeError`), not `ValueError`. The `has_interpretation_error` flag on `Pickled` signals downstream analysis to report `LIKELY_UNSAFE`.
@@ -105,7 +105,7 @@ Build payloads using fickling's opcode API (`op.Proto`, `op.ShortBinUnicode`, `o
 
 | Workflow | What it checks |
 |----------|---------------|
-| `tests.yml` | pytest across Python 3.10-3.14 |
+| `tests.yml` | pytest across Python 3.11-3.15 |
 | `lint.yml` | ruff format + ruff check + ty check |
 | `pip-audit.yml` | Dependency vulnerability scan (runs daily + on PRs) |
 | `release.yml` | PyPI publishing on tags |

README.md

@@ -22,7 +22,7 @@ Fickling can be used both as a **python library** and a **CLI**.
 
 ## Installation
 
-Fickling has been tested on Python 3.9 through Python 3.13 and has very few dependencies.
+Fickling requires Python 3.11 or newer and has very few dependencies.
 Both the library and command line utility can be installed through pip or uv:
 
 ```bash

fickling/fickle.py

@@ -17,6 +17,7 @@
     BinaryIO,
     ClassVar,
     Generic,
+    Self,
     TypeVar,
     overload,
 )
@@ -26,10 +27,9 @@
 T = TypeVar("T")
 
 if sys.version_info < (3, 12):
-    from typing_extensions import Buffer, Self
+    from typing_extensions import Buffer
 else:
     from collections.abc import Buffer
-    from typing import Self
 
 
 @dataclass(frozen=True)

fickling/loader.py

@@ -245,7 +245,7 @@ def _scan_bytes(
                 result = check_safety(pickled, json_output_path=json_output_path)
                 results.append(result)
                 overall_severity = max(overall_severity, result.severity)
-            except Exception as e:  # noqa: PERF203 -- each pickle is analyzed independently
+            except Exception as e:
                 if graceful:
                     errors.append(f"Analysis error ({type(e).__name__}): {e!s}")
                     overall_severity = max(overall_severity, Severity.LIKELY_UNSAFE)

pyproject.toml

@@ -16,16 +16,16 @@ classifiers = [
   "Intended Audience :: Science/Research",
   "License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)",
   "Programming Language :: Python :: 3 :: Only",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "Topic :: Security",
   "Topic :: Software Development :: Testing",
   "Topic :: Utilities",
 ]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 dependencies = [
   "typing-extensions >= 4.6.0; python_version < '3.12'",
 ]
@@ -34,8 +34,7 @@ dependencies = [
 torch = [
     "torch >= 2.1.0",
     "torchvision >= 0.24.1",
-    "numpy >= 2.2.6, < 2.3; python_version == '3.10'",
-    "numpy >= 2.3.5; python_version >= '3.11'",
+    "numpy >= 2.3.5",
 ]
 lint = [
   "ruff >= 0.16.0",
@@ -68,6 +67,9 @@ Homepage = "https://pypi.org/project/fickling"
 Issues = "https://github.com/trailofbits/fickling/issues"
 Source = "https://github.com/trailofbits/fickling"
 
+[tool.uv]
+exclude-newer = "1 week"
+
 # Black configuration removed - using ruff format instead
 
 [tool.coverage.run]
@@ -79,6 +81,9 @@ omit = ["fickling/__main__.py", "fickling/cli.py"]
 # Most mypy options don't have direct equivalents yet
 # See: https://docs.astral.sh/ty/configuration/
 
+[tool.ty.environment]
+python-version = "3.11"
+
 [tool.hatch.version]
 path = "fickling/__init__.py"
 
@@ -98,7 +103,7 @@ packages = ["fickling"]
 
 [tool.ruff]
 line-length = 100
-target-version = "py310"
+target-version = "py311"
 
 [tool.ruff.lint]
 # Only prefixes whose rules the defaults do not already cover in full are listed.

test/fixtures/generate_fixtures.py

@@ -1,6 +1,8 @@
 #!/usr/bin/env -S uv run --script
+# torch.jit.script() is unsupported on Python 3.14+, so generation requires <3.14.
+# Tests use the committed fixtures and can run on newer Python versions.
 # /// script
-# requires-python = ">=3.10,<3.14"
+# requires-python = ">=3.11,<3.14"
 # dependencies = ["torch>=2.10,<3", "torchvision>=0.25,<1"]
 # ///
 """Generate TorchScript fixture files for tests.