chore: update base Python to 3.14.7

[fatih-acar]

What changed

Bumps the base Python version of the Infrahub container image and the development environment from 3.14.3 → 3.14.7 — the latest 3.14 patch release (3.14.8 does not exist on python.org or Docker Hub).

File	Change
development/Dockerfile	ARG PYTHON_VER 3.14.3 → 3.14.7 (feeds both the base and backend stages)
.devcontainer/Dockerfile	FROM python:3.14.3 → 3.14.7
.github/workflows/define-versions.yml	PYTHON_VERSION 3.14.3 → 3.14.7
tasks/shared.py	PYTHON_VER default 3.13 → 3.14.7
.devcontainer/Dockerfile	ARG UV_VER 0.9.9 → 0.11.8
development/docker-compose.yml	UV_VER: ${UV_VERSION:-0.9.9} → :-0.11.8 (both build sites)

Notable details

Beyond the version bump itself, two local build defaults had drifted away from what CI already uses. Both were invisible in CI and only affected local/devcontainer builds:

• tasks/shared.py defaulted PYTHON_VER to 3.13, and it wins over the Dockerfile ARG because tasks/container_ops.py passes it as --build-arg PYTHON_VER=. So every local invoke dev.build was building on python:3.13-slim while CI built on 3.14.x — local and CI images were on different Python minor versions.
• UV_VER defaulted to 0.9.9 in the compose file and devcontainer. CI exports UV_VERSION as a job-level env (ci.yml, ci-docker-image.yml, version-upgrade.yml), so the fallback never fired there — but local and devcontainer builds silently installed uv 0.9.9 instead of the pinned 0.11.8.

uv is aligned to the repo's canonical 0.11.8 from define-versions.yml rather than bumped. Worth noting for a follow-up: uv's latest is 0.12.5, so 0.11.8 is itself a few minors behind.

Deliberately left alone: the CI test matrices (3.12/3.13/3.14) and requires-python = ">=3.12,<3.15" express the supported range, not the base version; [tool.ty.environment] python-version = "3.12" type-checks against the minimum supported version.

Testing performed

• python:3.14.7-slim pulls and reports Python 3.14.7 (main, Aug 5 2026) [GCC 14.2.0].
• Full builder stage builds clean with PYTHON_VER=3.14.7 UV_VER=0.11.8; the resulting venv runs 3.14.7 with 170 distributions and import infrahub succeeds.
• docker compose config across the full dev file set with UV_VERSION unset (the previously-broken local case): both build sites now resolve UV_VER: 0.11.8.
• https://astral.sh/uv/0.11.8/install.sh resolves and pins APP_VERSION="0.11.8".
• uv lock --check passes unchanged — 3.14.7 sits inside requires-python, and a patch bump cannot shift resolution (wheels are cp314-tagged).
• uv run invoke format, main.lint, ruff check . --exclude python_sdk, yamllint -s .github/ development/, invoke docs.lint, and invoke docs.validate all pass; docs.validate regenerated nothing, confirming no generated file is stale.

Backend unit tests were not run: the diff touches no backend source (only Dockerfiles, compose/workflow YAML, and tasks/shared.py, which the unit suite does not cover).

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Patch version bump for Python 3.14.7 and alignment of uv default to 0.11.8 in local build files, fixing stale defaults that diverged from CI.

Re-trigger cubic</sub>

[codspeed-hq]

Merging this PR will not alter performance

✅ 13 untouched benchmarks

---

_{Comparing fac/update-base-python-bztlx (970308d) with stable (e9b4b6d)}