Merge remote-tracking branch 'origin/develop' into wt/741-develop-merge

# Conflicts:
#	uv.lock

Author: cailmdaley

.github/dependabot.yml

@@ -18,12 +18,17 @@
 #     atomic to revert, large enough to actually be reviewed.
 #   - Major bumps stay as individual PRs (potentially breaking; each
 #     deserves its own review).
+#   - Security updates are grouped too (one batched PR per ecosystem) so a
+#     same-day burst of advisories arrives as a single PR, not one per package.
 #   - No auto-merge anywhere. Lockfile diffs are uninspectable; we eyeball
 #     the version metadata and source links before merging.
 #
-# Note: cooldown does NOT apply to security-updates (the GHSA-driven PRs).
-# Those still fire on the CVE-publication timeline, which is the right
-# tradeoff for shapepipe — fix CVEs fast, but don't auto-merge them either.
+# Note: cooldown and the monthly schedule do NOT apply to security-updates
+# (the GHSA-driven PRs) — only to version-updates. Security PRs still fire on
+# the CVE-publication timeline, which is the right tradeoff for shapepipe (fix
+# CVEs fast). The `applies-to: security-updates` groups below don't change that
+# timing; they only collapse a burst into one PR. Each `groups` block needs an
+# explicit `applies-to`, hence the paired version/security groups per ecosystem.
 
 version: 2
 
@@ -39,8 +44,12 @@ updates:
       semver-major-days: 30
     groups:
       lockfile-minor-patch:
+        applies-to: version-updates
         patterns: ["*"]
         update-types: ["minor", "patch"]
+      lockfile-security:
+        applies-to: security-updates
+        patterns: ["*"]
     open-pull-requests-limit: 3
     labels:
       - "dependencies"
@@ -55,6 +64,10 @@ updates:
       default-days: 14
     groups:
       actions:
+        applies-to: version-updates
+        patterns: ["*"]
+      actions-security:
+        applies-to: security-updates
         patterns: ["*"]
     open-pull-requests-limit: 2
     labels:

.github/workflows/cd.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Resolve version slug
         id: slug
@@ -55,12 +55,12 @@ jobs:
           echo "dir=$dir"   >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
         with:
           driver-opts: network=host
 
       - name: Build dev image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           target: dev
@@ -82,7 +82,7 @@ jobs:
             "
 
       - name: Upload built HTML as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docs-html-${{ steps.slug.outputs.slug }}
           path: docs/_build

.github/workflows/deploy-image.yml

@@ -37,24 +37,24 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
         with:
           driver-opts: network=host
 
       # Two parallel tag sets. `dev` is the default (no suffix, e.g. `:latest`,
       # `:develop`); `runtime` carries a `-runtime` suffix.
       - name: Tags — dev (default)
         id: meta-dev
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Tags — runtime
         id: meta-runtime
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -66,7 +66,7 @@ jobs:
 
       # Build runtime first (smaller, used to smoke-test pipeline binaries)
       - name: Build runtime (load)
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           target: runtime
@@ -96,7 +96,7 @@ jobs:
 
       # Build dev (reuses cached `base` layer)
       - name: Build dev (load)
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           target: dev
@@ -131,15 +131,15 @@ jobs:
       # ----------------------------------------------------------------
       - name: Log in to the Container registry
         if: github.event_name == 'push'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push runtime
         if: github.event_name == 'push'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           target: runtime
@@ -150,7 +150,7 @@ jobs:
 
       - name: Push dev
         if: github.event_name == 'push'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           target: dev

pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
     "skaha>=1.7",
     "sqlitedict>=2.0",
     "termcolor",
-    "tqdm>=4.63",
+    "tqdm>=4.68.1",
     "vos>=3.6",
     "ngmix>=2.4",
 ]
@@ -55,9 +55,9 @@ doc = [
     "sphinx-book-theme"
 ]
 jupyter = [
-    "ipython>=8.18",
-    "jupyterlab>=4.5.7",
-    "snakemake>=9.21.0",
+    "ipython>=9.14.1",
+    "jupyterlab>=4.5.9",
+    "snakemake>=9.22.0",
 ]
 lint = [
     "black",
@@ -68,7 +68,7 @@ release = [
     "twine",
 ]
 test = [
-    "hypothesis>=6.100",
+    "hypothesis>=6.155.2",
     "pytest>=8.3",
     "pytest-cov>=5.0",
     "pytest-pycodestyle>=2.4",