chore: Cherry-picked changes from upstream

.github/actions/test/action.yml

@@ -9,7 +9,6 @@ inputs:
   python-version:
     description: Python version, e.g. 3.11
     required: true
-
 runs:
   using: 'composite'
   steps:
@@ -78,8 +77,15 @@ runs:
         python -m pip cache list || true
 
         # install dependencies
-        python_minor_version="$(python -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
-        python -m pip install --force -r python/requirements-$python_minor_version.txt
+        PYTHON_VERSION="$(python -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
+        if [[ "$PYTHON_VERSION" == "3.7" ]]; then
+          DEPENDENCIES_VERSION=3.7
+        elif [[ "$PYTHON_VERSION" == "3.8" ]]; then
+          DEPENDENCIES_VERSION=3.8
+        else
+          DEPENDENCIES_VERSION=post-3.8
+        fi
+        python -m pip install --force -r python/requirements-$DEPENDENCIES_VERSION.txt
         python -m pip install --force -r python/test/requirements.txt -c python/test/constraints.txt
 
         # inspect pip cache

.github/workflows/check-upgrades.yml

@@ -0,0 +1,38 @@
+name: Check Upgrades
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        required: true
+        type: string
+jobs:
+  check:
+    name: Check (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ${{ fromJson(inputs.python-version) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Check for dependency updates
+        continue-on-error: true
+        run: |
+          pip install tox
+          tox
+          git diff | tee diff
+          if [ -s "diff" ]; then
+            echo 'Dependencies can be upgraded' >> $GITHUB_STEP_SUMMARY
+            echo '```diff' >> $GITHUB_STEP_SUMMARY
+            cat diff >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+        shell: bash

.github/workflows/ci-cd.yml

@@ -10,7 +10,7 @@ permissions: {}
 
 jobs:
   dependencies:
-    name: Test python/requirements.txt
+    name: Check python/requirements.txt
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -26,32 +26,27 @@ jobs:
           (diff -w <(grep -v -e "python_version <= '3.7'" -e "python_version >  '3.8'" python/requirements.txt | sed -e "s/;.*//") python/requirements-3.8.txt || true) | (! grep -e "^<")
           (diff -w <(grep -v -e "python_version <= '3.7'" -e "python_version == '3.8'" python/requirements.txt | sed -e "s/;.*//") python/requirements-post-3.8.txt || true) | (! grep -e "^<")
         shell: bash
-      - name: Check for dependency updates
-        continue-on-error: true
-        run: |
-          pip install tox
-          tox
-          git diff --exit-code
-        shell: bash
+
+  upgrade:
+    name: Check Upgrades
+    uses: "./.github/workflows/check-upgrades.yml"
+    with:
+      python-version: '["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]'
 
   test-mac:
     name: "Test macOS"
     uses: "./.github/workflows/test-os.yml"
     with:
-      os: '["macos-13", "macos-14", "macos-15"]'
-      python-version: '["3.10", "3.11", "3.12", "3.13", "installed"]'
-      include: >
-        [
-          {"os": "macos-13", "python-version": "3.8"},
-          {"os": "macos-13", "python-version": "3.9"},
-        ]
+      os: '["macos-14", "macos-15", "macos-26"]'
+      python-version: '["3.10", "3.11", "3.12", "3.13", "3.14", "installed"]'
+      include: '[]'
 
   test-lnx:
     name: "Test Ubuntu"
     uses: "./.github/workflows/test-os.yml"
     with:
       os: '["ubuntu-22.04", "ubuntu-24.04"]'
-      python-version: '["3.9", "3.10", "3.11", "3.12", "3.13", "installed"]'
+      python-version: '["3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "installed"]'
       include: >
         [
           {"os": "ubuntu-22.04", "python-version": "3.8"},
@@ -62,8 +57,8 @@ jobs:
     uses: "./.github/workflows/test-os.yml"
     with:
       os: '["windows-2022", "windows-2025"]'
-      python-version: '["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]'
-      include: '[{"os": "windows-2022", "python-version": "installed"}]'
+      python-version: '["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "installed"]'
+      include: '[]'
 
   publish:
     name: "Publish"
@@ -75,10 +70,10 @@ jobs:
       ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     uses: "./.github/workflows/publish.yml"
     permissions:
+      contents: read
       checks: write
       pull-requests: write
       security-events: write
-      contents: read
 
   config-deploy:
     name: Configure Deployment