chore: explain weightwatcher patches and bump pyproject minimums

The Dockerfile now carries an inline note about why we use Debian's
weightwatcher package instead of the source build with sed-patched
headers — short version: GCC 10 (Apr 2020) flipped its default to
-fno-common, breaking WeightWatcher 1.12's (2014) use of common-symbol
globals in headers. The old Dockerfile patched them inline; Debian's
weightwatcher 1.12+dfsg-3 patches the same way upstream of the build.

Pyproject minimums bumped to current major versions where the major
itself moved (astropy 6→7, numpy 1→2, pandas 2→3) so the abstract
constraint signals our actual target. Minor-version drift stays in
uv.lock. ngmix line carries an explicit "do not modernize" note since
it's pinned to Axel's stable_version branch until upstream absorbs the
fixes (tracked in the ngmix-update fiber).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: cailmdaley

Dockerfile

@@ -12,6 +12,12 @@ ENV SHELL=/bin/bash \
 # System dependencies. Three categories:
 #  - astromatic binaries (psfex, source-extractor, weightwatcher) ship as
 #    Debian packages on bookworm; preferred over building from source.
+#    WeightWatcher 1.12 (2014) source uses pre-GCC-10 "common symbol"
+#    globals that won't link with GCC's modern -fno-common default; the
+#    old Dockerfile patched them inline with sed. Debian's
+#    `weightwatcher 1.12+dfsg-3` carries an equivalent patch upstream of
+#    the build, so apt install gives us the same binary without the
+#    in-tree patches.
 #  - compilers and dev libs needed to build the heavier wheels (galsim,
 #    mpi4py, python-pysap, fitsio).
 #  - libgl1, proj, fftw at runtime for skyproj/PyQt5/galsim.

pyproject.toml

@@ -12,34 +12,37 @@ license = { "file" = "LICENSE" }
 requires-python = ">=3.12"
 # Abstract runtime constraints. Exact versions live in `uv.lock` — pyproject
 # is the single source of truth for *what* shapepipe needs, the lockfile for
-# *which versions*. Minimums reflect the versions known to work in the
-# published Dockerfile; bump them only when a feature actually requires it.
+# *which versions*. Minimums signal the major-version target; uv.lock pins
+# the actual installed versions. Bump minimums only when crossing a major
+# version line or when a feature actually requires a specific release.
 dependencies = [
-    "astropy>=6.1",
+    "astropy>=7.0",          # major 6 → 7
     "astroquery",
     "canfar",
     "cs_util>=0.1.9",
-    "galsim>=2.5.3",
+    "galsim>=2.8",
     "h5py",
     "joblib>=1.4",
-    "matplotlib>=3.8.4",
+    "matplotlib>=3.10",
     "mccd>=1.2.4",
     "modopt>=1.6",
     "mpi4py>=4.0",
-    "numba>=0.58.1",
-    "numpy>=1.26",
-    "pandas>=2.2",
+    "numba>=0.59",           # numpy 2 support
+    "numpy>=2.0",            # major 1 → 2
+    "pandas>=3.0",           # major 2 → 3
     "python-dateutil",
-    "python-pysap>=0.2.1",
+    "python-pysap>=0.3",
     "PyQt5",
     "pyqtgraph",
-    "reproject>=0.14",
+    "reproject>=0.19",
     "sf_tools>=2.0.4",
     "skaha>=1.7",
     "sqlitedict>=2.0",
     "termcolor",
     "tqdm>=4.63",
     "vos>=3.6",
+    # ngmix is pinned to Axel's stable_version branch until upstream ngmix
+    # absorbs the fixes — tracked separately, do not modernize this line.
     "ngmix @ git+https://github.com/aguinot/ngmix@stable_version",
 ]