Set version to 3.8.14

fix: check pip module availability instead of PATH binary in download (#13947)

Add least-privilege permissions to CI workflow

Pass github context via stdin instead of CLI arg

Pin GitHub Actions to commit SHAs for supply chain security

Add smoke test and upgrade test to release build workflow

Set version to 3.8.13

Pin confection>=1.3.2 — older versions crash with pydantic v2

Fully migrate to Pydantic v2 (#13940)

Fix import sorting for ruff isort compliance

Apply ruff formatting to 8 files

Autofix autofixable things from ruff

Limit CI ruff lint to isort-only checks for now

Update CI validation workflow: replace black, isort, flake8 with ruff

Format with ruff