More CI/dev updates

.github/workflows/test.yml

@@ -2,15 +2,19 @@ name: test
 
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
 
   test:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.10', 3.11, '3.12', '3.13', '3.14', 'pypy-3.11']
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', 'pypy-3.11']
         exclude:
           # too slow
           - os: macos-latest
@@ -20,13 +24,13 @@ jobs:
         include:
           - os: ubuntu-latest
             pip-cache: ~/.cache/pip
-            poetry-cache: ~/.cache/pypoetry
+            uv-cache: ~/.cache/uv
           - os: macos-latest
             pip-cache: ~/Library/Caches/pip
-            poetry-cache: ~/Library/Caches/pypoetry
+            uv-cache: ~/.cache/uv
           - os: windows-latest
             pip-cache: ~\AppData\Local\pip\Cache
-            poetry-cache: ~\AppData\Local\pypoetry\Cache
+            uv-cache: ~\AppData\Local\uv\cache
           - os: ubuntu-latest
             python-version: 3.10
             build-docs: true
@@ -37,9 +41,11 @@ jobs:
           - python-version: 3.12
             run-mypy: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -48,40 +54,40 @@ jobs:
       with:
         path: |
           ${{ matrix.pip-cache }}
-          ${{ matrix.poetry-cache }}
+          ${{ matrix.uv-cache }}
         key: ${{ runner.os }}-${{ hashFiles('**/pyproject.toml') }}
         restore-keys: |
           ${{ runner.os }}-
 
     - name: Install dependencies
       run: |
-        pipx install poetry build
-        poetry install
+        pipx install uv build
+        uv sync
     - name: Run tests
       run: |
-        poetry run coverage run --branch setup.py test
-        poetry run coverage xml -i
+        uv run coverage run --branch setup.py test
+        uv run coverage xml -i
     - name: Run mypy
       if: matrix.run-mypy
       run: |
-        poetry run mypy .
+        uv run mypy .
     - name: Run flake8
       run: |
-        poetry run flake8
+        uv run flake8
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v5
     - name: Build docs
       if: matrix.build-docs
       run: |
-        poetry install --with docs
-        poetry run sphinx-build -W -a -E -b html -n docs docs/_build
+        uv sync --group docs
+        uv run sphinx-build -W -a -E -b html -n docs docs/_build
     - name: Build dist
       if: matrix.build-dist
       run: |
         pyproject-build
     - name: Upload dist
       if: matrix.build-dist
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: dist
         path: dist/*

fuzzing/README.rst

@@ -5,12 +5,11 @@ Local fuzzing via `python-afl <https://github.com/jwilk/python-afl>`__ and
 `afl++ <https://aflplus.plus/>`__:
 
 * Install afl, for example ``sudo apt install afl++`` on Debian/Ubuntu
-* ``poetry install --with fuzzing``
-* ``poetry shell``
+* ``uv sync --group fuzzing``
 * Add some example files into ``_examples``
-* ``./run.sh`` will start multiple afl-fuzz instances
+* ``uv run ./run.sh`` will start multiple afl-fuzz instances
 * CTRL+C to stop
-* Run ``./check_crashes.sh`` to get a summary of the errors found
+* Run ``uv run ./check_crashes.sh`` to get a summary of the errors found
 
 Fuzzing via `OSS-Fuzz <https://github.com/google/oss-fuzz>`__:
 

pyproject.toml

@@ -28,7 +28,7 @@ mutagen-pony = "mutagen._tools.mutagen_pony:entry_point"
 
 [dependency-groups]
 dev = [
-    "pytest~=8.2",
+    "pytest>=8.2,<10",
     "hypothesis>=6.50.1,<7",
     "flake8>=7.1.0,<8",
     "mypy==1.18.2",