NeuNorm 2.2.2__tar.gz → 2.2.3__tar.gz

{neunorm-2.2.2 → neunorm-2.2.3}/.github/workflows/codeql.yml

@@ -22,14 +22,14 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: python
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           category: "/language:python"

{neunorm-2.2.2 → neunorm-2.2.3}/.github/workflows/dependency-scan.yml

@@ -24,13 +24,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           pixi-version: v0.70.1
           manifest-path: pyproject.toml
@@ -55,4 +55,4 @@ jobs:
           path: ${{ steps.install.outputs.conda_install_dir }}
           # gate on fixable findings; only-fixed defaults true in the v2
           # wrapper, so unfixable advisories never fail the build
-          fail-build: true
+          fail-build: false

{neunorm-2.2.2 → neunorm-2.2.3}/.github/workflows/test_and_deploy.yaml

@@ -25,13 +25,13 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           pixi-version: v0.70.1
           manifest-path: pyproject.toml
@@ -56,13 +56,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           pixi-version: v0.70.1
           manifest-path: pyproject.toml
@@ -83,7 +83,7 @@ jobs:
           python-version: "3.11"
 
       - name: Upload conda package as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: artifact-conda-package
           path: ${{ env.PKG_NAME }}-*.conda
@@ -95,20 +95,20 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup Pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           pixi-version: v0.70.1
           manifest-path: pyproject.toml
           frozen: true
 
       - name: Download conda package artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: artifact-conda-package
 
@@ -135,13 +135,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           pixi-version: v0.70.1
           manifest-path: pyproject.toml

{neunorm-2.2.2 → neunorm-2.2.3}/.github/workflows/update-lockfiles.yml

@@ -13,11 +13,22 @@ jobs:
   pixi-update:
     runs-on: ubuntu-latest
     steps:
+      # Mint an App installation token so the PR is created by the App identity,
+      # not GITHUB_TOKEN. PRs opened with GITHUB_TOKEN cannot trigger other
+      # workflows (GitHub recursion guard), which left the lockfile PR CI held
+      # on "Approve and run"; an App token opens the PR as a first-class PR.
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.LOCKFILE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.LOCKFILE_APP_PRIVATE_KEY }}
+
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
         with:
           # Pin to the same pixi the rest of CI uses, so the regenerated
           # lockfile stays in a format the pinned CI pixi can read.
@@ -34,7 +45,7 @@ jobs:
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: Update pixi lockfile
           title: Update pixi lockfile
           body-path: diff.md

{neunorm-2.2.2 → neunorm-2.2.3}/.grype.yaml

@@ -32,3 +32,13 @@ ignore:
   - vulnerability: CVE-2026-12003
     package:
       name: python
+  # high; fixed in 3.15.0, no stable 3.14 conda-forge backport yet
+  - vulnerability: CVE-2026-15308 # high
+    package:
+      name: python
+  # pydantic 2.13.4 is the newest conda-forge build; the fix is in 2.14.2,
+  # not yet packaged on conda-forge. Remove once conda-forge ships >= 2.14.2
+  # (the lockfile-update workflow will pick it up).
+  - vulnerability: CVE-2026-58203 # medium
+    package:
+      name: pydantic

{neunorm-2.2.2 → neunorm-2.2.3}/.pre-commit-config.yaml

@@ -17,7 +17,7 @@ repos:
       - id: trailing-whitespace
         exclude: "archive/.*"
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.15.21
     hooks:
       - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]

neunorm-2.2.3/.readthedocs.yaml

@@ -0,0 +1,28 @@
+---
+version: 2
+
+# Build docs through pixi so the docs env resolves the same locked, tested
+# dependencies as CI (pixi.lock), instead of a bare `pip install .[docs]`.
+# Read the Docs-official pixi route:
+# https://docs.readthedocs.com/platform/stable/build-customization.html
+build:
+  os: ubuntu-24.04
+  tools:
+    # Bootstrap interpreter only; pixi provides the real docs environment.
+    python: "latest"
+  jobs:
+    create_environment:
+      - asdf plugin add pixi
+      - asdf install pixi latest
+      - asdf global pixi latest
+    install:
+      # --frozen: use pixi.lock exactly (fail loudly on drift).
+      - pixi install --frozen -e docs
+    build:
+      html:
+        # -W keeps warnings-as-errors (old sphinx.fail_on_warning, which is
+        # ignored under build.jobs.build.html); --keep-going collects them all.
+        - pixi run -e docs sphinx-build -T -b html -W --keep-going docs $READTHEDOCS_OUTPUT/html  # yamllint disable-line rule:line-length
+
+sphinx:
+  configuration: docs/conf.py

{neunorm-2.2.2 → neunorm-2.2.3}/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to NeuNorm are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.2.3] - 2026-07-14
+
+Maintenance release — CI, documentation-build, and dependency updates only. There are
+**no `neunorm` library or API changes** since 2.2.2; the PyPI and conda artifacts are
+functionally identical to 2.2.2.
+
+### Fixed
+
+- **Read the Docs builds reliably again.** The documentation now builds through pixi
+  (`pixi install -e docs` + `pixi run -e docs sphinx-build`, the Read the Docs-official
+  route) so it resolves the same locked, tested dependencies as CI instead of a bare
+  `pip install .[docs]`, which floated `scitiff`/`pydantic` to an untested combination and
+  broke autodoc at import.
+  ([#184](https://github.com/ornlneutronimaging/NeuNorm/pull/184))
+
+### Changed
+
+- CI and security hardening: GitHub Actions pinned to full commit SHAs with version
+  comments, `setup-pixi` bumped, Grype switched to a non-blocking SARIF upload, lockfile
+  update PRs authored via a GitHub App token, and accepted upstream CVEs recorded in
+  `.grype.yaml`.
+  ([#178](https://github.com/ornlneutronimaging/NeuNorm/pull/178),
+  [#179](https://github.com/ornlneutronimaging/NeuNorm/pull/179),
+  [#181](https://github.com/ornlneutronimaging/NeuNorm/pull/181),
+  [#183](https://github.com/ornlneutronimaging/NeuNorm/pull/183))
+
 ## [2.2.2] - 2026-07-02
 
 ### Fixed

{neunorm-2.2.2 → neunorm-2.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: NeuNorm
-Version: 2.2.2
+Version: 2.2.3
 Summary: Neutron imaging normalization and TOF data processing for ORNL facilities
 Project-URL: homepage, https://github.com/ornlneutronimaging/NeuNorm
 Project-URL: repository, https://github.com/ornlneutronimaging/NeuNorm