feat: add Python 3.13 support

.github/workflows/python.yml

@@ -71,10 +71,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - python-version: '3.12'
+          - python-version: '3.13'  # latest
             os: ubuntu-latest
             toxenv-factors: '-current'
-          - python-version: '3.8'
+          - python-version: '3.8'   # lowest
             os: ubuntu-latest
             toxenv-factors: '-lowest'
     steps:
@@ -162,7 +162,8 @@ jobs:
           - macos-13  # macos-latest might be incompatible to py38 - see https://github.com/CycloneDX/cyclonedx-python-lib/pull/599#issuecomment-2077462142
           - windows-latest
         python-version:
-          - "3.12" # highest supported
+          - "3.13" # highest supported
+          - "3.12"
           - "3.11"
           - "3.10"
           - "3.9"

pyproject.toml

@@ -30,8 +30,7 @@ include = [
   { path="docs", format=["sdist"] },
 ]
 exclude = [
-  # exclude dotfiles and dotfolders
-  "**/.*",
+  "**/.*", # exclude dotfiles and dotfolders
   "docs/_build", "docs/processes",
 ]
 keywords = [
@@ -57,6 +56,7 @@ classifiers = [
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
   "Typing :: Typed"
 ]
 [tool.poetry.urls]

tests/__init__.py

@@ -149,6 +149,14 @@ def make_xml_comparable(bom: str) -> str:
         '        <version>\\1</version>\n'
         '        <externalReferences><!-- stripped --></externalReferences>',
         bom)
+    if sys.version_info < (3, 13):
+        # py3.13 finally fixed a bug in the XML writer: https://github.com/python/cpython/issues/81555
+        # no longer escape double-quotes(") in text/non-attribute.
+        # here is a backwards-compat mode, so we have consistent tests.
+        bom = re_sub(
+            r'>[^<]*&quot;[^<]*<',
+            lambda s: s[0].replace('&quot;', '"'),
+            bom)
     return bom
 
 

tests/_data/infiles/environment/normalize-packagename/init.py

@@ -63,8 +63,10 @@ def main() -> None:
     ).create(env_dir)
 
     pip_install(
+        '--no-deps',  # the clib dep cannot be installed consistently...
         # https://packaging.python.org/en/latest/specifications/name-normalization/#name-normalization
         'ruamel-YAML[jinja2]',  # actually "ruamel.yaml", normalizes to "ruamel-yaml"
+        'ruamel-Yaml.Jinja2',   # actually "ruamel.yaml.jinja2", normalizes to "ruamel-yaml-jinja2"
     )
 
 

tests/_data/infiles/environment/with-extras/init.py

@@ -68,6 +68,7 @@ def main() -> None:
         'importlib-resources>=1.4.0',
         'pkgutil-resolve-name>=1.3.10',
         'zipp>=3.1.0',
+        'jsonschema-specifications==2023.03.6',
     )
 
 

tests/_data/infiles/environment/with-extras/pinning.txt

@@ -1,28 +1,28 @@
 arrow==1.3.0
-attrs==23.1.0
+attrs==24.2.0
 boolean.py==4.0
-cyclonedx-python-lib==6.0.0
+cyclonedx-python-lib==8.2.0
 defusedxml==0.7.1
 fqdn==1.5.1
-idna==3.6
-importlib-resources==6.1.1
+idna==3.10
+importlib_resources==6.4.5
 isoduration==20.11.0
-jsonpointer==2.4
-jsonschema==4.20.0
-jsonschema-specifications==2023.11.2
-license-expression==30.2.0
-lxml==4.9.4
-packageurl-python==0.13.1
+jsonpointer==3.0.0
+jsonschema==4.23.0
+jsonschema-specifications==2023.3.6
+license-expression==30.3.1
+lxml==5.3.0
+packageurl-python==0.16.0
 pkgutil_resolve_name==1.3.10
-py-serializable==0.16.0
-python-dateutil==2.8.2
-referencing==0.32.0
+py-serializable==1.1.2
+python-dateutil==2.9.0.post0
+referencing==0.35.1
 rfc3339-validator==0.1.4
 rfc3987==1.3.8
-rpds-py==0.15.2
+rpds-py==0.20.0
 six==1.16.0
 sortedcontainers==2.4.0
-types-python-dateutil==2.8.19.14
+types-python-dateutil==2.9.0.20241003
 uri-template==1.3.0
-webcolors==1.13
-zipp==3.17.0
+webcolors==24.8.0
+zipp==3.20.2

tests/_data/infiles/environment/with-license-pep639/pinning.txt

@@ -2,4 +2,4 @@ attrs==23.2.0
 boolean.py==4.0
 jsonpointer==2.4
 license-expression==30.3.0
-lxml==5.2.2
+lxml==5.3.0