The isolated pre-commit mypy hook previously omitted runtime type information that
make mypy used, hiding errors involving dependencies such as Pydantic and Pendulum.
Makefile, pre-commit and CI now run the same full-project typing policy in the
development environment defined by uv.lock.
- Use uv run --locked --exact --extra dev and the same mypy arguments for Makefile
and the local hook. Check all of src and tests, including on configuration-only
changes.
- Pin Python 3.13 for local development and the pre-commit CI job, and install the
locked pre-commit version in CI.
- Disable incremental analysis because existing Pendulum cache state changes mypy 2.3.1
diagnostics. Document the policy, the performance tradeoff and the existing typing debt.
- Add a regression test that exercises Makefile, the hook and the CI command in a
temporary project, accepting valid dependency types and detecting deliberate
Pydantic/Pendulum assignment errors.
Resolve the newly detected mypy diagnostics.
- Enable the numpydantic and Pydantic mypy plugins, retaining strict Pydantic
constructor typing with init_typed = true. Validate raw/coercible payloads through model_validate.
- Propagate concrete record, provider and time-window types through generic collections,
factories and lookup methods. Preserve runtime field inspection and generated time-window
documentation.
- Align Pendulum annotations with actual factory/arithmetic results while retaining Pydantic
validation adapters at runtime. Correct optional values, array boundaries, REST handlers
and plotting interfaces.
- Add pinned scipy-stubs and types-psutil, update uv.lock, and supply the plugins' dependencies.
- Add runtime regression coverage for validated path defaults, normalized time-series metadata,
generic field inspection, invalid timestamps and unsupported provider imports.
Runtime and compatibility details:
- Validate path defaults as Path objects while retaining raw string defaults needed by
migration serialization with exclude_defaults.
- Normalize feed-in tariff lists and default charge rates to NumPy arrays; reject missing
timestamps/uninitialized values explicitly. Importing into a provider without import support
returns HTTP 400.
- Public JSON schemas and OpenAPI structure match main (excluding the generated version).
Signed-off-by: dr-dimitry
Signed-off-by: dr-dimitry
Signed-off-by: Bobby Noelte <b0661n0e17e@gmail.com>
Co-authored-by: dr-dimitri <87113560+dr-dimitri@users.noreply.github.com>
Co-authored-by: Normann <github@koldrack.com>
Consolidates the currently applicable dependency updates into one PR, including the closed Dependabot backlog such as #1241, plus dependency surfaces that were not covered by the repository's previous pip-only Dependabot configuration.
Cleanup of test warnings.
Most importent:
* GitPython + pypdf security hardening.
* Uvicorn WebSocket close/backpressure/header fixes for server/dashboard reliability.
* FastAPI dependency-memory/OpenAPI improvements for the API process.
* Bokeh WebSocket/resource-leak/prefix fixes for EOSdash and proxied deployments.
* cachebox cancellation/lock cleanup fixes for long-running/concurrent work.
* pandas 3.0.5 avoiding the yanked 3.0.4 datetime/segfault build.
* Ruff security-lint and pydocstyle correctness fixes, plus faster release builds via PGO.
* platformdirs malformed-XDG and duplicate-directory fixes for deployment portability.
* CI action modernization, regenerated uv.lock, and expanded Dependabot coverage.
Runtime dependencies
cachebox: 6.1.2 → 6.2.2
fastapi: 0.139.2 → 0.141.1
python-fasthtml: 0.14.9 → 0.14.11
MonsterUI: 1.0.46 → 1.0.47
bokeh: 3.9.1 → 3.9.2
uvicorn: 0.51.0 → 0.52.4 (build(deps): bump uvicorn from 0.51.0 to 0.52.3 #1241, refreshed to latest patch)
pandas: 3.0.3 → 3.0.5
platformdirs: 4.11.0 → 4.11.3
Development/test dependencies
pandas-stubs: 3.0.3.260530 → 3.0.5.260730
types-PyYAML: 6.0.12.20260518 → 6.0.12.20260724
GitPython: 3.1.53 → 3.1.58 (security/fix releases)
coverage: 7.15.2 → 7.15.4
pypdf: 6.14.2 → 6.16.1 (includes security fixes)
Pre-commit/tooling
ruff-pre-commit: v0.15.21 → v0.16.3
synchronize pandas-stubs, types-docutils, and types-PyYAML pins with pyproject.toml
CI / repository dependencies
Python 3.13.9 → 3.13.15 in CI, Docker, .env, and local Docker Make targets
actions/checkout → v7 in pytest, pre-commit, CodeQL, and release workflows
actions/setup-python → v7 in pytest, pre-commit, and release workflows
actions/upload-artifact → v7 in pytest workflow
actions/stale: v9.1.0 → v11.0.0 (SHA-pinned)
regenerate uv.lock from the final dependency pins so locked/frozen installs match pyproject.toml
Future update coverage
Expand Dependabot from pip-only to also monitor:
GitHub Actions
Docker
The existing open docutils 0.23 update (#1085) is intentionally excluded because it has separate compatibility/ignore handling and should remain isolated.
docker-build.yml was audited and is already using the newer action generations, so no changes were needed there.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-21 07:07:34 +02:00
NormannGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Michael OsthegeandAndreas