rustytree-xarray 0.3.0__tar.gz → 0.4.0__tar.gz

rustytree_xarray-0.4.0/.github/dependabot.yml

@@ -0,0 +1,73 @@
+# Dependabot version updates. Opens PRs on a schedule; nothing auto-merges —
+# every PR is reviewed and merged by hand (including the grouped github-actions
+# one). Security updates (CVE-triggered PRs) are enabled separately at the repo
+# level, independent of this schedule.
+#
+# Deliberately NOT managed here (bumped by hand — coordinated, cross-manifest):
+#   - icechunk / typetag: FFI lockstep. The Python `icechunk` (pyproject) must
+#     share a minor with the Rust `icechunk` (`=2.1.0`) and `typetag`
+#     (`=0.2.22`) the crate links — the msgpack `Session` bytes format is
+#     coupled across the boundary, so a solo bump breaks `Session::from_bytes`
+#     (the 2.0.5→2.0.6 skew behind #46). Bump all three together manually.
+#   - ruff: pinned in pyproject AND hardcoded in ci.yml (`uvx ruff@0.15.8`),
+#     which Dependabot can't edit; a solo bump desyncs the lint gate and can
+#     churn formatting. Bump pyproject + both ci.yml literals together.
+#   - dtolnay/rust-toolchain@stable, pypa/gh-action-pypi-publish@release/v1:
+#     branch refs, not semver tags — Dependabot leaves them alone (no rule
+#     needed).
+version: 2
+
+updates:
+  # GitHub Actions — the `uses:` version pins in .github/workflows/* (exactly
+  # the manual toil of #54). One grouped PR per run.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: ci
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Rust crates (Cargo.toml / Cargo.lock).
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: deps
+    open-pull-requests-limit: 5
+    groups:
+      # Keep the zarrs family (zarrs, zarrs_storage, zarrs_object_store,
+      # zarrs_icechunk) moving together — they share a release cadence.
+      zarrs:
+        patterns: ["zarrs*"]
+      # pyo3 and numpy track matched 0.x minors (pyo3 0.28 ↔ numpy 0.28).
+      pyo3:
+        patterns: ["pyo3", "numpy"]
+      # Everything else: fold minor/patch into one PR; majors get their own.
+      cargo-minor:
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "icechunk"  # FFI lockstep — bump by hand (see header)
+      - dependency-name: "typetag"   # FFI lockstep — bump by hand (see header)
+
+  # Python deps (pyproject.toml: project deps + the `dev` extra).
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: ["dependencies"]
+    commit-message:
+      prefix: deps
+    open-pull-requests-limit: 5
+    groups:
+      # Fold minor/patch into one PR; majors get their own.
+      python:
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "icechunk"  # FFI lockstep — bump by hand (see header)
+      - dependency-name: "ruff"      # also hardcoded in ci.yml — bump by hand

{rustytree_xarray-0.3.0 → rustytree_xarray-0.4.0}/.github/workflows/ci.yml

@@ -24,8 +24,8 @@ jobs:
     name: ruff (lint + format)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - run: uvx 'ruff@0.15.8' check .
       - run: uvx 'ruff@0.15.8' format --check .
 
@@ -35,11 +35,11 @@ jobs:
     name: cargo (fmt, clippy, test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - uses: Swatinem/rust-cache@v2
@@ -67,16 +67,16 @@ jobs:
       matrix:
         python-version: ["3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
           # Keyed by Python version so each matrix cell gets its own cache.
           key: py-${{ matrix.python-version }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@v7
       - name: Set up venv and install maturin
         run: |
           uv venv --python "${{ matrix.python-version }}"

{rustytree_xarray-0.3.0 → rustytree_xarray-0.4.0}/.github/workflows/release.yml

@@ -47,8 +47,8 @@ jobs:
         python-version: ["3.12", "3.13"]
     runs-on: ${{ matrix.platform.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
       - uses: dtolnay/rust-toolchain@stable
@@ -61,7 +61,7 @@ jobs:
           target: ${{ matrix.platform.target }}
           manylinux: ${{ matrix.platform.manylinux }}
           args: --release --strip --out dist -i python${{ matrix.python-version }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheel-${{ matrix.platform.target }}-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -71,12 +71,12 @@ jobs:
     name: sdist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: sdist
           path: dist/*.tar.gz
@@ -97,8 +97,8 @@ jobs:
       group: release-${{ github.ref }}
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
@@ -128,7 +128,7 @@ jobs:
     permissions:
       id-token: write   # mint short-lived OIDC tokens for trusted publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true

{rustytree_xarray-0.3.0 → rustytree_xarray-0.4.0}/CHANGELOG.md

@@ -11,6 +11,137 @@ release, that section is renamed to `[x.y.z] - YYYY-MM-DD` and a fresh
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-07-24
+
+### Added
+
+- Dependabot dependency automation ([#56]). A `.github/dependabot.yml` opens
+  weekly grouped version-update PRs for three ecosystems — `cargo`, `pip`
+  (pyproject), and `github-actions` — plus repo-level vulnerability alerts and
+  Dependabot security updates for CVE-triggered PRs. Nothing auto-merges; every
+  PR is reviewed by hand. `icechunk`/`typetag` (FFI lockstep) and `ruff` (also
+  pinned in `ci.yml`) are intentionally ignored and stay manual, coordinated
+  bumps.
+
+### Changed
+
+- Bump `zarrs` 0.22 → 0.23 ([#60]). A breaking upstream release: `DataType`
+  became a newtype over `Arc<dyn DataTypeTraits>` rather than an enum, so the
+  shared `for_each_supported_dtype!` dispatch is now an
+  `is::<Float64DataType>()` chain against the marker types in
+  `zarrs::array::data_type`. `ArraySubset` moved from the removed
+  `zarrs::array_subset` module into `zarrs::array`, and
+  `async_retrieve_array_subset_elements::<T>` (deprecated in 0.23, already
+  deleted upstream for 0.24) became `async_retrieve_array_subset::<Vec<T>>`.
+  The supported-dtype set, the read path, and the storage stack are otherwise
+  unchanged — `zarrs_storage` still resolves to a single 0.4.x, so
+  `zarrs_object_store` and `zarrs_icechunk` needed no bump and the icechunk
+  FFI lockstep is untouched.
+  - Fixes a dtype string that 0.23 would have silently corrupted: the walk
+    built `VarMeta::dtype` via `format!("{}", array.data_type())`, and 0.23's
+    `Display` renders *both* Zarr spellings when they differ (`float64` →
+    `"float64 / <f8"`), which `numpy.dtype()` rejects. Both walk sites now
+    route through `zarrs_dtype_to_numpy_str`, the same canonical mapper the
+    array handle already used.
+  - `zarrs_dtype_to_numpy_str` now reads the dtype's Zarr V3 name (identical
+    to the NumPy name for all thirteen dtypes we can name; pinned by a new
+    unit test) instead of maintaining a parallel hand-written table. The one
+    exception is `bytes`, reported as `object` to match zarr-python —
+    `np.dtype("bytes")` is `|S0`, which would mislabel a variable-length
+    binary array rather than fail. Dtypes we can neither read nor safely
+    rename (`string`, `numpy.datetime64`, `r32`, …) still surface as a
+    `TypeError` from `np.dtype()` at open, as before.
+
+- CI: bump GitHub Actions off the deprecated Node 20 runtime ([#55], fixes #54).
+  `actions/checkout` v4 → v5, `actions/setup-python` v5 → v6,
+  `actions/upload-artifact` v4 → v6, `actions/download-artifact` v4 → v7 — the
+  lowest major of each that runs on Node 24 (verified via each tag's
+  `runs.using`; the artifact actions only moved to Node 24 at v6/v7, so a naïve
+  bump to v5 would still have been Node 20). No workflow behaviour change.
+
+- Raise the NumPy floor `numpy>=1.24` → `numpy>=2.0` ([#71]). Variable-length
+  `string` arrays are surfaced as numpy 2's variable-width `StringDType`
+  (`np.dtype("T")`), which did not exist before 2.0. rustytree's other pins
+  (`zarr>=3`, recent `xarray`) already track numpy 2, so this only makes an
+  existing expectation explicit.
+
+- Routine dependency and CI-action bumps via Dependabot ([#57], [#58], [#59],
+  [#64]) — the first batch after the automation ([#56]) landed. Cargo: `tokio`
+  1.52.3 → 1.53.0, `futures` 0.3.32 → 0.3.33, `zarrs_storage` 0.4.3 → 0.4.4
+  ([#64]); `chrono` 0.4.44 → 0.4.45, `zarrs_icechunk` 0.5.0 → 0.5.1 ([#59]);
+  `cmov` 0.5.3 → 0.5.4 ([#57]). CI actions ([#58]): `actions/checkout` 5 → 7,
+  `astral-sh/setup-uv` 4 → 7, `actions/upload-artifact` 6 → 7, and
+  `actions/download-artifact` 7 → 8 — superseding the v5/v6/v7 pins the [#55]
+  entry above describes.
+
+### Fixed
+
+- Zarr v3 string arrays now open and read instead of crashing ([#71], fixes
+  #70). Both v3 string flavours failed before: a variable-length `string` array
+  raised `TypeError: data type 'string' not understood` (its name reached
+  `np.dtype()` unmapped), and a `fixed_length_utf32` array (numpy `<U…`,
+  xarray's default `str` encoding) raised `NotImplementedError` at read. This
+  became a production regression when raw2zarr's FM301 retrofit added
+  `sweep_mode`/`prt_mode`/`follow_mode` as vlen-`string` scalars to the KLOT
+  eager store and the Serbian OSN stores, forcing consumers to fall back to the
+  slower `engine="zarr"`. rustytree now mirrors `engine="zarr"` for both
+  flavours — `xr.testing.assert_identical` holds against it for all
+  valid-Unicode content (2-D chunking, interior NULs, non-BMP code points,
+  empty strings, and unwritten-chunk fill values all included):
+  - **vlen `string`** is *declared* `object` but its values *materialise* as
+    numpy-2 `StringDType`. That declared/read split is exactly what
+    `engine="zarr"` produces: xarray's CF-decode flattens a
+    `StringDType`-declared variable's values back to `object`, so declaring
+    `object` up-front is the only way to keep `StringDType` values. The `numpy`
+    crate can only build `object` arrays across the FFI boundary, so the read
+    returns `object` and `RustyBackendArray` casts to the dtype the new
+    `ZarrsArrayHandle.read_dtype` reports.
+  - **`fixed_length_utf32`** → fixed-width `<U{n}` (`n` code points). zarrs 0.23
+    opens this dtype (0.22 could not); rustytree decodes the native-endian
+    UTF-32 to `str` and builds the `<U` array. One documented divergence: lone
+    surrogate code points (U+D800–U+DFFF, malformed Unicode) are dropped rather
+    than preserved, because the decode goes through Rust `char`.
+  - `slice_nd`'s bound relaxed from `T: Copy` to `T: Clone` so the same slicer
+    serves the `String` buffers; zero-cost for the numeric arms.
+
+- An empty selection no longer returns a stray element or panics ([#68], fixes
+  #65). `isel(time=slice(1, 1))` and friends returned one bogus element whenever
+  the offset was not a multiple of the chunk size, and raised
+  `pyo3_runtime.PanicException` when the selection sat at the end of a ragged
+  final chunk (e.g. `slice(13, 13)` on a shape-13 array with chunks of 4).
+  Raggedness was needed only for the panic — the wrong length happened on any
+  non-chunk-aligned offset, including on arrays whose shape divides evenly.
+  `slice_nd`'s walk was a do-while that pushed an element before it could test
+  the bounds; it is now driven by the output element count, so an empty request
+  runs zero iterations and totality is structural rather than a guard. The panic
+  mattered beyond the wrong length: `PanicException` derives from
+  `BaseException`, so it passed straight through ordinary `except Exception:`
+  handlers. Empty selections also short-circuit before the chunk-alignment step
+  now, so they no longer pull a chunk off the network to return nothing.
+
+- A reversed slice is empty rather than an error ([#68]). `v.isel(n=slice(5, 3))`
+  and `v[5:3]` raised `ValueError: start 5 > stop 3`, where numpy, pandas and
+  `engine="zarr"` all return an empty array. `slice.indices()` reports a reversed
+  slice faithfully as `(5, 3, 1)`, and that pair reached `read_subset` unchanged;
+  the Python adapter now normalises it. `read_subset` keeps its stricter
+  `start <= stop` contract, so a genuinely malformed range still raises.
+
+- Tests: the two opt-in KTWX smoke tests now skip when the directory exists but
+  holds no icechunk repository ([#60]). The guard tested `KTWX_PATH.exists()`,
+  so an empty leftover directory failed the guard's purpose and the tests
+  errored with `KeyError: group / not found in store` instead of skipping. The
+  shared `ktwx_repo_available()` helper in `tests/conftest.py` now mirrors
+  rustytree's own detector (`looks_like_icechunk_repo`): a `repo` manifest file
+  plus a `snapshots/` directory.
+
+### Security
+
+- Bump `pyo3` and `numpy` 0.28 → 0.29 ([#61]) to fix a **high**-severity
+  out-of-bounds read in PyO3's `PyIterator` `nth`/`nth_back` (RUSTSEC/GHSA)
+  plus a medium-severity missing `Sync` bound on `PyCFunction::new_closure`.
+  A clean bump — no source changes; the pyo3/numpy majors move in lockstep.
+  (Surfaced by the newly-enabled Dependabot security alerts.)
+
 ## [0.3.0] - 2026-07-04
 
 ### Added
@@ -704,7 +835,8 @@ below.
   intentionally not normalized — relative-vs-absolute glob
   semantics differ in `PurePosixPath.match`.
 
-[Unreleased]: https://github.com/aladinor/rustytree/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/aladinor/rustytree/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/aladinor/rustytree/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/aladinor/rustytree/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/aladinor/rustytree/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/aladinor/rustytree/compare/v0.1.0...v0.2.0
@@ -742,3 +874,13 @@ below.
 [#49]: https://github.com/aladinor/rustytree/pull/49
 [#50]: https://github.com/aladinor/rustytree/pull/50
 [#52]: https://github.com/aladinor/rustytree/pull/52
+[#55]: https://github.com/aladinor/rustytree/pull/55
+[#56]: https://github.com/aladinor/rustytree/pull/56
+[#57]: https://github.com/aladinor/rustytree/pull/57
+[#58]: https://github.com/aladinor/rustytree/pull/58
+[#59]: https://github.com/aladinor/rustytree/pull/59
+[#60]: https://github.com/aladinor/rustytree/pull/60
+[#61]: https://github.com/aladinor/rustytree/pull/61
+[#64]: https://github.com/aladinor/rustytree/pull/64
+[#68]: https://github.com/aladinor/rustytree/pull/68
+[#71]: https://github.com/aladinor/rustytree/pull/71