ci: fix the three failures that have kept main red since July

.github/workflows/cd.yml

@@ -29,7 +29,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: hynek/build-and-inspect-python-package@v2
+      # v3 ships Twine 7, which understands packaging metadata 2.5 — what
+      # hatchling emits for a PEP 639 SPDX license. v2 bundles Twine 6 and
+      # fails `twine check --strict`. v3 no longer force-tags majors, so this
+      # pins the full version deliberately.
+      - uses: hynek/build-and-inspect-python-package@v3.0.1
 
   publish:
     needs: [dist]

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.14"]
+        python-version: ["3.11", "3.14"]
         runs-on: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
 
     steps:

pyproject.toml

@@ -108,7 +108,10 @@ report.exclude_also = [
 
 [tool.mypy]
 files = ["src", "tests"]
-python_version = "3.10"
+# 3.12, not the 3.11 floor in requires-python: numpy ships stubs using PEP 695
+# `type` statements, which mypy cannot parse when targeting < 3.12. The 3.11
+# floor is enforced by ruff (which infers it from requires-python) and pylint.
+python_version = "3.12"
 warn_unused_configs = true
 strict = true
 enable_error_code = ["ignore-without-code", "redundant-expr", "truthy-bool"]
@@ -190,7 +193,7 @@ ignore = [
 
 
 [tool.pylint]
-py-version = "3.10"
+py-version = "3.11"  # matches requires-python
 ignore-paths = [".*/_version.py"]
 reports.output-format = "colorized"
 similarities.ignore-imports = "yes"

tests/conftest.py

@@ -5,7 +5,7 @@
 
 import datajoint as dj
 import pytest
-from testcontainers.mysql import MySqlContainer
+from testcontainers.community.mysql import MySqlContainer
 
 logger = logging.getLogger(__name__)