Bug 2351393 - bandit fails to build with Python 3.14: TypeError: Error: Str is not a valid node type in AST
Summary: bandit fails to build with Python 3.14: TypeError: Error: Str is not a valid ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: bandit
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Orphan Owner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 2371680 (view as bug list)
Depends On:
Blocks: PYTHON3.14 F43FTBFS F43FailsToInstall F44FailsToInstall, RAWHIDEFailsToInstall
TreeView+ depends on / blocked
 
Reported: 2025-03-11 15:27 UTC by Karolina Surma
Modified: 2025-09-30 19:00 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-09-30 19:00:31 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github PyCQA bandit issues 1219 0 None open Redo support for Python 3.14 2025-03-11 15:48:46 UTC

Description Karolina Surma 2025-03-11 15:27:29 UTC
bandit fails to build with Python 3.14.0a5.

==================================== ERRORS ====================================
___________ ERROR collecting tests/unit/cli/test_config_generator.py ___________
tests/unit/cli/test_config_generator.py:22: in <module>
    @test.checks("Str")
bandit/core/test_properties.py:22: in wrapper
    func._checks.append(utils.check_ast_node(arg))
bandit/core/utils.py:370: in check_ast_node
    raise TypeError(f"Error: {name} is not a valid node type in AST")
E   TypeError: Error: Str is not a valid node type in AST
______________ ERROR collecting tests/unit/core/test_test_set.py _______________
tests/unit/core/test_test_set.py:17: in <module>
    @test.checks("Str")
bandit/core/test_properties.py:22: in wrapper
    func._checks.append(utils.check_ast_node(arg))
bandit/core/utils.py:370: in check_ast_node
    raise TypeError(f"Error: {name} is not a valid node type in AST")
E   TypeError: Error: Str is not a valid node type in AST

https://docs.python.org/3.14/whatsnew/3.14.html

For the build logs, see:
https://copr-be.cloud.fedoraproject.org/results/@python/python3.14/fedora-rawhide-x86_64/08750269-bandit/

For all our attempts to build bandit with Python 3.14, see:
https://copr.fedorainfracloud.org/coprs/g/python/python3.14/package/bandit/

Testing and mass rebuild of packages is happening in copr.
You can follow these instructions to test locally in mock if your package builds with Python 3.14:
https://copr.fedorainfracloud.org/coprs/g/python/python3.14/

Let us know here if you have any questions.

Python 3.14 is planned to be included in Fedora 43.
To make that update smoother, we're building Fedora packages with all pre-releases of Python 3.14.
A build failure prevents us from testing all dependent packages (transitive [Build]Requires),
so if this package is required a lot, it's important for us to get it fixed soon.

We'd appreciate help from the people who know this package best,
but if you don't want to work on this now, let us know so we can try to work around it on our side.

Comment 1 Karolina Surma 2025-06-11 15:52:20 UTC
*** Bug 2371680 has been marked as a duplicate of this bug. ***

Comment 2 Miro Hrončok 2025-08-25 10:49:52 UTC
Mikel, you ASSIGNED this Bugzilla in March. What is the plan? The Beta Freeze of Fedora 43 starts tomorrow.

Comment 3 Mikel Olasagasti Uranga 2025-08-25 11:09:18 UTC
Upstream hasn't fixed the issue and I don't time to check it by myself at the moment.

https://github.com/PyCQA/bandit/issues/1219

The only option would be to retire the package, right?

Comment 4 Miro Hrončok 2025-08-25 11:23:15 UTC
You can probably postpone the decision to later (near final freeze). Or orphan the package and ask for new maintainers.

Comment 5 Fedora Admin user for bugzilla script actions 2025-09-16 01:53:57 UTC
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.

Comment 6 Fedora Fails To Install 2025-09-16 09:58:42 UTC
This package has been orphaned.

You can pick it up at https://src.fedoraproject.org/rpms/bandit by clicking button "Take". If nobody picks it up, it will be retired and removed from a distribution.

Comment 7 Miro Hrončok 2025-09-23 14:12:56 UTC
This is a placeholder reminder

Comment 8 Miro Hrončok 2025-09-23 14:13:36 UTC
This is a placeholder reminder

Comment 9 Miro Hrončok 2025-09-30 19:00:31 UTC
Automation has figured out the package is retired in rawhide.

If you like it to be unretired, please open a ticket at https://pagure.io/releng/new_issue?template=package_unretirement


Note You need to log in before you can comment on or make changes to this bug.