chore: upgrade dependencies and add Python 3.15

[fgmacedo]

Why

Python 3.15.0 is out (actions/python-versions 3.15.0 published 2026-10-10, python-build-standalone 20261009), and CI stops at 3.14. The last dependency refresh was #659; uv lock --upgrade now moves 26 packages.

Closes #670.

What changes

• CI matrix runs 3.10 through 3.15; the classifiers list 3.15. requires-python stays >=3.10.
• The ruff lint step, the Codecov upload, the release build and mypy's python_version move from 3.14 to 3.15: ruff, coverage, codecov-action, hatchling, mypy (cp315 wheel, --python-version 3.15) and pyright all run clean on 3.15. Read the Docs stays on 3.14, the newest build.tools.python it offers.
• No library change: the suite passes on 3.15 under -X dev -W error::DeprecationWarning.
• Runtime floors (pydot, PyYAML, jsonschema) are untouched, so the release notes only state the supported range.
• Django split still matches Django's matrix: 6.1 requires >=3.12, 5.2 LTS covers 3.10/3.11. Neither declares 3.15 yet; 6.1.2 passes the Django tests on 3.15.

Upgraded packages (uv lock --upgrade, direct dependencies in bold):

Package	From	To
django (py>=3.12)	6.1.1	6.1.2
django (py<3.12)	5.2.17	5.2.18
mypy	2.3.1	2.4.0
pytest-mock	3.15.1	3.16.0
ruff	0.16.7	0.16.10
sphinx-gallery	0.21.0	0.22.1
ast-serialize	0.11.2	0.12.1
charset-normalizer	3.5.1	3.5.2
coverage	7.16.1	7.16.2
filelock	3.32.6	4.0.12
identify	2.6.19	2.6.20
idna	3.19	3.20
librt	0.15.0	0.16.0
markupsafe	3.0.3	3.0.4
nodeenv	1.10.0	1.11.0
platformdirs	4.11.8	4.12.3
pyparsing	3.3.2	3.3.3
python-discovery	1.6.0	1.6.1
rpds-py (newer branch)	2026.6.3	2026.9.1
soupsieve	2.9.2	2.10
starlette	1.6.0	1.7.0
tzdata	2026.4	2026.5
urllib3	2.7.0	2.8.0
uvicorn	0.52.4	0.54.0
virtualenv	21.7.9	21.14.5
watchfiles	1.2.0	1.3.0
websockets (newer branch)	17.1	17.2

Dev floors raised to the locked versions: ruff, pytest-mock, both Django entries. Pre-commit: ruff hook v0.16.7 -> v0.16.10. Actions: setup-uv v10.1.0 -> v10.2.0 (cache saves disabled in merge queues, checksum updates); every other action is already on its latest major.

The lock keeps its exclude-newer-span = "P7D", so releases younger than 7 days are not taken: ruff 0.17.0 (2026-10-09), pre-commit 4.7.0 (2026-10-12) and setup-uv v10.3.0 (2026-10-09) stay for the next refresh.

Evidence

Local runs on CPython 3.14.7 and 3.15.0 (python-build-standalone 20261009, checksum verified), each in its own venv:

$ timeout 300 uv run pytest -n 4 --cov --cov-fail-under=100      # 3.14 and 3.15
2631 passed, 25 skipped, 44 xfailed            # same counts on both
Required test coverage of 100% reached. Total coverage: 100.00%

$ uv run --python 3.15 python -X dev -W error::DeprecationWarning -m pytest -n 4
2631 passed, 25 skipped, 44 xfailed

$ uv run ruff check . && uv run ruff format --check .
All checks passed!  /  347 files already formatted
$ uv run mypy --namespace-packages --explicit-package-bases statemachine/ tests/
Success: no issues found in 265 source files   # 3.12, 3.14 and 3.15 envs
$ uv run pyright statemachine/
0 errors, 0 warnings, 0 informations           # 3.14 and 3.15
$ uv run pre-commit run --all-files            # 3.14 and 3.15 envs
all 9 hooks Passed

$ uv run sphinx-build -q docs <out>            # 3.14 and 3.15, one at a time
48 warnings on both, identical set (the baseline #659 reported)

The independent reviewer also ran uv sync --locked --all-extras --dev and pytest -n 4 on 3.10 and 3.11: 2631 passed, 25 skipped, 44 xfailed on both; mypy clean on 3.10.

The 25 skips and the 9 RemovedInSphinx11Warning warnings (sphinx_ext.py:260, env.app) are the same on 3.12, 3.14 and 3.15.

Not verified

• 3.12 and 3.13 with the new lock were not run locally; the CI matrix covers them.
• release.yml on 3.15 runs only on the next tag.
• PyYAML 6.0.3 ships no cp315 wheel and builds from the sdist on 3.15; on macOS arm64 it fell back to the pure-Python loader (yaml.__with_libyaml__ is False). Users of the yaml/io extras on 3.15 get the same until PyYAML ships a cp315 wheel. Not tried on Linux outside CI.
• Django does not declare 3.15 support yet; only this repo's Django tests were run against it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b52d534) to head (481d623).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #676   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           53        53           
  Lines         5787      5787           
  Branches       918       918           
=========================================
  Hits          5787      5787           

Flag	Coverage Δ
unittests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud