scientific-computing-system 2.2.13__tar.gz → 2.2.15__tar.gz

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/bot-reviewer.yml

@@ -9,7 +9,6 @@ env:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   approve:

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/changelog.yml

@@ -29,8 +29,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # Serialize dispatches: two concurrent runs would both regenerate CHANGELOG.md
 # and force-push the single shared branch, racing each other. The fixed

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/codeql.yml

@@ -26,13 +26,15 @@ concurrency:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
     strategy:
       fail-fast: false
       matrix:

scientific_computing_system-2.2.15/.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/npm-publish.yml

@@ -99,18 +99,29 @@ jobs:
       actions: read
     outputs:
       published: ${{ steps.check.outputs.published }}
+      head_sha: ${{ steps.check.outputs.head_sha }}
     steps:
       - name: Check the triggering Release run published
         id: check
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
           set -euo pipefail
-          conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+          echo "head_sha=${sha}" >> "$GITHUB_OUTPUT"
+          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          publish_conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
             --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
-          echo "Release publish job: ${conclusion}"
-          if [ "${conclusion}" = "success" ]; then
+          echo "Release publish job: ${publish_conclusion}"
+          if [ "${publish_conclusion}" = "success" ]; then
             echo "published=true" >> "$GITHUB_OUTPUT"
           else
             echo "published=false" >> "$GITHUB_OUTPUT"
@@ -140,7 +151,7 @@ jobs:
           persist-credentials: false
           # Release-triggered runs must publish the exact commit that was released,
           # not whatever main points at when the follow-up workflow starts.
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
+          ref: ${{ github.event_name == 'workflow_run' && needs.release_gate.outputs.head_sha || github.ref }}
 
       # GATE: bind each trigger to the version it is allowed to publish.
       #

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/pypi-release-policy.yml

@@ -37,11 +37,35 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
+      actions: read
     steps:
+      - name: Resolve the source commit
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [ "${EVENT_NAME}" = "workflow_run" ]; then
+            data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+            IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+            if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+               [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+              echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+              exit 1
+            fi
+          else
+            sha="${GITHUB_SHA}"
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - name: Check out released source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ steps.target.outputs.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
@@ -64,18 +88,41 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "tag=v$version" >> "$GITHUB_OUTPUT"
 
+      # The policy check also runs on a push that touches the release
+      # workflow, which can land before the version has been released (the
+      # 2.2.13 merge did exactly that). A missing release is not a policy
+      # violation: there is nothing to check yet, and the workflow_run trigger
+      # re-runs this job after the Release workflow creates it.
+      - name: Resolve matching GitHub Release
+        id: release_state
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if release_id="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '.id' 2>&1)"; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "release_id=$release_id" >> "$GITHUB_OUTPUT"
+          elif grep -q "HTTP 404" <<<"$release_id"; then
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "GitHub Release $RELEASE_TAG does not exist yet; nothing to enforce."
+          else
+            echo "::error::Could not resolve GitHub Release $RELEASE_TAG: $release_id"
+            exit 1
+          fi
+
       - name: Remove forbidden wheel and sdist assets from matching GitHub Release
+        if: steps.release_state.outputs.exists == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_ID: ${{ steps.release_state.outputs.release_id }}
         shell: bash
         run: |
           set -euo pipefail
-          release_id="$(
-            gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '.id'
-          )"
           asset_ids="$(
-            gh api --paginate "repos/$GITHUB_REPOSITORY/releases/$release_id/assets" \
+            gh api --paginate "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets" \
               --jq '.[] | select((.name | endswith(".whl")) or (.name | endswith(".tar.gz"))) | .id'
           )"
           if [ -z "$asset_ids" ]; then
@@ -88,6 +135,7 @@ jobs:
           fi
 
       - name: Verify public PyPI and asset-free GitHub Release policy
+        if: steps.release_state.outputs.exists == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_VERSION: ${{ steps.release.outputs.version }}

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/release.yml

@@ -50,13 +50,32 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
+      actions: read
     outputs:
       release_sha: ${{ steps.candidate.outputs.release_sha }}
       should_release: ${{ steps.candidate.outputs.should_release }}
     steps:
+      - name: Resolve and verify the triggering CI run
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ steps.target.outputs.sha }}
           fetch-depth: 2
 
       - name: Bind release to the exact CI-tested commit
@@ -167,7 +186,10 @@ jobs:
               previous_tag="$tag"
               break
             fi
-          done < <(git tag --merged HEAD --sort=-creatordate --list 'v*')
+          # Sort by version, not tag creation date: tags backfilled for older
+          # versions are created later, so -creatordate would pick e.g. v2.2.6
+          # as the base for v2.2.13 and weaken the version-discipline diff.
+          done < <(git tag --merged HEAD --sort=-v:refname --list 'v*')
           if [ -n "$previous_tag" ]; then
             base="$(git rev-list -n 1 "$previous_tag")"
             echo "Previous release: $previous_tag ($base)"

scientific_computing_system-2.2.15/.github/workflows/scorecard.yml

@@ -0,0 +1,37 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 1 * * 6"
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: results.sarif

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/.github/workflows/tests.yml

@@ -13,7 +13,9 @@ on:
       - 'CONTRIBUTING.md'
       - 'LICENSE'
       - 'SECURITY.md'
-      - 'docs/**'
+      # No 'docs/**' here: deploy-docs runs inside this workflow on main
+      # pushes, so ignoring docs-only pushes meant documentation changes
+      # merged to main were never deployed.
   pull_request:
     branches: [main]
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/CHANGELOG.md

@@ -19,6 +19,23 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.15] - 2026-10-23
+
+### Dependency security floors
+
+- Raise the test and documentation dependency floors to versions that carry security fixes: `pytest>=9.0.3` (PYSEC-2026-1845) and `mkdocs-material>=9.7.7` (PYSEC-2026-3864). The locked development environment already resolved these versions; the manifests now state the same minimum.
+- Bump synchronized package metadata to 2.2.15 as required by the version-discipline gate for the `[project]` dependency change.
+
+## [v2.2.14] - 2026-10-23
+
+### Input validation and supply-chain transparency
+
+- Reject non-square and non-rectangular matrices in `determinant` with a normalised `ValueError` instead of leaking an index error from the elimination loop.
+- Report a vanishing Newton gradient as `converged=False` instead of silently returning success.
+- Require every ODE right-hand-side derivative to match the initial-state length, and report the expected and actual lengths instead of letting an implicit broadcast hide the bug.
+- Add Dependabot, OpenSSF Scorecard and dependency review workflows with SHA-pinned actions, and add a citation file so tooling can resolve package metadata.
+- Bump synchronized package metadata to 2.2.14 as required by the version-discipline gate for `src/cds/` changes.
+
 ## [v2.2.13] - 2026-10-21
 
 ### Release packaging, CI and documentation accuracy

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.13
+version: 2.2.15
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.13
+  version: 2.2.15
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.13
+Version: 2.2.15
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -34,7 +34,7 @@ Requires-Dist: h5py>=3.10; extra == 'all'
 Requires-Dist: hypothesis>=6.100; extra == 'all'
 Requires-Dist: ipykernel; extra == 'all'
 Requires-Dist: matplotlib>=3.8.0; extra == 'all'
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'all'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'all'
 Requires-Dist: mkdocs>=1.5.0; extra == 'all'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'all'
 Requires-Dist: mypy>=1.10; extra == 'all'
@@ -44,7 +44,7 @@ Requires-Dist: numpy>=1.26; extra == 'all'
 Requires-Dist: pandas>=2.0; extra == 'all'
 Requires-Dist: pre-commit; extra == 'all'
 Requires-Dist: pytest-cov; extra == 'all'
-Requires-Dist: pytest>=8.0; extra == 'all'
+Requires-Dist: pytest>=9.0.3; extra == 'all'
 Requires-Dist: ruff==0.15.17; extra == 'all'
 Requires-Dist: scikit-learn>=1.4; extra == 'all'
 Requires-Dist: scipy>=1.11; extra == 'all'
@@ -65,7 +65,7 @@ Requires-Dist: pandas-stubs>=2.0; extra == 'dev'
 Requires-Dist: pre-commit; extra == 'dev'
 Requires-Dist: ruff==0.15.17; extra == 'dev'
 Provides-Extra: docs
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'docs'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'docs'
 Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'docs'
 Provides-Extra: io
@@ -91,7 +91,7 @@ Requires-Dist: sympy>=1.12; extra == 'scientific'
 Requires-Dist: z3-solver>=4.12.2; extra == 'scientific'
 Provides-Extra: test
 Requires-Dist: pytest-cov; extra == 'test'
-Requires-Dist: pytest>=8.0; extra == 'test'
+Requires-Dist: pytest>=9.0.3; extra == 'test'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -145,21 +145,21 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.12,
+At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11 and 2.2.12. The 2.2.7 wheel and sdist
-  return 404 from the per-file provenance endpoint, so "every release since
-  attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
+  sdist return 404 from the per-file provenance endpoint, so "every release
+  since attestations were enabled" would be false.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
   has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12, which is how the latest versions can match while the histories
-  do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
+  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
+  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
   not proof of origin, and `dist.signatures`, which is npm's registry transport
   signature, not build provenance.
 
@@ -211,7 +211,7 @@ The authoritative per-module list is the [API reference](https://furox-art.githu
 
 ### Runnable examples and the dashboard
 
-- **[`examples/`](examples/)** — 35 runnable scripts and notebooks (33 `.py`, 2
+- **[`examples/`](examples/)** — 34 runnable scripts and notebooks (32 `.py`, 2
   `.ipynb`), each self-contained and dependency-free unless noted. Every tutorial
   page in the docs has a matching example.
 - **[`dashboard/app.py`](dashboard/app.py)** — a Streamlit dashboard:
@@ -277,7 +277,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.13
+System version 2.2.15
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/README.md

@@ -49,21 +49,21 @@ The import name is **`cds`** (the distribution is `scientific-computing-system`)
 | **PyPI** (the library) | `pip install scientific-computing-system` | The actual Python package. Zero runtime dependencies. This is what you want. |
 | **npm** (a launcher shim) | `npm i -g scientific-computing-system` | A thin Node wrapper that runs `python -m cds`. It ships no Python and needs the Python distribution installed so that `python -m cds` resolves. |
 
-At the time of writing (2026-10-22), both registries' latest versions are 2.2.12,
+At the time of writing (2026-10-22), both registries' latest versions are 2.2.13,
 but they are not published in lockstep and are **not** equally verifiable:
 
 - **PyPI** — carries a **PEP 740 provenance attestation** (Sigstore-signed,
   binding the file digest to the publishing workflow). Verified on 2.2.3,
-  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11 and 2.2.12. The 2.2.7 wheel and sdist
-  return 404 from the per-file provenance endpoint, so "every release since
-  attestations were enabled" would be false.
+  2.2.4, 2.2.5, 2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13. The 2.2.7 wheel and
+  sdist return 404 from the per-file provenance endpoint, so "every release
+  since attestations were enabled" would be false.
 - **npm** — carries a **Sigstore attestation as of 2.2.3**, minted by npm's
   OIDC trusted publisher (the registry serves both an npm publish attestation
   and a SLSA provenance v1 bundle for that tarball). 1.0.0 through 2.2.2
   predate the publisher registration and have none, so pin 2.2.3 or newer. npm
   has no 2.2.7, 2.2.8 or 2.2.11 at all: its 2.2.x line is 2.2.0 through 2.2.6
-  plus 2.2.12, which is how the latest versions can match while the histories
-  do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
+  plus 2.2.12 and 2.2.13, which is how the latest versions can match while the
+  histories do not. npm also exposes `dist.integrity` (sha512), which is a content pin,
   not proof of origin, and `dist.signatures`, which is npm's registry transport
   signature, not build provenance.
 
@@ -115,7 +115,7 @@ The authoritative per-module list is the [API reference](https://furox-art.githu
 
 ### Runnable examples and the dashboard
 
-- **[`examples/`](examples/)** — 35 runnable scripts and notebooks (33 `.py`, 2
+- **[`examples/`](examples/)** — 34 runnable scripts and notebooks (32 `.py`, 2
   `.ipynb`), each self-contained and dependency-free unless noted. Every tutorial
   page in the docs has a matching example.
 - **[`dashboard/app.py`](dashboard/app.py)** — a Streamlit dashboard:
@@ -181,7 +181,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.13
+System version 2.2.15
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/SECURITY.md

@@ -128,7 +128,7 @@ repository's publish workflows mints an attestation on each channel:
 - **PyPI** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `release.yml`, environment `pypi`.
   Exercised since 2.2.1. The per-file provenance endpoint returned 200 for the
-  published files of 2.2.1–2.2.6, 2.2.8, 2.2.11 and 2.2.12 on 2026-10-22;
+  published files of 2.2.1–2.2.6, 2.2.8, 2.2.11, 2.2.12 and 2.2.13 on 2026-10-22;
   2.2.7 returns 404 for both its wheel and sdist.
 - **npm** — Trusted Publisher: owner `Furox-Art`, repository
   `scientific-computing-system`, workflow `npm-publish.yml`, environment `npm`.
@@ -191,7 +191,7 @@ In particular, `sympy_verify_identity()` passes caller-provided symbolic strings
 
 1. **Pin the package version** in reproducible environments, for example `pip install "scientific-computing-system==X.Y.Z"` with the exact release you have evaluated, rather than an unconstrained range. Deliberately no concrete version is written here: a pinned example goes stale at the next release and readers copy it regardless, so take the number from the [release notes](https://github.com/Furox-Art/scientific-computing-system/releases) for the release you are deploying, and record it in your own lockfile or constraints file.
 2. **Install only the optional extras you need.** Fewer third-party packages reduce supply-chain and compatibility surface.
-3. **Verify provenance for high-assurance use.** For PyPI, fetch the PEP 740 bundle from `/integrity/<project>/<version>/<filename>/provenance` and confirm its `subject` digest equals the `sha256` PyPI publishes for that file. There is currently **no** attestation for the npm package; its `dist.integrity` is an integrity pin, not provenance. See [Distribution channels and provenance](#distribution-channels-and-provenance).
+3. **Verify provenance for high-assurance use.** For PyPI, fetch the PEP 740 bundle from `/integrity/<project>/<version>/<filename>/provenance` and confirm its `subject` digest equals the `sha256` PyPI publishes for that file. npm publishes are attested from `2.2.3` onward; for versions without an attestation, `dist.integrity` is an integrity pin, not provenance. See [Distribution channels and provenance](#distribution-channels-and-provenance).
 4. **Treat optional backend inputs as backend inputs.** Do not pass hostile symbolic expressions or untrusted scientific files without the validation/sandboxing appropriate to SymPy, HDF5, NetCDF, or the relevant backend.
 5. **Keep the environment current.** Review dependency updates and run vulnerability auditing against the exact environment deployed.
 6. **Do not use the library as the sole validation layer for safety-critical conclusions.** Independent domain validation remains necessary.

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.13",
+  "version": "2.2.15",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.13",
+  "version": "2.2.15",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.13"
+version = "2.2.15"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -38,7 +38,7 @@ dependencies = []
 all = [
     "streamlit>=1.30.0",
     "matplotlib>=3.8.0",
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
     "ruff==0.15.17",
     "mypy>=1.10",
@@ -47,7 +47,7 @@ all = [
     "ipykernel",
     "notebook",
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
     "hypothesis>=6.100",
     "pandas>=2.0",
@@ -93,7 +93,7 @@ plot = [
     "matplotlib>=3.8.0",
 ]
 test = [
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
 ]
 # Property-based testing. Used only by tests/test_property_invariants.py and
@@ -127,7 +127,7 @@ dev = [
 ]
 docs = [
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
 ]
 # Promo/asset build tooling. Used only by scripts/build_gif.py,

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/src/cds/_version.py

@@ -5,5 +5,5 @@ from __future__ import annotations
 
 __all__ = ["__version__", "version", "__version_tuple__", "version_tuple"]
 
-__version__ = version = "2.2.13"
-__version_tuple__ = version_tuple = (2, 2, 13)
+__version__ = version = "2.2.15"
+__version_tuple__ = version_tuple = (2, 2, 14)

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/src/cds/diffeq/solvers.py

@@ -267,6 +267,17 @@ def rk45(
     return ODESolution(t=t_vals, y=y_vals, method="rk45", steps=steps)
 
 
+def _checked_derivative(
+    f: Callable[[float, list[float]], list[float]], t: float, y: list[float], n: int
+) -> list[float]:
+    dy = f(t, y)
+    if len(dy) != n:
+        raise ValueError(
+            f"ODE right-hand side returned {len(dy)} derivative(s) for a state of length {n}"
+        )
+    return dy
+
+
 def solve_system(
     f: Callable[[float, list[float]], list[float]],
     t0: float,
@@ -296,13 +307,13 @@ def solve_system(
     while (t_end - t) * direction > LOOP_EPSILON:
         h = direction * min(dt, abs(t_end - t))
 
-        k1 = f(t, y)
+        k1 = _checked_derivative(f, t, y, n)
         y_tmp = [y[i] + h * k1[i] / 2 for i in range(n)]
-        k2 = f(t + h / 2, y_tmp)
+        k2 = _checked_derivative(f, t + h / 2, y_tmp, n)
         y_tmp = [y[i] + h * k2[i] / 2 for i in range(n)]
-        k3 = f(t + h / 2, y_tmp)
+        k3 = _checked_derivative(f, t + h / 2, y_tmp, n)
         y_tmp = [y[i] + h * k3[i] for i in range(n)]
-        k4 = f(t + h, y_tmp)
+        k4 = _checked_derivative(f, t + h, y_tmp, n)
 
         y = [y[i] + (h / 6) * (k1[i] + 2 * k2[i] + 2 * k3[i] + k4[i]) for i in range(n)]
         t = t + h

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/src/cds/math_utils/linalg.py

@@ -120,6 +120,9 @@ def determinant(m: Matrix) -> float:
     n = len(m)
     if n == 0:
         return 1.0
+    rows, cols = _require_rectangular(m, "matrix")
+    if rows != cols:
+        raise ValueError(f"determinant requires a square matrix (got {rows}x{cols})")
     if n == 1:
         return m[0][0]
 

{scientific_computing_system-2.2.13 → scientific_computing_system-2.2.15}/src/cds/optimization/minimize.py

@@ -226,7 +226,12 @@ def newton_method(
         dfx = _compute_gradient(f, x, h_base)
 
         if abs(dfx) < NEAR_ZERO:
-            break
+            return OptResult(
+                x=x,
+                value=f(x),
+                iterations=i,
+                converged=False,
+            )
         x -= fx / dfx
     return OptResult(
         x=x,
@@ -401,6 +406,8 @@ def line_search(
         max_iter: iteration limit
     """
     phi = (math.sqrt(5) - 1) / 2
+    if a > b:
+        raise ValueError(f"line_search requires a <= b (got a={a}, b={b})")
     for i in range(max_iter):
         if abs(b - a) < tol:
             mid = (a + b) / 2