Python 3.13 Support

python/Dockerfile

@@ -1,13 +1,15 @@
 # This list must match the versions specified in
 # python/lib/dependabot/python/language_version_manager.rb: PRE_INSTALLED_PYTHON_VERSIONS
+ARG PY_3_13=3.13.0
 ARG PY_3_12=3.12.5
 ARG PY_3_11=3.11.9
 ARG PY_3_10=3.10.15
 ARG PY_3_9=3.9.18
 ARG PY_3_8=3.8.20
-ARG PYENV_VERSION=v2.3.35
+ARG PYENV_VERSION=v2.4.16
 
 FROM ghcr.io/dependabot/dependabot-updater-core as python-core
+ARG PY_3_13
 ARG PY_3_12
 ARG PY_3_11
 ARG PY_3_10
@@ -120,6 +122,24 @@ RUN find $PYTHON_INSTALL_LOCATION/bin -type f -exec sed -i "1s|^#!/usr/local/bin
 # Ensure pyenv works and it's the python version we expect
 RUN PYENV_VERSION=$PY_3_12 pyenv exec python --version | grep "Python $PY_3_12" || exit 1
 RUN bash /opt/python/helpers/build $PY_3_12
+# This python environment occupies ~0.5 GB and gets used for a fraction of jobs, so store it compressed.
+RUN cd $PYENV_ROOT/versions \
+  && tar -acf $PY_3_12.tar.zst $PY_3_12
+
+## 3.13
+# Docker doesn't support parametrizing `COPY --from:python:$PY_1_23-bookworm`, so work around it using an alias.
+# TODO: If upstream adds support for Ubuntu, use that instead of Debian as the base suffix: https://github.com/docker-library/python/pull/791
+FROM docker.io/library/python:$PY_3_13-bookworm as upstream-python-3.13
+FROM python-core as python-3.13
+ARG PYTHON_INSTALL_LOCATION="$PYENV_ROOT/versions/$PY_3_13"
+COPY --from=upstream-python-3.13 --chown=dependabot:dependabot /usr/local/bin $PYTHON_INSTALL_LOCATION/bin
+COPY --from=upstream-python-3.13 --chown=dependabot:dependabot /usr/local/include $PYTHON_INSTALL_LOCATION/include
+COPY --from=upstream-python-3.13 --chown=dependabot:dependabot /usr/local/lib $PYTHON_INSTALL_LOCATION/lib
+# `pip` and other scripts need their shebangs rewritten for the new location
+RUN find $PYTHON_INSTALL_LOCATION/bin -type f -exec sed -i "1s|^#!/usr/local/bin/python|#!${PYTHON_INSTALL_LOCATION}/bin/python|" {} +
+# Ensure pyenv works and it's the python version we expect
+RUN PYENV_VERSION=$PY_3_13 pyenv exec python --version | grep "Python $PY_3_13" || exit 1
+RUN bash /opt/python/helpers/build $PY_3_13
 # This is the default Python, so no need to tar it
 
 FROM python-core
@@ -152,9 +172,10 @@ COPY --from=python-3.8 $PYENV_ROOT/versions/$PY_3_8.tar.zst $PYENV_ROOT/versions
 COPY --from=python-3.9 $PYENV_ROOT/versions/$PY_3_9.tar.zst $PYENV_ROOT/versions/$PY_3_9.tar.zst
 COPY --from=python-3.10 $PYENV_ROOT/versions/$PY_3_10.tar.zst $PYENV_ROOT/versions/$PY_3_10.tar.zst
 COPY --from=python-3.11 $PYENV_ROOT/versions/$PY_3_11.tar.zst $PYENV_ROOT/versions/$PY_3_11.tar.zst
-COPY --from=python-3.12 $PYENV_ROOT/versions/ $PYENV_ROOT/versions/
+COPY --from=python-3.12 $PYENV_ROOT/versions/$PY_3_12.tar.zst $PYENV_ROOT/versions/$PY_3_12.tar.zst
+COPY --from=python-3.13 $PYENV_ROOT/versions/ $PYENV_ROOT/versions/
 
 # Copy the output of the build script, it should be identical across Python versions
-COPY --from=python-3.12 /opt/python/ /opt/python/
+COPY --from=python-3.13 /opt/python/ /opt/python/
 
-RUN pyenv global $PY_3_12
+RUN pyenv global $PY_3_13

python/helpers/requirements.txt

@@ -2,6 +2,8 @@ pip==24.0
 pip-tools==7.4.1
 flake8==7.1.0
 hashin==1.0.1
+# TODO: Remove "legacy-cgi" dependency when hashin is updated to support Python 3.13
+legacy-cgi; python_version >= "3.13"
 pipenv==2024.0.2
 plette==2.1.0
 poetry==1.8.3

python/lib/dependabot/python/language_version_manager.rb

@@ -9,6 +9,7 @@ module Python
     class LanguageVersionManager
       # This list must match the versions specified at the top of `python/Dockerfile`
       PRE_INSTALLED_PYTHON_VERSIONS = %w(
+        3.13.0
         3.12.5
         3.11.9
         3.10.15

python/spec/dependabot/python/file_fetcher_spec.rb

@@ -524,7 +524,7 @@
 
       it "exposes the expected ecosystem_versions metric" do
         expect(file_fetcher_instance.ecosystem_versions).to eq({
-          languages: { python: { "max" => "3.12", "raw" => "unknown" } }
+          languages: { python: { "max" => "3.13", "raw" => "unknown" } }
         })
       end
     end

python/spec/fixtures/projects/unresolvable/requirements.in

@@ -13,7 +13,7 @@ jupyter_nbextensions_configurator
 
 librosa
 numba==0.48
-numpy==1.26.1
+numpy==1.26.4
 
 jax
 matplotlib

python/spec/fixtures/requirements/pip_compile_native_dependencies.txt

@@ -8,7 +8,7 @@ asn1crypto==1.4.0         # via cryptography
 cffi==1.11.5              # via cryptography
 cryptography==2.2.2       # via -r requirements.in
 idna==2.10                # via cryptography
-numpy==1.26.1             # via -r requirements.in, pandas
+numpy==1.26.4             # via -r requirements.in, pandas
 pandas==2.1.1             # via -r requirements.in
 pycparser==2.18           # via cffi
 python-dateutil==2.8.1    # via pandas