Merge branch 'main' into chore/copilot-ai-findings-safe

Author: turbomam

.github/workflows/codeql.yml

@@ -9,6 +9,9 @@ on:
     - cron: '0 6 * * 1'  # Monday 6am UTC
   workflow_dispatch:
 
+# Deny all permissions by default; the analyze job grants the minimum it needs.
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/qc.yml

@@ -13,13 +13,19 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Deny all permissions by default; grant the minimum needed at the job level.
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "ontology_qc"
   ontology_qc:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
     container: obolibrary/odkfull:v1.6.1
+    # Only needs to read the repository to check it out and run the QC make target.
+    permissions:
+      contents: read
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:

pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "rdflib>=7.1.4",
     "requests>=2.34.2",
     "rich>=13.0.0",
-    "tqdm>=4.68.1",
+    "tqdm>=4.68.3",
 ]
 
 [project.urls]
@@ -44,21 +44,21 @@ Documentation = "https://github.com/berkeleybop/metpo/blob/main/README.md"
 
 [project.optional-dependencies]
 test = [
-    "pytest>=9.0.3",
+    "pytest>=9.1.1",
 ]
 dev = [
     "oaklib>=0.6.23",
     "pandas>=3.0.3",
     "pymongo>=4.17.0",
     "rdflib>=7.1.4",
     "semsql>=0.4.0",
-    "tqdm>=4.68.1",
-    "openai>=2.41.0",
+    "tqdm>=4.68.3",
+    "openai>=2.43.0",
     # Testing
-    "pytest>=9.0.3",
+    "pytest>=9.1.1",
     # Code quality tools
     "black>=26.5.1",
-    "ruff>=0.15.16",
+    "ruff>=0.15.18",
     "mypy>=2.1.0",
     "pre-commit>=4.6.0",
     "types-PyYAML>=6.0.12",
@@ -69,7 +69,7 @@ literature = [
     "linkml>=1.11.1",
     "oaklib>=0.6.23",
     "pandas>=3.0.3",
-    "openai>=2.41.0",
+    "openai>=2.43.0",
     "semsql>=0.4.0",
 ]
 databases = [
@@ -78,11 +78,11 @@ databases = [
 ]
 notebooks = [
     "jupyter>=1.1.1",
-    "notebook>=7.5.7",
-    "matplotlib>=3.10.9",
+    "notebook>=7.6.0",
+    "matplotlib>=3.11.0",
     "numpy>=2.4.6",
     "python-levenshtein>=0.27.1",
-    "tqdm>=4.68.1",
+    "tqdm>=4.68.3",
 ]
 
 [project.scripts]