Regression tests were scattered across feature- and bug-specific files, and some suites repeated the same checks. Group tests by responsibility, isolate feature fixtures in test classes, and remove duplicate or obsolete cases.
The review covered all 127 collected test modules on main. This reduces them and removes or combines definitions:.
No application code changes.
Compare elapsed offsets when checking and merging appliance windows so
both occurrences of the autumn hour obey the configured boundaries.
Preserve calendar durations when finding the earliest valid start.
Add optimizer and calendar-day regressions, and consolidate the existing
time-window regression files into test_configabc classes.
Consolidates all eleven Dependabot updates in this batch into one reviewable change with a synchronized uv.lock:
build(deps-dev): bump mypy from 2.3.1 to 2.4.0 #1410 — mypy 2.3.1 → 2.4.0
build(deps-dev): bump gitpython from 3.1.62 to 3.2.0 #1411 — GitPython 3.1.62 → 3.2.0
build(deps-dev): bump commitizen from 4.19.1 to 4.19.2 #1412 — Commitizen 4.19.1 → 4.19.2
build(deps): bump fastapi from 0.142.2 to 0.143.0 #1413 — FastAPI 0.142.2 → 0.143.0
build(deps-dev): bump pypdf from 6.19.0 to 6.20.0 #1414 — pypdf 6.19.0 → 6.20.0
build(deps): bump platformdirs from 4.12.2 to 4.13.0 #1416 — platformdirs 4.12.2 → 4.13.0
build(deps): bump pydantic from 2.13.5 to 2.14.1 #1417 — Pydantic 2.13.5 → 2.14.1
build(deps): bump tzfpy from 2.1.0 to 2.1.1 #1418 — tzfpy 2.1.0 → 2.1.1
build(deps): bump cachebox from 6.2.7 to 6.2.8 #1419 — cachebox 6.2.7 → 6.2.8
build(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 #1420 — types-requests 2.33.0.20260906 → 2.33.0.20261006
build(deps): bump rich-toolkit from 0.20.5 to 0.20.6 #1421 — rich-toolkit 0.20.5 → 0.20.6
2026-10-15 19:21:26 +02:00
NormannGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 6: URL redirection from remote source
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix: reject scheme-bearing EOSdash redirect paths
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-10-14 15:23:02 +02:00
NormannGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 11: Information exposure through an exception
traceback should not be in client side code
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix: keep unexpected API error details private and test problem responses
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Consolidates seven compatible Dependabot updates into one reviewable change:
Runtime dependencies
platformdirs 4.11.7 → 4.11.8 (build(deps): bump platformdirs from 4.11.7 to 4.11.8 #1307)
rich-toolkit 0.20.4 → 0.20.5 (build(deps): bump rich-toolkit from 0.20.4 to 0.20.5 #1313)
Development, documentation, and CI dependencies
types-requests 2.33.0.20260712 → 2.33.0.20260906 (build(deps-dev): bump types-requests from 2.33.0.20260712 to 2.33.0.20260906 #1306)
pypdf 6.17.0 → 6.18.0 (build(deps-dev): bump pypdf from 6.17.0 to 6.18.0 #1308)
types-PyYaml 6.0.12.20260815 → 6.0.12.20260906 (build(deps-dev): bump types-pyyaml from 6.0.12.20260815 to 6.0.12.20260906 #1309)
sphinxcontrib-mermaid 2.1.0 → 2.1.1 (build(deps-dev): bump sphinxcontrib-mermaid from 2.1.0 to 2.1.1 #1310)
GitPython 3.1.61 → 3.1.62 (build(deps-dev): bump gitpython from 3.1.61 to 3.1.62 #1312)
The committed uv.lock file is regenerated for all seven updates. The pre-commit mypy hook already executes the locked project development environment, so the type-stub pins have a single source of truth in pyproject.toml and uv.lock.
The mypy regression-test command in CONTRIBUTING.md points to the nonexistent tests/test_typingmypytoolchain.py, causing copied commands to fail.
Change the path to tests/test_typingmypytooling.py, the existing integration test.
### Significant changes / EOS impact
The dependency bumps are mostly patch/tooling updates, but a few are worth explicit review:
- **`pydantic-settings` 2.14.2 → 2.15.0 — highest runtime impact.** EOS directly subclasses `pydantic_settings.BaseSettings` for `SettingsEOS` / `ConfigEOS`, with `case_sensitive` left at its default. In 2.15.0, `case_sensitive` now also applies to init kwargs and config-file sources, so top-level setting keys are now matched case-insensitively by default where those sources previously did not behave that way. This can change how differently-cased config keys are accepted/resolved. The release also adds warnings for unresolved forward references and changes strict non-JSON env-value failures to `ValidationError`. **Recommended:** exercise JSON config loading, init/update paths, env overrides, and config round-trips.
- **`tzfpy` 1.3.2 → 1.3.3 — runtime correctness change.** EOS uses `tzfpy.get_tz()` in `to_timezone()` and exposes the result through `GeneralSettings.timezone`. Queries exactly on timezone polygon borders now resolve instead of returning an empty result, and the `America/Argentina/Ushuaia` boundary is corrected. This can intentionally change timezone output for users on/near affected boundaries.
- **`cachebox` 6.2.2 → 6.2.5 — runtime cache correctness/safety.** EOS uses `cachebox.LRUCache` and `cachebox.cached` for the energy-management cache. The update fixes iterator lifetime safety, LRU iterator invalidation when reads promote entries, and a potential `setdefault_with` locking issue. EOS does not appear to rely on those edge cases directly, so this is expected to be low-risk and mostly corrective; existing cache tests are the relevant regression coverage.
- **`GitPython` 3.1.58 → 3.1.59 — dev/tooling security hardening.** This release blocks file-reading Git options, separate git-directory use during clone, and hardens config parsing. It appears to be a dev/docs dependency rather than EOS runtime code, but CI/tooling that intentionally passes unusual Git options could be affected.
- **`pre-commit` 4.6.1 → 4.6.2 — dev-only bug fix.** Fixes a regression in Node-language hooks using npm 11.x build scripts.
- **`mypy` 2.3.1, `commitizen` 4.17.1, and `types-PyYaml` stub update** are tooling/type-checking changes with no expected EOS runtime behavior change.
Overall, the main compatibility focus should be **configuration handling (`pydantic-settings`)**, followed by **timezone edge cases (`tzfpy`)**. The remaining updates are primarily correctness, security, or developer-tooling fixes.
* initialize the temporary Git repository in test_workflow_git with --initial-branch=main
* avoid Git's default-branch advisory in pytest logs without changing global Git configuration or suppressing stderr
* upload generated optimization result artifacts only when the test job fails
* use the actual nested tests/testdata/**/new_optimize_result* paths
* ignore the no-files case so unrelated test failures do not produce an artifact warning
Consolidates the currently applicable dependency updates into one PR, including the closed Dependabot backlog such as #1241, plus dependency surfaces that were not covered by the repository's previous pip-only Dependabot configuration.
Cleanup of test warnings.
Most importent:
* GitPython + pypdf security hardening.
* Uvicorn WebSocket close/backpressure/header fixes for server/dashboard reliability.
* FastAPI dependency-memory/OpenAPI improvements for the API process.
* Bokeh WebSocket/resource-leak/prefix fixes for EOSdash and proxied deployments.
* cachebox cancellation/lock cleanup fixes for long-running/concurrent work.
* pandas 3.0.5 avoiding the yanked 3.0.4 datetime/segfault build.
* Ruff security-lint and pydocstyle correctness fixes, plus faster release builds via PGO.
* platformdirs malformed-XDG and duplicate-directory fixes for deployment portability.
* CI action modernization, regenerated uv.lock, and expanded Dependabot coverage.
Runtime dependencies
cachebox: 6.1.2 → 6.2.2
fastapi: 0.139.2 → 0.141.1
python-fasthtml: 0.14.9 → 0.14.11
MonsterUI: 1.0.46 → 1.0.47
bokeh: 3.9.1 → 3.9.2
uvicorn: 0.51.0 → 0.52.4 (build(deps): bump uvicorn from 0.51.0 to 0.52.3 #1241, refreshed to latest patch)
pandas: 3.0.3 → 3.0.5
platformdirs: 4.11.0 → 4.11.3
Development/test dependencies
pandas-stubs: 3.0.3.260530 → 3.0.5.260730
types-PyYAML: 6.0.12.20260518 → 6.0.12.20260724
GitPython: 3.1.53 → 3.1.58 (security/fix releases)
coverage: 7.15.2 → 7.15.4
pypdf: 6.14.2 → 6.16.1 (includes security fixes)
Pre-commit/tooling
ruff-pre-commit: v0.15.21 → v0.16.3
synchronize pandas-stubs, types-docutils, and types-PyYAML pins with pyproject.toml
CI / repository dependencies
Python 3.13.9 → 3.13.15 in CI, Docker, .env, and local Docker Make targets
actions/checkout → v7 in pytest, pre-commit, CodeQL, and release workflows
actions/setup-python → v7 in pytest, pre-commit, and release workflows
actions/upload-artifact → v7 in pytest workflow
actions/stale: v9.1.0 → v11.0.0 (SHA-pinned)
regenerate uv.lock from the final dependency pins so locked/frozen installs match pyproject.toml
Future update coverage
Expand Dependabot from pip-only to also monitor:
GitHub Actions
Docker
The existing open docutils 0.23 update (#1085) is intentionally excluded because it has separate compatibility/ignore handling and should remain isolated.
docker-build.yml was audited and is already using the newer action generations, so no changes were needed there.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This workflow file sets up CodeQL analysis for the repository, defining triggers for pushes and pull requests on the main branch, as well as a scheduled analysis. It includes configuration for multiple programming languages and initialization steps for CodeQL.
* Pre-fetch data
* maintanance and extend tests
* comment clean up
* nansum usage (to be save)
* Feature/config nested (#421)
* Nested config, devices registry
* All config now nested.
- Use default config from model field default values. If providers
should be enabled by default, non-empty default config file could
be provided again.
- Environment variable support with EOS_ prefix and __ between levels,
e.g. EOS_SERVER__EOS_SERVER_PORT=8503 where all values are case
insensitive.
For more information see:
https://docs.pydantic.dev/latest/concepts/pydantic_settings/#parsing-environment-variable-values
- Use devices as registry for configured devices. DeviceBase as base
class with for now just initializion support (in the future expand
to operations during optimization).
- Strip down ConfigEOS to the only configuration instance. Reload
from file or reset to defaults is possible.
* Fix multi-initialization of derived SingletonMixin classes.
* Documentation: Support nested config
* Add examples to pydantic models.
* EOSdash: Support nested types
* Rename settings variables (remove prefixes)
* Fix API endpoint
* Fix EOSdash startup (docker)
* Docker: Copy the same directory structure (src/) to support the
lifespan startup of EOSdash.
Use EOS_SERVER_EOSDASH_SESSKEY environment variable to provide
EOSdash with session key.
* PR review
* PVForecast: planes as nested config (list)
* Update manual documentation for nested config.
* Add config_file_path, config_folder_path back to general
(ConfigCommonSettings). Overwrite in docs generation.
* Config: Move lat/long/timezone from prediction to general
* Docs: Add global example documentation.
* merge_models: Use deecopy to not change input data.
* EOSdash: Sort config by name
* Review comments
* Feature/config nested dependabot req. (#415)
* Bump numpydantic from 1.6.4 to 1.6.7 (#413)
Bumps [numpydantic](https://github.com/p2p-ld/numpydantic) from 1.6.4 to 1.6.7.
- [Release notes](https://github.com/p2p-ld/numpydantic/releases)
- [Changelog](https://github.com/p2p-ld/numpydantic/blob/main/docs/changelog.md)
- [Commits](https://github.com/p2p-ld/numpydantic/compare/v1.6.4...v1.6.7)
---
updated-dependencies:
- dependency-name: numpydantic
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump timezonefinder from 6.5.7 to 6.5.8 (#414)
Bumps [timezonefinder](https://github.com/jannikmi/timezonefinder) from 6.5.7 to 6.5.8.
- [Release notes](https://github.com/jannikmi/timezonefinder/releases)
- [Changelog](https://github.com/jannikmi/timezonefinder/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jannikmi/timezonefinder/compare/6.5.7...6.5.8)
---
updated-dependencies:
- dependency-name: timezonefinder
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump pydantic from 2.10.5 to 2.10.6 (#412)
Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.10.5 to 2.10.6.
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/compare/v2.10.5...v2.10.6)
---
updated-dependencies:
- dependency-name: pydantic
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump fastapi[standard] from 0.115.6 to 0.115.7 (#411)
Bumps [fastapi[standard]](https://github.com/fastapi/fastapi) from 0.115.6 to 0.115.7.
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.115.6...0.115.7)
---
updated-dependencies:
- dependency-name: fastapi[standard]
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Readme: Add hint for interfering ports on Synology Closes#408 (#419)
* Pics or it didn't happen (#402)
* inverter added
* png creation
* save svg into cache folder
* mypy
* comment
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* inverter, prediction.hours
* self.config.general.data_cache_path
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* footer with date and version
* ruff
* replace toml module with build in
* using re to extract the string
* optimize re usage
* use of use pendulum in Akkudoktor-EOS
* create_line_chart_date function added
* replace datetime with pendulum
* align ax2 with ax1 and 0 first point
* dynamic ticks
* all charts with dates
* style changes
* mypy fixes
* fix test
* fixed current time
* Tests for class_load_container v2
- file as same name as class
- useless numpy conversations removed
- switched to built-in type tests
- human readable tests included
* ruff
* removed dupicate empty list
* load_aggregator: collections.abc.Sequence
---------
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
NormannandGitHub
