diff --git a/pyproject.toml b/pyproject.toml index f8f60924..5d51b9a1 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -19,31 +19,31 @@ requires-python = ">=3.12" # renovatebot/renovate#41624). `uv.lock` is the reproducible manifest generated # by uv (never hand-edited). dependencies = [ - "astropy>=7.0", # major 6 → 7 + "astropy==7.2.0", # major 6 → 7 "astroquery", "canfar", "cs_util>=0.2.1", - "galsim>=2.8", + "galsim==2.8.4", "h5py", - "joblib>=1.4", - "matplotlib>=3.10", - "mccd>=1.2.4", - "modopt>=1.6", - "mpi4py>=4.1.2", - "numba>=0.59", # numpy 2 support - "numpy>=2.4.6", # major 1 → 2 - "pandas>=3.0.3", # major 2 → 3 + "joblib==1.5.3", + "matplotlib==3.10.9", + "mccd==1.2.4", + "modopt==1.7.2", + "mpi4py==4.1.2", + "numba==0.65.1", # numpy 2 support + "numpy==2.4.6", # major 1 → 2 + "pandas==3.0.3", # major 2 → 3 "python-dateutil", - "python-pysap>=0.3", + "python-pysap==0.3.0", "PyQt5", "pyqtgraph", - "reproject>=0.19", - "sf_tools>=2.0.4", - "skaha>=1.7", - "sqlitedict>=2.0", + "reproject==0.19.0", + "sf_tools==2.0.4", + "skaha==1.7.0", + "sqlitedict==2.1.0", "termcolor", - "tqdm>=4.68.1", - "vos>=3.6", + "tqdm==4.68.1", + "vos==3.6.4", "ngmix>=2.4", ] @@ -57,9 +57,9 @@ doc = [ "sphinx-book-theme" ] jupyter = [ - "ipython>=9.14.1", - "jupyterlab>=4.5.9", - "snakemake>=9.22.0", + "ipython==9.14.1", + "jupyterlab==4.5.9", + "snakemake==9.22.0", ] lint = [ "ruff", @@ -69,9 +69,9 @@ release = [ "twine", ] test = [ - "hypothesis>=6.155.2", - "pytest>=8.3", - "pytest-cov>=5.0", + "hypothesis==6.155.2", + "pytest==9.1.1", + "pytest-cov==7.1.0", ] fitsio = ["fitsio"] dev = ["shapepipe[doc,jupyter,lint,release,test,fitsio]"] @@ -99,7 +99,7 @@ cs_util = { git = "https://github.com/CosmoStat/cs_util", branch = "develop" } # Declaring a build backend makes shapepipe an installed package (not a uv # "virtual" project), so `uv sync` / `pip install -e .` put it on the path # rather than only its dependencies. -requires = ["setuptools>=61"] +requires = ["setuptools==82.0.1"] build-backend = "setuptools.build_meta" [tool.setuptools] diff --git a/renovate.json b/renovate.json index 9d8e31c6..fe5e22b9 100644 --- a/renovate.json +++ b/renovate.json @@ -1,16 +1,18 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "description": [ - "Repo overrides on the Mend org/inherited config. Goal: keep the supply-chain minimum-release-age delay AND make dependency automerge reliable.", - "The org config sets rangeStrategy=update-lockfile via a packageRule, which outranks a top-level repo rangeStrategy (packageRules always beat top-level keys). So we set rangeStrategy=pin in a packageRule too — repo packageRules are merged LAST, so this wins. Pinning is the only way Renovate honors minimumReleaseAge with uv: floor ranges let uv resolve to a too-fresh version it can't pin (renovatebot/renovate#41624). shapepipe ships as a container, not a PyPI library, so pinning is appropriate. Scoped to PyPI datasource, so the git-sourced ngmix/cs_util are left untouched.", - "internalChecksFilter=strict: only act on versions past the age gate. minimumReleaseAge=3 days: supply-chain detection window; tunable." + "Low-noise dependency updates with mild supply-chain hygiene, layered on the Mend org config.", + "Pins: ShapePipe ships as a container, not a PyPI library, so per the Renovate dependency-pinning doc we pin app dependencies exactly. The pins are written directly in pyproject.toml (== versions), so nothing depends on rangeStrategy resolution against the org config; the packageRule (scoped to PyPI, leaving git-sourced deps like ngmix/cs_util alone) just keeps future deps pinned. Exact pins are also what lets minimumReleaseAge work with uv (renovatebot/renovate#41624).", + "Python base-image bumps (3.12 -> 3.14 rides as 'minor' in Renovate's python versioning) never automerge — a Python upgrade gets human eyes.", + "Noise: all non-major updates grouped into one weekly PR that automerges when CI (full suite in the container) is green; majors surface individually for review; lockFileMaintenance refreshes transitive deps.", + "minimumReleaseAge=7 days: supply-chain detection window, sized per the Renovate docs' automerge guidance and Astral's uv guide." ], - "internalChecksFilter": "strict", - "minimumReleaseAge": "3 days", + "extends": ["config:recommended", "group:allNonMajor", "schedule:weekly"], + "minimumReleaseAge": "7 days", + "lockFileMaintenance": { "enabled": true }, "packageRules": [ - { - "matchDatasources": ["pypi"], - "rangeStrategy": "pin" - } + { "matchDatasources": ["pypi"], "rangeStrategy": "pin" }, + { "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "automerge": true }, + { "matchPackageNames": ["python"], "automerge": false } ] } diff --git a/uv.lock b/uv.lock index a1639e7b..c5de4cdd 100644 --- a/uv.lock +++ b/uv.lock @@ -3411,48 +3411,48 @@ test = [ [package.metadata] requires-dist = [ - { name = "astropy", specifier = ">=7.0" }, + { name = "astropy", specifier = "==7.2.0" }, { name = "astroquery" }, { name = "build", marker = "extra == 'release'" }, { name = "canfar" }, { name = "cs-util", git = "https://github.com/CosmoStat/cs_util?branch=develop" }, { name = "fitsio", marker = "extra == 'fitsio'" }, - { name = "galsim", specifier = ">=2.8" }, + { name = "galsim", specifier = "==2.8.4" }, { name = "h5py" }, - { name = "hypothesis", marker = "extra == 'test'", specifier = ">=6.155.2" }, - { name = "ipython", marker = "extra == 'jupyter'", specifier = ">=9.14.1" }, - { name = "joblib", specifier = ">=1.4" }, - { name = "jupyterlab", marker = "extra == 'jupyter'", specifier = ">=4.5.9" }, - { name = "matplotlib", specifier = ">=3.10" }, - { name = "mccd", specifier = ">=1.2.4" }, - { name = "modopt", specifier = ">=1.6" }, - { name = "mpi4py", specifier = ">=4.1.2" }, + { name = "hypothesis", marker = "extra == 'test'", specifier = "==6.155.2" }, + { name = "ipython", marker = "extra == 'jupyter'", specifier = "==9.14.1" }, + { name = "joblib", specifier = "==1.5.3" }, + { name = "jupyterlab", marker = "extra == 'jupyter'", specifier = "==4.5.9" }, + { name = "matplotlib", specifier = "==3.10.9" }, + { name = "mccd", specifier = "==1.2.4" }, + { name = "modopt", specifier = "==1.7.2" }, + { name = "mpi4py", specifier = "==4.1.2" }, { name = "myst-parser", marker = "extra == 'doc'" }, { name = "ngmix", git = "https://github.com/esheldon/ngmix?tag=v2.4.0" }, - { name = "numba", specifier = ">=0.59" }, - { name = "numpy", specifier = ">=2.4.6" }, + { name = "numba", specifier = "==0.65.1" }, + { name = "numpy", specifier = "==2.4.6" }, { name = "numpydoc", marker = "extra == 'doc'" }, - { name = "pandas", specifier = ">=3.0.3" }, + { name = "pandas", specifier = "==3.0.3" }, { name = "pyqt5" }, { name = "pyqtgraph" }, - { name = "pytest", marker = "extra == 'test'", specifier = ">=8.3" }, - { name = "pytest-cov", marker = "extra == 'test'", specifier = ">=5.0" }, + { name = "pytest", marker = "extra == 'test'", specifier = "==9.1.1" }, + { name = "pytest-cov", marker = "extra == 'test'", specifier = "==7.1.0" }, { name = "python-dateutil" }, - { name = "python-pysap", specifier = ">=0.3" }, - { name = "reproject", specifier = ">=0.19" }, + { name = "python-pysap", specifier = "==0.3.0" }, + { name = "reproject", specifier = "==0.19.0" }, { name = "ruff", marker = "extra == 'lint'" }, - { name = "sf-tools", specifier = ">=2.0.4" }, + { name = "sf-tools", specifier = "==2.0.4" }, { name = "shapepipe", extras = ["doc", "jupyter", "lint", "release", "test", "fitsio"], marker = "extra == 'dev'" }, - { name = "skaha", specifier = ">=1.7" }, - { name = "snakemake", marker = "extra == 'jupyter'", specifier = ">=9.22.0" }, + { name = "skaha", specifier = "==1.7.0" }, + { name = "snakemake", marker = "extra == 'jupyter'", specifier = "==9.22.0" }, { name = "sphinx", marker = "extra == 'doc'" }, { name = "sphinx-book-theme", marker = "extra == 'doc'" }, { name = "sphinxcontrib-bibtex", marker = "extra == 'doc'" }, - { name = "sqlitedict", specifier = ">=2.0" }, + { name = "sqlitedict", specifier = "==2.1.0" }, { name = "termcolor" }, - { name = "tqdm", specifier = ">=4.68.1" }, + { name = "tqdm", specifier = "==4.68.1" }, { name = "twine", marker = "extra == 'release'" }, - { name = "vos", specifier = ">=3.6" }, + { name = "vos", specifier = "==3.6.4" }, ] provides-extras = ["doc", "jupyter", "lint", "release", "test", "fitsio", "dev"]