chore: avoid distributed CVE

[ikrommyd]

No description provided.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.05%. Comparing base (8cb8994) to head (3d90b72).
⚠️ Report is 317 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #608      +/-   ##
==========================================
- Coverage   93.06%   90.05%   -3.02%     
==========================================
  Files          23       24       +1     
  Lines        3290     3610     +320     
==========================================
+ Hits         3062     3251     +189     
- Misses        228      359     +131     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[martindurant]

Note that the dask dependency reads "dask >=2023.04.0,<2025.4.0". Can you please check what actually gets installed? Since there is no dask release 2025.3.1, we can't pin to that.

[ikrommyd]

Note that the dask dependency reads "dask >=2023.04.0,<2025.4.0". Can you please check what actually gets installed? Since there is no dask release 2025.3.1, we can't pin to that.

There is a 2025.3.1 dask release https://pypi.org/project/dask/2025.3.1/

[ikrommyd]

2023.04.0 should be 2023.4.0 though

[martindurant]

Actually, not sure about that, the syntax of the tags might have changed years ago

[ikrommyd]

On pypi, it is 2023.4.0. This is what gets installed with the latest commit

The reason I didn't do ==2025.3.1 is just in case there ever is a backport like 2025.3.2 :)

[martindurant]

There is a 2025.3.1 dask release

Source only? There is a conda-forge package at least.

I see there is a corresponding tag ( https://github.com/dask/dask/releases/tag/2025.3.1 ), which was sorted by time of creation, not alphabetically.

[ikrommyd]

No there is dask-2025.3.1-py3-none-any.whl and conda-forge. It's a proper release in my understanding.

[martindurant]

Sorry, you're right - the interface changed, I think.

[ikrommyd]

There's problems with github actions FYI https://www.githubstatus.com/

[ikrommyd]

@martindurant actions are alive again, should be good to merge now?