build(deps): refresh dependencies and clean up test warnings (#1243)

Consolidates the currently applicable dependency updates into one PR, including the closed Dependabot backlog such as #1241, plus dependency surfaces that were not covered by the repository's previous pip-only Dependabot configuration.

Cleanup of test warnings.

Most importent:

* GitPython + pypdf security hardening.
* Uvicorn WebSocket close/backpressure/header fixes for server/dashboard reliability.
* FastAPI dependency-memory/OpenAPI improvements for the API process.
* Bokeh WebSocket/resource-leak/prefix fixes for EOSdash and proxied deployments.
* cachebox cancellation/lock cleanup fixes for long-running/concurrent work.
* pandas 3.0.5 avoiding the yanked 3.0.4 datetime/segfault build.
* Ruff security-lint and pydocstyle correctness fixes, plus faster release builds via PGO.
* platformdirs malformed-XDG and duplicate-directory fixes for deployment portability.
* CI action modernization, regenerated uv.lock, and expanded Dependabot coverage.

Runtime dependencies

    cachebox: 6.1.2 → 6.2.2
    fastapi: 0.139.2 → 0.141.1
    python-fasthtml: 0.14.9 → 0.14.11
    MonsterUI: 1.0.46 → 1.0.47
    bokeh: 3.9.1 → 3.9.2
    uvicorn: 0.51.0 → 0.52.4 (build(deps): bump uvicorn from 0.51.0 to 0.52.3 #1241, refreshed to latest patch)
    pandas: 3.0.3 → 3.0.5
    platformdirs: 4.11.0 → 4.11.3

Development/test dependencies

    pandas-stubs: 3.0.3.260530 → 3.0.5.260730
    types-PyYAML: 6.0.12.20260518 → 6.0.12.20260724
    GitPython: 3.1.53 → 3.1.58 (security/fix releases)
    coverage: 7.15.2 → 7.15.4
    pypdf: 6.14.2 → 6.16.1 (includes security fixes)

Pre-commit/tooling

    ruff-pre-commit: v0.15.21 → v0.16.3
    synchronize pandas-stubs, types-docutils, and types-PyYAML pins with pyproject.toml

CI / repository dependencies

    Python 3.13.9 → 3.13.15 in CI, Docker, .env, and local Docker Make targets
    actions/checkout → v7 in pytest, pre-commit, CodeQL, and release workflows
    actions/setup-python → v7 in pytest, pre-commit, and release workflows
    actions/upload-artifact → v7 in pytest workflow
    actions/stale: v9.1.0 → v11.0.0 (SHA-pinned)
    regenerate uv.lock from the final dependency pins so locked/frozen installs match pyproject.toml

Future update coverage

Expand Dependabot from pip-only to also monitor:

    GitHub Actions
    Docker

The existing open docutils 0.23 update (#1085) is intentionally excluded because it has separate compatibility/ignore handling and should remain isolated.

docker-build.yml was audited and is already using the newer action generations, so no changes were needed there.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/workflows/bump-version.yml

@@ -22,13 +22,13 @@ jobs:
     steps:
       # --- Step 1: Checkout the repository ---
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0   # Needed to create tags and see full history
 
       # --- Step 2: Set up Python ---
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/pre-commit.yml

@@ -12,6 +12,6 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v7
+    - uses: actions/setup-python@v7
     - uses: pre-commit/action@v3.0.1

.github/workflows/pytest.yml

@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
-          python-version: "3.13.9"
+          python-version: "3.13.15"
 
       - name: Install uv
         run: |
@@ -35,7 +35,7 @@ jobs:
           uv run pytest --finalize --check-config-side-effect -vs --cov src --cov-report term-missing
 
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: optimize-results
           path: tests/testdata/new_optimize_result*

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write        # to comment on stale issues
 
     steps:
-    - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+    - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
       with:
         stale-pr-message: 'This pull request has been marked as stale because it has been open (more
           than) 90 days with no activity. Remove the stale label or add a comment saying that you