[dmytrotkk]

Moves node-cli to Python 3.14.10, skale.py-core 8.0dev0 and uv 0.13.6, upgrades every dependency to its latest release, fixes several bugs found on the way, and drops what is no longer used. Version 3.3.2 → 3.4.0, so develop publishes 3.4.0-develop.0. Node hosts are assumed to run Ubuntu 24.04, which this release ships with.

Dependencies

• pip-audit finds no known vulnerabilities in the new runtime set. Develop's set had 8 vulnerable packages: GitPython 3.1.45 (critical GHSA-284h-m62q-gf8w and 30+ more), cryptography 46.0.5, pyOpenSSL 25.3.0, sh 2.2.2, filelock 3.20.0, Flask 3.1.2, python-dotenv 1.2.1 and requests 2.32.5.
• Runtime set 47 → 41 packages on Linux: GitPython 3.2.1, cryptography 50.0.2, docker 7.2.0, redis 8.1.0, click 8.5.0, filelock 4.2.4, Flask 3.1.3, python-crontab 3.4.0, PyInstaller 6.22.3 and the rest at their latest releases
• Removed pyOpenSSL and python-dateutil (the SSL status parses certificates with cryptography, as in skale-admin, with the same output), sh, terminaltables (the health, sgx and ssl tables use the CLI's texttable formatter), and the explicit MarkupSafe and itsdangerous pins (Flask pulls them in)
• requests-mock moved to dev; bumpversion, twine, mock (tests use unittest.mock) and pytest-cov dropped; ruff 0.17.3, pytest 9.2.0
• requires-python = ">=3.14", .python-version 3.14, no prerelease = "allow"; unused project metadata and setuptools options removed

Python 3.14

• The lvmpy submodule is bumped to the merge of Upgrade to Python 3.14, uv and current dependencies docker-lvmpy#170, which replaces lvmpy's multiprocessing.Lock: with 3.14's forkserver default it made every skale command re-execute the binary through the resource tracker, and skale lvmpy run kept spawning copies. The bump also brings in Fix inactive volumes docker-lvmpy#169: ensure_group_active now reactivates the schains volume group only when its own volumes are inactive, not when any volume group on the host has one
• skale node restore extracts with filter='tar': 3.14's default data filter would make restored files root-owned, including the node user's admin-api.token
• datetime.utcfromtimestamp replaced; times print with +00:00

Fixes

• The hidden --pull-config option of the update commands was accepted but never saved, so skale node update --pull-config ... did nothing; it is passed to the internal settings again, and the update operations no longer overwrite them
• skale node init and skale fair boot init never ran the post-install checks; a failed init now exits right away with the real error instead of waiting for the containers
• Importing node-cli created a docker client, so every command, including skale version, failed on a host without docker
• skale health containers called health/containers, which admin moved to info/containers; routes the CLI never calls are removed (schains/repair, gone from admin, plus node/send-tg-notification, ssl/status and ssl/upload, since SSL is handled locally)
• node signature and fair boot signature printed the error as the signature and exited 0
• Checks: a log placeholder without its argument, a leaked socket in the network check that also changed the process-wide default timeout
• Static params are read with yaml.safe_load; settings files are no longer deleted before being rewritten

Removed dead code

• The focal-to-jammy migration, which could never run (its version gate only matched test or 2.6.*), with the nftables helpers only it used
• Unused helpers, resources, schain types, volume and docker-lvmpy install leftovers from the git-clone install, a cryptography < 42 fallback, the no-op skale exit finalize command, unused text keys, and dead test fixtures; nftables is imported where it is used instead of in a guarded module-level import

Build

• Python 3.14.10 bundled into the binary, uv 0.13.6 instead of uv:latest, no apt step in the builder
• The image keeps only what the build and the nftables tests need (binutils, git, patchelf, python3-nftables), and exposes only the nftables bindings from Ubuntu's dist-packages instead of all of them
• main.spec, scripts/build.sh and scripts/generate_info.sh trimmed to what PyInstaller 6 and the build use; the patchelf step for datafiles/skaled-ssl-test stays
• Test fixture images off EOL Python 3.8 and alpine 3.12

CI

• checkout v7, setup-uv v10.3.3 with uv 0.13.6 instead of curl | sh, .python-version instead of setup-python, uv sync, least-privilege permissions
• No apt, redis or host PyInstaller steps the tests do not need; nftables tests run in the builder image; binaries build into the workspace dist instead of /home/ubuntu/dist
• publish: version calculation inlined (no set_versions_ga.sh), softprops/action-gh-release@v3, prerelease unless the base is stable
• Added audit.yml (push and weekly pip-audit of the runtime set); deleted issue_check.yml, .codacy.yml and .github/dependabot.yml
• README Development section matches the new setup; deleted .github/copilot-instructions.md

Tested locally: ruff; the test suite on Python 3.14.10 with a private Docker daemon (283 passed; the 6 failures come from the test container, which runs as root with no docker group, docker CLI or btrfs binary, and fail the same way on develop). After the lvmpy bump: ruff, every lvmpy entry point imports under -W error, the test suite again on macOS (287 passed; the 2 failures need a btrfs binary and a docker group, and core_node_test.py needs a Docker daemon), and both binaries rebuilt with scripts/build.sh (34.2 MB each, 34.7 MB on develop) and run on Ubuntu 24.04 amd64: --help, version and info exit 0 with nothing on stderr, and skale lvmpy run serves with a steady two processes (the PyInstaller bootloader and the CLI) instead of spawning copies.

After merge, the open dependabot PRs can be closed.

Part of skalenetwork/skale-node#891