### Significant changes / EOS impact
The dependency bumps are mostly patch/tooling updates, but a few are worth explicit review:
- **`pydantic-settings` 2.14.2 → 2.15.0 — highest runtime impact.** EOS directly subclasses `pydantic_settings.BaseSettings` for `SettingsEOS` / `ConfigEOS`, with `case_sensitive` left at its default. In 2.15.0, `case_sensitive` now also applies to init kwargs and config-file sources, so top-level setting keys are now matched case-insensitively by default where those sources previously did not behave that way. This can change how differently-cased config keys are accepted/resolved. The release also adds warnings for unresolved forward references and changes strict non-JSON env-value failures to `ValidationError`. **Recommended:** exercise JSON config loading, init/update paths, env overrides, and config round-trips.
- **`tzfpy` 1.3.2 → 1.3.3 — runtime correctness change.** EOS uses `tzfpy.get_tz()` in `to_timezone()` and exposes the result through `GeneralSettings.timezone`. Queries exactly on timezone polygon borders now resolve instead of returning an empty result, and the `America/Argentina/Ushuaia` boundary is corrected. This can intentionally change timezone output for users on/near affected boundaries.
- **`cachebox` 6.2.2 → 6.2.5 — runtime cache correctness/safety.** EOS uses `cachebox.LRUCache` and `cachebox.cached` for the energy-management cache. The update fixes iterator lifetime safety, LRU iterator invalidation when reads promote entries, and a potential `setdefault_with` locking issue. EOS does not appear to rely on those edge cases directly, so this is expected to be low-risk and mostly corrective; existing cache tests are the relevant regression coverage.
- **`GitPython` 3.1.58 → 3.1.59 — dev/tooling security hardening.** This release blocks file-reading Git options, separate git-directory use during clone, and hardens config parsing. It appears to be a dev/docs dependency rather than EOS runtime code, but CI/tooling that intentionally passes unusual Git options could be affected.
- **`pre-commit` 4.6.1 → 4.6.2 — dev-only bug fix.** Fixes a regression in Node-language hooks using npm 11.x build scripts.
- **`mypy` 2.3.1, `commitizen` 4.17.1, and `types-PyYaml` stub update** are tooling/type-checking changes with no expected EOS runtime behavior change.
Overall, the main compatibility focus should be **configuration handling (`pydantic-settings`)**, followed by **timezone edge cases (`tzfpy`)**. The remaining updates are primarily correctness, security, or developer-tooling fixes.
* initialize the temporary Git repository in test_workflow_git with --initial-branch=main
* avoid Git's default-branch advisory in pytest logs without changing global Git configuration or suppressing stderr
* upload generated optimization result artifacts only when the test job fails
* use the actual nested tests/testdata/**/new_optimize_result* paths
* ignore the no-files case so unrelated test failures do not produce an artifact warning
Consolidates the currently applicable dependency updates into one PR, including the closed Dependabot backlog such as #1241, plus dependency surfaces that were not covered by the repository's previous pip-only Dependabot configuration.
Cleanup of test warnings.
Most importent:
* GitPython + pypdf security hardening.
* Uvicorn WebSocket close/backpressure/header fixes for server/dashboard reliability.
* FastAPI dependency-memory/OpenAPI improvements for the API process.
* Bokeh WebSocket/resource-leak/prefix fixes for EOSdash and proxied deployments.
* cachebox cancellation/lock cleanup fixes for long-running/concurrent work.
* pandas 3.0.5 avoiding the yanked 3.0.4 datetime/segfault build.
* Ruff security-lint and pydocstyle correctness fixes, plus faster release builds via PGO.
* platformdirs malformed-XDG and duplicate-directory fixes for deployment portability.
* CI action modernization, regenerated uv.lock, and expanded Dependabot coverage.
Runtime dependencies
cachebox: 6.1.2 → 6.2.2
fastapi: 0.139.2 → 0.141.1
python-fasthtml: 0.14.9 → 0.14.11
MonsterUI: 1.0.46 → 1.0.47
bokeh: 3.9.1 → 3.9.2
uvicorn: 0.51.0 → 0.52.4 (build(deps): bump uvicorn from 0.51.0 to 0.52.3 #1241, refreshed to latest patch)
pandas: 3.0.3 → 3.0.5
platformdirs: 4.11.0 → 4.11.3
Development/test dependencies
pandas-stubs: 3.0.3.260530 → 3.0.5.260730
types-PyYAML: 6.0.12.20260518 → 6.0.12.20260724
GitPython: 3.1.53 → 3.1.58 (security/fix releases)
coverage: 7.15.2 → 7.15.4
pypdf: 6.14.2 → 6.16.1 (includes security fixes)
Pre-commit/tooling
ruff-pre-commit: v0.15.21 → v0.16.3
synchronize pandas-stubs, types-docutils, and types-PyYAML pins with pyproject.toml
CI / repository dependencies
Python 3.13.9 → 3.13.15 in CI, Docker, .env, and local Docker Make targets
actions/checkout → v7 in pytest, pre-commit, CodeQL, and release workflows
actions/setup-python → v7 in pytest, pre-commit, and release workflows
actions/upload-artifact → v7 in pytest workflow
actions/stale: v9.1.0 → v11.0.0 (SHA-pinned)
regenerate uv.lock from the final dependency pins so locked/frozen installs match pyproject.toml
Future update coverage
Expand Dependabot from pip-only to also monitor:
GitHub Actions
Docker
The existing open docutils 0.23 update (#1085) is intentionally excluded because it has separate compatibility/ignore handling and should remain isolated.
docker-build.yml was audited and is already using the newer action generations, so no changes were needed there.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This workflow file sets up CodeQL analysis for the repository, defining triggers for pushes and pull requests on the main branch, as well as a scheduled analysis. It includes configuration for multiple programming languages and initialization steps for CodeQL.
* Pre-fetch data
* maintanance and extend tests
* comment clean up
* nansum usage (to be save)
* Feature/config nested (#421)
* Nested config, devices registry
* All config now nested.
- Use default config from model field default values. If providers
should be enabled by default, non-empty default config file could
be provided again.
- Environment variable support with EOS_ prefix and __ between levels,
e.g. EOS_SERVER__EOS_SERVER_PORT=8503 where all values are case
insensitive.
For more information see:
https://docs.pydantic.dev/latest/concepts/pydantic_settings/#parsing-environment-variable-values
- Use devices as registry for configured devices. DeviceBase as base
class with for now just initializion support (in the future expand
to operations during optimization).
- Strip down ConfigEOS to the only configuration instance. Reload
from file or reset to defaults is possible.
* Fix multi-initialization of derived SingletonMixin classes.
* Documentation: Support nested config
* Add examples to pydantic models.
* EOSdash: Support nested types
* Rename settings variables (remove prefixes)
* Fix API endpoint
* Fix EOSdash startup (docker)
* Docker: Copy the same directory structure (src/) to support the
lifespan startup of EOSdash.
Use EOS_SERVER_EOSDASH_SESSKEY environment variable to provide
EOSdash with session key.
* PR review
* PVForecast: planes as nested config (list)
* Update manual documentation for nested config.
* Add config_file_path, config_folder_path back to general
(ConfigCommonSettings). Overwrite in docs generation.
* Config: Move lat/long/timezone from prediction to general
* Docs: Add global example documentation.
* merge_models: Use deecopy to not change input data.
* EOSdash: Sort config by name
* Review comments
* Feature/config nested dependabot req. (#415)
* Bump numpydantic from 1.6.4 to 1.6.7 (#413)
Bumps [numpydantic](https://github.com/p2p-ld/numpydantic) from 1.6.4 to 1.6.7.
- [Release notes](https://github.com/p2p-ld/numpydantic/releases)
- [Changelog](https://github.com/p2p-ld/numpydantic/blob/main/docs/changelog.md)
- [Commits](https://github.com/p2p-ld/numpydantic/compare/v1.6.4...v1.6.7)
---
updated-dependencies:
- dependency-name: numpydantic
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump timezonefinder from 6.5.7 to 6.5.8 (#414)
Bumps [timezonefinder](https://github.com/jannikmi/timezonefinder) from 6.5.7 to 6.5.8.
- [Release notes](https://github.com/jannikmi/timezonefinder/releases)
- [Changelog](https://github.com/jannikmi/timezonefinder/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jannikmi/timezonefinder/compare/6.5.7...6.5.8)
---
updated-dependencies:
- dependency-name: timezonefinder
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump pydantic from 2.10.5 to 2.10.6 (#412)
Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.10.5 to 2.10.6.
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/compare/v2.10.5...v2.10.6)
---
updated-dependencies:
- dependency-name: pydantic
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump fastapi[standard] from 0.115.6 to 0.115.7 (#411)
Bumps [fastapi[standard]](https://github.com/fastapi/fastapi) from 0.115.6 to 0.115.7.
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.115.6...0.115.7)
---
updated-dependencies:
- dependency-name: fastapi[standard]
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Readme: Add hint for interfering ports on Synology Closes#408 (#419)
* Pics or it didn't happen (#402)
* inverter added
* png creation
* save svg into cache folder
* mypy
* comment
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* inverter, prediction.hours
* self.config.general.data_cache_path
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* footer with date and version
* ruff
* replace toml module with build in
* using re to extract the string
* optimize re usage
* use of use pendulum in Akkudoktor-EOS
* create_line_chart_date function added
* replace datetime with pendulum
* align ax2 with ax1 and 0 first point
* dynamic ticks
* all charts with dates
* style changes
* mypy fixes
* fix test
* fixed current time
* Tests for class_load_container v2
- file as same name as class
- useless numpy conversations removed
- switched to built-in type tests
- human readable tests included
* ruff
* removed dupicate empty list
* load_aggregator: collections.abc.Sequence
---------
Co-authored-by: Dominique Lasserre <lasserre.d@gmail.com>
- Optimized Imports: Removed unused imports and organized them.
- Refactored Code: Introduced split_individual function for clarity.
- Improved Efficiency: Enhanced penalty calculation and streamlined loops.
- Updated Evaluation Logic: Better handling of penalties in evaluate.
- Type Hints added
- fixed seed option added for automated tests
- verbose comment added, default False
Notes:
- isfloat is only used in flask_server.py
- start_hour is not used in this class
first step of cleanup. only formatting and very minor code changes
To Do:
- implement proper config
- move parameters into config
- remove not needed commented code (idk which is useful)
- logic in has_no_empty_params is unnecessary complicated
NormannandGitHub
