Bump pinned tooling and keep CI, docs, and lockfile aligned.

.github/workflows/build.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/codecov.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/deploy.yml

@@ -5,7 +5,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:
@@ -98,7 +98,7 @@ jobs:
     if: ${{ needs.build_test.result == 'success' }}
     permissions:
       contents: write  # Required for release-tag reusable workflow to push signed tags
-    uses: ./.github/workflows/release-tag.yml
+    uses: $/.github/workflows/release-tag.yml
     secrets:
       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
 

.github/workflows/docs.yml

@@ -5,7 +5,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/supply-chain.yml

@@ -7,9 +7,9 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
-  PIP_AUDIT_VERSION: "2.10.0"
+  PIP_AUDIT_VERSION: "2.10.1"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}

.github/workflows/test.yml

@@ -7,7 +7,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
+  UV_VERSION: "0.12.10"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/zizmor.yml

@@ -7,8 +7,8 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.12.7"
-  ZIZMOR_VERSION: "1.29.0"
+  UV_VERSION: "0.12.10"
+  ZIZMOR_VERSION: "1.30.0"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}

.github/zizmor.yml

@@ -30,8 +30,13 @@ rules:
         - pypa/gh-action-pypi-publish
         - softprops/action-gh-release
         - astral-sh/setup-uv
+        - astral-sh/ruff-pre-commit
+        - astral-sh/uv-pre-commit
         - codecov/codecov-action
         - google/osv-scanner-action/osv-scanner-action
+        - pre-commit/mirrors-mypy
+        - pre-commit/pre-commit-hooks
+        - pre-commit/pygrep-hooks
 
   dependabot-cooldown:
     config:

.pre-commit-config.yaml

@@ -3,18 +3,18 @@ default_language_version:
 
 repos:
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.12.7
+    rev: 0.12.10
     hooks:
       - id: uv-lock
         args: [ --check ]
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.5
+    rev: v0.16.6
     hooks:
       - id: ruff-check
         args: [ --fix, --exit-non-zero-on-fix ]
       - id: ruff-format
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v2.1.0
+    rev: v2.3.1
     hooks:
       - id: mypy
         pass_filenames: false

Makefile

@@ -1,7 +1,7 @@
 .ONESHELL:
 
-UV_VERSION ?= 0.12.7
-PIP_AUDIT_VERSION ?= 2.10.0
+UV_VERSION ?= 0.12.10
+PIP_AUDIT_VERSION ?= 2.10.1
 
 .PHONY: all install update test lint audit clean builddocs servedocs cleandocs
 

docs/source/development/contributing.rst

@@ -18,7 +18,7 @@ Development Setup
    cd openseries
 
 3. Create the development environment. This installs the pinned uv version
-   (``uv==0.12.7``), syncs locked ``dev`` and ``docs`` dependencies from
+   (``uv==0.12.10``), syncs locked ``dev`` and ``docs`` dependencies from
    ``uv.lock``, and installs pre-commit hooks:
 
 .. code-block:: bash

docs/source/user_guide/installation.rst

@@ -119,7 +119,7 @@ Development Installation
 ------------------------
 
 If you plan to contribute to openseries or need the development dependencies,
-use the same pinned tooling as CI (``uv==0.12.7``):
+use the same pinned tooling as CI (``uv==0.12.10``):
 
 .. code-block:: bash
 
@@ -136,8 +136,8 @@ dependencies include:
 - **pytest** (>=9.1.0) - Testing framework
 - **pytest-cov** (>=7.1.0) - Coverage plugin
 - **pytest-xdist** (>=3.8.0) - Parallel test runner
-- **mypy** (==2.1.0) - Static type checking
-- **ruff** (==0.16.5) - Linting and formatting
+- **mypy** (==2.3.1) - Static type checking
+- **ruff** (==0.16.6) - Linting and formatting
 - **pre-commit** (>=4.6.0) - Git hooks for code quality
 
 Troubleshooting

make.ps1

@@ -14,8 +14,8 @@ param (
 
 $ErrorActionPreference = 'Stop'
 
-$UV_VERSION = "0.12.7"
-$PIP_AUDIT_VERSION = "2.10.0"
+$UV_VERSION = "0.12.10"
+$PIP_AUDIT_VERSION = "2.10.1"
 
 # Ensure we run from repo root
 Push-Location (Split-Path -Parent $MyInvocation.MyCommand.Definition)

pyproject.toml

@@ -63,13 +63,13 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
-    "mypy==2.1.0",
+    "mypy==2.3.1",
     "pandas-stubs>=2.1.2",
     "pre-commit>=4.6.0",
     "pytest>=9.1.0",
     "pytest-cov>=7.1.0",
     "pytest-xdist>=3.8.0",
-    "ruff==0.16.5",
+    "ruff==0.16.6",
     "scipy-stubs>=1.14.1.0",
     "setuptools>=82",
     "types-openpyxl>=3.1.2",

scripts/run-zizmor.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-readonly ZIZMOR_VERSION=1.29.0
+readonly ZIZMOR_VERSION=1.30.0
 
 if [[ -z "${GH_TOKEN:-}" && -z "${GITHUB_TOKEN:-}" ]]; then
   if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then