scientific-computing-system 2.2.14__tar.gz → 2.2.17__tar.gz

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/bot-reviewer.yml

@@ -9,7 +9,6 @@ env:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   approve:

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/changelog.yml

@@ -29,8 +29,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # Serialize dispatches: two concurrent runs would both regenerate CHANGELOG.md
 # and force-push the single shared branch, racing each other. The fixed

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/codeql.yml

@@ -26,13 +26,15 @@ concurrency:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
     strategy:
       fail-fast: false
       matrix:
@@ -43,13 +45,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           category: "/language:${{ matrix.language }}"

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/dependency-review.yml

@@ -6,11 +6,13 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

scientific_computing_system-2.2.17/.github/workflows/fuzz.yml

@@ -0,0 +1,38 @@
+name: Fuzz
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "src/cds/**"
+      - "tests/fuzz/**"
+      - "pyproject.toml"
+      - ".github/workflows/fuzz.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-scientific-computing-system
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Atheris
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Install Atheris
+        run: python -m pip install atheris==3.1.0
+      - name: Install scientific-computing-system
+        run: python -m pip install -e .
+      - name: Fuzz the BPE merge validator
+        run: python tests/fuzz/fuzz_bpe_merge.py -max_total_time=60 -rss_limit_mb=2048 -print_final_stats=1

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/npm-publish.yml

@@ -99,18 +99,60 @@ jobs:
       actions: read
     outputs:
       published: ${{ steps.check.outputs.published }}
+      head_sha: ${{ steps.check.outputs.head_sha }}
     steps:
       - name: Check the triggering Release run published
         id: check
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
           set -euo pipefail
-          conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
+          # The trigger is the Release workflow, which normally is itself a
+          # workflow_run consumer: its event is `workflow_run`. The Release
+          # recovery path is dispatched manually and never publishes to PyPI,
+          # so a `workflow_dispatch` run is accepted too; its publish job is
+          # declared workflow_run-only, so it cannot set published=true.
+          # Release already verified its upstream CI run through the Actions
+          # API, so trust the head SHA only after proving the run belongs to
+          # this repository's release.yml on the default branch.
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
+          echo "head_sha=${sha}" >> "$GITHUB_OUTPUT"
+          case "${event}" in
+            workflow_run|workflow_dispatch) ;;
+            *)
+              echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+              exit 1
+              ;;
+          esac
+          if [ "${path}" != ".github/workflows/release.yml" ] || \
+             [ "${branch}" != "main" ] || \
+             [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a Release run on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          # A Release run whose jobs all skip (the version is already released)
+          # concludes `skipped`. That is an ordinary push, not a release, so the
+          # npm job must skip too. A failed or cancelled release stays loud.
+          case "${conclusion}" in
+            success|skipped) ;;
+            *)
+              echo "::error::Release run ${RUN_ID} concluded ${conclusion}."
+              exit 1
+              ;;
+          esac
+          if [ "${conclusion}" != "success" ]; then
+            echo "Release run was ${conclusion}; no release was published."
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          publish_conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
             --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
-          echo "Release publish job: ${conclusion}"
-          if [ "${conclusion}" = "success" ]; then
+          echo "Release publish job: ${publish_conclusion}"
+          if [ "${publish_conclusion}" = "success" ]; then
             echo "published=true" >> "$GITHUB_OUTPUT"
           else
             echo "published=false" >> "$GITHUB_OUTPUT"
@@ -140,7 +182,7 @@ jobs:
           persist-credentials: false
           # Release-triggered runs must publish the exact commit that was released,
           # not whatever main points at when the follow-up workflow starts.
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
+          ref: ${{ github.event_name == 'workflow_run' && needs.release_gate.outputs.head_sha || github.ref }}
 
       # GATE: bind each trigger to the version it is allowed to publish.
       #

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/pypi-release-policy.yml

@@ -37,11 +37,51 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
+      actions: read
     steps:
+      - name: Resolve the source commit
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [ "${EVENT_NAME}" = "workflow_run" ]; then
+            # This workflow triggers on the Release workflow, which normally is
+            # itself a workflow_run consumer, so the triggering run's event is
+            # `workflow_run`. The Release recovery path is dispatched manually
+            # and never publishes to PyPI, so a `workflow_dispatch` run is
+            # accepted too. The Release gate already verified its own upstream
+            # CI run through the Actions API; here we only need to prove the
+            # trigger came from this repository's Release workflow on the
+            # default branch before trusting its head SHA.
+            data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+            IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
+            case "${event}" in
+              workflow_run|workflow_dispatch) ;;
+              *)
+                echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+                exit 1
+                ;;
+            esac
+            if [ "${path}" != ".github/workflows/release.yml" ] || \
+               [ "${branch}" != "main" ] || \
+               [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+              echo "::error::Run ${RUN_ID} is not a successful Release run on ${GITHUB_REPOSITORY} main."
+              exit 1
+            fi
+          else
+            sha="${GITHUB_SHA}"
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - name: Check out released source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ steps.target.outputs.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/release.yml

@@ -50,13 +50,32 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
+      actions: read
     outputs:
       release_sha: ${{ steps.candidate.outputs.release_sha }}
       should_release: ${{ steps.candidate.outputs.should_release }}
     steps:
+      - name: Resolve and verify the triggering CI run
+        id: target
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ steps.target.outputs.sha }}
           fetch-depth: 2
 
       - name: Bind release to the exact CI-tested commit
@@ -401,7 +420,7 @@ jobs:
 
       - name: Publish to PyPI (Trusted Publishing)
         if: steps.pypi_state.outputs.already_published != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
 
       - name: Create or verify release tag after successful PyPI state
         # The tag is created only after PyPI accepted the upload. An existing tag

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/.github/workflows/scorecard.yml

@@ -32,6 +32,6 @@ jobs:
           name: scorecard-sarif
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif

scientific_computing_system-2.2.17/.github/workflows/sign-release.yml

@@ -0,0 +1,170 @@
+name: Sign release
+
+# Attach a signed source archive plus a cosign keyless signature bundle to the
+# GitHub Release that the publish workflows already created. OpenSSF Scorecard's
+# Signed-Releases check looks for a release asset whose name ends in
+# `.sigstore`, and this workflow is the only producer of one.
+#
+# Security: the workflow_run payload is untrusted input. The run is re-read from
+# the Actions API, validated against this repository, the allowed event types
+# and the exact release workflow paths, and only then is its head_sha checked
+# out. The checkout never consumes a raw event expression.
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to sign (e.g. v1.2.3)"
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sign-release-${{ github.event.workflow_run.head_sha || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository)
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Resolve the trusted release commit
+        id: resolve
+        shell: bash
+        env:
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "sha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event conclusion repo path <<<"${data}"
+          # The Release workflow here is itself a workflow_run consumer that
+          # waits for CI, so the run this workflow follows has event
+          # `workflow_run`. All of these are accepted; the path, repository and
+          # conclusion checks below still have to pass.
+          case "${event}" in
+            push|release|workflow_run|workflow_dispatch) ;;
+            *) echo "::error::Run ${RUN_ID} has unsupported event ${event}."; exit 1 ;;
+          esac
+          case "${path}" in
+            .github/workflows/release.yml) ;;
+            *) echo "::error::Run ${RUN_ID} is not a release workflow (${path})."; exit 1 ;;
+          esac
+          if [[ "${conclusion}" != "success" || "${repo}" != "${GITHUB_REPOSITORY}" ]]; then
+            echo "::error::Run ${RUN_ID} is not a successful release run on ${GITHUB_REPOSITORY}."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Check out the released commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.resolve.outputs.sha }}
+
+      - name: Resolve the release tag
+        id: tag
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          HEAD_SHA: ${{ steps.resolve.outputs.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && -n "$INPUT_TAG" ]]; then
+            TAG="$INPUT_TAG"
+          else
+            git fetch --tags --force origin
+            refs="$(git for-each-ref --format='%(refname:short) %(objectname) %(*objectname)' refs/tags)"
+            TAG="$(printf '%s\n' "$refs" | awk -v sha="$HEAD_SHA" '$2==sha || $3==sha {print $1; exit}')"
+          fi
+          if [[ -z "$TAG" ]]; then
+            echo "::notice::No tag points at ${HEAD_SHA}; nothing to sign."
+            exit 0
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $TAG"
+
+      - name: Check the GitHub Release exists
+        id: release
+        if: steps.tag.outputs.tag != ''
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::GitHub Release $TAG does not exist; nothing to sign."
+          fi
+
+      - name: Check the release is not signed yet
+        id: signature
+        if: steps.release.outputs.exists == 'true'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          names="$(gh release view "$TAG" --json assets --jq '.assets[].name')"
+          if grep -q '\.sigstore$' <<<"$names"; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release $TAG already has a .sigstore asset; skipping."
+          else
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build the source archive
+        id: archive
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git fetch --tags --force origin
+          repo="${GITHUB_REPOSITORY##*/}"
+          asset="${repo}-${TAG}.tar.gz"
+          git archive --format=tar.gz --prefix="${repo}-${TAG}/" -o "$asset" "$TAG"
+          echo "asset=$asset" >> "$GITHUB_OUTPUT"
+          echo "Built $asset from $TAG"
+
+      - name: Install cosign
+        if: steps.signature.outputs.signed == 'false'
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign the archive with a keyless identity
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          cosign sign-blob --yes --bundle "${ASSET}.sigstore" "$ASSET"
+
+      - name: Upload the archive and the signature bundle
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          gh release upload "$TAG" "$ASSET" "${ASSET}.sigstore" --clobber

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/CHANGELOG.md

@@ -19,6 +19,24 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.17] - 2026-10-24
+
+### Dependency hygiene
+
+- Update the locked `ruff` development pin from 0.15.17 to 0.17.1 (Dependabot routine update), in both `pyproject.toml` and `requirements-dev.lock`.
+- Refresh `requirements-dev.lock` to `filelock==4.2.4` on Python 3.11+, clearing CVE-2026-112940 reported by the `pip-audit` lock gate. No fixed release supports Python 3.10, so the dev-only 3.10 pin stays at 3.29.4 (marker split).
+- Refresh `requirements-dev.lock` to `virtualenv==21.14.13`, clearing CVE-2026-113713 and CVE-2026-115586 reported by the `pip-audit` lock gate.
+- Bump synchronized package metadata to 2.2.17 as required by the version-discipline gate for the `[project]` dev-extra change.
+
+> 2.2.16 was staged on `main` but never published: its CI run failed on advisories disclosed after the bump, so these changes ship in 2.2.17.
+
+## [v2.2.15] - 2026-10-23
+
+### Dependency security floors
+
+- Raise the test and documentation dependency floors to versions that carry security fixes: `pytest>=9.0.3` (PYSEC-2026-1845) and `mkdocs-material>=9.7.7` (PYSEC-2026-3864). The locked development environment already resolved these versions; the manifests now state the same minimum.
+- Bump synchronized package metadata to 2.2.15 as required by the version-discipline gate for the `[project]` dependency change.
+
 ## [v2.2.14] - 2026-10-23
 
 ### Input validation and supply-chain transparency

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.14
+version: 2.2.17
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.14
+  version: 2.2.17
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.14
+Version: 2.2.17
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -34,7 +34,7 @@ Requires-Dist: h5py>=3.10; extra == 'all'
 Requires-Dist: hypothesis>=6.100; extra == 'all'
 Requires-Dist: ipykernel; extra == 'all'
 Requires-Dist: matplotlib>=3.8.0; extra == 'all'
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'all'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'all'
 Requires-Dist: mkdocs>=1.5.0; extra == 'all'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'all'
 Requires-Dist: mypy>=1.10; extra == 'all'
@@ -44,8 +44,8 @@ Requires-Dist: numpy>=1.26; extra == 'all'
 Requires-Dist: pandas>=2.0; extra == 'all'
 Requires-Dist: pre-commit; extra == 'all'
 Requires-Dist: pytest-cov; extra == 'all'
-Requires-Dist: pytest>=8.0; extra == 'all'
-Requires-Dist: ruff==0.15.17; extra == 'all'
+Requires-Dist: pytest>=9.0.3; extra == 'all'
+Requires-Dist: ruff==0.17.1; extra == 'all'
 Requires-Dist: scikit-learn>=1.4; extra == 'all'
 Requires-Dist: scipy>=1.11; extra == 'all'
 Requires-Dist: statsmodels>=0.14; extra == 'all'
@@ -63,9 +63,9 @@ Requires-Dist: notebook; extra == 'dev'
 Requires-Dist: numpy<2.5,>=2.0; extra == 'dev'
 Requires-Dist: pandas-stubs>=2.0; extra == 'dev'
 Requires-Dist: pre-commit; extra == 'dev'
-Requires-Dist: ruff==0.15.17; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Provides-Extra: docs
-Requires-Dist: mkdocs-material>=9.0.0; extra == 'docs'
+Requires-Dist: mkdocs-material>=9.7.7; extra == 'docs'
 Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'docs'
 Provides-Extra: io
@@ -91,7 +91,7 @@ Requires-Dist: sympy>=1.12; extra == 'scientific'
 Requires-Dist: z3-solver>=4.12.2; extra == 'scientific'
 Provides-Extra: test
 Requires-Dist: pytest-cov; extra == 'test'
-Requires-Dist: pytest>=8.0; extra == 'test'
+Requires-Dist: pytest>=9.0.3; extra == 'test'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -277,7 +277,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.14
+System version 2.2.17
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/README.md

@@ -181,7 +181,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.14
+System version 2.2.17
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.14",
+  "version": "2.2.17",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.14",
+  "version": "2.2.17",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.14 → scientific_computing_system-2.2.17}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.14"
+version = "2.2.17"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -38,16 +38,16 @@ dependencies = []
 all = [
     "streamlit>=1.30.0",
     "matplotlib>=3.8.0",
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
-    "ruff==0.15.17",
+    "ruff==0.17.1",
     "mypy>=1.10",
     "pre-commit",
     "build",
     "ipykernel",
     "notebook",
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
     "hypothesis>=6.100",
     "pandas>=2.0",
@@ -93,7 +93,7 @@ plot = [
     "matplotlib>=3.8.0",
 ]
 test = [
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-cov",
 ]
 # Property-based testing. Used only by tests/test_property_invariants.py and
@@ -105,7 +105,7 @@ property = [
     "hypothesis>=6.100",
 ]
 dev = [
-    "ruff==0.15.17",
+    "ruff==0.17.1",
     "mypy>=1.10",
     "pre-commit",
     "build",
@@ -127,7 +127,7 @@ dev = [
 ]
 docs = [
     "mkdocs>=1.5.0",
-    "mkdocs-material>=9.0.0",
+    "mkdocs-material>=9.7.7",
     "mkdocstrings[python]>=0.24.0",
 ]
 # Promo/asset build tooling. Used only by scripts/build_gif.py,