{Packaging} Support Python 3.14

[azure-cli-python-upgrade-bot]

Automated Python upgrade: 3.13 → 3.14

This PR was opened by the Python Upgrade Agent. See
scripts/python_upgrade_agent/README.md
for the full design.

Embedded Python: 3.13.13 → 3.14.5 (latest stable patch on python.org)

The list of changed files is in the Files changed tab.

Locations the agent did NOT update — please review

These are matches for the previous minor that the agent was uncertain about.
Tick each item once you've decided whether to bump it or leave as-is.

• src/azure-cli/HISTORY.rst @ line 717 — Historical changelog entry referencing a specific past PR; version is part of the recorded reason, not a live build target.
  * Support Python 3.13 (#31895)
• src/azure-cli/HISTORY.rst @ line 718 — Historical changelog entry referencing a specific past PR; version is part of the recorded reason, not a live build target.
  * Bump embedded Python to 3.13.7 (#31928)
• src/azure-cli/azure/cli/command_modules/batch/_command_type.py @ line 811 — Comment describing compatibility across 3.13 and 3.14; not a live build target reference.
  # Use get_args() to detect optional types (stable across Python 3.13 and 3.14)
• scripts/ci/test_extensions.sh @ line 28 — Historical comment referencing past PR/issue; version is part of the recorded reason, not a live build target.
  # serviceconnector-passwordless's dependency is not compatible with 3.13 https://github.com/Azure/azure-cli/pull/31895

Post-check: possible forgotten references

A deterministic sweep ran after the LLM's plan was applied in memory; the lines
below still match the previous minor and were not in the skipped list, so
they may have been overlooked. Please verify — these are most often historical
comments or test fixtures, but occasionally indicate a missed bump.

(none — post-check found no leftover references.)

Agent metadata

• Model: openai/gpt-4.1
• Run: https://github.com/YangAn-microsoft/azure-cli/actions/runs/26348903211
• Reference PRs used as few-shot examples: [Packaging] Support Python 3.13 Azure/azure-cli#31895, [Packaging] Support Python 3.12 Azure/azure-cli#29465, [Packaging] Support Python 3.11 Azure/azure-cli#26923
• Notes from the agent: All CI matrix keys, job names, and python.version values referencing 3.13 are updated to 3.14 per reference PRs and rule 4. setup.py classifiers are additive per rule 11. Historical changelog and comments are skipped per rules 5 and 13.

---

Next steps for the developer

This draft PR completes the mechanical bump described in Step 4 of the
Python-onboarding workflow. The items below are the remaining manual steps
needed to ship Python 3.14 support. References point to the 3.14
roll-out (issue #32869)
as a worked example.

1. Verify the prerequisite workstreams have started

These should already be in motion before the agent was dispatched. Confirm
each one before moving the PR out of draft.

• Tracking issue filed in Azure/azure-cli titled Support Python 3.14,
  with a checklist linked from this PR. (References: 3.14
  #32869, 3.13
  #29640.)
• Quality & Productivity squad notified to add Python 3.14
  support to azdev (Azure/azure-cli-dev-tools)
  and aaz-dev (Azure/aaz-dev-tools).
  These tools do not run in the azure-cli pipeline, so a missing bump
  will not show as a red leg here — but command authors cannot develop
  locally under 3.14 until both are released.
• knack released with Python 3.14 support and pinned in azure-cli.
  Land a PR in microsoft/knack that
  declares 3.14 in classifiers (and fixes any test-suite fallout
  under 3.14), cut a release via the ADO pipeline
  (azclitools / release / definitionId=8),
  then bump the knack pin in this repo. Reference: 3.14
  #33377.

2. Triage CI failures on this PR and land fix PRs

The first CI run on this draft PR is your TODO list. Categorise each failure
into one of the buckets below and address them in roughly this order. Each
fix should be its own PR, reviewed and merged independently of this umbrella
draft. Rebase this PR on dev after each merge.

Category A — Bump a third-party dependency

Symptom: import error, missing cp3.14 wheel, or runtime error
inside a dependency.

Action: find a dependency release that ships 3.14 wheels and bump
the pin in src/azure-cli/setup.py or src/azure-cli-core/setup.py.

Examples from 3.14: msal-extensions / portalocker / pywin32
(#32859),
urllib3 2.7.0 (#33351).

If upstream has no 3.14 release yet, file an issue against them and
record the blocker on the tracking issue.

Category B — Linter / style fallout

If the azdev release from step 1 bumped pylint / astroid (which happens
when new CPython syntax requires a newer astroid — e.g. PEP 750 template
strings in 3.14), new diagnostics may be enabled. Run

azdev style --pylint CLI

under 3.14 and fix everything that pops up in a single cleanup PR.
Reference: #33347 — bumped
pylint to 4.x and fixed C0123, E1206, E0102, W4902.

If a class of warnings is too noisy to fix at once, add the offending files
to linter_exclusions.yml and file follow-ups;
do not disable the check globally.

Category C — CPython behavioural change in CLI code

Real product fixes inside azure-cli. Patterns that have bitten us:

• importlib parallel-import deadlock (3.14+). CPython 3.14 changed
  importlib to raise _DeadlockError instead of blocking when two threads
  import the same module. The command-module loader in
  src/azure-cli-core/azure/cli/core/__init__.py (_load_modules →
  ThreadPoolExecutor) trips this. Fix: a _prewarm_shared_imports() helper
  invoked on the main thread before the pool starts, importing azure.core,
  azure.mgmt.core, msrest, msrestazure (and their common submodules)
  behind try / except ImportError and a _prewarm_done idempotency flag.
  Repro on Windows:
  az --debug 2>&1 | Select-String "deadlock|Error loading".
• Typing strictness in modules that re-declare generic aliases or use
  typing.Self / PEP 695 syntax. Reference: #33298.
• argparse golden-file drift. Reference: #33314.
• http.client header / Accept-Encoding differences breaking
  header-sensitive recordings. Reference: #33316.

Category D — Extension incompatibility

scripts/ci/test_extensions.sh adds every published extension under the new
interpreter. For each extension that fails:

1. File an issue against the extension owner, linked from the tracking issue.
2. Add the extension to the ignore_list in
   scripts/ci/test_extensions.sh with
   a comment pointing to the issue.
3. Remove it from the ignore list once the owner fixes it.

3. Bump Python in azure-cli-extensions

The Azure/azure-cli-extensions repo has its own CI pipeline that pins Python
independently. This bump is a prerequisite for merging this PR — once
azure-cli ships 3.14, users will install extensions on top of it,
so the extensions repo must be green on 3.14 first.

Edit azure-pipelines.yml in the extensions repo:

• Change the default UsePythonVersion@0 legs (build, lint, style, source
  tests) from '3.13' to '3.14'.

• Add a new matrix entry to the multi-version test job (which keeps legs for
  prior minors). For 3.14 this looks like:

  Python314:
    python.version: '3.14'

• Leave the azdev verify history / azdev verify dependencies legs on their
  existing pinned version (currently 3.11) unless those tools have explicitly
  been validated on 3.14.

Reference: 3.14 — azure-cli-extensions#9843.

For each extension that fails on 3.14 in the extensions pipeline,
identify the root cause and either fix it directly (if the change is small
and you own the area) or file an issue against the owning service team and
link it from the tracking issue. This is a build/test failure in the
extension's own source — distinct from the published-extension load check in
Category D above; the ignore_list in test_extensions.sh does not help here.

4. Land this PR

When all categories are addressed and the extensions bump has landed:

1. Rebase on dev.
2. Move this PR out of draft and request review.
3. Merge once approved.

---

Generated from scripts/python_upgrade_agent/next_steps_template.md.
Tick the checkboxes above as you complete each step.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>