From e3eca22a3a7e507c6541589e4acceced88089909 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Wed, 5 Aug 2026 21:57:24 -0700 Subject: [PATCH 01/19] fix(deps): pin `flit_core` to match the already pinned `flit` package (#1274) --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index 134c9ed9..39a50d91 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -91,6 +91,7 @@ docs = [ dist = [ "cyclonedx-bom >=7.0.0,<8.0.0", "flit >=3.2.0,<4.0.0", + "flit_core >=3.2.0,<4.0.0", ] hooks = [ "pre-commit >=4.0.0,<4.7.0", From 99a113acf592307e5ced5fc6a2b0eba04b6ca3e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Tue, 18 Aug 2026 21:06:28 -0700 Subject: [PATCH 02/19] fix(ci): force Dependabot to always widen the version range of dependent pip packages, instead of narrowly pinning the ranges (#1283) --- .github/dependabot.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index fef394fa..4285ae10 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -7,6 +7,7 @@ version: 2 updates: - package-ecosystem: pip directory: / + versioning-strategy: widen schedule: interval: weekly cooldown: From afaea91c10e65c1c01b429e1b916cd00fd34c0cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Tue, 18 Aug 2026 21:26:51 -0700 Subject: [PATCH 03/19] revert(ci): undo force Dependabot to always widen the version range of dependent pip packages, instead of narrowly pinning the ranges (#1284) Refs: 99a113acf592307e5ced5fc6a2b0eba04b6ca3e2 --- .github/dependabot.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 4285ae10..fef394fa 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -7,7 +7,6 @@ version: 2 updates: - package-ecosystem: pip directory: / - versioning-strategy: widen schedule: interval: weekly cooldown: From 93b1cb44f6457f7e89011dcd3703073f7d5e65d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Thu, 27 Aug 2026 09:56:02 +0200 Subject: [PATCH 04/19] fix(ci): force Dependabot to always increase the version range of dependent pip packages, instead of narrowly pinning the ranges (#1298) --- .github/dependabot.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index fef394fa..5a783fea 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -7,6 +7,7 @@ version: 2 updates: - package-ecosystem: pip directory: / + versioning-strategy: increase-if-necessary schedule: interval: weekly cooldown: From 345dca539ff6cd38e32956b46d4f358a8190b326 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:36:10 +1000 Subject: [PATCH 05/19] chore(deps-dev): bump twine from 6.2.0 to 7.0.0 (#1267) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 39a50d91..9fcc4e8c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -65,7 +65,7 @@ dev = [ # installed. Make sure to keep the requirements in sync with the workflows! actions = [ "commitizen ==4.16.5", - "twine ==6.2.0", + "twine ==7.0.0", ] check = [ "mypy >=2.0.0,<2.4.0", From 09508b40b933ab218a4e3854d92e7f2da3bfc6c9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:36:34 +1000 Subject: [PATCH 06/19] chore(deps-dev): bump pytest-benchmark from 5.2.3 to 5.3.0 (#1299) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 9fcc4e8c..e3846ea4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -77,7 +77,7 @@ test = [ "faker ==40.36.0", "hypothesis >=6.21.0,<6.161.6", "pytest >=9.0.3,<9.1.0", # Pin until fixed: https://github.com/smarie/python-pytest-cases/issues/385 - "pytest-benchmark ==5.2.3", + "pytest-benchmark ==5.3.0", "pytest-cases ==3.10.1", "pytest-cov ==7.1.0", "pytest-custom_exit_code ==0.3.0", From 5d0585d97d1ae290d62af43aa6ef649ff56463bf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:36:57 +1000 Subject: [PATCH 07/19] chore(deps-dev): bump pytest-env from 1.7.0 to 1.7.1 (#1308) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index e3846ea4..bb9f98ee 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -82,7 +82,7 @@ test = [ "pytest-cov ==7.1.0", "pytest-custom_exit_code ==0.3.0", "pytest-doctestplus ==1.7.1", - "pytest-env ==1.7.0", + "pytest-env ==1.7.1", ] docs = [ "sphinx >=5.1.1,<9.0.0", From e7bfb19f6d64d74d777663fea26d549aaa22c69e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:37:50 +1000 Subject: [PATCH 08/19] chore(deps-dev): update mypy requirement from <2.4.0,>=2.0.0 to >=2.0.0,<2.5.0 (#1325) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index bb9f98ee..9782cf99 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -68,7 +68,7 @@ actions = [ "twine ==7.0.0", ] check = [ - "mypy >=2.0.0,<2.4.0", + "mypy >=2.0.0,<2.5.0", "pip-audit >=2.4.4,<3.0.0", "pylint >=4.0.0,<4.1.0", ] From a13ee738cd345ded11af4d946387dab94d9cc291 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:38:45 +1000 Subject: [PATCH 09/19] chore(deps-dev): update pylint requirement from <4.1.0,>=4.0.0 to >=4.0.0,<4.2.0 (#1328) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 9782cf99..46fc1845 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -70,7 +70,7 @@ actions = [ check = [ "mypy >=2.0.0,<2.5.0", "pip-audit >=2.4.4,<3.0.0", - "pylint >=4.0.0,<4.1.0", + "pylint >=4.0.0,<4.2.0", ] # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained. test = [ From 2f2d176b4b68ba032bc3e9ea3900cd38082dacc9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:39:22 +1000 Subject: [PATCH 10/19] chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.38.3 (#1330) Signed-off-by: dependabot[bot] --- .github/workflows/scorecards-analysis.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml index 2ab15378..90488773 100644 --- a/.github/workflows/scorecards-analysis.yaml +++ b/.github/workflows/scorecards-analysis.yaml @@ -59,6 +59,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif From 05227ae643d8415a591c1ce80f5ffd1abdf87e30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:40:30 +1000 Subject: [PATCH 11/19] chore(deps-dev): update hypothesis requirement from <6.161.6,>=6.21.0 to >=6.21.0,<6.168.6 (#1331) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 46fc1845..8713b165 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -75,7 +75,7 @@ check = [ # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained. test = [ "faker ==40.36.0", - "hypothesis >=6.21.0,<6.161.6", + "hypothesis >=6.21.0,<6.168.6", "pytest >=9.0.3,<9.1.0", # Pin until fixed: https://github.com/smarie/python-pytest-cases/issues/385 "pytest-benchmark ==5.3.0", "pytest-cases ==3.10.1", From 541acf676a11fb427b0d2404a20d0ab3ff208a71 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:54:11 +1000 Subject: [PATCH 12/19] chore(deps-dev): bump faker from 40.36.0 to 40.43.0 (#1334) Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 8713b165..66270652 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -74,7 +74,7 @@ check = [ ] # Note that the `custom_exit_code` and `env` plugins may currently be unmaintained. test = [ - "faker ==40.36.0", + "faker ==40.43.0", "hypothesis >=6.21.0,<6.168.6", "pytest >=9.0.3,<9.1.0", # Pin until fixed: https://github.com/smarie/python-pytest-cases/issues/385 "pytest-benchmark ==5.3.0", From 9d0ae2fdda7aaacff6b70f1e3801920519414c3d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 08:07:04 +1000 Subject: [PATCH 13/19] chore(deps-dev): bump commitizen from 4.16.5 to 4.19.2 (#1332) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jens Troeger --- .github/workflows/pr-conventional-commits.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- .pre-commit-config.yaml | 2 +- pyproject.toml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml index a1fb25d5..079610ca 100644 --- a/.github/workflows/pr-conventional-commits.yaml +++ b/.github/workflows/pr-conventional-commits.yaml @@ -36,7 +36,7 @@ jobs: - name: Set up Commitizen run: | pip install --upgrade pip wheel - pip install 'commitizen ==4.16.5' + pip install 'commitizen ==4.19.2' # Run Commitizen to check the title of the PR which triggered this workflow, and check # all commit messages of the PR's branch. If any of the checks fails then this job fails. diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d5761cd5..9c754bef 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -49,7 +49,7 @@ jobs: - name: Set up Commitizen run: | pip install --upgrade pip wheel - pip install 'commitizen ==4.16.5' + pip install 'commitizen ==4.19.2' - name: Set up user run: | @@ -133,7 +133,7 @@ jobs: - name: Set up Commitizen run: | pip install --upgrade pip wheel - pip install 'commitizen ==4.16.5' + pip install 'commitizen ==4.19.2' - name: Create Release Notes run: cz changelog --dry-run "$(cz version --project)" > RELEASE_NOTES.md diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9d160529..fc2801a1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -15,7 +15,7 @@ repos: # Commitizen enforces semantic and conventional commit messages. - repo: https://github.com/commitizen-tools/commitizen - rev: 6afcd8e9560ddf1b9a5032262a0be26540e85fb3 # frozen: v4.16.5 + rev: f6be1834c1d5c46f3ad126fb112ca599b6ade685 # frozen: v4.19.2 hooks: - id: commitizen name: Check conventional commit message diff --git a/pyproject.toml b/pyproject.toml index 66270652..946fd2fd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -64,7 +64,7 @@ dev = [ # We keep them listed here to ensure the infrastructure BOM is consistent with what's # installed. Make sure to keep the requirements in sync with the workflows! actions = [ - "commitizen ==4.16.5", + "commitizen ==4.19.2", "twine ==7.0.0", ] check = [ From 01c0d6f912abf838a5f80aaeec4c99ec24e2eb56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 08:21:48 +1000 Subject: [PATCH 14/19] chore(deps-dev): update flit and flit-core requirements from <4.0.0,>=3.2.0 to >=4.0.0,<5.0.0 (#1313) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jens Troeger --- Makefile | 2 +- pyproject.toml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index cd1830ad..7b1626fd 100644 --- a/Makefile +++ b/Makefile @@ -199,7 +199,7 @@ dist/$(PACKAGE_WHEEL_NAME): check test-all SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --format wheel echo $(SOURCE_DATE_EPOCH) > dist/$(PACKAGE_WHEEL_BASE_NAME)-build-epoch.txt dist/$(PACKAGE_SDIST_NAME): check test-all - SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --no-setup-py --format sdist + SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) python -m flit build --format sdist dist/$(PACKAGE_BASE_NAME)-docs-html.zip: docs-html python -m zipfile -c dist/$(PACKAGE_BASE_NAME)-docs-html.zip docs/_build/html/ dist/$(PACKAGE_BASE_NAME)-docs-md.zip: docs-md diff --git a/pyproject.toml b/pyproject.toml index 946fd2fd..8b6cd59e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ # https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html # https://flit.pypa.io/en/latest/pyproject_toml.html [build-system] -requires = ["flit_core >=3.12.0,<4.0.0"] +requires = ["flit_core >=4.0.0,<5.0.0"] build-backend = "flit_core.buildapi" [project] @@ -90,8 +90,8 @@ docs = [ ] dist = [ "cyclonedx-bom >=7.0.0,<8.0.0", - "flit >=3.2.0,<4.0.0", - "flit_core >=3.2.0,<4.0.0", + "flit >=4.0.0,<5.0.0", + "flit_core >=4.0.0,<5.0.0", ] hooks = [ "pre-commit >=4.0.0,<4.7.0", From 35d4436002047ec60100b5870d07356fc27034eb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 08:47:43 +1000 Subject: [PATCH 15/19] chore(deps): bump the pre-commit group across 1 directory with 2 updates (#1341) Signed-off-by: dependabot[bot] --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index fc2801a1..4ef0351b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,7 +23,7 @@ repos: # Ruff formats and lints code. - repo: https://github.com/astral-sh/ruff-pre-commit - rev: cb8c523fd4835aba42af70f4cad5568db4df0b6c # frozen: v0.16.0 + rev: 38bfb07c0c64c304f47eb52090f8288150c77730 # frozen: v0.17.1 hooks: - id: ruff-format args: [--config, pyproject.toml] @@ -108,7 +108,7 @@ repos: # Check GitHub Actions workflow files. - repo: https://github.com/Mateusz-Grzelinski/actionlint-py - rev: c04ed26e40637cab1aa9879c693832a9c120fb20 # frozen: v1.7.12.24 + rev: 805f85e558841bf4d852335e036b33d2b26be1cc # frozen: v1.7.12.25 hooks: - id: actionlint From 16832c346ea133375265487e385a80ad46550d23 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 10:14:17 +1000 Subject: [PATCH 16/19] chore(deps): bump step-security/harden-runner from 2.20.0 to 2.22.1 (#1337) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/_build.yaml | 2 +- .github/workflows/_generate-rebase.yaml | 2 +- .github/workflows/_wiki-documentation.yaml | 2 +- .github/workflows/codeql-analysis.yaml | 2 +- .github/workflows/release.yaml | 6 +++--- .github/workflows/scorecards-analysis.yaml | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml index 846ad7af..8ced72ea 100644 --- a/.github/workflows/_build.yaml +++ b/.github/workflows/_build.yaml @@ -55,7 +55,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true diff --git a/.github/workflows/_generate-rebase.yaml b/.github/workflows/_generate-rebase.yaml index bc0dbeed..ae47b4cf 100644 --- a/.github/workflows/_generate-rebase.yaml +++ b/.github/workflows/_generate-rebase.yaml @@ -34,7 +34,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/_wiki-documentation.yaml b/.github/workflows/_wiki-documentation.yaml index aae0be0f..014ad7a3 100644 --- a/.github/workflows/_wiki-documentation.yaml +++ b/.github/workflows/_wiki-documentation.yaml @@ -41,7 +41,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml index 6d4f7c93..41c90861 100644 --- a/.github/workflows/codeql-analysis.yaml +++ b/.github/workflows/codeql-analysis.yaml @@ -33,7 +33,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9c754bef..2f0bd88b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -30,7 +30,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true @@ -98,7 +98,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true @@ -199,7 +199,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml index 90488773..11d4f465 100644 --- a/.github/workflows/scorecards-analysis.yaml +++ b/.github/workflows/scorecards-analysis.yaml @@ -26,7 +26,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs disable-sudo: true From 23acfcdc834c42baa25d238ce014eb328d5b78b0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 10:14:51 +1000 Subject: [PATCH 17/19] chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#1333) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecards-analysis.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml index 11d4f465..24086535 100644 --- a/.github/workflows/scorecards-analysis.yaml +++ b/.github/workflows/scorecards-analysis.yaml @@ -37,7 +37,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif From 9c749e553b18656ff20b8caed2610106345aa1f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Tue, 20 Oct 2026 10:15:55 +1000 Subject: [PATCH 18/19] docs: enable a few additional features for the generated Markdown documentation (#1282) --- docs/source/conf.py | 15 +++++++++++++-- pyproject.toml | 2 +- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/docs/source/conf.py b/docs/source/conf.py index 40d19662..41003dc2 100644 --- a/docs/source/conf.py +++ b/docs/source/conf.py @@ -19,7 +19,7 @@ # -- Project information ----------------------------------------------------- project = "Package" -copyright = "2023, Package" +copyright = "2023-2026, Package" author = "" @@ -52,10 +52,21 @@ # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. -# html_theme = "alabaster" # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ["_static"] + + +# -- Options for Markdown output ------------------------------------------------- +# For details, see: https://github.com/liran-funaro/sphinx-markdown-builder#configurations +markdown_anchor_sections = True +markdown_anchor_signature = True +markdown_docinfo = True +# markdown_http_base = +# markdown_uri_doc_suffix = +# markdown_file_suffix = +# markdown_bullet = +markdown_flavor = "github" diff --git a/pyproject.toml b/pyproject.toml index 8b6cd59e..7c6f026c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -86,7 +86,7 @@ test = [ ] docs = [ "sphinx >=5.1.1,<9.0.0", - "sphinx-markdown-builder >=0.6.4,<1.0.0", + "sphinx-markdown-builder >=0.6.10,<1.0.0", ] dist = [ "cyclonedx-bom >=7.0.0,<8.0.0", From 3d169c5309a5bd45d6631f439601323ddcf5b2cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Tr=C3=B6ger?= Date: Tue, 20 Oct 2026 11:18:13 +1000 Subject: [PATCH 19/19] feat: add support for Python 3.14 and retire support for Python 3.10 (#1340) --- .github/workflows/_build.yaml | 6 ++-- .github/workflows/codeql-analysis.yaml | 2 +- .../workflows/pr-conventional-commits.yaml | 2 +- .github/workflows/release.yaml | 8 +++--- Makefile | 4 +-- README.md | 28 +++++++++---------- pyproject.toml | 4 +-- 7 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml index 8ced72ea..e15c1701 100644 --- a/.github/workflows/_build.yaml +++ b/.github/workflows/_build.yaml @@ -6,7 +6,7 @@ # # Even though we run the build in a matrix to check against different platforms, due to a known # limitation of reusable workflows that do not support setting strategy property from the caller -# workflow, we only generate artifacts for ubuntu-latest and Python 3.14, which can be used to +# workflow, we only generate artifacts for ubuntu-latest and Python 3.15, which can be used to # create a release. For details see: # # https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations @@ -35,7 +35,7 @@ permissions: contents: read env: ARTIFACT_OS: ubuntu-latest # The default OS for release. - ARTIFACT_PYTHON: '3.14' # The default Python version for release. + ARTIFACT_PYTHON: '3.15' # The default Python version for release. jobs: check-and-build-package: @@ -51,7 +51,7 @@ jobs: # It is recommended to pin a Runner version specifically: # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners os: [ubuntu-latest, macos-latest, windows-latest] - python: ['3.10', '3.11', '3.12', '3.13', '3.14'] + python: ['3.11', '3.12', '3.13', '3.14', '3.15'] steps: - name: Harden Runner diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml index 41c90861..05dedcce 100644 --- a/.github/workflows/codeql-analysis.yaml +++ b/.github/workflows/codeql-analysis.yaml @@ -29,7 +29,7 @@ jobs: matrix: # Learn more about CodeQL language support at https://git.io/codeql-language-support language: [python, actions] - python: ['3.14'] + python: ['3.15'] steps: - name: Harden Runner diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml index 079610ca..c0e16bbe 100644 --- a/.github/workflows/pr-conventional-commits.yaml +++ b/.github/workflows/pr-conventional-commits.yaml @@ -29,7 +29,7 @@ jobs: - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: '3.14' + python-version: '3.15' # Install Commitizen without using the package's Makefile: that's much faster than # creating a venv and installing heaps of dependencies that aren't required for this job. diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2f0bd88b..a69be954 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -44,7 +44,7 @@ jobs: - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: '3.14' + python-version: '3.15' - name: Set up Commitizen run: | @@ -111,7 +111,7 @@ jobs: - name: Download artifact uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: - name: artifact-ubuntu-latest-python-3.14 + name: artifact-ubuntu-latest-python-3.15 path: dist # Verify hashes by first computing hashes for the artifacts and then comparing them @@ -128,7 +128,7 @@ jobs: - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: '3.14' + python-version: '3.15' - name: Set up Commitizen run: | @@ -250,7 +250,7 @@ jobs: # Github disallows passing environment variables as arguments to a reusable # workflow, so we have to duplicate these values here. Related discussion # here: https://github.com/actions/toolkit/issues/931 - artifact-name: artifact-ubuntu-latest-python-3.14 + artifact-name: artifact-ubuntu-latest-python-3.15 git-user-name: jenstroeger git-user-email: jenstroeger@users.noreply.github.com secrets: diff --git a/Makefile b/Makefile index 7b1626fd..649048e2 100644 --- a/Makefile +++ b/Makefile @@ -22,7 +22,7 @@ PACKAGE_WHEEL_BASE_NAME := $(PACKAGE_BASE_NAME)-py3-none-any PACKAGE_WHEEL_NAME := $(PACKAGE_WHEEL_BASE_NAME).whl # If a PYTHON environment variable exists then use that, else define it here. -PYTHON ?= python3.14 +PYTHON ?= python3.15 # This variable contains the first goal that matches any of the listed goals # here, else it contains an empty string. The net effect is to filter out @@ -75,7 +75,7 @@ endif .PHONY: all all: check test dist docs -# Create a virtual environment, either for Python3.14 (default) or using +# Create a virtual environment, either for Python3.15 (default) or using # the Python interpreter specified in the PYTHON environment variable. Also # create an empty pip.conf file to ensure that `pip config` modifies this # venv only, unless told otherwise. For more background, see: diff --git a/README.md b/README.md index 5c002d27..ca88c69a 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ The badges above give you an idea of what this project template provides. It’s ### Typing -The package requires a minimum of [Python 3.10](https://www.python.org/downloads/release/python-31020/), and it supports [Python 3.11](https://www.python.org/downloads/release/python-31115/), [Python 3.12](https://www.python.org/downloads/release/python-31213/), [Python 3.13](https://www.python.org/downloads/release/python-31313/), and [Python 3.14](https://www.python.org/downloads/release/python-3144/) (default). All code requires comprehensive [typing](https://docs.python.org/3/library/typing.html). The [mypy](http://mypy-lang.org/) static type checker and ruff’s [pyi](https://docs.astral.sh/ruff/rules/#flake8-pyi-pyi) plugin are invoked by git hooks and through a Github Action to enforce continuous type checks on Python source and [stub files](https://peps.python.org/pep-0484/#stub-files). Make sure to add type hints to your code or to use [stub files](https://mypy.readthedocs.io/en/stable/stubs.html) for types, to ensure that users of your package can `import` and type-check your code (see also [PEP 561](https://www.python.org/dev/peps/pep-0561/)). +The package requires a minimum of [Python 3.11](https://www.python.org/downloads/release/python-31117/), and it supports [Python 3.12](https://www.python.org/downloads/release/python-31215/), [Python 3.13](https://www.python.org/downloads/release/python-31316/), [Python 3.14](https://www.python.org/downloads/release/python-3148/), and [Python 3.15](https://www.python.org/downloads/release/python-3150/) (default). All code requires comprehensive [typing](https://docs.python.org/3/library/typing.html). The [mypy](http://mypy-lang.org/) static type checker and ruff’s [pyi](https://docs.astral.sh/ruff/rules/#flake8-pyi-pyi) plugin are invoked by git hooks and through a Github Action to enforce continuous type checks on Python source and [stub files](https://peps.python.org/pep-0484/#stub-files). Make sure to add type hints to your code or to use [stub files](https://mypy.readthedocs.io/en/stable/stubs.html) for types, to ensure that users of your package can `import` and type-check your code (see also [PEP 561](https://www.python.org/dev/peps/pep-0561/)). ### Quality assurance @@ -105,19 +105,19 @@ If you’d like to start your own Python project from scratch, you can either co To develop your new package, first create a [virtual environment](https://docs.python.org/3/tutorial/venv.html) by either using the [Makefile](https://www.gnu.org/software/make/manual/make.html#toc-An-Introduction-to-Makefiles): ```bash -make venv # Create a new virtual environment in .venv folder using Python 3.14. +make venv # Create a new virtual environment in .venv folder using Python 3.15. ``` or for a specific version of Python: ```bash -PYTHON=python3.12 make venv # Same virtual environment for a different Python version. +PYTHON=python3.14 make venv # Same virtual environment for a different Python version. ``` or manually: ```bash -python3.14 -m venv .venv # Or use .venv314 for more than one local virtual environments. +python3.15 -m venv .venv # Or use .venv315 for more than one local virtual environments. ``` When working with this Makefile _it is important to always [activate the virtual environment](https://docs.python.org/3/library/venv.html)_ because some of the [git hooks](#git-hooks) (see below) depend on that: @@ -184,13 +184,13 @@ Note that the unit tests include [doctest](https://docs.python.org/3/library/doc Both statement and branch coverage are being tracked using [coverage](https://github.com/nedbat/coveragepy) and the [pytest-cov](https://github.com/pytest-dev/pytest-cov) plugin for pytest when running unit tests, and it measures how much code in the `src/package/` folder is covered by tests: ``` =========================================== test session starts =========================================== -platform darwin -- Python 3.14.5, pytest-9.0.3, pluggy-1.6.0 -- /path/to/python-package-template/.venv/bin/python +platform darwin -- Python 3.15.0, pytest-9.0.3, pluggy-1.7.0 -- /path/to/python-package-template/.venv/bin/python cachedir: .pytest_cache benchmark: 5.2.3 (defaults: timer=time.perf_counter disable_gc=False min_rounds=5 min_time=0.000005 max_time=1.0 calibration_precision=10 warmup=False warmup_iterations=100000) hypothesis profile 'default-with-verbose-verbosity' -> verbosity=Verbosity.verbose rootdir: /path/to/python-package-template configfile: pyproject.toml -plugins: benchmark-5.2.3, cov-7.1.0, env-1.6.0, Faker-40.19.1, custom-exit-code-0.3.0, doctestplus-1.7.1, cases-3.10.1, hypothesis-6.152.9 +plugins: benchmark-5.2.3, hypothesis-6.161.5, cov-7.1.0, custom-exit-code-0.3.0, Faker-40.36.0, doctestplus-1.7.1, cases-3.10.1, env-1.7.0, platformdirs-4.13.5 collected 6 items / 2 deselected / 4 selected src/package/something.py::package.something.Something.do_something PASSED [ 25%] @@ -199,7 +199,7 @@ tests/unit/test_something.py::test_something_cases[_case_boolean] PASSED docs/source/index.rst::index.rst PASSED [100%] ============================================= tests coverage ============================================== -____________________________ coverage: platform darwin, python 3.14.5-final-0 _____________________________ +____________________________ coverage: platform darwin, python 3.15.0-final-0 _____________________________ Name Stmts Miss Branch BrPart Cover Missing ---------------------------------------------------------------------- @@ -213,25 +213,25 @@ tests/unit/test_something.py::test_something_hypothesis: - during generate phase (0.00 seconds): - Typical runtimes: ~ 0-1 ms, of which < 1ms in data generation - - 2 passing examples, 0 failing examples, 0 invalid examples + - 2 passing, 0 failing, and 0 invalid test cases - Stopped because nothing left to do ============================================ slowest durations ============================================ 0.05s setup src/package/something.py::package.something.Something.do_something +0.04s call src/package/something.py::package.something.Something.do_something 0.00s call tests/unit/test_something.py::test_something_hypothesis -0.00s call src/package/something.py::package.something.Something.do_something -0.00s setup tests/unit/test_something.py::test_something_cases[_case_boolean] 0.00s call docs/source/index.rst::index.rst -0.00s setup docs/source/index.rst::index.rst +0.00s setup tests/unit/test_something.py::test_something_cases[_case_boolean] 0.00s setup tests/unit/test_something.py::test_something_hypothesis -0.00s call tests/unit/test_something.py::test_something_cases[_case_boolean] -0.00s teardown src/package/something.py::package.something.Something.do_something +0.00s setup docs/source/index.rst::index.rst 0.00s teardown docs/source/index.rst::index.rst +0.00s teardown src/package/something.py::package.something.Something.do_something +0.00s call tests/unit/test_something.py::test_something_cases[_case_boolean] 0.00s teardown tests/unit/test_something.py::test_something_cases[_case_boolean] 0.00s teardown tests/unit/test_something.py::test_something_hypothesis -===================================== 4 passed, 2 deselected in 0.16s ===================================== +===================================== 4 passed, 2 deselected in 0.19s ===================================== ``` Note that code that’s not covered by tests is listed under the `Missing` column, and branches not taken too. The net effect of enforcing 100% code and branch coverage is that every new major and minor feature, every code change, and every fix are being tested (keeping in mind that high _coverage_ does not imply comprehensive, meaningful _test data_). diff --git a/pyproject.toml b/pyproject.toml index 7c6f026c..c92c4e87 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "flit_core.buildapi" [project] name = "package" -requires-python = ">=3.10.0,<3.15.0" +requires-python = ">=3.11.0,<3.16.0" authors = [{name = "Author", email = "author@email"}] maintainers = [{name = "Maintainer", email = "maintainer@email"}] dynamic = ["version"] @@ -23,11 +23,11 @@ classifiers = [ "Natural Language :: English", "Operating System :: OS Independent", "Programming Language :: Python", - "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Programming Language :: Python :: 3.14", + "Programming Language :: Python :: 3.15", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: Implementation :: CPython", "Topic :: Software Development :: Libraries :: Python Modules",